The rule detects potential adversary behavior involving the exfiltration of sensitive data through suspicious file transfers between internal hosts and external IP addresses. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate data leakage risks early in the attack lifecycle.
YARA Rule
rule _84b76d765e7357fa5402b5af97d351424a8edf03_d0f90c1b3ebd79a816b5597a49ae8257df697591_da24c17f75cf0b7d6c5ab01832a827ee4b4c52eb_0 {
meta:
description = "Auto-generated rule - from files 84b76d765e7357fa5402b5af97d351424a8edf03.codex, d0f90c1b3ebd79a816b5597a49ae8257df697591.codex, da24c17f75cf0b7d6c5ab01832a827ee4b4c52eb.codex"
author = "YarGen Rule Generator"
reference = "not set"
date = "2016-07-21"
super_rule = 1
hash1 = "add7ed26bc5bcacdf3159fcde71bdd429feeef94dff7d3b22bc9af9deb471c48"
hash2 = "a9a62edbafa5932894ed53319c924932b94a0ccdf15644764256eed39fd46d86"
hash3 = "efcc9e0377cf83a73bd5fbe42a51a2330936b8e362fc2ab99af6d932079893d9"
strings:
$s1 = ":\":':,:5:=:B:K:P:U:^:c:h:q:v:{:" fullword ascii
$s2 = "[email protected] \\" fullword ascii
$s3 = "0$0+02090@0G0N0U0\\0c0j0v0{0" fullword ascii
$s4 = "6\"6(6-6:6I6O6T6a6p6v6{6" fullword ascii
$s5 = "1\"1/14191F1K1P1]1b1g1t1y1~1" fullword ascii
$s6 = "0\"0(0-0<0B0G0S0_0d0s0y0~0" fullword ascii
$s7 = "9\"9'959:9?9L9Q9^9c9p9y9~9" fullword ascii
$s8 = "3%3*363=3B3N3T3Y3e3k3p3|3" fullword ascii
$s9 = "4#4)4.4:4C4H4T4Z4_4k4q4v4" fullword ascii
$s10 = "|&.WTm" fullword ascii
$s11 = "6#63686E6J6W6\\6i6n6{6" fullword ascii
$s12 = ";\";(;7;F;W;];f;o;{;" fullword ascii
$s13 = "0+02080>0B0P0\\0i0|0" fullword ascii
$s14 = "1 1(10181C1N1Y1d1o1z1" fullword ascii
$s15 = "3 3%3*3;3@3E3R3^3c3t3y3" fullword ascii
$s16 = "8\"8)8.8:8?8S8X8f8r8x8" fullword ascii
$s17 = "8$8+82898@8G8N8U8\\8" fullword ascii
$s18 = "9-929?9P9U9b9s9x9" fullword ascii
$s19 = "9*9/9<9A9N9T9`9e9r9w9" fullword ascii
$s20 = "2-292?2G2N2U2\\2c2j2q2" fullword ascii
$op0 = { e0b34200c78424ac } /* Opcode */
$op1 = { 39750c598bd0598955fc7e4b0fb64c3e } /* Opcode */
$op2 = { 3cee4200c784248c } /* Opcode */
$op3 = { a1a8794400681c40430057ff90400100 } /* Opcode */
$op4 = { 395814eb31a1a879440057ff75f456ff } /* Opcode */
$op5 = { 663bd875438bc62b450c8945fceb038b } /* Opcode */
$op6 = { f24200c784245c01000010f24200c784 } /* Opcode */
$op7 = { 83c4108944241c8d4424345056ff7424 } /* Opcode */
$op8 = { 83c41483f8ff74138b4de88d04868b04 } /* Opcode */
$op9 = { 7cb34200c784249c } /* Opcode */
$op10 = { f8ae4300c78424e0 } /* Opcode */
$op11 = { 08b44200c78424b8 } /* Opcode */
$op12 = { 57568944241c50a1a8794400ff907801 } /* Opcode */
$op13 = { e0174300c78424d8 } /* Opcode */
$op14 = { 8b4dfc8b0481050410000050a1a87944 } /* Opcode */
$op15 = { 595985c00f8586010000685c5a4300ff } /* Opcode */
$op16 = { 595933c05e5f5bc9c3ff75c88b7508ff } /* Opcode */
$op17 = { 28424400c78424c4 } /* Opcode */
$op18 = { 83c4188945fc837dfc000f848f } /* Opcode */
$op19 = { 895dbc895dfcff90f8 } /* Opcode */
$op20 = { 595985c00f8543050000689c534300ff } /* Opcode */
$op21 = { ff90bc0200003d220000c075408d4424 } /* Opcode */
$op22 = { 383c4400c78424e0 } /* Opcode */
$op23 = { 85c07495eb03885dffa1a879440057ff } /* Opcode */
$op24 = { 6a01ff75acff75f46a00ff750ca1a879 } /* Opcode */
$op25 = { 40af4300c784240001000048af4300c7 } /* Opcode */
$op26 = { 836508005959668b4b02664966894802 } /* Opcode */
$op27 = { ff75108bd8ff750ca1a879440068385e } /* Opcode */
$op28 = { c4b34200c78424a8 } /* Opcode */
$op29 = { dc404400c7842498 } /* Opcode */
$op30 = { 30af4300c78424fc } /* Opcode */
$op31 = { bfb025440057894df0ff90c402000059 } /* Opcode */
$op32 = { 806a4300c78424f0 } /* Opcode */
$op33 = { 80ee4200c784249c } /* Opcode */
$op34 = { 1f4300c7842468020000141f4300c784 } /* Opcode */
$op35 = { 68feff0000ff750889442428a1a87944 } /* Opcode */
$op36 = { 897424688974246cff904803000085c0 } /* Opcode */
$op37 = { 85c00f8495fdffffff742414a1a87944 } /* Opcode */
$op38 = { 10184300c78424e8 } /* Opcode */
$op39 = { ff75fca1a8794400576868c64300688c } /* Opcode */
$op40 = { 59598945888b458cff308b458c83c004 } /* Opcode */
$op41 = { 595985c00f85130700006860524300ff } /* Opcode */
$op42 = { 603c4400c78424ec } /* Opcode */
$op43 = { 8b450cff742414668378023f50a1a879 } /* Opcode */
$op44 = { 595985c00f85fa010000680c5a4300ff } /* Opcode */
$op45 = { fcf84200c78424c0 } /* Opcode */
$op46 = { 14f94200c78424c8 } /* Opcode */
$op47 = { 3c6a4300c78424e8 } /* Opcode */
$op48 = { 88424400c78424d4 } /* Opcode */
$op49 = { 83c4188945fc837dfc000f8404010000 } /* Opcode */
$op50 = { 595985c00f8568020000ff75dca1a879 } /* Opcode */
$op51 = { 8b463a0345fc50a1a8794400ff900404 } /* Opcode */
$op52 = { 85c00f84cdfdffffff742414a1a87944 } /* Opcode */
$op53 = { a1a879440056ff90a0 } /* Opcode */
$op54 = { 40ae4300c78424b0 } /* Opcode */
$op55 = { 83c40cff7588ff7508a1a8794400ff90 } /* Opcode */
$op56 = { 68585c4300ff7588a1a8794400ff9090 } /* Opcode */
$op57 = { 78274300c78424b0 } /* Opcode */
$op58 = { 3d230000c0740b3d050000800f85c7 } /* Opcode */
$op59 = { a1a879440068345f440057ff90f40300 } /* Opcode */
$op60 = { 0fbf40483b45cc751d508b45e483c04c } /* Opcode */
$op61 = { 836424180059598bd8c74424207cb542 } /* Opcode */
$op62 = { 681c5c4300ff7588a1a8794400ff9090 } /* Opcode */
$op63 = { 5c284300c78424f0 } /* Opcode */
$op64 = { 59593bc3744a837dcc00741fff75f8a1 } /* Opcode */
$op65 = { 60f94200c78424d8 } /* Opcode */
$op66 = { 94274300c78424b8 } /* Opcode */
$op67 = { 895c2440895c2444ff90c40300005959 } /* Opcode */
$op68 = { 8bd859598d45ec50a1a87944008d7b02 } /* Opcode */
$op69 = { ff90680100008bf08d45fc50a1a87944 } /* Opcode */
$op70 = { a1a879440068e85e440057ff90f40300 } /* Opcode */
$op71 = { ff45f88d474450a1a8794400ff909803 } /* Opcode */
$op72 = { ff45f88d474450a1a8794400ff909803 } /* Opcode */
$op73 = { 44b44200c78424d0 } /* Opcode */
$op74 = { 595985c0754f6834584300ff75b8a1a8 } /* Opcode */
$op75 = { 8b44242483c00450ff7508e824e6ffff } /* Opcode */
$op76 = { 60404400c7842488 } /* Opcode */
$op77 = { 6a1a4000c781a40100004eaa4100c781 } /* Opcode */
$op78 = { 8bf859593bfe750433c0eb353975107e } /* Opcode */
$op79 = { 59596a055e3bc775103935d479440075 } /* Opcode */
$op80 = { 8975ec8975f0ff900c0300005f5e85c0 } /* Opcode */
$op81 = { 8975ec8975f0ff900c0300005f5e85c0 } /* Opcode */
$op82 = { 57ff75088945dca1a8794400ff90b8 } /* Opcode */
$op83 = { 583b4400c7842488 } /* Opcode */
$op84 = { 83c40c8b45fc8b4df489086881 } /* Opcode */
$op85 = { 0c274300c7842490 } /* Opcode */
$op86 = { 2c184300c78424f4 } /* Opcode */
$op87 = { a1a879440068185f440057ff90f40300 } /* Opcode */
$op88 = { ff7424148bf0a1a879440056ff90fc } /* Opcode */
$op89 = { a1a87944006894e5430053ff9090 } /* Opcode */
$op90 = { 8d44240c50a1a8794400ff90f8010000 } /* Opcode */
$op91 = { 85c00f95c0595984c0743dff75f4a1a8 } /* Opcode */
$op92 = { 59598bf8eb308d471050ff75fca1a879 } /* Opcode */
