From 533e7dfd15c61d67a742820db8175caddc860119 Mon Sep 17 00:00:00 2001
From: 87owo <85057800+87owo@users.noreply.github.com>
Date: Fri, 23 Jan 2026 13:49:06 +0800
Subject: [PATCH] Add files via upload

---
 Engine/Heuristic/Rules_General_A1.yar | 1439 +++++++++++++++++++++++++
 Engine/Pattern/convert.py             |   55 +
 Engine/Pattern/deduplicate.py         |   34 +
 Engine/Pattern/train.py               |  163 +++
 Engine/Properties/convert.py          |  513 +++++++++
 Engine/Properties/train.py            |  195 ++++
 6 files changed, 2399 insertions(+)
 create mode 100644 Engine/Heuristic/Rules_General_A1.yar
 create mode 100644 Engine/Pattern/convert.py
 create mode 100644 Engine/Pattern/deduplicate.py
 create mode 100644 Engine/Pattern/train.py
 create mode 100644 Engine/Properties/convert.py
 create mode 100644 Engine/Properties/train.py

diff --git a/Engine/Heuristic/Rules_General_A1.yar b/Engine/Heuristic/Rules_General_A1.yar
new file mode 100644
index 0000000..bc7a446
--- /dev/null
+++ b/Engine/Heuristic/Rules_General_A1.yar
@@ -0,0 +1,1439 @@
+import "pe"
+
+rule General_1 {
+   meta:
+      description = "1"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $x1 = "System.Object, mscorlib, Version=" ascii
+      $x2 = ".pdb" ascii
+      $x3 = "System.Drawing" ascii
+      $s1 = "a2VybmVsMzIuZGxs" fullword wide
+      $s2 = "RnJlZUNvbnNvbGU=" fullword wide
+      $s3 = "Paleozoologist Timpanist Troubling" ascii
+      $s4 = "Paleozoologist Timpanist Troubling" wide
+      $s5 = "Levitating" fullword ascii
+      $s6 = ".Properties" ascii
+      $s7 = "PublicKeyToken" ascii
+      $s8 = "helpToolStripButton.Image" fullword wide
+      $s9 = "newToolStripButton.Image" fullword wide
+      $s10 = "openToolStripButton.Image" fullword wide
+      $s11 = "printToolStripButton.Image" fullword wide
+      $s12 = "printPreviewToolStripButton.Image" fullword wide
+      $s13 = "Extractor" ascii
+      $s14 = "Congratulations" fullword ascii
+      $s15 = "Byrnies" fullword wide
+      $s16 = "showString" fullword ascii
+      $s17 = "AScsrhgtr" fullword ascii
+      $s18 = "ZknciocoiAw" fullword ascii
+      $s19 = "Volute Transitions" fullword wide
+      $s20 = "IOasuoihciujo" fullword ascii
+      $s21 = "labelComp" wide
+      $s22 = "ErrorImage" wide
+      $s23 = "get_QuestCompletionItems" fullword ascii
+      $s24 = "get_DropPercentage" fullword ascii
+      $s25 = "PlayerData.xml" fullword wide
+      $s26 = "get_LootTable" fullword ascii
+      $s27 = "get_Potions" ascii
+      $s28 = "get_CurrentMonster" fullword ascii
+      $s29 = "MONSTER_ID_RAT" fullword ascii
+      $s30 = "get_AddExtraNewLine" fullword ascii
+      $s31 = "get_LootItems" fullword ascii
+      $s32 = "get_HasAMonster" fullword ascii
+      $s33 = "get_MinimumDamage" fullword ascii
+      $s34 = "get_RewardGold" fullword ascii
+      $s35 = "get_VendorWorkingHere" fullword ascii
+      $s36 = "get_RewardItem" fullword ascii
+      $s37 = "get_MaximumDamage" fullword ascii
+      $s38 = "get_RewardExperiencePoints" fullword ascii
+      $s39 = "imgur.com" wide
+      $s40 = "CURD_ALUNOS.md" wide
+      $s41 = "Parametros.xml" fullword wide
+      $s42 = "dgEditar_CellContentClick" fullword ascii
+      $s43 = "dgDados_CellContentClick" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 5000KB and
+      1 of ($x*) and 8 of them
+}
+
+rule General_2 {
+   meta:
+      description = "2"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $s1 = "You walk into the" wide
+      $s2 = "_unprocessedInterAgentMessages" fullword ascii
+      $s3 = "ProcessAllInterAgentMessages" fullword ascii
+      $s4 = "AgentsComunnicationExecution" fullword ascii
+      $s5 = "SendExecuteMessage" fullword ascii
+      $s6 = "TemporarySetAgentModel" fullword ascii
+      $s7 = "immediatelyProcess" fullword ascii
+      $s8 = "ProcessTheMessage" fullword ascii
+      $s9 = "HoldTarget" ascii nocase
+      $s10 = "SimulationEngine." ascii
+      $s11 = "FindAddresseeAgent" ascii
+      $s12 = "AgentIsAlreadyRegistredException" fullword ascii
+      $s13 = "MessageTimestampComparer" fullword ascii
+      $s14 = "startcombat" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 5000KB and
+      8 of them
+}
+
+rule General_3 {
+   meta:
+      description = "3"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $x1 = "GrapeCity.ActiveReports.Chart.Win" ascii
+      $s1 = "ComponentlessCollectionEditor" ascii
+      $s2 = "LabelsCollectionEditorGrapeCity" ascii
+      $s3 = "AxesEditor" ascii
+      $s4 = "AnnotationEditor" ascii
+      $s5 = "GradientEditor" ascii
+      $s6 = "DoubleArrayEditor" ascii
+      $s7 = "LegendsEditor" ascii
+      $s8 = "DataPointsEditor" ascii
+      $s9 = "ChartAreasEditor" ascii
+      $s10 = "AxesSelectEditor" ascii
+      $s11 = "StyleEditor" ascii
+      $s12 = "PatternEditor" ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 30000KB and
+      $x1 and 8 of them
+}
+
+rule General_4 {
+   meta:
+      description = "PYAS_Rules_A4"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $x1 = ".Properties" ascii nocase
+      $x2 = ".Resources" ascii nocase
+      $s1 = "ListenToAll" fullword ascii
+      $s2 = "Abberant" fullword ascii
+      $s3 = "Shlyber" fullword ascii
+      $s4 = ".exe" wide
+      $s5 = ".pdb" wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 4000KB and
+      ($x1 and $x2) and 5 of them
+}
+
+rule General_5 {
+   meta:
+      description = "5"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $x1 = "Microsoft.VSDesigner.DataSource.Design" ascii
+      $s1 = "columnPostcode" fullword ascii
+      $s2 = "GetRealUpdatedRows" fullword ascii
+      $s3 = "set_Postcode" fullword ascii
+      $s4 = "System.Drawing.Design.UITypeEditor" fullword ascii
+      $s5 = "postcodeDataGridViewTextBoxColumn" fullword wide
+      $s6 = "get_AlexandraDBConnectionString" fullword ascii
+      $s7 = "SELECT [Number]" wide
+      $s8 = "Original_Postcode" fullword wide
+      $s9 = "get_CellPhone" fullword ascii
+      $s10 = "get_CellPhoneColumn" fullword ascii
+      $s11 = "postcodeTextBox" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 5000KB and
+      $x1 and 3 of them
+}
+
+rule General_6 {
+   meta:
+      description = "6"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $x1 = "System.Drawing" ascii
+      $x2 = "PublicKeyToken" ascii
+      $x3 = "System.Security.Permissions.SecurityPermission" wide
+      $x4 = "urn:schemas-microsoft-com:asm" ascii
+      $s1 = "feffeeffeef" ascii
+      $s2 = "fefefeffefe" ascii
+      $s3 = "feffefeeffe" ascii
+      $s4 = "ffeefeffeefa" ascii
+      $s5 = "ffeeffefeef" ascii
+      $s6 = "ffeeffeeffe" ascii
+      $s7 = "ffefeeffefe" ascii
+      $s8 = "feffefefe" ascii
+      $s9 = "fefefeffea" ascii
+      $s10 = "supercommerce@example.com" fullword wide
