FB700DDA15959BF91F2BE758C0F1F54E cfg_ml.pol
17671916BC03763CBC20D35D7B44E7C6 l0_InstallerInfo.pol
000A8BC433DB9E9E57265618619E7BA0 l0_White.pol
1C8FF9363AC698C0421C4C9FC1166D98 l1_AMSIAlert.pol
E1B81A0A82D8D06DF4BA973467097630 l1_AppAssoc.pol
F030D74BB78303C3EC8E77364B883011 l1_BrowserHelperObj.pol
B8A912EDF787E497A4CF469E9027D504 l1_ChildAlert.pol
98E649EB3290BDADDD2E191ECA147049 l1_ControlSet.pol
6A6AC07666704ECF01002BA43640422E l1_CryptoMiner.pol
08A148EAE2CC3F51FE6614B61E93A5B6 l1_DefaultDebugger.pol
663C386284D99795F2FED7238BAF88E8 l1_DisableRegTools.pol
958F83E19676A9F1B1D55223CB2B1AB9 l1_DisableTaskMgr.pol
92BDDDC4198EF7F70FDB03E122944D78 l1_Emotet.pol
50D272203C53B8442E1A9E2F080A5921 l1_ExeDrop.pol
CBCCB2D97F0A9F9917C39B628D37593C l1_ExplorerPolicy.pol
AE07328E847161ECFD001FE2443D68A0 l1_EyeScore.pol
B380F0FAEDD8F82D23A26E9AD93521B9 l1_FakeSig.pol
60FAB0DDCEBB9F60BB0A816ACF9FBE07 l1_FakeSvcHost.pol
67D7AED250CD13AF16E55F97485D4128 l1_FakeWinProg.pol
A7A85B0AA5737C79B669F7D2EE88353E l1_Firewall.pol
F7E6516A7A350B01EA3E858C7A31B633 l1_FirewallChange.pol
5570A7F99D52C3720FF00D7DE5DDB2E7 l1_Hidden.pol
FDA37955EA0C75C46BF9883E8A2C3886 l1_IExplorer.pol
1204244D2CD9A9FB45FC96BFB8158E79 l1_Inject.pol
EB2019CA3B63056887B8D702907C1C64 l1_LocalApp.pol
EE2E3FDDF3305B5953A1B0BECF535064 l1_MiscFlags.pol
8FDBC1E9CB5AB71A9A2A2D4E06CD03A5 l1_MLD.pol
1529F0E559D208DEE9672425C4C408BB l1_MsHta.pol
8CD2B34FE96BD62AB3B8FED954F99575 l1_NoFolderOptions.pol
967D34D43399603E7394F343A0855960 l1_OnAccessAlert.pol
BDFC118E672BB0B512330D093A76D826 l1_OnFileScanAlert.pol
9BE12ED070CE61E1CD2833ABB64CA3B1 l1_OnSafeBrowsing.pol
D45AC9D09939DC8FDC2310D331F7A1A7 l1_Progdata.pol
6B388849BAA6B399C4D4CB72863AC027 l1_PsDownload.pol
FA1940547657C2C49A9D2CE07C0DCD84 l1_Recycle.pol
CA12F1E76A12B1D094FCAB1C9783617D l1_RegAppInit.pol
1C530F0179EDC22D66C61E37636F92F7 l1_RegRunServices.pol
5260DBFD2DF798247417148B06CF23B9 l1_RegShellRun.pol
5BF8E2DA283C9127ECCD51D720B02404 l1_RegStartup.pol
93BDED1590940B6A679B717CF8A650ED l1_RegStartupFolders.pol
F948A4720558C12E3B4F781E590ECF55 l1_RegSysCert.pol
AC5D9ACA04F434A24A809840C02E7DBF l1_RegSystemCertificates.pol
ADC03E6E0BD40A330A36802FAE465FEE l1_RegWinFirewall.pol
44784CE072BFEDD2C2FB5E814A8111BA l1_RegWinLogon.pol
F9FA27538676AE793FD139FC0AAB932E l1_Roaming.pol
5C362FB72010D6EE3907AE697F66BD37 l1_RunBrowser.pol
217A1E47A12E6621BC60D1C7ECC962AE l1_SharedTaskSched.pol
F471987317F4A5762286D5D07794C212 l1_ShellExecuteHooks.pol
31A41958550F42900F3D6F6A354A77B6 l1_ShellHijack.pol
526A7676B9DCAF327D9BE2D674736660 l1_Startup.pol
92ECFAD9EDC77B7434ADFFD965B4D333 l1_SysPolicy.pol