$op93 = { 50ff750ca1a879440057ff90ac020000 } /* Opcode */
$op94 = { 595985c00f856901000068705a4300ff } /* Opcode */
$op95 = { 914300c784245806000014914300c784 } /* Opcode */
$op96 = { a1a87944006a006870e04300ff7508ff } /* Opcode */
$op97 = { b0684300c78424ac } /* Opcode */
$op98 = { 8b433a8b4dfc8d048803c650a1a87944 } /* Opcode */
$op99 = { 04414400c78424a0 } /* Opcode */
$op100 = { 883b4400c784249c } /* Opcode */
$op101 = { 30284300c78424e4 } /* Opcode */
$op102 = { c6059179440001892d9c794400892598 } /* Opcode */
$op103 = { c6059179440001892d9c794400892598 } /* Opcode */
$op104 = { 595985c00f85340200006804564300ff } /* Opcode */
$op105 = { a13ca0420089819c030000a118a04200 } /* Opcode */
$op106 = { 595985c00f858b02000068bc554300ff } /* Opcode */
$op107 = { 6c684300c78424a0 } /* Opcode */
$op108 = { 83c4108945ec8d45bc50a1a879440056 } /* Opcode */
$op109 = { f0424400c78424e0 } /* Opcode */
$op110 = { 30f84200c7842494 } /* Opcode */
$op111 = { 8bf0a1a879440068b4b7420056ff90fc } /* Opcode */
$op112 = { 595985c00f850905000068b8534300ff } /* Opcode */
$op113 = { 595985c0756868b85b4300ff7588a1a8 } /* Opcode */
$op114 = { a1a8794400beff7f00005653ff90b8 } /* Opcode */
$op115 = { 595985c075686818584300ff75b8a1a8 } /* Opcode */
$op116 = { 83c4148bc65ec3558bec83ec14837d0c } /* Opcode */
$op117 = { 85c0a1a8794400750f5653ff902c0100 } /* Opcode */
$op118 = { 3d220000c0740732c0e9be } /* Opcode */
$op119 = { b4434400c7842400010000c4434400c7 } /* Opcode */
$op120 = { ff75f88d431050ff7508a1a8794400ff } /* Opcode */
$op121 = { 48f94200c78424d4 } /* Opcode */
$op122 = { ff75f4a1a879440053683cc843006854 } /* Opcode */
$op123 = { ff75fca1a8794400576814c743006830 } /* Opcode */
$op124 = { 81f9d03f00000f8e9c } /* Opcode */
$op125 = { 689461440068b06144008bf8a1a87944 } /* Opcode */
$op126 = { b0ad4300c7842488 } /* Opcode */
$op127 = { 85c07581881e837dfc02752c8d45d450 } /* Opcode */
$op128 = { ff75fca1a87944005768e0c6430068fc } /* Opcode */
$op129 = { ff751050ff7508a1a8794400ff905001 } /* Opcode */
$op130 = { ff750c8945f86898e143006854e24300 } /* Opcode */
$op131 = { 59598bf08d45f450a1a8794400680780 } /* Opcode */
$op132 = { 83c40cff75fcff7508a1a8794400ff90 } /* Opcode */
$op133 = { 83c40cff75fcff7508a1a8794400ff90 } /* Opcode */
$op134 = { 83c40cff75fcff7508a1a8794400ff90 } /* Opcode */
$op135 = { ff75fca1a87944006a0268a0c7430068 } /* Opcode */
$op136 = { 8b50245685d20f8ee2 } /* Opcode */
$op137 = { d4424400c78424dc } /* Opcode */
$op138 = { 68feff0000ff7508ff90b8 } /* Opcode */
$op139 = { a8414400c78424b4 } /* Opcode */
$op140 = { 595985c00f858601000068ac564300ff } /* Opcode */
$op141 = { 595985c0756868905c4300ff7588a1a8 } /* Opcode */
$op142 = { 8365f8008365fc00578b7d0c85ff0f84 } /* Opcode */
$op143 = { 80751583780800740fa1a87944005756 } /* Opcode */
$op144 = { 85c07579ff74241ca1a8794400ff750c } /* Opcode */
$op145 = { 83c428381dad7944007419ff75f8a1a8 } /* Opcode */
$op146 = { a0ae4300c78424c8 } /* Opcode */
$op147 = { 25a24100c781d40300008c514100c781 } /* Opcode */
$op148 = { 595985c00f85b204000068f0534300ff } /* Opcode */
$op149 = { 85c074b6ff75fca1a8794400ff906002 } /* Opcode */
$op150 = { 8975d8894ddc8975e48975e8ff90bc02 } /* Opcode */
$op151 = { e0674300c7842488 } /* Opcode */
$op152 = { 58694300c78424cc } /* Opcode */
$op153 = { 50284300c78424ec } /* Opcode */
$op154 = { 595985c00f85dd0100006840564300ff } /* Opcode */
$op155 = { 595985c0751d68105c4300ff7588a1a8 } /* Opcode */
$op156 = { f4f94200c78424f8 } /* Opcode */
$op157 = { 98164300c7842490 } /* Opcode */
$op158 = { b54200c784240801000010b54200c784 } /* Opcode */
$op159 = { acf94200c78424e4 } /* Opcode */
$op160 = { a1a87944008d5f106814de430053ff90 } /* Opcode */
$op161 = { 08af4300c78424e8 } /* Opcode */
$op162 = { 20184300c78424ec } /* Opcode */
$op163 = { 56689c56440068ff7f00008945f850a1 } /* Opcode */
$op164 = { 8d45f850a1a8794400ff90f801000083 } /* Opcode */
$op165 = { 595985c00f85c001000068345a4300ff } /* Opcode */
$op166 = { 83c4188945fc837dfc00752a6880 } /* Opcode */
$op167 = { 5f3d230000c075578b45ec03c0668945 } /* Opcode */
$op168 = { 4c174300c78424b4 } /* Opcode */
$op169 = { 8b45a4595985c075038b45b005001000 } /* Opcode */
$op170 = { 8bd8595985db0f8490 } /* Opcode */
$op171 = { a8ef4200c78424ec } /* Opcode */
$op172 = { b870794400bf34b042002bc78945e40f } /* Opcode */
$op173 = { 9cf94200c78424e0 } /* Opcode */
$op174 = { 595985c00f853508000068bc514300ff } /* Opcode */
$op175 = { 85c07405e9ef100000ff7514ff75c8ff } /* Opcode */
$op176 = { 24f94200c78424cc } /* Opcode */
$op177 = { ff7518ff75145753ff908402000083c4 } /* Opcode */
$op178 = { 85c00f8464fcffffff74240ca1a87944 } /* Opcode */
$op179 = { 595985c0756068f4584300ff75b8a1a8 } /* Opcode */
$op180 = { 5f8b45fc5e5bc9c3558bec83e4f883ec } /* Opcode */
$op181 = { b0b44200c78424f4 } /* Opcode */
$op182 = { 595985c075365650a1a879440057ff90 } /* Opcode */
$op183 = { 8bd88b450c8bf85903c659895d108945 } /* Opcode */
$op184 = { 783b4400c7842494 } /* Opcode */
$op185 = { 595985c0741ba1a87944006858e44300 } /* Opcode */
$op186 = { f4404400c784249c } /* Opcode */
$op187 = { 57ff75088945c8a1a8794400ff90b8 } /* Opcode */
$op188 = { 50a1a8794400576864bf43006894c043 } /* Opcode */
$op189 = { 8b450c8b4d142bc883e90651ff75fc8d } /* Opcode */
$op190 = { 8b4e2485c90f84e6 } /* Opcode */
$op191 = { d4414400c78424bc } /* Opcode */
$op192 = { ff75f8a1a8794400576804c143006818 } /* Opcode */
$op193 = { 68e0094400ff75fcff91600100008b0d } /* Opcode */
$op194 = { 595985c00f8532020000ff75d4a1a879 } /* Opcode */
$op195 = { 564000c741700a284000c78130040000 } /* Opcode */
$op196 = { 508d44245450a1a8794400c744245818 } /* Opcode */
$op197 = { 595985c00f856a0700006828524300ff } /* Opcode */
$op198 = { b0694300c78424d8 } /* Opcode */
$op199 = { 983b4400c78424a4 } /* Opcode */
$op200 = { 08184300c78424e4 } /* Opcode */
$op201 = { a1a879440056ff750cff907c0100008b } /* Opcode */
$op202 = { 83c40cff75bcff75bc0fb705b8794400 } /* Opcode */
$op203 = { 68b8584300ff75b8a1a8794400ff9090 } /* Opcode */
$op204 = { 3935d47944000f859b } /* Opcode */
$op205 = { 595985c00f85950400006808544300ff } /* Opcode */
$op206 = { 83c4108944241c8d44242c5056ff7424 } /* Opcode */
$op207 = { 8944241ca1a8794400680829440056ff } /* Opcode */
$op208 = { 3b4300c7842438060000103b4300c784 } /* Opcode */
$op209 = { f17a4000c78188010000f8944100c781 } /* Opcode */
$op210 = { 837d0c007505e98d } /* Opcode */
$op211 = { b44300c78424600200000cb44300c784 } /* Opcode */
$op212 = { 143c4400c78424d4 } /* Opcode */
$op213 = { 595985c00f85870700006818524300ff } /* Opcode */
$op214 = { 40184300c78424f8 } /* Opcode */
$op215 = { a1a87944005756ff902c01000083c428 } /* Opcode */
$op216 = { 595985c00f859e020000ff75c4a1a879 } /* Opcode */
$op217 = { ff74242ca1a879440068c863430053ff } /* Opcode */
$op218 = { 8b413c3bc30f84e0 } /* Opcode */