+      $s11 = "btnLogin" fullword ascii
+      $s12 = "loginToolStripMenuItem" fullword wide
+      $s13 = "loginToolStripMenuItem_Click" fullword ascii
+      $s14 = "LoginController" fullword ascii
+      $s15 = "Erro: login Mal Sucedido" fullword wide
+      $s16 = "Erro de Login" fullword wide
+      $s17 = "supermercado.Login.resources" fullword ascii
+      $s18 = "get_Cordinations" fullword ascii
+      $s19 = "get_Utgivnings" fullword ascii
+      $s20 = "The Dark Knight" fullword wide
+      $s21 = "get_Both_Shiled_and_Sword_Hero" fullword ascii
+      $s22 = "get_Empty_handed_Hero" fullword ascii
+      $s23 = "LogicValues1" fullword ascii
+      $s24 = "by adguard" fullword wide
+      $s25 = "ErrorImage" wide
+      $s26 = "thedarkknight.jpg" fullword wide
+      $s27 = "terkomst.jpg" fullword wide
+      $s28 = "rymdimperiet.jpg" fullword wide
+      $s29 = "get_Hero_with_shield" fullword ascii
+      $s30 = "get_PowerOfDistraction" fullword ascii
+      $s31 = "operationPressed" fullword ascii
+      $s32 = "get_RadiusOfAttack" fullword ascii
+      $s33 = "get_FilmNamn" fullword ascii
+      $s34 = "operatorClick" fullword ascii
+      $s35 = "get_Hero_with_sword" fullword ascii
+      $s36 = "CustomImageFormat.txt" wide
+      $s37 = "get_BeatsPerSecond" fullword ascii
+      $s38 = "get_BeatPerSecond" fullword ascii
+      $s39 = "DJ Control" fullword wide
+      $s40 = "add_BeatChanged" fullword ascii
+      $s41 = "_presenterModel" fullword ascii
+      $s42 = "set_BeatsPerSecond" fullword ascii
+      $s43 = "HandleBeat" fullword ascii
+      $s44 = "BeatEventArgs" fullword ascii
+      $s45 = ".NET Framework 4.6l" fullword ascii
+      $s46 = ".?AV?$IListEnum@PAVECChildEvent@@@bd@@" fullword ascii
+      $s47 = ".?AV?$_Func_impl_no_alloc@V<lambda_d43bfa6363a0258b5d083dd2b690cdbc>@@_NABUDllProtectEvent@@@std@@" fullword ascii
+      $s48 = ".?AV?$_Func_base@_NABUDllProtectEvent@@@std@@" fullword ascii
+      $s49 = ".?AV?$ListEnum@PAVECChildEvent@@@bd@@" fullword ascii
+      $s50 = ".?AV?$IConstListEnum@PAVECChildEvent@@@bd@@" fullword ascii
+      $s51 = ".?AV?$ConstListEnum@PAVECChildEvent@@@bd@@" fullword ascii
+      $s52 = "labelComp" wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 10000KB and
+      1 of ($x*) and 5 of them
+}
+
+rule General_7 {
+   meta:
+      description = "7"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $s1 = "python3" ascii nocase
+      $s2 = "_:@:P:H:X:D:T:L:\\:B:R:J:Z:F:V:N:^:A:Q:I:Y:E:U:M:]:C:S:K:[:G:W:O:_" fullword ascii
+      $s3 = "KkdgJiVj1" fullword ascii
+      $s4 = "2V1V5V3V7" fullword ascii
+      $s5 = "Cxz.Yfc" fullword ascii
+      $s6 = "'7 7$7\"7&7!7%7#7'" fullword ascii
+      $s7 = "* %\\5?" fullword ascii
+      $s8 = "xezygjy" fullword ascii
+      $s9 = "tgkvdjv" fullword ascii
+      $s10 = "bfDs /nU," fullword ascii
+      $s11 = "zktmxjuxjeh" fullword ascii
+      $s12 = "indljaj" fullword ascii
+      $s13 = "Z t:\"-" fullword ascii
+      $s14 = "o^EX:\"" fullword ascii
+      $s15 = "rjF.tNb" fullword ascii
+      $s16 = "pynput.keyboard._dummy)" fullword ascii
+      $s17 = "pynput.keyboard._darwin)" fullword ascii
+      $s18 = "pynput.keyboard)" fullword ascii
+      $s19 = "pynput.keyboard._uinput)" fullword ascii
+      $s20 = "pynput.keyboard._win32)" fullword ascii
+      $s21 = "pynput.keyboard._xorg)" fullword ascii
+      $s22 = "pynput.keyboard._base)" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 50000KB and
+      10 of them
+}
+
+rule General_8 {
+   meta:
+      description = "8"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $x1 = "TASKKILL /F /IM" wide nocase
+      $x2 = "processhacker" wide nocase
+      $x3 = "cmd.exe /" wide nocase
+      $s1 = "SHELL32.dll" wide nocase
+      $s2 = "mmc.exe" wide nocase
+      $s3 = "Execute ERROR" fullword wide
+      $s4 = "WindowsServiceMode.exe" fullword wide
+      $s5 = "ping 0" wide nocase
+      $s6 = "Microsoft" wide nocase
+      $s7 = "shutdown" wide nocase
+      $s8 = "Download ERROR" fullword wide
+      $s9 = "Executed As " fullword wide
+      $s10 = "winmgmts:\\\\.\\root\\SecurityCenter2" fullword wide
+      $s11 = "ScanProcess" fullword ascii
+      $s12 = "HKEY_CURRENT_USER\\Software\\" wide nocase
+      $s13 = "HKEY_LOCAL_MACHINE\\SOFTWARE\\" wide nocase
+      $s14 = "TerminateProcessPath" ascii nocase
+      $s15 = "svchost.exe" wide nocase
+      $s16 = "wscript.exe" wide nocase
+      $s17 = "Application.exe" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 15000KB and
+      2 of ($x*) and 6 of them
+}
+
+rule General_9 {
+   meta:
+      description = "9"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $s1 = "SignalEventHandler" fullword ascii
+      $s2 = "get_CrossTraffic" fullword ascii
+      $s3 = "get_BeforeIntersection" fullword ascii
+      $s4 = "get_InIntersection" fullword ascii
+      $s5 = "get_CloseToIntersection" fullword ascii
+      $s6 = "TrafficSignal.Settings" fullword ascii
+      $s7 = "TrafficSignal.Strategy" fullword ascii
+      $s8 = "TrafficSignal.Serializers" fullword ascii
+      $s9 = "lblComputerName" fullword wide
+      $s10 = "TrafficSignal.Properties.Resources.resources" fullword ascii
+      $s11 = "TrafficSignal.TrafficSignalForm.resources" fullword ascii
+      $s12 = "TrafficSignal.Properties" fullword ascii
+      $s13 = "TrafficSignal.Properties.Resources" fullword wide
+      $s14 = "get_pmYK" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 5000KB and
+      6 of them
+}
+
+rule General_10 {
+   meta:
+      description = "10"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $x1 = "DQuasar.Common" ascii
+      $x2 = "PublicKeyToken" ascii
+      $s1 = "GetKeyShareHelloRetryRequest" ascii
+      $s2 = "GetKeyShareServerHello" ascii
+      $s3 = "Process already elevated." fullword wide
+      $s4 = "get_PotentiallyVulnerablePasswords" ascii
+      $s5 = "GetKeyloggerLogsDirectory" ascii
+      $s6 = "Gma.System.MouseKeyHook.KeyPressEventArgsExt" ascii
+      $s7 = "GetKeyloggerLogsDirectoryResponse" ascii
+      $s8 = "Quasar.Common.Models.FileChunk" ascii
+      $s12 = "set_PotentiallyVulnerablePasswords" ascii
+      $s13 = "potentiallyVulnerablePasswords" ascii
+      $s16 = "getBytesProcessed" ascii
+      $s17 = "GetPreSharedKeyClientHello" ascii
+      $s18 = "GetKeyShareClientHello" ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 20000KB and
+      ($x1 and $x2) and 6 of them
+}
+
+rule General_11 {
+   meta:
+      description = "11"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $s1 = "/c schtasks /create /f /sc onlogon /rl highest /tn \"" fullword wide
+      $s2 = "get_SendSync" fullword ascii
+      $s3 = "get_SslClient" fullword ascii
+      $s4 = "kpTBNFtPhayeH" fullword ascii
+      $s5 = "get_ActivatePong" fullword ascii