569379DC2A2C23E9F0FC309AC306A821 l1_UserProfile.pol
3600D19A03DCFC6A644658715B004F81 l1_VbsScript.pol
11EA81656B2B9188B089BB6C76CAE458 l1_VSSDelete.pol
6919D207380690203D8665FB867D712F l1_WinDefend.pol
171856B99F4FBDB744C7AEDEE356FA1D l1_WinDir.pol
674942B9400C5AABB5DACA8AA72182FB l2_AMSIAlert.pol
82A5DC211D54789220EF35E7C7C4FBFF l2_ChildAlert.pol
4CC8DF15702D69A531CFF96B6618B0B4 l2_ControlSetSelfCopy.pol
381DDA72C2B2A9C3617ADD0877E28098 l2_ControlSetSelfDelete.pol
E476807C7907EEC014E667DDF058217B l2_ControlSetSelfRename.pol
E765693CEA6AD132641C48FF38431786 l2_FakeExeDrop.pol
3470036C8999C4584E713B81AC7BA596 l2_FakeProgFwChange.pol
2EF4FCDDCAAB58F71DE65E9939FF499F l2_FakeProgHidden.pol
27B4356F576EC883869317EC24FC6404 l2_FakeProgRegStartup.pol
3CD130FF5B41432F92506A66A28C450C l2_FakeProgSelfCopy.pol
DFE5DF13C12E936BDBC4D7EB08051E1B l2_FakeProgSelfRename.pol
2FCD64AF63C298373B7EBC6FE166FCC2 l2_FakeProgSelfRun.pol
FEA075BE3A81D1541359680A983B2C84 l2_FakeProgWinDir.pol
7A596476CFEBD23F2C7E6FD12DE0E0D3 l2_FakeSvcHost.pol
0E173FCFB7082EE4AE5C26DB47D025B0 l2_FileType.pol
D1F47D393B19108002EB80B9F7A01881 l2_HiddenRecycle.pol
1D6FA89D18C25D81F12674BBC1A71B7E l2_Invertor.pol
F467992C5D573A6F82D58B3E8720C800 l2_LocalAppSelfCopy.pol
3ABE23CD2F0B57B395C99059265A5A9C l2_LocalAppSelfRename.pol
C24B2593B23624831470B1E18D466364 l2_LocalAppSelfRun.pol
3DEF3DE1E97FCB761E3FA76B2FC76BF6 l2_MemAllocApps.pol
9B2AF53A687009BFB64D425BB557F5E4 l2_MemAllocChrome.pol
B8E9570364A13971FFF4DAEF2B0164BF l2_MemAllocEdge.pol
26EDB75087FAAAC811E3401EBEFCB4A0 l2_MemAllocFirefox.pol
E6CAE134054B742D93EDB3E8F04314ED l2_MemAllocIE.pol
449B5100602F6B360627AD018F762B30 l2_MemAllocNet.pol
BAA70B3CC65EE7503E9CB02E3E7A903A l2_MemAllocOpera.pol
853FDDB7143A1EFEE54F63ADBC5B395C l2_MemAllocProcess.pol
4F2AB8C46AFCE26A8DAFA94DFBD8D051 l2_MemAllocSelf.pol
49DCAE2987ECE4113666D718FAA6F1EA l2_MemAllocWow.pol
52AC5CEEAE0E12DA645B49B1C642AA54 l2_MemChangeNet.pol
29596BC9660D70544EDFA71799CED2BA l2_MemChangeSelf.pol
1A7E6718650C89F277D2408F889FAD96 l2_MemChangeWow.pol
3C721FD1ED0FF957034D7CCF823B27B9 l2_MemContextIE.pol
ECD8BE4EB236F9D5920BCFBE19F4A7E8 l2_MemContextNet.pol
9461D863AC3B95AC66671A6034E37DC2 l2_MemContextProcess.pol
D24708E94603329B5E91CF40B208C259 l2_MemContextSelf.pol
CC848183E888A0FFF1B02AEB1592F074 l2_MemMapNet.pol
3F2992ECDF5F1E2E8844649C55D881E8 l2_MemMapProcess.pol
D09F283258AD26A6CB74063E7B5C6A25 l2_MemMapSelf.pol
5A9D47CD2C0151C6322523E91AB82D1B l2_MemMapWow.pol
18FB9F3D7CEF51079AFDC545767A1E08 l2_MemTaskIE.pol
110B7416FA558066355A019D92A864BD l2_MemTaskProcess.pol
9092E0029A174892E0587D9ED83E343C l2_Misc.pol
920416E9457548D9230BBC66D61F0E8A l2_ML.pol