$op219 = { babebff202b91204ca01a3a479440089 } /* Opcode */
$op220 = { 595985c00f8554010000a1a879440068 } /* Opcode */
$op221 = { 224300c784242403000018224300c784 } /* Opcode */
$op222 = { d83b4400c78424c0 } /* Opcode */
$op223 = { 53684ce34300568945c050a1a8794400 } /* Opcode */
$op224 = { 44ef4200c78424d4 } /* Opcode */
$op225 = { 7c3c4400c78424f4 } /* Opcode */
$op226 = { 598bf0598b4d0889750c85db7e6d578a } /* Opcode */
$op227 = { 874300c78424a803000008874300c784 } /* Opcode */
$op228 = { 84174300c78424bc } /* Opcode */
$op229 = { b8404400c7842490 } /* Opcode */
$op230 = { 8364241800c70500b04200222700008b } /* Opcode */
$op231 = { 836424140059598bd8beff7f000033c0 } /* Opcode */
$op232 = { 5f85c07404b001c9c3a1a87944005356 } /* Opcode */
$op233 = { 85c00f851f020000ff742424a1a87944 } /* Opcode */
$op234 = { 8bf0a1a87944006848b7420056ff9060 } /* Opcode */
$op235 = { 6868574300ff75b8a1a8794400ff9090 } /* Opcode */
$op236 = { 1cae4300c78424a8 } /* Opcode */
$op237 = { 68284300c78424f4 } /* Opcode */
$op238 = { 59598945f48b45fcff308b45fc83c004 } /* Opcode */
$op239 = { 8bf00fb705b879440050a1a879440068 } /* Opcode */
$op240 = { ac274300c78424c0 } /* Opcode */
$op241 = { 568d441b0250ff7514a1a8794400ff90 } /* Opcode */
$op242 = { 043c4400c78424d0 } /* Opcode */
$op243 = { 595985c00f85e70300006874544300ff } /* Opcode */
$op244 = { c4404400c7842494 } /* Opcode */
$op245 = { 74754000c7812004000082964100c781 } /* Opcode */
$op246 = { 78414400c78424ac } /* Opcode */
$op247 = { 986a4300c78424f4 } /* Opcode */
$op248 = { 595985c00f855603000068fc544300ff } /* Opcode */
$op249 = { f0f84200c78424bc } /* Opcode */
$op250 = { ff4b148b5f3a035d0c837da80059590f } /* Opcode */
$op251 = { e8274300c78424d0 } /* Opcode */
$op252 = { 895c2464895c2468ff90bc0200003d22 } /* Opcode */
$op253 = { 834b1cff5959eb178b4df00500f0ffff } /* Opcode */
$op254 = { a1a879440056ff9000040000a1a87944 } /* Opcode */
$op255 = { 83c40c6814594300ff7588a1a8794400 } /* Opcode */
$op256 = { fb4200c784243401000010fb4200c784 } /* Opcode */
$op257 = { a1a879440083c40cff742418ff907401 } /* Opcode */
$op258 = { 8975ec8975f0ff900c030000f7d81bc0 } /* Opcode */
$op259 = { 20af4300c78424f4 } /* Opcode */
$op260 = { 3c274300c78424a0 } /* Opcode */
$op261 = { 595985c00f855102000068f0554300ff } /* Opcode */
$op262 = { 595985c0754f68d45b4300ff7588a1a8 } /* Opcode */
$op263 = { 60ef4200c78424dc } /* Opcode */
$op264 = { 595985c00f85e20200006860554300ff } /* Opcode */
$op265 = { 10af4300c78424ec } /* Opcode */
$op266 = { 83c0083bc30f84ab } /* Opcode */
$op267 = { 85db7456ff75108bf0ff750ca1a87944 } /* Opcode */
$op268 = { d8ef4200c78424f4 } /* Opcode */
$op269 = { 70424400c78424d0 } /* Opcode */
$op270 = { 59598d4dec51568bf833c057508945fc } /* Opcode */
$op271 = { 59593bc37461a1a879440068dce54300 } /* Opcode */
$op272 = { 595985c00f85f60600006870524300ff } /* Opcode */
$op273 = { 68b0424300ff75f057ff905001000083 } /* Opcode */
$op274 = { 59598bd88d45f050565357897dfc57e9 } /* Opcode */
$op275 = { ff750c8bd8a1a87944006800b1420068 } /* Opcode */
$op276 = { 8d45ec50ff75fca1a8794400ff90f802 } /* Opcode */
$op277 = { 595983670400836708008b450c5fc9c3 } /* Opcode */
$op278 = { ff75f0a1a879440068f0c8430056ff50 } /* Opcode */
$op279 = { 595985c00f8517020000ff75c0a1a879 } /* Opcode */
$op280 = { 0f825affffff5f5e8be55dc3558bec83 } /* Opcode */
$op281 = { 8975e48975e88975fcff90bc02000085 } /* Opcode */
$op282 = { ff4424148d474450a1a8794400ff9098 } /* Opcode */
$op283 = { 30174300c78424ac } /* Opcode */
$op284 = { 595985c00f85a407000068fc514300ff } /* Opcode */
$op285 = { 837d100159598bf07510ff750cff35bc } /* Opcode */
$op286 = { 595985c00f85f10500006824534300ff } /* Opcode */
$op287 = { fc274300c78424d4 } /* Opcode */
$op288 = { 88f84200c78424a8 } /* Opcode */
$op289 = { b24300c78424d401000008b24300c784 } /* Opcode */
$op290 = { 30ae4300c78424ac } /* Opcode */
$op291 = { 53ff75088bf0a1a8794400ff90780200 } /* Opcode */
$op292 = { 8c404400c784248c } /* Opcode */
$op293 = { 83c4188945fc837dfc00746c8b45fc81 } /* Opcode */
$op294 = { 8b45fc8b008d44000250ff7508a1a879 } /* Opcode */
$op295 = { c8ad4300c7842490 } /* Opcode */
$op296 = { 64174300c78424b8 } /* Opcode */
$op297 = { 85c07524ff74240ca1a8794400ff7508 } /* Opcode */
$op298 = { 595985c00f85bc0600006894524300ff } /* Opcode */
$op299 = { 895dd4897ddc895de0895de4ff90bc02 } /* Opcode */
$op300 = { f4b34200c78424b4 } /* Opcode */
$op301 = { 8b45fc0fb7400483f8250f85d9 } /* Opcode */
$op302 = { 59595e837df40074198b470805001000 } /* Opcode */
$op303 = { 50a1a87944005356ff90bc } /* Opcode */
$op304 = { 8b463a03c350a1a8794400ff90040400 } /* Opcode */
$op305 = { 44f84200c7842498 } /* Opcode */
$op306 = { 595985c00f85fb07000068d4514300ff } /* Opcode */
$op307 = { ff75fca1a8794400576804c643006820 } /* Opcode */
$op308 = { 90414400c78424b0 } /* Opcode */
$op309 = { 70164300c7842484 } /* Opcode */
$op310 = { 1cf04200c784240001000038f04200c7 } /* Opcode */
$op311 = { 68b4574300ff75b8a1a8794400ff9090 } /* Opcode */
$op312 = { e0f94200c78424f4 } /* Opcode */
$op313 = { 83c40c68fc8043008d45c050a1a87944 } /* Opcode */
$op314 = { 59595656ff74243889442424508d4424 } /* Opcode */
$op315 = { 8b45f88038030f85fc } /* Opcode */
$op316 = { 14434400c78424e4 } /* Opcode */
$op317 = { 30ee4200c7842488 } /* Opcode */
$op318 = { 85c07405e9500100006a018d45e8508d } /* Opcode */
$op319 = { 59598bf8895df4895df8c645ff01eb51 } /* Opcode */
$op320 = { cc174300c78424d4 } /* Opcode */
$op321 = { 68b34200c7842498 } /* Opcode */
$op322 = { 354300c784247804000010354300c784 } /* Opcode */
$op323 = { 10d54000b89ba64100898174030000c7 } /* Opcode */
$op324 = { 48424400c78424c8 } /* Opcode */
$op325 = { 85c07535a1a8794400538db8c4010000 } /* Opcode */
$op326 = { 68feff0000ff750889442424a1a87944 } /* Opcode */
$op327 = { b76c4000c781500200003e6f4000c741 } /* Opcode */
$op328 = { 395d14598bf0598975f87e36578b4510 } /* Opcode */
$op329 = { 8bf80fb705b879440050a1a879440068 } /* Opcode */
$op330 = { 595985c00f851808000068c8514300ff } /* Opcode */
$op331 = { a24300c78424440b000008a24300c784 } /* Opcode */
$op332 = { ff75f8a1a8794400576898c0430068b0 } /* Opcode */
$op333 = { 595985c00f856901000068d0564300ff } /* Opcode */
$op334 = { d8274300c78424cc } /* Opcode */
$op335 = { a1a879440083c450ff75fc5768a4c643 } /* Opcode */
$op336 = { 663bd8740a46460fb7066685c075d333 } /* Opcode */
$op337 = { 98b44200c78424ec } /* Opcode */
$op338 = { 85c00f84f2feffffa1a879440053ff75 } /* Opcode */
$op339 = { 595985c00f85390300006814554300ff } /* Opcode */
$op340 = { ff35d079440089442428684474430056 } /* Opcode */
$op341 = { 59598bf88d44241450ff7424188d4424 } /* Opcode */
$op342 = { a1a87944008d5e0c68a8dd430053ff90 } /* Opcode */
$op343 = { ff90c403000059598d45e050a1a87944 } /* Opcode */
$op344 = { 5353ff35bc7944008945d4a1a8794400 } /* Opcode */