+      $s6 = "Pastebin" fullword wide
+      $s7 = "GetUtf8Bytes" fullword ascii
+      $s8 = "Plugin.Plugin" fullword wide
+      $s9 = "RunAntiAnalysis" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 1000KB and
+      6 of them
+}
+
+rule General_12 {
+   meta:
+      description = "12"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $x1 = "-ExecutionPolicy Bypass" wide
+      $s1 = "shutdown" wide nocase
+      $s2 = "OfflineKeylogger Not Enabled" fullword wide
+      $s3 = "Win32_Processor.deviceid" wide
+      $s4 = "CloseMutex" fullword ascii
+      $s5 = "AES_Encryptor" fullword ascii
+      $s6 = "POST / HTTP/1.1" fullword wide
+      $s7 = "GetHashT" fullword ascii
+      $s8 = "AES_Decryptor" fullword ascii
+      $s9 = "PCLogoff" fullword wide
+      $s10 = "RunShell" fullword wide
+      $s11 = "HostsMSG" fullword wide
+      $s12 = "HostsErr" fullword wide
+      $s13 = "OfflineGet" fullword wide
+      $s14 = "Content-length:" wide
+      $s15 = "Mozilla/5.0" wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 30000KB and
+      1 of ($x*) and 5 of them
+}
+
+rule General_13 {
+   meta:
+      description = "13"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $s1 = "xehook.exe" fullword wide
+      $s2 = "System.Collections.Generic" ascii
+      $s3 = "<xehook.Classes.LogRecord>" ascii
+      $s7 = "Confuser.Core 1.6.0+447341964f" fullword ascii
+      $s8 = "rsqypuz" fullword ascii
+      $s9 = "scyt6m$!k-}qbwu|ud6m#!k-sctbqs6m\"!k-u}q~s`6 -cbud|yv6m!!k-dhu6m !k-~u{" fullword ascii
+      $s10 = "s6m%k-u}q~buce6m$k-cuy{" fullword ascii
+      $s11 = "ETALUME" fullword ascii
+      $s12 = "EYKLLGJCYEHBODMAHOGOCDNCJABEGNCG" fullword ascii
+      $s13 = "JGVIWIWIPUVG" fullword ascii
+      $s14 = "BAAD10E40DF6B5D52A22FCCE498BBD641EBB2377BB7DA4FE04EE26F084647F69" ascii
+      $s15 = "(&'(/- /.,$ $, &  */! .('% ,#$+(" fullword ascii
+      $s16 = "xehook" fullword ascii
+      $s17 = "#+- +e,:'?;;)8" fullword ascii
+      $s18 = "\\DVzVCRz " fullword ascii
+      $s19 = "gv8)  -" fullword ascii
+      $s20 = "[oBxxnhdy[" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 2000KB and
+      6 of them
+}
+
+rule General_14 {
+   meta:
+      description = "14"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $s1 = "jdownloader" wide nocase
+      $s2 = "cmdvrt32.dll" fullword wide
+      $s3 = "accounts.dat" fullword wide
+      $s4 = "SxIn.dll" fullword wide
+      $s5 = "Paltalk NG" wide
+      $s6 = "encrypted" fullword wide
+      $s7 = "ip-api.com" wide
+      $s8 = "mRzIs.exe" fullword wide
+      $s9 = "SmtpPassword" fullword wide
+      $s10 = "FTP Commander" wide
+      $s14 = "privateinternetaccess.com" fullword wide
+      $s15 = "paltalk.com" fullword wide
+      $s16 = "discord.com" fullword wide
+      $s17 = "Sf2.dll" fullword wide
+      $s18 = "account.dyn.com" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 2000KB and
+      8 of them
+}
+
+rule General_15 {
+   meta:
+      description = "15"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $s1 = "aGVpbWdsaWduZGRramdvZmtjYmdla2hlbmJofE94eWdlbgptZ2Zma2ZiaWRpaGpwb2FvbWFqbGJnY2hkZGxpY2dwbnxQYWxpV2FsbGV0CmFvZGtrYWduYWRjYm9iZnBn" wide
+      $s2 = "Could not list processes locking resource." wide
+      $s3 = "Failed to get size of result." wide
+      $s4 = "DownloadAndExecuteUpdate" fullword ascii
+      $s5 = "loginusers.vdf" fullword wide
+      $s7 = "ProcessInfo" wide
+      $s8 = "get_encrypted_key" fullword ascii
+      $s9 = "Tokens.txt" fullword wide
+      $s10 = "DisplayDown" wide
+      $s11 = "VisualPlus-Debug.log" fullword wide
+      $s12 = "Total of RAMExecutablePath" fullword wide
+      $s13 = "loginPairs" fullword ascii
+      $s15 = "Software\\Valve\\SteamLogin Data" fullword wide
+      $s16 = "SELSystem" wide
+      $s17 = "FRSystem" wide
+      $s18 = "WinSystem" wide
+      $s19 = "%localappdata%\\" fullword wide
+      $s20 = "NoEngrdVpEngn.exe*" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 2000KB and
+      8 of them
+}
+
+rule General_16 {
+   meta:
+      description = "16"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $x1 = "LoginForm." ascii
+      $x2 = ".pdb" ascii
+      $s1 = "btnLogin" fullword ascii
+      $s2 = "Wrong ID or Password" fullword wide
+      $s3 = "Log In" wide
+      $s4 = "CodiNauts" wide
+      $s5 = "btnclear" fullword ascii
+      $s6 = "GridFactura.Factura.resources" fullword ascii
+      $s7 = "txtUserID_Validating" fullword ascii
+      $s8 = "TrabajoPractico.GridFactura.resources" fullword ascii
+      $s9 = "txtUserPass" fullword wide
+      $s10 = "txtUserID" fullword wide
+      $s11 = "Please Enter User ID" fullword wide
+      $s12 = "Properties.Resources" ascii
+      $s13 = "Log In Successfully" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 4000KB and
+      ($x1 and $x2) and 6 of them
+}
+
+rule General_17 {
+   meta:
+      description = "17"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $x1 = "select * from user" wide nocase
+      $s1 = "ltromatic.ttf" wide
+      $s2 = "password mismatch issue" fullword wide
+      $s3 = "tada.wav" wide
+      $s4 = "GetAllIncome" fullword ascii
+      $s5 = "getIcomeData" fullword ascii
+      $s6 = "execQueryForStoredProcedure" fullword ascii
+      $s7 = "GetAllIncomeValues" fullword ascii
+      $s8 = "GetTotalIncomeSum" fullword ascii
+      $s9 = "getAllUser" fullword ascii
+      $s10 = "The password must include letters and numbers both" fullword wide
+      $s11 = "Passwords not mathced" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 4000KB and
+      $x1 and 8 of them
+}
+
+rule General_18 {
+   meta:
+      description = "18"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $s1 = "WINDESCRIPTION" fullword wide
+      $s2 = "2#2?2a2{2" fullword ascii
+      $s3 = "CWM_GETCONTROLNAME" fullword wide
+      $s4 = ":%:=:C:L:R:\\:g:" fullword ascii
+      $s5 = ":-:I:T:\\:g:o:{:" fullword ascii
+      $s6 = "C@COM_EVENTOBJ" fullword wide
+      $s7 = "ISTABLE" fullword wide
+      $s8 = "Cstatic" fullword wide
+      $s9 = "HtZHtEHt2" fullword ascii
+      $s10 = "tgHuM95" fullword ascii
+      $s11 = "EEnvironment" fullword wide
+      $s12 = "Invalid characters behind Object assignment!" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 6000KB and
+      6 of them
+}
+
+rule General_19 {
+   meta:
+      description = "19"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $x1 = "step executed succcessfully" wide
+      $x2 = "NurseWorkstationDemo" wide
+      $s1 = "get_ObejctOperation" fullword ascii
+      $s2 = "man.png" wide
+      $s3 = "woman.png" fullword wide
+      $s4 = "get_AUTHORITY_ALL" fullword ascii
+      $s5 = "GetDataTableInfo_CommonGood" fullword ascii
+      $s6 = "from CommonGood where user_name=@user_Name" wide
+      $s7 = "PSYCHOLOGY" fullword ascii