9CEF7094F88D5A36E58014A6596EC299 l2_MLD.pol
E18C8BF1B0047F355B091DDF8E0B14BA l2_MLDCpy.pol
595A294E10C08236D8591C8FE9E988FB l2_MLDCrypto.pol
A0DF6FD082EA5550676807DF46CDA109 l2_MLDDel.pol
56B42DF4524FE980593185947B41A038 l2_MsHtaAssoc.pol
269BB32772834FA16F5DF9DCBF5A517B l2_OnAccessAlert.pol
B82556E250DDA1C2DEB0F89529B4CAF8 l2_OnFileScanAlert.pol
EBDB1AA022FDB2A932C47FCD96164D40 l2_OnFlare11Scan.pol
DEEBCD7BBD569FC162DEF680407F306B l2_ProgdataExplorerPolicy.pol
B559A57F1507BA596AC74769B5140C05 l2_ProgdataRegStartup.pol
7598370C4114D8FD55ED5AA652E754C8 l2_ProgdataSelfCopy.pol
7A12D6B8EBED6C37C6F14432CF90E95B l2_ProgdataSelfRename.pol
31E79D99DAB6125A1C907E2B6EBB3EAD l2_ProgdataSelfRun.pol
18623E7A2942CA595E9E764C60AC28B2 l2_ProgdataVSSDelete.pol
7669E24E95F0AA105A9BA3A1DB976A01 l2_PsDownloadSelfRun.pol
995C40BAF90C9906C7B143E53024B708 l2_RecycleSelfRun.pol
B043E9772BF3B4A17C82E19E24C2B94E l2_RegAppInit.pol
98EDFBA1B643939968EFF25994855D6E l2_RegRunServices.pol
83E43CABDDD1E9B6233061BC75260F9B l2_RegStartupCryptoMiner.pol
1260D20DE7CFE1163A6FF0B73FD208B2 l2_RegStartupExplorer.pol
6A9BDF780B6A7563699712A5336E9196 l2_RegStartupFolders.pol
9C4FF6AAA9C14080D000E769340A0BA9 l2_RegStartupFwChange.pol
A6A69F52D1C1AB237EB8A9AE51BC59E3 l2_RegStartupHidden.pol
026C9E6B3DEF6634EAE3D319AF541883 l2_RegStartupLocalApp.pol
8759EB4483DE4234F9B3CCADC8F42209 l2_RegStartupRecycle.pol
6BF2BA75B9F088940E7FAA6683C27C6C l2_RegStartupRoaming.pol
5EE2C58935C52251DDD1EF501ECBDD81 l2_RegStartupSelfCopy.pol
F80CA99E932D026EBC20EE9AD24A628D l2_RegStartupSelfDelete.pol
FB248BDAD0A3FD94565475198F8D7A01 l2_RegStartupSelfRename.pol
65A3CCA486B59DFE1C2EF2A0F9D46C8D l2_RegStartupSysPolicy.pol
3B849B46F65ACC4C145357152E16B89A l2_RegStartupUserProfile.pol
A64155A78C5E50DBCEB5076986567B2D l2_RegStartupWin.pol
946B29A203CD68908DEB0C8933DF9929 l2_RegStartupWinLogon.pol
CFF8FAB92B1CA8E0B892C26D45362C6F l2_RegWinLogonHidden.pol
7DC86C9F735115DC8B347ED5E9CD17BD l2_RoamingControlSet.pol
AACE7E9552CD8AE36ABC22DA1383CB55 l2_RoamingFwChange.pol
69AEABBE6466CC353D967A50457F1379 l2_RoamingInject.pol
34FE9425726D67B0F7CB406F1FF37851 l2_RoamingSelfCopy.pol
D79C1B31A9C04E4AB50A1C8942918C08 l2_RoamingSelfRename.pol
609A1B2A73A07ABA8FB996243AB319C9 l2_RoamingSelfRun.pol
46CCA63CC395F503FA649593565C2C8D l2_ScoreControlSet.pol
210BA4389EC15E06909294D0B9BF0AC7 l2_ScoreExeDrop.pol
443A6D44D6168446B8BB6A3D8F097CD1 l2_ScoreExeDropKiller.pol
7FE05D644E6916123BC46789CEF09288 l2_ScoreExeDropMsHta.pol
A405C03D82F099039B939F64788B9109 l2_ScoreExeDropSchd.pol
839E0C4765A7A4628679110B5518867F l2_ScoreExeDropStartup.pol
47AF0184CCB1AE4CA1F6AF0B9812783A l2_ScoreExeDropSysCert.pol