$op345 = { 68478000006a008944242450a1a87944 } /* Opcode */
$op346 = { 5068000010808d44245050a1a8794400 } /* Opcode */
$op347 = { 543c4400c78424e8 } /* Opcode */
$op348 = { 595985c00f851201000068ec5a4300ff } /* Opcode */
$op349 = { d4164300c784249c } /* Opcode */
$op350 = { a8ee4200c78424a4 } /* Opcode */
$op351 = { f83b4400c78424cc } /* Opcode */
$op352 = { 595985c00f8571010000a1a879440068 } /* Opcode */
$op353 = { f4ee4200c78424bc } /* Opcode */
$op354 = { 808d45f850a1a87944006a00ff5044c9 } /* Opcode */
$op355 = { 83c40c8b45f85e5f5bc9c3558bec51a1 } /* Opcode */
$op356 = { 895de4895de8ff90bc02000085c07d07 } /* Opcode */
$op357 = { ff75148b45fc83c00450ff750ca1a879 } /* Opcode */
$op358 = { 30b44200c78424c8 } /* Opcode */
$op359 = { fc694300c78424e0 } /* Opcode */
$op360 = { 68274300c78424ac } /* Opcode */
$op361 = { bcef4200c78424f0 } /* Opcode */
$op362 = { a1a879440083c440ff7510681cb74200 } /* Opcode */
$op363 = { 7cb44200c78424e0 } /* Opcode */
$op364 = { 24284300c78424e0 } /* Opcode */
$op365 = { a0b44200c78424f0 } /* Opcode */
$op366 = { 50a1a879440051ff90b8 } /* Opcode */
$op367 = { 8d47fc50a1a879440053ff90b4 } /* Opcode */
$op368 = { 5c274300c78424a8 } /* Opcode */
$op369 = { 8975e48975e8ff90bc0200003d220000 } /* Opcode */
$op370 = { 59598945ec0fb705b879440050687444 } /* Opcode */
$op371 = { 56ff7424188bf8a1a879440057ff90d0 } /* Opcode */
$op372 = { 194300c78424100100001c194300c784 } /* Opcode */
$op373 = { a1a87944005653ff902c01000083c41c } /* Opcode */
$op374 = { 8d4744685c61430050a1a8794400ff90 } /* Opcode */
$op375 = { 8b46048b0d987944008988c4 } /* Opcode */
$op376 = { a1a8794400536800080000ff7508ff90 } /* Opcode */
$op377 = { 5150a1a8794400ff90b8 } /* Opcode */
$op378 = { 5150a1a8794400ff90b8 } /* Opcode */
$op379 = { ac174300c78424c8 } /* Opcode */
$op380 = { 83c410ff75108945f88d45dc50a1a879 } /* Opcode */
$op381 = { 595985c00f85120100006850574300ff } /* Opcode */
$op382 = { 0f8260ffffffa1a879440068a0384400 } /* Opcode */
$op383 = { 8b44240c83c04468dc7f430050a1a879 } /* Opcode */
$op384 = { bcb44200c78424f8 } /* Opcode */
$op385 = { 895dcc894dd0895dd8895ddcff90bc02 } /* Opcode */
$op386 = { 20274300c7842498 } /* Opcode */
$op387 = { 59598bf88d44242050ff7424248d4424 } /* Opcode */
$op388 = { 59598bf08d45fc50ff75fc8d45f4566a } /* Opcode */
$op389 = { a1a879440083c40cff74240cff907401 } /* Opcode */
$op390 = { e989feffffa1a87944005357685cb042 } /* Opcode */
$op391 = { 28af4300c78424f8 } /* Opcode */
$op392 = { 595985c00f856e0200006870594300ff } /* Opcode */
$op393 = { ff75108bf8a1a87944006810b7420056 } /* Opcode */
$op394 = { 3935d47944000f85c6 } /* Opcode */
$op395 = { 924300c78424a006000010924300c784 } /* Opcode */
$op396 = { ecee4200c78424b8 } /* Opcode */
$op397 = { 595985c00f852f01000068c85a4300ff } /* Opcode */
$op398 = { 8b4e24c1e10251ff75fc8945f850a1a8 } /* Opcode */
$op399 = { 6a228d45ec50ff757ca1a8794400c745 } /* Opcode */
$op400 = { 58414400c78424a8 } /* Opcode */
$op401 = { 897dc4897dc8ff904803000085c00f85 } /* Opcode */
$op402 = { d03b4400c78424bc } /* Opcode */
$op403 = { 895c2464895c2468ff90bc02000085c0 } /* Opcode */
$op404 = { dcae4300c78424d8 } /* Opcode */
$op405 = { a1a8794400538b5d08565768feff0000 } /* Opcode */
$op406 = { 595985c00f858b0200006858594300ff } /* Opcode */
$op407 = { 943c4400c78424fc } /* Opcode */
$op408 = { b0ee4200c78424a8 } /* Opcode */
$op409 = { ff90bc02000085c0a1a87944007412ff } /* Opcode */
$op410 = { ff75108945f80fb7450c50a1a8794400 } /* Opcode */
$op411 = { 8b1584a042008991a4020000c7813802 } /* Opcode */
$op412 = { 895e10895e14ff90bc02000085c0742a } /* Opcode */
$op413 = { ff7510a1a87944006834b742005657ff } /* Opcode */
$op414 = { 595985c00f854d0700006844524300ff } /* Opcode */
$op415 = { 30ef4200c78424d0 } /* Opcode */
$op416 = { 595985c00f85c00100006864564300ff } /* Opcode */
$op417 = { 94ee4200c78424a0 } /* Opcode */
$op418 = { 8b6c24248b5c242059598bf8beff7f00 } /* Opcode */
$op419 = { 33db395d14598bf0598975fc7e2e8b45 } /* Opcode */
$op420 = { ff900c030000f7d81bc0f7d02345fc5f } /* Opcode */
$op421 = { 24b44200c78424c4 } /* Opcode */
$op422 = { 803b4400c7842498 } /* Opcode */
$op423 = { 57ff75088945e0a1a8794400ff90b8 } /* Opcode */
$op424 = { ff75fca1a8794400576838c643006850 } /* Opcode */
$op425 = { 68e0574300ff75b8a1a8794400ff9090 } /* Opcode */
$op426 = { 8b45fc8338040f8ee9 } /* Opcode */
$op427 = { 38b44200c78424cc } /* Opcode */
$op428 = { ff742448a1a879440053ff902c010000 } /* Opcode */
$op429 = { 4c694300c78424c8 } /* Opcode */
$op430 = { 85c07402eb60ff75f4ff7518ff7508a1 } /* Opcode */
$op431 = { 6c434400c78424f4 } /* Opcode */
$op432 = { a1a8794400682ce54300ff75f8ff9090 } /* Opcode */
$op433 = { 8b44242083c00450ff7508a1a8794400 } /* Opcode */
$op434 = { a1a8794400595968a86b440068e06b44 } /* Opcode */
$op435 = { 28ee4200c7842484 } /* Opcode */
$op436 = { 85c074258d45f450a1a8794400ff90a4 } /* Opcode */
$op437 = { a1a879440056ff90d0030000a1a87944 } /* Opcode */
$op438 = { ff7508a1a8794400ff7308ff909c } /* Opcode */
$op439 = { e9b0feffffa1a879440053576850b042 } /* Opcode */
$op440 = { 598945f8598d45fc508d45f4508d45ec } /* Opcode */
$op441 = { 8bf8a1d079440033f65959897c24203b } /* Opcode */
$op442 = { 8975d88975e48975e8ff90bc02000053 } /* Opcode */
$op443 = { 59598bf88d45f450565753895dfc53e9 } /* Opcode */
$op444 = { c0174300c78424d0 } /* Opcode */
$op445 = { 8bf083c40c3bf375148d45fc50a1a879 } /* Opcode */
$op446 = { 595985c00f853e0400006848544300ff } /* Opcode */
$op447 = { e8ae4300c78424dc } /* Opcode */
$op448 = { 80ae4300c78424c0 } /* Opcode */
$op449 = { c7430c20020000895df0ff506853ff75 } /* Opcode */
$op450 = { e962feffffa1a879440053576864b042 } /* Opcode */
$op451 = { 595985c00f852605000068ac534300ff } /* Opcode */
$op452 = { 668b4d0a663bc874c7464666833e000f } /* Opcode */
$op453 = { 595985c00f85ec04000068c8534300ff } /* Opcode */
$op454 = { c0414400c78424b8 } /* Opcode */
$op455 = { 85c075d68d45c050a1a8794400ff501c } /* Opcode */
$op456 = { 40284300c78424e8 } /* Opcode */
$op457 = { 14284300c78424dc } /* Opcode */
$op458 = { ff75f8a1a87944005768d0c0430068e4 } /* Opcode */
$op459 = { ff75108bf8ff750ca1a879440068b460 } /* Opcode */
$op460 = { b03b4400c78424b0 } /* Opcode */
$op461 = { 836508008365f8008bd8668b46026648 } /* Opcode */
$op462 = { 595985c07415b301a1a87944005657ff } /* Opcode */
$op463 = { 59595656578bd8538d45f450a1a87944 } /* Opcode */
$op464 = { 595985c0757968d4584300ff75b8a1a8 } /* Opcode */
$op465 = { 595985c00f855b040000682c544300ff } /* Opcode */
$op466 = { a1a87944005657beff7f000056ff7508 } /* Opcode */
$op467 = { a1a87944005657beff7f000056ff7508 } /* Opcode */
$op468 = { 83c40c5f33c05e5dc3558bec83e4f883 } /* Opcode */
$op469 = { 59595f5ec3558bec83ec286a0a8d45d8 } /* Opcode */
$op470 = { a1a8794400689477440056ff90740300 } /* Opcode */
$op471 = { 595985c0754733c0668945b033c08d7d } /* Opcode */