+      $s8 = "GYNECOLOGY" fullword ascii
+      $s9 = "Workstation_Library.Common" fullword ascii
+      $s10 = "get_DataColumn1" fullword ascii
+      $s11 = "get_DataColumn1Column" fullword ascii
+      $s12 = "get_DataTable1" fullword ascii
+      $s13 = "get_Status_R" fullword ascii
+      $s14 = "GetAllBedNum" fullword ascii
+      $s15 = "GetDataTableInfo_PatientName" fullword ascii
+      $s16 = "get_Major_Doctor" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 5000KB and
+      ($x1 and $x2) and 8 of them
+}
+
+rule General_20 {
+   meta:
+      description = "20"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $s1 = "Log_Clientes.txt" wide
+      $s2 = "Log_Produtos.txt" wide
+      $s3 = "Log_Vendas.txt" wide
+      $s4 = "SCV - Sistema de Cadastro e Vendas" fullword wide
+      $s5 = "SCV - Novo Cliente" fullword wide
+      $s6 = "SCV - Lista de Clientes" fullword wide
+      $s7 = "SCV - Lista de Produtos" fullword wide
+      $s8 = "SCV - Listar Vendas" fullword wide
+      $s9 = "SCV - Novo Produto" fullword wide
+      $s10 = "SCV - Nova Venda" fullword wide
+      $s11 = "dgvListaClientes_CellContentClick" fullword ascii
+      $s12 = "Comprador" fullword wide
+      $s13 = "LogProdutos" fullword ascii
+      $s14 = "LogVendas" fullword ascii
+      $s15 = "dgvListaProdutos_CellContentClick" fullword ascii
+      $s16 = "LogClientes" fullword ascii
+      $s17 = "Compras" fullword ascii
+      $s18 = "dgvProdutos_CellContentClick" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 5000KB and
+      8 of them
+}
+
+rule General_21 {
+   meta:
+      description = "21"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $s1 = "xeno rat client" wide
+      $s2 = "Windows Functionality" wide
+      $s3 = "mutex_string" fullword ascii
+      $s4 = "<getdll>5__2" fullword ascii
+      $s5 = "xeno_rat_client" ascii
+      $s6 = "_EncryptionKey" fullword ascii
+      $s7 = "/query /v /fo csv" fullword wide
+      $s8 = "<hasdll>5__3" fullword ascii
+      $s9 = "<tempXmlFile>5__2" fullword ascii
+      $s10 = "GetIdleTimeAsync" ascii
+      $s11 = "<ExecutionTimeLimit>PT0S</ExecutionTimeLimit>" wide
+      $s12 = "L0MgY2hvaWNlIC9DIFkgL04gL0QgWSAvVCAzICYgRGVsICI=" fullword wide
+      $s13 = "<GetAndSendInfo>d__5" fullword ascii
+      $s14 = "<dllname>5__7" fullword ascii
+      $s15 = "_dllhandler" fullword ascii
+      $s16 = "<DllNodeHandler>d__3" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 500KB and
+      8 of them
+}
+
+rule General_22 {
+   meta:
+      description = "22"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $s1 = "Single.exe" fullword wide
+      $s2 = "Single.pdb" fullword ascii
+      $s3 = "Overchills" fullword wide
+      $s4 = "Single.g.resources" fullword ascii
+      $s5 = "dYuVXzkLLVWbcxpNkzwMQNycwFrMShzJDdw" fullword ascii
+      $s6 = "ZtrbobDfRVDVSYJDbiTjJYMtnApmznZIIGm" fullword ascii
+      $s7 = "OmmLUOYnOXYPbQacJiJgtIiOzIZqtuzkkZYgGzISElssPeGNll" fullword wide
+      $s8 = "RuJwfBUCLwnFkjrsmBeNtwwSyNBZKewfylZFqqPiXRqujAEskL" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 2000KB and
+      6 of them
+}
+
+rule General_23 {
+   meta:
+      description = "23"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $s1 = "HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" wide
+      $s2 = "-ItemProperty -Path" wide
+      $s3 = "Kutc64InaW" fullword ascii
+      $s4 = "Cronos-Crypter" fullword wide
+      $s5 = "PrivateImplementationDetails" ascii
+      $s6 = "SetProcessSecurityDescriptor" ascii
+      $s7 = "Systemhost" fullword wide
+      $s8 = "decKey" fullword ascii
+      $s9 = "StartupInformation" fullword ascii
+      $s10 = "InstallRegistry" fullword ascii
+      $s11 = "EEC0C451-6B9A-45A0-A879-90E70D3033F5" ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 500KB and
+      7 of them
+}
+
+rule General_24 {
+   meta:
+      description = "24"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $s1 = "LcD$`Mi" fullword ascii
+      $s2 = "yBZh11AY&SYS" fullword ascii
+      $s3 = "+HcD$DHcL$DH" fullword ascii
+      $s4 = "D$P9D$@}0" fullword ascii
+      $s5 = "tkHcD$8H" fullword ascii
+      $s6 = "BHcD$D" fullword ascii
+      $s7 = "|$(2t%" fullword ascii
+      $s8 = "D$ 9D$(}z" fullword ascii
+      $s9 = "D$ 9D$$}w" fullword ascii
+      $s10 = "|$02t\"" fullword ascii
+      $s11 = "L$P9H$s" fullword ascii
+      $s12 = "L$P9H$|uH" fullword ascii
+      $s13 = "D$89D$(}," fullword ascii
+      $s14 = " `l;Vig" fullword ascii
+      $s15 = "D$@HcL$\\H" fullword ascii
+      $s16 = "L$p9A<r" fullword ascii
+      $s17 = "D$T9D$D}0" fullword ascii
+      $s18 = "L$\\9H8|" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 1000KB and
+      6 of them
+}
+
+rule General_25 {
+   meta:
+      description = "25"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $x1 = "Storm ddos" ascii nocase
+      $s1 = "StormServer.dll" fullword ascii
+      $s2 = "%SystemRoot%\\System32\\" fullword ascii
+      $s3 = "ServiceDLL" fullword ascii
+      $s4 = "SppHostParameterUniqueGraceTimer" fullword wide
+      $s5 = "SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters" fullword ascii
+      $s6 = "x2IewLL49ZGPwaBBKatfGEtAFT9g327lJCkLLIoJXpM=" fullword wide
+      $s7 = "stubpath" fullword ascii
+      $s8 = "pYm2nwOxGc6z7lSognw0yFDwAvT6vw19fUA6AgZO2X4=" fullword wide
+      $s9 = "pcdWYYb9DmAfsyF2r5F3eZ8d90dxwbNrwv3g3w7zeG4=" fullword wide
+      $s10 = "pwsgLvKPxCIWaZdkJ81sXVaE8Ymalx/SRYktvM2Dh2k=" fullword wide
+      $s11 = "oLq+2/XBPbG84P21eK0nQshRCgrb7+zrQ0qm8iOu75M=" fullword wide
+      $s12 = "pBeoAt+o4LduQNgbijEgrAwSFIGNV9An96aBd5EQdAE=" fullword wide
+      $s13 = "cde4d5c7-2f36-dfac-49ee-b4ef7966706a" fullword wide
+      $s14 = "4a69babc-79ff-d8d0-e21f-1ad764610ba5" fullword wide
+      $s15 = "7e746adc-aded-b4e0-f905-958045b82a91" fullword wide
+      $s16 = "c4ddee78-55b7-8e06-319f-e099efa3c9f5" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 300KB and
+      $x1 and 5 of them
+}
+
+rule General_26 {
+   meta:
+      description = "26"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $s1 = "<InitializeComponent>b__22_0" fullword ascii
+      $s2 = "get_JpaO" fullword ascii
+      $s3 = "GetPrevName" fullword ascii
+      $s4 = "GetStepByName" fullword ascii
+      $s5 = "_BindTreeView" fullword ascii
+      $s6 = "get__AllSteps" fullword ascii
+      $s7 = "get__CurrentTreeNode" fullword ascii
+      $s8 = "StepNavigationWizard.Properties" fullword ascii
+      $s9 = "System.Reflection.AssemblyA" fullword ascii
+      $s10 = "StepNavigationWizard.Properties.Resources" fullword wide
+      $s11 = "StepNavigationWizard.StepFormBase.resources" fullword ascii
+      $s12 = "StepNavigationWizard.Home.resources" fullword ascii
+      $s13 = "StepNavigationWizard.Properties.Resources.resources" fullword ascii