EAEF3C2BB1C0FA05F8D6BED4C7901D06 l2_ScoreExplorerKiller.pol
43D97B51064DA6375A1B09B748541EFD l2_ScoreFirewallChange.pol
B3E4B191F96C7B54022E070B90F123BA l2_ScoreHidden.pol
A1E7D8FD5EDA44B20CE86C1CD3281FC1 l2_ScoreInject.pol
D297DEBB62EFE73B6AD384945826B212 l2_ScoreKiller.pol
83A49D2269D219364545E500C618F251 l2_ScoreRegStartup.pol
A65D47D9480BA4952116D8BA2ACA5822 l2_ScoreRegWinFirewall.pol
4BFE973104321252A96917CA94AB0189 l2_ScoreSelfDelete.pol
BC5331916E2AE76D9305358702EDC93F l2_Startup.pol
7F470872A2B3E1BF5C0E3E4E3D017AB1 l2_SvcHostInject.pol
4D334D0E6D46B6F5356D4C5A2EEF1F24 l2_SvcHostLeech.pol
DC84D899560E479BC888819BCE310396 l2_SysPolicySelfCopy.pol
768CD5CC9DE4AF06FCEEC69FF25400CC l2_SysPolicySelfDelete.pol
3E98BAAF149C124DA201DD5FD8FD1BE3 l2_SysPolicySelfRename.pol
F0081B58F3E155636EBCC5ED9EF4CC38 l2_UserProfileSelfRun.pol
DAD5A85747CD5A12B1F8C83F380ED570 l2_VbsScriptAssoc.pol
A92654C100475CFEB211602CC8250B36 l2_WinDirBHO.pol
A295F8B60DFBCBD85C984669D33AD37F l2_WinDirControlSet.pol
5343EE8A0837E27DC5CD2AC23B389466 l2_WinDirCryptoMiner.pol
97001E6C9F0B16A3F8A9ABA3A60754E6 l2_WinDirExplorerPolicy.pol
93A76A964671A3816362E96C7D6C300A l2_WinDirFwChange.pol
95AD1E377B06929DFC190EA7C6084831 l2_WinDirHidden.pol
B8279464A26725301BE37D7759F37AE0 l2_WinDirNFO.pol
A00F965A3E4D22BCE486B82F078C2714 l2_WinDirRegWinLogon.pol
D17248535A1C086197983FFB70143881 l2_WinDirSelfDelete.pol
ECB7366DC4177C1764A9EFA77834D1A2 l2_WinDirShellHook.pol
AD2259425DE8B18E50129C54D9C22D9D l2_WinLogonSelfCopy.pol
F3F989CFFABBD0368FC6FFB934AAD624 l2_WinLogonSelfRename.pol
7CF37D1F4EA6D2C1E9D2B21C9D61DC54 l2_WinSelfCopy.pol
2E659914E688CA6E2087DBCC207787BF l2_WinSelfRename.pol
4BB233E7765BE625B1C612AD336C806F l2_WinSelfRun.pol
8262B5706F93A2D4234D9BF9B28178CD l3_GameDetection.pol
B7FB73EE3B4F82E8A59865BEC9A34540 l3_InstallerDetectionCU.pol
C04E7F714CC1003E5C3AAA8C7B81DB76 l3_InstallerDetectionCUReqElev.pol
9E4C0C31E7DBEDAC3C0E2217DA94654E l3_InstallerDetectionLM.pol
145CDC1D59818B27398E9A6792BECE57 l3_InstallerDetectionLMReqElev.pol
58018C1DEE02730F9686A67E476F1120 l3_InstallerDetectionLMWow64.pol
6E470002FFC520732CF43E84664E5FC3 l3_InstallerDetectionLMWow64ReqElev.pol
DFD99AD4B32813211B0E79AADB9F3377 l3_VerifiedInstaller.pol
D058AC227C8ADB2E0891FA348BD65C64 l3_VerifiedUnInstaller.pol
954CE21EC9A37433E07FB40B857F94D4 lm_sha_pe.cfg
3171EFB684E47D0ECE55258B5976E3FD lm_sha_pe.onnx
64C83CF5BA7DCE2073C37C40B2763A44 l0_FilterSuspiciousDlls.lda
B525BAA2331CE91185E37EED9EB2BDDD l0_ProcessNameClassify.lda
FE6121455521ED5D4DB773F8BAFC31A7 l2_JSPSExeDropper.lda
7D48787EE13A1B5C2828A07AAA8F0B89 l3_Detection.lda