$op472 = { 40694300c78424c4 } /* Opcode */
$op473 = { 595985c00f85300700006850524300ff } /* Opcode */
$op474 = { 8d45dc5068000108008d45fc50a1a879 } /* Opcode */
$op475 = { a14300c78424f80a00000ca14300c784 } /* Opcode */
$op476 = { d0ae4300c78424d4 } /* Opcode */
$op477 = { 30404400c7842484 } /* Opcode */
$op478 = { f8264300c784248c } /* Opcode */
$op479 = { e937feffff558bec83e4f881ec9c0100 } /* Opcode */
$op480 = { 04fa4200c78424fc } /* Opcode */
$op481 = { 20414400c78424a4 } /* Opcode */
$op482 = { 80434400c78424f8 } /* Opcode */
$op483 = { 34774000c781a4030000e3f940008991 } /* Opcode */
$op484 = { 104000c7810c040000ae2b4000c781c8 } /* Opcode */
$op485 = { 895c245c895c2460ff900c03000085c0 } /* Opcode */
$op486 = { b23e4000c7814c020000361b4000c781 } /* Opcode */
$op487 = { 595985c00f85040400006868544300ff } /* Opcode */
$op488 = { bc164300c7842498 } /* Opcode */
$op489 = { 50a1a8794400ff901c01000083c41ceb } /* Opcode */
$op490 = { dc684300c78424b4 } /* Opcode */
$op491 = { 3cf94200c78424d0 } /* Opcode */
$op492 = { b8f94200c78424e8 } /* Opcode */
$op493 = { cc274300c78424c8 } /* Opcode */
$op494 = { 3b05d8794400751b8b4604ff80b8 } /* Opcode */
$op495 = { ff750c8bd8a1a87944006880b0420068 } /* Opcode */
$op496 = { 83c4508d45f450a1a8794400ff90f801 } /* Opcode */
$op497 = { 58424400c78424cc } /* Opcode */
$op498 = { 817c2410102700000f8fd8 } /* Opcode */
$op499 = { 895de0895de4ff90bc02000089450c3d } /* Opcode */
$op500 = { 8b45080500f0ffff89461c53ff7708e8 } /* Opcode */
$op501 = { 50a1a87944005668306443005653ff90 } /* Opcode */
$op502 = { a1a87944008b405083c40c3bc3740b8d } /* Opcode */
$op503 = { 83c40c834b0c048b075e5b5fc9c3558b } /* Opcode */
$op504 = { 72b6ff75f8a1a8794400ff7508ff902c } /* Opcode */
$op505 = { f0ad4300c7842498 } /* Opcode */
$op506 = { b4264300c7842484 } /* Opcode */
$op507 = { 595985c00f858e010000a1a879440068 } /* Opcode */
$op508 = { 38b34200c7842490 } /* Opcode */
$op509 = { ff75108bf8ff750ca1a879440068d85f } /* Opcode */
$op510 = { 50ee4200c7842494 } /* Opcode */
$op511 = { 8cae4300c78424c4 } /* Opcode */
$op512 = { 7cf94200c78424dc } /* Opcode */
$op513 = { ff742454a1a879440068406343006848 } /* Opcode */
$op514 = { ff750c50a1a8794400ff904001000059 } /* Opcode */
$op515 = { 14274300c7842494 } /* Opcode */
$op516 = { 89463a85c0744f897e288b7e3a037d08 } /* Opcode */
$op517 = { c8674300c7842484 } /* Opcode */
$op518 = { 3d230000c0740b3d050000800f85df } /* Opcode */
$op519 = { 3d230000c075618b45fc8d4400025089 } /* Opcode */
$op520 = { 83c41489451083f8ff0f84b6 } /* Opcode */
$op521 = { 595985c00f853402000068c0594300ff } /* Opcode */
$op522 = { 8974247489742478ff90bc02000085c0 } /* Opcode */
$op523 = { 8974247489742478ff90bc02000085c0 } /* Opcode */
$op524 = { a170a04200898128010000a19ca04200 } /* Opcode */
$op525 = { 895db0895db4ff90bc020000bf340000 } /* Opcode */
$op526 = { 83c414c60437008bc75f5ec3558bec83 } /* Opcode */
$op527 = { ff900c0300003d220000c00f8586 } /* Opcode */
$op528 = { 85c00f84a9fdffffff742418a1a87944 } /* Opcode */
$op529 = { 7c164300c7842488 } /* Opcode */
$op530 = { 59974100c7416cf8184000c781340100 } /* Opcode */
$op531 = { 8b48103bcb0f84eb } /* Opcode */
$op532 = { 8944241c8d474450ff750ca1a8794400 } /* Opcode */
$op533 = { 85c075138b45f0668378023a7509668b } /* Opcode */
$op534 = { 2a4300c7842468010000102a4300c784 } /* Opcode */
$op535 = { c8ee4200c78424ac } /* Opcode */
$op536 = { 83c40c6a0a83c71057568d45ec50ff75 } /* Opcode */
$op537 = { 314300c78424500300000c314300c784 } /* Opcode */
$op538 = { 80184300c7842400010000a4184300c7 } /* Opcode */
$op539 = { ff7608a1a8794400ff50788bd8a1a879 } /* Opcode */
$op540 = { 1c6a4300c78424e4 } /* Opcode */
$op541 = { a1a87944006850e5430053ff9090 } /* Opcode */
$op542 = { 595985c00f8551020000689c594300ff } /* Opcode */
$op543 = { 8bd80fb705b879440050a1a879440068 } /* Opcode */
$op544 = { 18684300c7842494 } /* Opcode */
$op545 = { 8975dc8975e08975f4ff90f8 } /* Opcode */
$op546 = { 595985c00f85c50200006828594300ff } /* Opcode */
$op547 = { e0ee4200c78424b4 } /* Opcode */
$op548 = { 4e914000a1cca04200898154030000c7 } /* Opcode */
$op549 = { a34300c784248c0b00000ca34300c784 } /* Opcode */
$op550 = { 5cae4300c78424b8 } /* Opcode */
$op551 = { 68345b4300ff7588a1a8794400ff9090 } /* Opcode */
$op552 = { 595985c00f85dd01000068245a4300ff } /* Opcode */
$op553 = { 595985c00f85ad030000688c544300ff } /* Opcode */
$op554 = { 83c424ff4e248b4624744f6a01c1e002 } /* Opcode */
$op555 = { 595985c00f859f06000068b0524300ff } /* Opcode */
$op556 = { 5f85c0740432c0c9c3568d45f850ff75 } /* Opcode */
$op557 = { 68feff0000ff75088944241ca1a87944 } /* Opcode */
$op558 = { 6a2f8d45b850ff757ca1a8794400c745 } /* Opcode */
$op559 = { 688c41430050a1a879440053ff905001 } /* Opcode */
$op560 = { 8c164300c784248c } /* Opcode */
$op561 = { ecef4200c78424f8 } /* Opcode */
$op562 = { 83c414381db17944007459a1a8794400 } /* Opcode */
$op563 = { ff75f88bf8ff750ca1a8794400687014 } /* Opcode */
$op564 = { 57ff751056ff909c02000053ff76088b } /* Opcode */
$op565 = { 595985c07536684c584300ff75b8a1a8 } /* Opcode */
$op566 = { 595985c00f85ff0200006848554300ff } /* Opcode */
$op567 = { d6224100c7811801 } /* Opcode */
$op568 = { 686a4300c78424ec } /* Opcode */
$op569 = { 8975b88975bcff900c03000085c00f85 } /* Opcode */
$op570 = { 568bd8a1a879440068d0b8410053ff90 } /* Opcode */
$op571 = { 8b0da8794400536689450aff91e8 } /* Opcode */
$op572 = { 6820b14200683cb142008bf0a1a87944 } /* Opcode */
$op573 = { 14b44200c78424bc } /* Opcode */
$op574 = { 595985c00f850e0600006810534300ff } /* Opcode */
$op575 = { 595985c074156a005750a1a879440056 } /* Opcode */
$op576 = { 08f04200c78424fc } /* Opcode */
$op577 = { a1a879440083c450ff75fc576864c743 } /* Opcode */
$op578 = { a46a4300c78424f8 } /* Opcode */
$op579 = { 8c3c4400c78424f8 } /* Opcode */
$op580 = { 8bf8a1a8794400684780000053ff90b8 } /* Opcode */
$op581 = { 595985c0757ba1a87944006830de4300 } /* Opcode */
$op582 = { 83c410894424108d4424245056ff7424 } /* Opcode */
$op583 = { 903b4400c78424a0 } /* Opcode */
$op584 = { bc3b4400c78424b4 } /* Opcode */
$op585 = { 8945fc8d474450ff7510a1a879440068 } /* Opcode */
$op586 = { 9c434400c78424fc } /* Opcode */
$op587 = { ff75108bf8a1a879440068dcb6420056 } /* Opcode */
$op588 = { 3c434400c78424e8 } /* Opcode */
$op589 = { 595985c0754da1a8794400687cde4300 } /* Opcode */
$op590 = { 6888574300ff75b8a1a8794400ff9090 } /* Opcode */
$op591 = { 94ef4200c78424e8 } /* Opcode */
$op592 = { 68b45b440050a1a879440053ff905001 } /* Opcode */
$op593 = { ff75106a00ff750ca1a8794400ff909c } /* Opcode */
$op594 = { ff75106a00ff750ca1a8794400ff909c } /* Opcode */
$op595 = { a1a879440083c450ff742418687c6343 } /* Opcode */
$op596 = { a43b4400c78424ac } /* Opcode */
$op597 = { 59164000c781a0010000bc2f4000a188 } /* Opcode */
$op598 = { 85c0754e50ff742414a1a8794400683c } /* Opcode */