+      $s14 = "StepNavigationWizard.Helpers" fullword ascii
+      $s15 = "StepNavigationWizard.StepForms" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 4000KB and
+      8 of them
+}
+
+rule General_27 {
+   meta:
+      description = "27"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $s1 = "TrackerUI.Properties" fullword ascii
+      $s2 = "TrackerUI.Properties.Resources" fullword wide
+      $s3 = "get_TeamCompeting" fullword ascii
+      $s4 = "get_EnteredTeams" fullword ascii
+      $s5 = "get_EntryFee" fullword ascii
+      $s6 = "get_PrizeAmount" fullword ascii
+      $s7 = "get_PrizePercentage" fullword ascii
+      $s8 = "get_MatchupRound" fullword ascii
+      $s9 = "get_ParentMatchup" fullword ascii
+      $s10 = "get_TournamentName" fullword ascii
+      $s11 = "get_PriceNumber" fullword ascii
+      $s14 = "<TeamCompeting>k__BackingField" fullword ascii
+      $s15 = "TrackerUI.TournamentViewerForm.resources" fullword ascii
+      $s17 = "set_TeamCompeting" fullword ascii
+      $s18 = "TrackerUI.Properties.Resources.resources" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 4000KB and
+      6 of them
+}
+
+rule General_28 {
+   meta:
+      description = "28"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $x1 = "schemas.microsoft.com" wide
+      $x2 = "Client Worker Thread" ascii
+      $s1 = "A6BFEA43-501F-456F-A845-983D3AD7B8F0" wide
+      $s2 = "upgrader" wide
+      $s3 = "rtvscan.exe" wide
+      $s4 = "Enable-WindowsOptionalFeature -FeatureName" wide
+      $s5 = "remupd.exe" fullword wide
+      $s6 = "Mcshield.exe" fullword wide
+      $s7 = "mssecess.exe" fullword wide
+      $s8 = "RavMonD.exe" fullword wide
+      $s9 = "KvMonXP.exe" fullword wide
+      $s10 = "baiduSafeTray.exe" fullword wide
+      $s11 = "Qavanijeb.exe" fullword wide
+      $s12 = "%s --> Error: %d, EC: %d" fullword ascii
+      $s13 = "wscript.exe //E:vbscript" wide
+      $s14 = "upgrader_64" wide
+      $s15 = "Process Data Error" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 1000KB and
+      1 of ($x*) and 6 of them
+}
+
+rule General_29 {
+   meta:
+      description = "29"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $s1 = "* qH('" fullword ascii
+      $s2 = "EYeijVu" fullword ascii
+      $s3 = "zSEoS\\` -~" fullword ascii
+      $s4 = "iumsyue" fullword ascii
+      $s5 = "pqwwwww" fullword ascii
+      $s6 = "bengwfvfw" fullword ascii
+      $s7 = "exoowono" fullword ascii
+      $s8 = "Mzs.Cff=" fullword ascii
+      $s9 = "P7sq.FFH" fullword ascii
+      $s10 = "gSh.UKc" fullword ascii
+      $s11 = "uP$O:\"" fullword ascii
+      $s12 = "0skCOM.b" fullword ascii
+      $s13 = "T.^y8i:\"[" fullword ascii
+      $s14 = "oymL@R>%j-" fullword ascii
+      $s15 = "HOFKWMGQU" fullword ascii
+      $s16 = "Ly(loge" fullword ascii
+      $s17 = "diRcS|" fullword ascii
+      $s18 = "\\%G%*;J#_" fullword ascii
+      $s19 = "$x%Dllx" fullword ascii
+      $s20 = "Lunqnuns" fullword ascii
+      $s21 = "- &DNB" fullword ascii
+      $s22 = "tlpyp49" fullword ascii
+      $s23 = "xrarreg.key" fullword ascii
+      $s24 = "xblank.aes" fullword ascii
+      $s25 = "S^%ggvWrvfo%gg" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 18000KB and
+      6 of them
+}
+
+rule General_30 {
+   meta:
+      description = "30"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $s1 = "Robah luj cerizunerGGiwuvayasaye melexeye beculepub holumojore vosuxurikube jenuxafejifamoh=Fub hasobucuwuwu zamojibuw wujenuji " wide
+      $s2 = "paminiwiyisivifo" fullword ascii
+      $s3 = "pipovozulememokutefoseyo" fullword ascii
+      $s4 = "keminivefayosexerukugufebaponif" fullword wide
+      $s5 = "GNNNNNNNNNNNN" ascii
+      $s6 = "Slupido" fullword wide
+      $s7 = "Torchok" fullword wide
+      $s8 = "mukozewiba nirocemerese tukolaraxamefapage" fullword wide
+      $s9 = "renej luwoyisawopab dadabayegutenecisufoba wozonotuwugewiropoxu vogiwipeladoxakanahotucucuwi" fullword wide
+      $s10 = "12.3.3.193" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 2000KB and
+      6 of them
+}
+
+rule General_31 {
+   meta:
+      description = "31"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $s1 = "Form_Data_Transfer" ascii
+      $s2 = "frmGetData" fullword wide
+      $s3 = "get_xveG" fullword ascii
+      $s4 = "ZorgPe0" fullword ascii
+      $s5 = "tBHgbZ6" fullword ascii
+      $s6 = "KsFcPdQ" fullword ascii
+      $s7 = "c3bbecb66bae" ascii
+      $s8 = "Forms_app_looping" fullword ascii
+      $s9 = "get_bHV" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 4000KB and
+      6 of them
+}
+
+rule General_32 {
+   meta:
+      description = "32"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $x1 = "Cryptodome" ascii
+      $s1 = "_ghash_portable.pyd" ascii
+      $s2 = "_ec_ws.pyd" ascii
+      $s3 = "_ed25519.pyd" ascii
+      $s4 = "_ed448.pyd" ascii
+      $s5 = "_x25519.pyd" ascii
+      $s6 = "Hash.CMAC)" ascii
+      $s7 = "Hash.SHA3_512" ascii
+      $s8 = "Hash.SHA1" ascii
+      $s9 = "Protocol.KDF" ascii
+      $s10 = "_SHA512.pyd" ascii
+      $s11 = "SHA3_256" ascii
+      $s12 = "HMAC" ascii
+      $s13 = "_SHA384.pyd" ascii
+      $s14 = "_SHA256.pyd" ascii
+      $s15 = "SHA3_384" ascii
+      $s16 = "_MD2.pyd" ascii
+      $s17 = "SHA512" ascii
+      $s18 = "Util.py3compat" ascii
+      $s19 = "_ghash_clmul.pyd" ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 50000KB and
+      $x1 and 8 of them
+}
+
+rule General_33 {
+   meta:
+      description = "33"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $x1 = "FileBackuper" ascii nocase
+      $s1 = "dev.neptuo.com" wide
+      $s2 = "BackuperConsole" ascii
+      $s3 = "{0:yyyy-MM-dd}" ascii
+      $s4 = "TRACE LoggerFactory config" fullword wide
+      $s5 = "Configuration" wide
+      $s6 = "Logging" ascii
+      $s7 = "Logic" ascii
+      $s8 = "Config.xml" ascii
+      $s9 = "Settings.LogDirPath" fullword wide
+      $s10 = "hadn't been processed, do you want to backup now?" fullword wide
+      $s11 = "get_LogDirPath" fullword ascii
+      $s12 = "Wrong data in LoggerSetup!" fullword wide
+      $s13 = "ConfigurationForm" ascii
+      $s14 = "get_compress" fullword ascii
+      $s15 = "get_VersionsNames" fullword ascii
+      $s16 = "GetUIComponentsValues" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 4000KB and
+      $x1 and 8 of them
+}
+
+rule General_34 {
+   meta:
+      description = "34"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $s1 = "www.zeustech.net" ascii
+      $s2 = "Copyright 1996 Adam Twiss, Zeus Technology Ltd" ascii
+      $s3 = "content-type" ascii nocase
+      $s4 = "Display usage information" ascii nocase
+      $s5 = "Use HEAD instead of GET" ascii nocase
+      $s6 = "File containing data to POST" ascii nocase