$op599 = { a4174300c78424c4 } /* Opcode */
$op600 = { 30274300c784249c } /* Opcode */
$op601 = { 740ac705d479440006 } /* Opcode */
$op602 = { 595985c00f85a30100006878564300ff } /* Opcode */
$op603 = { 18ef4200c78424c8 } /* Opcode */
$op604 = { 84ef4200c78424e4 } /* Opcode */
$op605 = { dcb44200c7842400010000ecb44200c7 } /* Opcode */
$op606 = { 59598bd8ff74bd88a1a879440068d006 } /* Opcode */
$op607 = { 60184300c78424fc } /* Opcode */
$op608 = { 85c0752bff7510a1a8794400ff750cff } /* Opcode */
$op609 = { 8945f0668b45ec59668945ee598d45ec } /* Opcode */
$op610 = { 0f8252ffffffa1a879440053ff7508ff } /* Opcode */
$op611 = { ff7510a1a879440056ff907402000083 } /* Opcode */
$op612 = { 5c434400c78424f0 } /* Opcode */
$op613 = { 68545b4300ff7588a1a8794400ff9090 } /* Opcode */
$op614 = { 595985c00f85b7050000684c534300ff } /* Opcode */
$op615 = { a1a879440056536a0468f8a04200ff90 } /* Opcode */
$op616 = { 595985c00f85c50200006894554300ff } /* Opcode */
$op617 = { 59598945fc8b45f4484850ff75188b45 } /* Opcode */
$op618 = { 595985c00f851c0300006838554300ff } /* Opcode */
$op619 = { 83c41889458c837d8c000f8407040000 } /* Opcode */
$op620 = { 595985c00f851a010000a1a879440068 } /* Opcode */
$op621 = { 595985c00f85d40500006838534300ff } /* Opcode */
$op622 = { a1a87944006808624400ff75f856ff90 } /* Opcode */
$op623 = { c8f94200c78424ec } /* Opcode */
$op624 = { ff75f0a1a87944005368b4c8430068c8 } /* Opcode */
$op625 = { ff75eca1a879440068e8c7430056ff50 } /* Opcode */
$op626 = { 85c0754d8b450c668378023f50a1a879 } /* Opcode */
$op627 = { 66837938020f86d5 } /* Opcode */
$op628 = { ff75f4a1a8794400576820c84300682c } /* Opcode */
$op629 = { ff75d08b4df88b45ccff751403c10345 } /* Opcode */
$op630 = { 68805b4300ff7588a1a8794400ff9090 } /* Opcode */
$op631 = { 4c274300c78424a4 } /* Opcode */
$op632 = { a1a879440068e44443005653ff900801 } /* Opcode */
$op633 = { 58ef4200c78424d8 } /* Opcode */
$op634 = { 8d8500feffff689880430068ff } /* Opcode */
$op635 = { 595985c00f859003000068ac544300ff } /* Opcode */
$op636 = { 8b45fc8d048603433a50a1a8794400ff } /* Opcode */
$op637 = { 54684300c784249c } /* Opcode */
$op638 = { 68b0464300ff75088bf8a1a8794400ff } /* Opcode */
$op639 = { 643b4400c784248c } /* Opcode */
$op640 = { 894424608b44244883c04468cc7f4300 } /* Opcode */
$op641 = { 595985c00f859a0500006860534300ff } /* Opcode */
$op642 = { a1a879440053ff7508ff90b8 } /* Opcode */
$op643 = { 8b5d1085c07535a1a8794400538db8c4 } /* Opcode */
$op644 = { a1a879440056ff5028a1a87944006a13 } /* Opcode */
$op645 = { 2c3c4400c78424dc } /* Opcode */
$op646 = { 443c4400c78424e4 } /* Opcode */
$op647 = { 08ae4300c78424a4 } /* Opcode */
$op648 = { 94694300c78424d4 } /* Opcode */
$op649 = { 83c8ffe95c010000836508008d450850 } /* Opcode */
$op650 = { ff75fca1a87944006838b04200ff7514 } /* Opcode */
$op651 = { 71324000c7814c0100006a6b4000a1d4 } /* Opcode */
$op652 = { 3c684300c7842498 } /* Opcode */
$op653 = { 595985c00f854c01000068a45a4300ff } /* Opcode */
$op654 = { c0ae4300c78424d0 } /* Opcode */
$op655 = { 703b4400c7842490 } /* Opcode */
$op656 = { 595985c07520a1a87944005753ff9060 } /* Opcode */
$op657 = { e43b4400c78424c4 } /* Opcode */
$op658 = { d4f84200c78424b8 } /* Opcode */
$op659 = { a18ca042008981bc020000a190a04200 } /* Opcode */
$op660 = { 64ee4200c7842498 } /* Opcode */
$op661 = { d4f94200c78424f0 } /* Opcode */
$op662 = { 8945f48d474450ff750ca1a879440068 } /* Opcode */
$op663 = { 8945f48d474450ff750ca1a879440068 } /* Opcode */
$op664 = { ff503c8d44242c894424588d842480 } /* Opcode */
$op665 = { 6cf84200c78424a0 } /* Opcode */
$op666 = { 68385c4300ff7588a1a8794400ff9090 } /* Opcode */
$op667 = { 595985c0745aa1a879440068feff0000 } /* Opcode */
$op668 = { 595985c0745aa1a879440068feff0000 } /* Opcode */
$op669 = { 24184300c78424f0 } /* Opcode */
$op670 = { 59598945bc8b45c0ff70108b45c083c0 } /* Opcode */
$op671 = { 8b45088b50183bca0f82270100008b40 } /* Opcode */
$op672 = { 10f84200c7842488 } /* Opcode */
$op673 = { ff75f4a1a8794400683f420f006864c8 } /* Opcode */
$op674 = { 8d45e450a1a8794400ff90f801000083 } /* Opcode */
$op675 = { 85c00f8420faffff5fff75f0a1a87944 } /* Opcode */
$op676 = { 30694300c78424c0 } /* Opcode */
$op677 = { 8d4300c7842440050000148d4300c784 } /* Opcode */
$op678 = { 6898584300ff75b8a1a8794400ff9090 } /* Opcode */
$op679 = { 8b5dfc3bde75053975f4747b33c03bde } /* Opcode */
$op680 = { 85c075158d45f850ffd68d45f850a1a8 } /* Opcode */
$op681 = { 595985c00f85de07000068e0514300ff } /* Opcode */
$op682 = { 0fb748486685c97e770fbfd13955f07f } /* Opcode */
$op683 = { 595985c00f85210400006858544300ff } /* Opcode */
$op684 = { 595985c00f855208000068b0514300ff } /* Opcode */
$op685 = { a0284300c7842400010000b0284300c7 } /* Opcode */
$op686 = { a4424400c78424d8 } /* Opcode */
$op687 = { 817c2414102700000f8fcc } /* Opcode */
$op688 = { 24ef4200c78424cc } /* Opcode */
$op689 = { 595985c00f85ab010000a1a879440068 } /* Opcode */
$op690 = { a194a04200898194 } /* Opcode */
$op691 = { 8cb34200c78424a0 } /* Opcode */
$op692 = { 8b5d088bf8a1a8794400688049430053 } /* Opcode */
$op693 = { 895c2464895c2468ff900c03000085c0 } /* Opcode */
$op694 = { 895c2464895c2468ff900c03000085c0 } /* Opcode */
$op695 = { ff75108b5d0c8bf8a1a879440053897d } /* Opcode */
$op696 = { 518db884020000ff907c0100005903c0 } /* Opcode */
$op697 = { 54b44200c78424d4 } /* Opcode */
$op698 = { 08284300c78424d8 } /* Opcode */
$op699 = { fbd94000c78110040000cb584100c781 } /* Opcode */
$op700 = { ccb44200c78424fc } /* Opcode */
$op701 = { 595985c0751d6870584300ff75b8a1a8 } /* Opcode */
$op702 = { 595985c00f85cf04000068e0534300ff } /* Opcode */
$op703 = { 578b7d088d45fe508b450cff34b0a1a8 } /* Opcode */
$op704 = { 595985c00f85fc010000a1a879440068 } /* Opcode */
$op705 = { 8944246c8b44244483c04450ff742450 } /* Opcode */
$op706 = { 595985c00f8583020000ff75e0a1a879 } /* Opcode */
$op707 = { 59598d44240850a1a8794400ff90a402 } /* Opcode */
$op708 = { 85c0753aa1a87944006a01683c3d4400 } /* Opcode */
$op709 = { 74b44200c78424dc } /* Opcode */
$op710 = { a8b34200c78424a4 } /* Opcode */
$op711 = { a1e0a04200898128040000a144a04200 } /* Opcode */
$op712 = { 60b44200c78424d8 } /* Opcode */
$op713 = { f4674300c784248c } /* Opcode */
$op714 = { 59598945d08d45d85068ff8f0000ff75 } /* Opcode */
$op715 = { 6814e34300ff75f88945cca1a8794400 } /* Opcode */
$op716 = { a1a879440083c450ff74240c681c6643 } /* Opcode */
$op717 = { 78f84200c78424a4 } /* Opcode */
$op718 = { 9c3c4400c7842400010000a83c4400c7 } /* Opcode */
$op719 = { 9c4300c784248c0900000c9c4300c784 } /* Opcode */
$op720 = { b4174300c78424cc } /* Opcode */
$op721 = { 6c3c4400c78424f0 } /* Opcode */
$op722 = { 894da4ff503c8d45dc8945bc8d459c50 } /* Opcode */
$op723 = { 78ef4200c78424e0 } /* Opcode */
$op724 = { 54b34200c7842494 } /* Opcode */
$op725 = { 8365fc0059598945f88b45fc8b9c8590 } /* Opcode */
$op726 = { 90284300c78424fc } /* Opcode */
$op727 = { c4684300c78424b0 } /* Opcode */
$op728 = { bcad4300c784248c } /* Opcode */
$op729 = { 0fb70db879440053516824e343005689 } /* Opcode */
$op730 = { 24b34200c784248c } /* Opcode */
$op731 = { 534c4100c781a8020000dd284100c781 } /* Opcode */
$op732 = { ff75f8a1a87944005768b4c0430068cc } /* Opcode */
$op733 = { 833dcc79440000750ac705cc7944009c } /* Opcode */
$op734 = { 344400c78424ec02000010344400c784 } /* Opcode */
$op735 = { 85c0753cff742424a1a879440068a82c } /* Opcode */
$op736 = { 1cb44200c78424c0 } /* Opcode */
$op737 = { 8d45e050ff75f4a1a8794400ff905402 } /* Opcode */
$op738 = { c43b4400c78424b8 } /* Opcode */
$op739 = { 595985c00f856506000068e0524300ff } /* Opcode */
$op740 = { ff76088bf88d460c50a1a879440057ff } /* Opcode */
$op741 = { 50a1a8794400ff500c84c0a1a8794400 } /* Opcode */
$op742 = { 595985c0754f68b05c4300ff7588a1a8 } /* Opcode */
$op743 = { 836508008365f8005959668b4e026649 } /* Opcode */
$op744 = { 8bf033c0668945dc8d7ddeab6a08ff75 } /* Opcode */
$op745 = { 904300c78424100600000c904300c784 } /* Opcode */
$op746 = { 595985c00f858206000068c8524300ff } /* Opcode */
$op747 = { 595985c07564a1a87944006858de4300 } /* Opcode */
$op748 = { 59598945e88365cc008365e40068feff } /* Opcode */
$op749 = { 85c074148d45d050a1a8794400ff90a4 } /* Opcode */
$op750 = { a1a8794400566800100000ff7508ff90 } /* Opcode */
$op751 = { 595985c00f85a8020000683c594300ff } /* Opcode */
$op752 = { 515350a1a879440057ff90bc0100008b } /* Opcode */
$op753 = { 374400c78424ac03000010374400c784 } /* Opcode */
$op754 = { 895ddc895de0ff90bc02000085c00f85 } /* Opcode */
$op755 = { 895ddc895de0ff90bc02000085c00f85 } /* Opcode */
$op756 = { 68b8094400ff75fcff91600100008b0d } /* Opcode */
$op757 = { 595985c0753668ec5b4300ff7588a1a8 } /* Opcode */
$op758 = { ff90840100005f85c0740432c0c9c38b } /* Opcode */
$op759 = { 84b44200c78424e4 } /* Opcode */
$op760 = { 595985c00f8578040000681c544300ff } /* Opcode */
$op761 = { 595985c00f85d9060000687c524300ff } /* Opcode */
$op762 = { a8ad4300c7842484 } /* Opcode */
$op763 = { 93364000c781640100006e984100a178 } /* Opcode */
$op764 = { 78284300c78424f8 } /* Opcode */
$op765 = { 8d8500feffff686c80430068ff } /* Opcode */
$op766 = { a1a879440083c44056ff90e4030000a1 } /* Opcode */
$op767 = { 83c41c894424146a01e99b0300008b44 } /* Opcode */
$op768 = { 2e4300c7842470020000102e4300c784 } /* Opcode */
$op769 = { a16ca04200c7411c1f4c41008981f8 } /* Opcode */
$op770 = { f0174300c78424dc } /* Opcode */
$op771 = { bc274300c78424c4 } /* Opcode */
$op772 = { 59598b45c0050010000050a1a8794400 } /* Opcode */
$op773 = { 595985c00f854c01000068f8564300ff } /* Opcode */
$op774 = { 8d44242450ff74241ca1a8794400ff90 } /* Opcode */
$op775 = { ff742434a1a879440068ac65430068bc } /* Opcode */
$op776 = { 964300c78424cc0700000c964300c784 } /* Opcode */
$op777 = { 33f6803d9379440000751aa1a8794400 } /* Opcode */
$op778 = { 595985c00f85fa0100006830564300ff } /* Opcode */
$op779 = { 8bf0a1a879440083c4108975fc85f675 } /* Opcode */
$op780 = { a1a8794400686ce5430053ff9090 } /* Opcode */
$op781 = { 59598d4de4515650538945f8895dfc53 } /* Opcode */
$op782 = { acae4300c78424cc } /* Opcode */
$op783 = { 48ee4200c7842490 } /* Opcode */
$op784 = { 0faf459c8d7008a1a879440056ff750c } /* Opcode */
$op785 = { 0cf94200c78424c4 } /* Opcode */
$op786 = { 894424188d474450ff750ca1a8794400 } /* Opcode */
$op787 = { 8b7d0ceb2550a1a8794400ff90e8 } /* Opcode */
$op788 = { 85c00f85e905000057bffeff0000eb02 } /* Opcode */
$op789 = { 595989463a85c074bc33ff8b46282bc7 } /* Opcode */
$op790 = { 8bf08b450c6683385c59598975f87516 } /* Opcode */
$op791 = { 8bf08b450c6683385c59598975f87516 } /* Opcode */
$op792 = { 595985c00f857d0500006870534300ff } /* Opcode */
$op793 = { 895de0895de4ff90bc0200008bf881ff } /* Opcode */
$op794 = { bc6a4300c7842400010000cc6a4300c7 } /* Opcode */
$op795 = { 84684300c78424a4 } /* Opcode */
$op796 = { 85c00f84b4feffffff75f8a1a8794400 } /* Opcode */
$op797 = { a1a87944006820de430053ff9090 } /* Opcode */
$op798 = { e0ad4300c7842494 } /* Opcode */
$op799 = { dcce4000c78130010000bd184000c781 } /* Opcode */
$op800 = { 595985c00f854d020000ff75d8a1a879 } /* Opcode */
$op801 = { 595985c00f85ca0300006880544300ff } /* Opcode */
$op802 = { 5933db5989442410895c2414be80 } /* Opcode */
$op803 = { 50a1a879440057689cc8430068acc843 } /* Opcode */
$op804 = { ff75fca1a8794400576848c74300685c } /* Opcode */
$op805 = { a1a879440068d45e440057ff90f40300 } /* Opcode */
$op806 = { a1a879440056ff9080020000a1a87944 } /* Opcode */
$op807 = { ff7424148bf0a1a879440056ff906003 } /* Opcode */
$op808 = { a1a879440083c4485753ff902c010000 } /* Opcode */
$op809 = { ff742420a1a8794400686866430053ff } /* Opcode */
$op810 = { fcb24200c7842484 } /* Opcode */
$op811 = { 834f28ff8367240059595e5b5fc9c355 } /* Opcode */
$op812 = { 64ae4300c78424bc } /* Opcode */
$op813 = { 50a1a8794400ff901c01000083c418a1 } /* Opcode */
$op814 = { ff75108bf8ff750ca1a879440068185f } /* Opcode */
$op815 = { 595985c00f8537010000a1a879440068 } /* Opcode */
$op816 = { e4264300c7842488 } /* Opcode */
$op817 = { ff45fc817dfc102700000f8ffe } /* Opcode */
$op818 = { 595985c00f85a802000068a4554300ff } /* Opcode */
$op819 = { a1a8794400683440430057ff90400100 } /* Opcode */
$op820 = { 595985c00f856e02000068d8554300ff } /* Opcode */
$op821 = { 568bf8a1a87944006a0057ff90780100 } /* Opcode */
$op822 = { a1a879440068f0464300ff7508ff902c } /* Opcode */
$op823 = { 595985c00f85c107000068f0514300ff } /* Opcode */
$op824 = { 85c00f8444ffffff32dbeb02b301a1a8 } /* Opcode */
$op825 = { 4c3b4400c7842484 } /* Opcode */
$op826 = { 8bf8a1a87944005653897dfcff90b8 } /* Opcode */
$op827 = { 0cef4200c78424c4 } /* Opcode */
$op828 = { 8cb44200c78424e8 } /* Opcode */
$op829 = { 59598d4c244c51575056894424248974 } /* Opcode */
$op830 = { a0684300c78424a8 } /* Opcode */
$op831 = { 10174300c78424a4 } /* Opcode */
$op832 = { a1a879440068fc5e440057ff90f40300 } /* Opcode */
$op833 = { ff742440a1a8794400680c634300681c } /* Opcode */
$op834 = { ff75f0a1a87944005368d0c8430068e0 } /* Opcode */
$op835 = { 8b46048b0d9c7944008988b4 } /* Opcode */
$op836 = { f8ad4300c784249c } /* Opcode */
$op837 = { 87194000c741487b614000c781b80300 } /* Opcode */
$op838 = { 50ae4300c78424b4 } /* Opcode */
$op839 = { 18af4300c78424f0 } /* Opcode */
$op840 = { ff75f8a1a87944005356ff5014ff75f8 } /* Opcode */
$op841 = { a8f84200c78424b0 } /* Opcode */
$op842 = { 8d45fc50a1a8794400ff90f801000083 } /* Opcode */
$op843 = { 8d45fc50a1a8794400ff90f801000083 } /* Opcode */
$op844 = { 595985c00f854806000068f0524300ff } /* Opcode */
$op845 = { a1a8794400685440430057ff90400100 } /* Opcode */
$op846 = { bbd03f00003bf36a010f8e9f } /* Opcode */
$op847 = { 85c07549a1a879440053ff74241868d8 } /* Opcode */
$op848 = { 68cc574300ff75b8a1a8794400ff9090 } /* Opcode */