+      $s7 = "Use HTTP KeepAlive feature" ascii nocase
+      $s8 = "Don't exit on socket receive errors" ascii nocase
+      $s9 = "Proxyserver and port number to use" ascii nocase
+      $s10 = "Add Arbitrary header line" ascii nocase
+      $s11 = "Output collected data to gnuplot format file" ascii nocase
+      $s12 = "Size of TCP send/receive buffer" ascii nocase
+      $s13 = "Number of multiple requests to make" ascii nocase
+      $s14 = "How much troubleshooting info to print" ascii nocase
+      $s15 = "String to insert as tr attributes" ascii nocase
+      $s16 = "are a colon separated username and password" ascii nocase
+      $s17 = "Do not show percentiles served table" ascii nocase
+   condition:
+      uint16(0) == 0x5a4d and filesize < 500KB and
+      8 of them
+}
+
+rule General_35 {
+   meta:
+      description = "35"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $s1 = "Data Source=" wide
+      $s2 = "Initial Catalog=ECRS" wide
+      $s3 = "ExecutarConsulta" fullword ascii
+      $s4 = "System.Data.MySqlClient" fullword wide
+      $s5 = "Persist Security Info=True" fullword wide
+      $s6 = "get_SysShopStringConnection" fullword ascii
+      $s7 = "get_ShipAddress" fullword ascii
+      $s8 = "ExecutarTransacao" fullword ascii
+      $s9 = "PDF files (*.txt)|*.txt" fullword wide
+      $s10 = "SysShop.BLL" fullword ascii
+      $s11 = "SysShop.DTO" fullword ascii
+      $s12 = "SysShop.DAL" fullword ascii
+      $s13 = "SysShop.BLL.Excecoes" fullword ascii
+      $s14 = "get_ProdutoId" fullword ascii
+      $s15 = "get_ShipCity" fullword ascii
+      $s16 = "Get_Customer_And_Orders" fullword ascii
+      $s17 = "GetTipoProduto" fullword ascii
+      $s18 = "get_SysShopProviderFactory" fullword ascii
+      $s19 = "GetWordLenth" fullword ascii
+      $s20 = "GetDiscountByRule" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 4000KB and
+      6 of them
+}
+
+rule General_36 {
+   meta:
+      description = "36"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $s1 = "btnlimpiar" fullword wide
+      $s2 = "Liquidacion.txt" fullword wide
+      $s3 = "GetColumn2Sum" fullword ascii
+      $s4 = "get_CuotaModerada" fullword ascii
+      $s5 = "get_ListaLiquidaciones" fullword ascii
+      $s6 = "panelprice" fullword wide
+      $s7 = "get_Label15Text" fullword ascii
+      $s8 = "get_Mensaje" fullword ascii
+      $s9 = "get_liquidacion" fullword ascii
+      $s10 = "GetExistingRowIndex" fullword ascii
+      $s11 = "get_SalarioDevengado" fullword ascii
+      $s12 = "get_ValorServicio" fullword ascii
+      $s13 = "Error al Consultar: " fullword wide
+      $s14 = "cmbtipo" fullword wide
+      $s15 = "Kurunegala" fullword wide
+      $s16 = "Trincomalee" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 4000KB and
+      6 of them
+}
+
+rule General_37 {
+   meta:
+      description = "37"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $x1 = "GogMagogIsraelVsPalestine" fullword wide
+      $s1 = "JitInstrumentationDataKeywordResolveFieldHandle" fullword wide
+      $s2 = "getDaylightNameFlowExecutionContext" fullword wide
+      $s3 = "GetRandomizedEqualityComparer" fullword ascii
+      $s4 = "GetEqualityComparerForSerialization" fullword ascii
+      $s5 = "LookForThreadgetIsTypeDefinition" fullword wide
+      $s6 = "SemaphoreGetEnumeratord17" fullword ascii
+      $s7 = "RtlNtStatusToDosErrorRootDirectory" fullword wide
+      $s8 = "TryGetArrayPhi" fullword ascii
+      $s9 = "ResourceEnumeratorgetAsyncWaitHandle" fullword ascii
+      $s10 = "AmsiDll" fullword ascii
+      $s11 = "PopgetNativeDigits" fullword wide
+      $s12 = "RevokeObjectBoundGetObjectParam" fullword wide
+      $s13 = "FinalizeHash32" fullword ascii
+      $s14 = "Properties.Resources.resources" fullword ascii
+      $s15 = "VARFLAGFREADONLYSetCheckSum" fullword ascii
+      $s16 = "TimeSpanFormatConfiguredTaskAwaiter" fullword wide
+      $s17 = "TYPEFLAGFREVERSEBINDDefineEnum" fullword ascii
+      $s18 = "InitBlockUnalignedWaitForFullGCComplete" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 500KB and
+      6 of them
+}
+
+rule General_38 {
+   meta:
+      description = "38"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $s1 = "Stream write error" wide
+      $s2 = "'%s' is not a valid integer value" wide
+      $s3 = "Write$Error creating variant or safe array!" wide
+      $s4 = "Vevalcomp" fullword ascii
+      $s7 = "archiveint" fullword ascii
+      $s8 = "tscreenps" fullword ascii
+      $s9 = "9 :0:<:@:H:L:P:T:X:\\:`:d:h:l:p:t:|:" fullword ascii
+      $s10 = "archive__version_string" fullword ascii
+      $s11 = "No help found for context" wide
+      $s12 = "KeyPreview," fullword ascii
+      $s13 = "TThreadListT" fullword ascii
+      $s14 = ":<:D:H:L:P:T:X:\\:`:d:x:" fullword ascii
+      $s15 = "93:?:L:\\:|:" fullword ascii
+      $s16 = ":4:<:@:D:H:L:P:T:X:\\:l:" fullword ascii
+      $s17 = "BCDFGHJKLMNPQRSTVWXZ" fullword ascii
+      $s18 = "Unable to find a Table of Contents" wide
+      $s19 = "CTDDTEV" fullword ascii
+      $s20 = "_4%i;h" fullword ascii
+      $s21 = "No topic-based help system installed" wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 4000KB and
+      6 of them
+}
+
+rule General_39 {
+   meta:
+      description = "39"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $s1 = "amsimg32.dll" fullword wide
+      $s2 = "70.49.20.77" fullword wide
+      $s3 = "YYYYLLL" fullword ascii
+      $s4 = "666%%%%3|" fullword ascii
+      $s5 = "``%6666%%%%" fullword ascii
+      $s6 = "alezecebesijorabifovihapida" fullword ascii
+      $s7 = "folemajamivujogi" fullword ascii
+      $s8 = "YYYYLL" fullword ascii
+      $s9 = "PLLLLQQQC" fullword ascii
+      $s10 = "juyutopewotucisutolok gokikicenifejoyoxeruzi kibewozaneferigov" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 2000KB and
+      6 of them
+}
+
+rule General_40 {
+   meta:
+      description = "40"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $s1 = "cekuduzupuwuhoxixomagahimuvecigicucesuhayoxoyo" fullword ascii
+      $s2 = " -f$FFFFFFFFFFFFFFFF$v~\"" fullword ascii
+      $s3 = "xzilehipizireyujexazav" fullword wide
+      $s4 = "Slupido" fullword wide
+      $s5 = "Torchok" fullword wide
+      $s6 = "Skkkkkkkkkkkkkkkkk" fullword ascii
+      $s7 = "Wgggggggggguuuuuggggggggg" fullword ascii
+      $s8 = "89.49.84.33" fullword wide
+      $s9 = "B* fn4E3k" fullword ascii
+      $s10 = "\\%|RJJq$OC" fullword ascii
+      $s11 = "jomak" ascii
+      $s12 = "LegalCopyrights" fullword wide
+      $s13 = "vayusupogisoxewememuvapobahekot" ascii
+      $s14 = "yifasupuvuvetaduwa" ascii
+      $s15 = "difocusarijigobuco" ascii
+      $s16 = "remotoxevuketorigosukiduve" ascii
+      $s17 = "durudaxo" wide
+      $s18 = "payuyafelamelokeyir" wide
+      $s19 = "tacadasevow" wide
+      $s20 = "kipazoci" wide
+      $s21 = "kanorowawacasolicalotija" wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 1500KB and
+      8 of them
+}
+
+rule General_41 {
+   meta:
+      description = "41"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $s1 = "cmd /c  mysql.exe -u" fullword wide
+      $s2 = "MSVBVM60.DLL" ascii
+      $s3 = "AxeDB VBTool" wide
+      $s4 = "lblshell" ascii
+      $s5 = "Command9" ascii
+      $s6 = "Command7" ascii
+      $s7 = "Restore.sql" wide
+      $s8 = "Update.sql" wide
+      $s9 = "fk.exe" wide
+      $s10 = "CREATE TABLE `user`" wide
+      $s11 = "www.ja2inn.com" wide
+      $s12 = "Commandb" ascii
+      $s13 = "ntory.vbp" wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 4000KB and
+      6 of them
+}
+
+rule General_42 {
+   meta:
+      description = "42"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $s1 = "Extractor.pdb" fullword ascii
+      $s2 = "Congratulations" fullword ascii
+      $s3 = "Byrnies" fullword wide
+      $s4 = "showString" fullword ascii
+      $s5 = "AScsrhgtr" fullword ascii
+      $s6 = "ZknciocoiAw" fullword ascii
+      $s7 = "Volute Transitions" fullword wide
+      $s8 = "IOasuoihciujo" fullword ascii
+      $s9 = "ParamOnMove" fullword ascii
+      $s10 = "AINsuiciA" fullword ascii
+      $s11 = "AUIsbcoA" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 2000KB and
+      6 of them
+}
+
+rule General_43 {
+   meta:
+      description = "43"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $s1 = "Arbyter Copy Run Started" wide
+      $s2 = "ExecuteUnregisteredTextUpdate" fullword ascii
+      $s3 = "get_UnauthorizedAccesAppology" fullword ascii
+      $s4 = "Arbyter_Log.txt" wide
+      $s6 = "get_IOExceptionAppology" fullword ascii
+      $s7 = "IOExceptionAppology" fullword wide
+      $s8 = "UnauthorizedAccesAppology" fullword wide
+      $s9 = "Appologise" fullword ascii
+      $s10 = "get_GenericAppology_ExceptionMessage" fullword ascii
+      $s11 = "ARBAErrorManager.Resources" fullword wide
+      $s12 = "CopyModifiedContent" fullword ascii
+      $s13 = "GetArbyterClean" fullword ascii
+      $s14 = "DialogFilters" fullword ascii
+      $s15 = "DeleteExtraContent" fullword ascii
+      $s16 = "GetArbyterCopy" fullword ascii
+      $s17 = "ResetDocumentContent" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 2000KB and
+      8 of them
+}
+
+rule General_44 {
+   meta:
+      description = "44"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $s1 = "System.Windows.Forms" ascii
+      $s2 = "PublicKeyToken" fullword wide
+      $s3 = "Forward.png" fullword wide
+      $s4 = "get_GlobalDialog" fullword ascii
+      $s5 = "Unable to save file {0} - {1}" fullword wide
+      $s6 = "{0} - MyPhotos" wide
+      $s7 = "get_HasEdits" fullword ascii
+      $s8 = "Save.png" fullword wide
+      $s9 = "Back.png" fullword wide
+      $s10 = "Notes.png" fullword wide
+      $s11 = "notebook.png" fullword wide
+      $s12 = "boot.png" fullword wide
+      $s13 = "traffic.png" fullword wide
+      $s14 = "gwenview.png" fullword wide
+      $s15 = "open1.png" fullword wide
+      $s16 = "get_AlbumFile" fullword ascii
+      $s17 = "pnlPhoto_DragEnter" fullword ascii
+      $s18 = "get_CurrentPhoto" fullword ascii
+      $s19 = "get_GlobalMdiParent" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 5000KB and
+      8 of them
+}
+
+rule General_45 {
+   meta:
+      description = "45"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $s1 = "myData.json" wide
+      $s2 = "bFLv.exe" fullword wide
+      $s3 = "Water elevation" fullword wide
+      $s4 = "Polder elevation" fullword wide
+      $s5 = "Queens Puzzle  - Deven Dayal" fullword wide
+      $s6 = "getPositionInRow" fullword ascii
+      $s7 = "getSumXY" fullword ascii
+      $s8 = "cmdExport" wide
+      $s9 = "get_TotalSalary" fullword ascii
+      $s10 = "get_PhilHealth" fullword ascii
+      $s11 = "GetTotalDeductions" fullword ascii
+      $s12 = "GetPhilHealth" fullword ascii
+      $s13 = "get_LongPay" fullword ascii
+      $s14 = "get_TotalDeductions" fullword ascii
+      $s15 = "get_HireDate" fullword ascii
+      $s16 = "get_GrossPay" fullword ascii
+      $s17 = "getSquareSum" fullword ascii
+      $s18 = "* utxL" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 4000KB and
+      8 of them
+}
+
+rule General_46 {
+   meta:
+      description = "46"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $x1 = "rating_browser" wide
+      $s1 = "remove_SerialPortStateChangedEvent" fullword ascii
+      $s2 = "samskip" ascii
+      $s3 = "Clients.APIClien" ascii
+      $s4 = "get_Jirakey" fullword ascii
+      $s5 = "jirakey" fullword ascii
+      $s6 = "SerialPortStringSender" ascii
+      $s7 = "SelectedIndexChanged" ascii
+      $s8 = "comPortComboBox" wide
+      $s9 = "setComPort" fullword ascii
+      $s10 = "dataGridViewResult_CellContentClick" fullword ascii
+      $s11 = "MainView.resources" fullword ascii
+      $s12 = "Open Connection" fullword wide
+      $s13 = "initialiseConnection" fullword ascii
+      $s14 = "rating-browser" wide
+      $s15 = "Properties.Resources" ascii
+      $s16 = "MainForm.resources" ascii
+      $s17 = "openConnectionButton_Click" fullword ascii
+      $s18 = "serialPort" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 2000KB and
+      $x1 and 8 of them
+}
+
+rule General_47 {
+   meta:
+      description = "47"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $x1 = "Microsoft.Windows.Common-Controls" ascii
+      $s2 = "sfxelevation" fullword wide
+      $s3 = "ExecuteOnLoad" fullword wide
+      $s4 = "www.sysdevlabs.com" ascii
+      $s5 = "Error in command line:" fullword ascii
+      $s6 = "processorArchitecture" ascii
+      $s7 = "7-Zip.SfxMod" ascii
+      $s8 = "Never.bat" ascii
+      $s9 = "RunProgram=" ascii
+      $s11 = "Alice" ascii
+      $s12 = "Oleg Scherbakov" fullword ascii
+      $s13 = "SfxVarSystemPlatform" fullword wide
+      $s14 = "SfxVarCmdLine1" fullword wide
+      $s15 = "SfxVarCmdLine0" fullword wide
+      $s16 = "The archive is corrupted, or invalid password was entered." fullword ascii
+      $s17 = " \"setup.exe\" " fullword ascii
+      $s18 = "*.sfx.config.*" fullword ascii
+      $s19 = "T:\\HfVdT(l8'" fullword ascii
+      $s20 = ";Heading Longest Desperate " fullword ascii
+      $s21 = "Gardens" ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 3000KB and
+      1 of ($x*) and 5 of them
+}
+
+rule General_48 {
+   meta:
+      description = "48"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $x1 = "passportRadioButton" wide
+      $x2 = "computerGuess" wide
+      $x3 = "get_Data" ascii
+      $s1 = "panelcolors" fullword wide
+      $s2 = "generateRandomComputerGuess" fullword ascii
+      $s3 = "ConfirmArrowAndResults" fullword ascii