$op849 = { 85c0754fa1a87944006a01ff74241c68 } /* Opcode */
$op850 = { 9c3b4400c78424a8 } /* Opcode */
$op851 = { ff742448a1a879440068e065430068e8 } /* Opcode */
$op852 = { 5cf84200c784249c } /* Opcode */
$op853 = { 6800080000ff75088945f0a1a8794400 } /* Opcode */
$op854 = { 595985c00f85a3010000684c5a4300ff } /* Opcode */
$op855 = { 88274300c78424b4 } /* Opcode */
$op856 = { 24f84200c7842490 } /* Opcode */
$op857 = { 85c00f84ddfeffffa1a87944005753ff } /* Opcode */
$op858 = { 8b55f80fb6120fb63f8b450803d75981 } /* Opcode */
$op859 = { 558beca1a879440083ec14538b5d0856 } /* Opcode */
$op860 = { 24174300c78424a8 } /* Opcode */
$op861 = { 8b75108b363bf30f8d92 } /* Opcode */
$op862 = { 595985c00f852b0600006800534300ff } /* Opcode */
$op863 = { 59598bf0a1a87944005668ff7f0000ff } /* Opcode */
$op864 = { ec3b4400c78424c8 } /* Opcode */
$op865 = { 689842430050a1a879440057ff905001 } /* Opcode */
$op866 = { c4694300c78424dc } /* Opcode */
$op867 = { 83c43885c00f85bb020000a1a8794400 } /* Opcode */
$op868 = { 18f84200c784248c } /* Opcode */
$op869 = { 0cb34200c7842488 } /* Opcode */
$op870 = { 6818494300ff75088bf8a1a8794400ff } /* Opcode */
$op871 = { e4b34200c78424b0 } /* Opcode */
$op872 = { ff7604a1a8794400ff75fc5368145d44 } /* Opcode */
$op873 = { 85c074148d45f450a1a8794400ff90a4 } /* Opcode */
$op874 = { 668bd80fb70750a1a8794400ff90e8 } /* Opcode */
$op875 = { 668bd80fb70750a1a8794400ff90e8 } /* Opcode */
$op876 = { 83c410ff45fc8b45fc3b45f87caf5ba1 } /* Opcode */
$op877 = { 6683780a3a0f85b6 } /* Opcode */
$op878 = { 8bf8a1a879440083c41857c7071c0100 } /* Opcode */
$op879 = { b8f84200c78424b4 } /* Opcode */
$op880 = { 8944241833c066894424308d7c2432ab } /* Opcode */
$op881 = { a1a8794400ff742434681080430056ff } /* Opcode */
$op882 = { ff75fca1a8794400536888c743006898 } /* Opcode */
$op883 = { a1a879440056ff9008020000a1a87944 } /* Opcode */
$op884 = { 837d0c02598bf0598975f8750dff35c0 } /* Opcode */
$op885 = { 10fa4200c784240001000024fa4200c7 } /* Opcode */
$op886 = { 576800654400682865440056ff903c03 } /* Opcode */
$op887 = { 8975e88975ecff90f8 } /* Opcode */
$op888 = { 595985c00f8560050000687c534300ff } /* Opcode */
$op889 = { 595985c00f852f0100006820574300ff } /* Opcode */
$op890 = { 57ff75088945d8a1a8794400ff90b8 } /* Opcode */
$op891 = { 59598945f88b45fcff308b45fc83c004 } /* Opcode */
$op892 = { 59598945f88b45fcff308b45fc83c004 } /* Opcode */
$op893 = { 5733ff397d7c0f84f5010000a1a87944 } /* Opcode */
$op894 = { 681c5b4300ff7588a1a8794400ff9090 } /* Opcode */
$op895 = { 8b55148b1285d20f8c1f0100000fbf70 } /* Opcode */
$op896 = { 8946048b442418893083c40c8bc65ec3 } /* Opcode */
$op897 = { 595985c075368b45a44050ff7590ff75 } /* Opcode */
$op898 = { 344300c784243404000010344300c784 } /* Opcode */
$op899 = { 04694300c78424bc } /* Opcode */
$op900 = { 595985c00f851702000068f4594300ff } /* Opcode */
$op901 = { 836004008320005959c3558beca1a879 } /* Opcode */
$op902 = { 68c07344008945f0578d45f050a1a879 } /* Opcode */
$op903 = { 8b75fca1a87944006a0056ff506483c4 } /* Opcode */
$op904 = { 11654000c74164e7744000c741241a74 } /* Opcode */
$op905 = { 59593bc37478a1a879440068c0e54300 } /* Opcode */
$op906 = { 595985c00f85c8010000a1a879440068 } /* Opcode */
$op907 = { 68745c4300ff7588a1a8794400ff9090 } /* Opcode */
$op908 = { 595985c00f856f08000068a4514300ff } /* Opcode */
$op909 = { 595985c00f8517020000681c564300ff } /* Opcode */
$op910 = { ff35c87944008bf8a1a8794400688477 } /* Opcode */
$op911 = { a0274300c78424bc } /* Opcode */
$op912 = { 44174300c78424b0 } /* Opcode */
$op913 = { 98174300c78424c0 } /* Opcode */
$op914 = { 686c5b4300ff7588a1a8794400ff9090 } /* Opcode */
$op915 = { 687c584300ff75b8a1a8794400ff9090 } /* Opcode */
$op916 = { ff4424108d474450a1a8794400ff9098 } /* Opcode */
$op917 = { ec164300c78424a0 } /* Opcode */
$op918 = { 4c434400c78424ec } /* Opcode */
$op919 = { 8b75108b363bf20f8dd5 } /* Opcode */
$op920 = { 6834484300ff75088bf8a1a8794400ff } /* Opcode */
$op921 = { 85c0753cff74242ca1a8794400683038 } /* Opcode */
$op922 = { 1d4300c78424e00100000c1d4300c784 } /* Opcode */
$op923 = { a1a87944006860e5430053ff9090 } /* Opcode */
$op924 = { f8684300c78424b8 } /* Opcode */
$op925 = { 595981ffd03f00008945f889380f8eb0 } /* Opcode */
$op926 = { fcf74200c7842484 } /* Opcode */
$op927 = { fec3660fb6c35959663b450c750232db } /* Opcode */
$op928 = { 836424200089442428a100b042005959 } /* Opcode */
$op929 = { 50a1a87944005668d06643005653ff90 } /* Opcode */
$op930 = { 8b45f40145f02945ec83c40cff45fc8b } /* Opcode */
$op931 = { 83c42c85c00f852e030000ff75100fb7 } /* Opcode */
$op932 = { 6c694300c78424d0 } /* Opcode */
$op933 = { 595985c00f857303000068d8544300ff } /* Opcode */
$op934 = { 9cf84200c78424ac } /* Opcode */
$op935 = { a8164300c7842494 } /* Opcode */
$op936 = { ff45fc817dfce80300000f8fac } /* Opcode */
$op937 = { e9adfeffffa1a87944006a006affff90 } /* Opcode */
$op938 = { 33c0668944242c8d7c242eab66ab6810 } /* Opcode */
$op939 = { fc414400c78424c0 } /* Opcode */
$op940 = { a1a879440083c450ff75f85768e8c043 } /* Opcode */
$op941 = { 59881daf794400ff0500b04200381daf } /* Opcode */
$op942 = { d4ee4200c78424b0 } /* Opcode */
$op943 = { 203c4400c78424d8 } /* Opcode */
condition:
( uint16(0) == 0x5a4d and filesize < 900KB and ( 5 of ($s*) )and 1 of ($op*) ) or ( all of them )
}This YARA rule can be deployed in the following contexts:
This rule contains 964 string patterns in its detection logic.
Scenario: A system administrator is using PowerShell to automate the deployment of updates via WSUS (Windows Server Update Services).
Filter/Exclusion: process.parent_process_name != "Windows Update" or process.name != "powershell.exe" if the script is known and whitelisted.
Scenario: A scheduled task is configured to run a PowerShell script that generates temporary files in the %TEMP% directory as part of a routine system cleanup.
Filter/Exclusion: process.name != "powershell.exe" or process.parent_process_name == "schtasks.exe" to exclude legitimate scheduled tasks.
Scenario: A backup tool like Veeam or Commvault is generating temporary files during a backup operation.
Filter/Exclusion: process.name contains "veeam" or process.name contains "commvault" to exclude known backup processes.
Scenario: An IT admin is using LogonScript or Group Policy Preferences to deploy configuration files to user profiles, which may involve file creation in user directories.
Filter/Exclusion: process.parent_process_name == "services.exe" or process.parent_process_name == "lsass.exe" to identify administrative actions.
Scenario: A CI/CD pipeline (e.g., Jenkins, GitHub Actions) is deploying code and generating temporary files in a shared development directory.
Filter/Exclusion: process.name contains "jenkins" or process.name contains "github" to exclude pipeline-related activity.