+      $s4 = "FlightBookingApp" fullword ascii
+      $s5 = "Properties" fullword ascii
+      $s6 = "i_ComputerGeneratedColors" fullword ascii
+      $s7 = "NumberOfGuessesForm" ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 4000KB and
+      2 of ($x*) and 6 of them
+}
+
+rule General_49 {
+   meta:
+      description = "49"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $x1 = "Microsoft.Windows.Common-Controls" ascii
+      $x2 = "Unable to get" wide
+      $x3 = "avsupport@autoitscript.com" ascii
+      $x4 = "function call" wide
+      $x5 = "Failed to create the" wide
+      $s1 = "#NoAutoIt3Execute" fullword wide
+      $s2 = "WINDESCRIPTION" fullword wide
+      $s3 = "AutoIt" wide
+      $s4 = "AU3_GetPluginDetails" fullword ascii
+      $s5 = "DSeAssignPrimaryTokenPrivilege" fullword wide
+      $s6 = "@COM_EVENTOBJ" fullword wide
+      $s7 = "Failed to create the Event Object." fullword wide
+      $s8 = "WRPQCSV" fullword ascii
+      $s9 = "%s (%d) : ==> %s:" fullword wide
+      $s10 = "PLUGINOPEN" fullword wide
+      $s11 = "PLUGINCLOSE" fullword wide
+      $s12 = "DMUILANG" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 5000KB and
+      3 of ($x*) and 5 of them
+}
+
+rule General_50 {
+   meta:
+      description = "50"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $x1 = "System.Collections.Generic" ascii
+      $s1 = "JsonFx.Serialization.DataName" ascii
+      $s2 = "JsonFx.Model.ModelToken" ascii
+      $s3 = "JsonFx.Serialization.Token" ascii
+      $s4 = "JsonFx.Serialization.Resolvers.MemberMap" ascii
+      $s5 = "KeyValuePair" ascii
+      $s6 = "IEnumerator" ascii
+      $s7 = "Unable to find a suitable constructor for instantiating the target Type" wide
+      $s8 = "1d0d5de7-1c32-4ecd-bde7-6965263fbc6b" wide
+      $s9 = "PublicKeyToken" wide
+      $s10 = "Selected compression algorithm is not supported" wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 10000KB and
+      $x1 and 6 of them
+}
+
+rule General_51 {
+   meta:
+      description = "51"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $x1 = "System.Diagnostics.DiagnosticSource" ascii
+      $x2 = "PublicKeyToken" ascii
+      $s1 = "launcher.exe" fullword wide
+      $s2 = "CleanerNatives.dll" fullword ascii
+      $s3 = "costura" wide
+      $s4 = "MindCleaner.Login.resources" fullword ascii
+      $s5 = "start cmd /C" wide nocase
+      $s6 = "InetCpl.cpl" wide
+      $s7 = "ClearMyTracksByProcess" wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 4000KB and
+      1 of ($x*) and 4 of them
+}
+
+rule General_52 {
+   meta:
+      description = "52"
+      author = "PYAS Security"
+      date = "2024-06-13"
+   strings:
+      $s1 = "avghook" wide
+      $s2 = "tab_url from downloads" fullword ascii
+      $s3 = "cmdvrt64.dll" wide
+      $s4 = "passwords.txt" fullword ascii
+      $s5 = "SELECT target_path" fullword ascii
+      $s6 = "recentservers.xml" ascii
+      $s7 = "[Processes]" fullword ascii
+      $s8 = "steam_tokens.txt" ascii
+      $s9 = "information.txt" ascii
+      $s10 = "UseMasterPassword" ascii
+      $s11 = "Opera GX" ascii
+      $s12 = "Opera Crypto" ascii
+      $s13 = "DRIVE_FIXED" ascii
+      $s14 = "DRIVE_REMOVABLE" ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 2000KB and
+      8 of them
+}
diff --git a/Engine/Pattern/convert.py b/Engine/Pattern/convert.py
new file mode 100644
index 0000000..b7b3b17
--- /dev/null
+++ b/Engine/Pattern/convert.py
@@ -0,0 +1,55 @@
+from PIL import Image
+import numpy, os
+
+####################################################################################################
+
+def preprocess_image(file_data, size, channels=1):
+    width, height = size
+    wah = int(numpy.ceil(numpy.sqrt(len(file_data) / channels)))
+    arr = numpy.frombuffer(file_data, dtype=numpy.uint8)
+    img = numpy.zeros(wah*wah*channels, dtype=numpy.uint8)
+    img[:len(file_data)] = arr
+    image = Image.fromarray(img.reshape((wah, wah)), 'L')
+    return image.resize((width, height), Image.Resampling.NEAREST)
+
+####################################################################################################
+
+def get_type(file_path):
+    suffix = {".com", ".dll", ".drv", ".exe", ".ocx", ".scr", ".sys", ".mui", ".cpl"}
+    try:
+        file_content = None
+        if not os.path.splitext(file_path)[-1].lower() in suffix:
+            return file_content
+        with open(file_path, 'rb') as f:
+            file_content = f.read()
+    except:
+        pass
+    return file_content
+
+####################################################################################################
+
+def file_to_images(input_dir, output_dir):
+    for root, dirs, files in os.walk(input_dir):
+        for file in files:
+            try:
+                file_path = os.path.join(root, file)
+                file_content = get_type(file_path)
+                if file_content:
+                    print(file_path)
+                    relative_path = os.path.relpath(root, input_dir)
+                    output_path_dir = os.path.join(output_dir, relative_path)
+
+                    if not os.path.exists(output_path_dir):
+                        os.makedirs(output_path_dir)
+                    image = preprocess_image(file_content, (224, 224))
+                    safe_name = os.path.basename(file_path).replace('/', '_').replace('\\', '_')
+                    image.save(os.path.join(output_path_dir, f"{safe_name}.png"))
+            except Exception as e:
+                print(e)
+
+####################################################################################################
+
+input_directory = input('Enter the folder path: ')
+output_directory = "./Image_Output"
+file_to_images(input_directory, output_directory)
+input('Conversion Complete')
diff --git a/Engine/Pattern/deduplicate.py b/Engine/Pattern/deduplicate.py
new file mode 100644
index 0000000..78697da
--- /dev/null
+++ b/Engine/Pattern/deduplicate.py
@@ -0,0 +1,34 @@
+import os, hashlib
+
+####################################################################################################
+
+def calc_sha256(path):
+    with open(path, "rb") as f:
+        return hashlib.sha256(f.read()).digest()
+
+def dedup_realtime(root):
+    seen = set()
+    deleted = 0
+    for dirpath, _, files in os.walk(root):
+        for name in files:
+            p = os.path.join(dirpath, name)
+            try:
+                h = calc_sha256(p)
+            except Exception:
+                continue
+            if h in seen:
+                try:
+                    os.remove(p)
+                    print(p)
+                    deleted += 1
+                except Exception:
+                    pass
+            else:
+                seen.add(h)
+    print(f"deleted {deleted}")
+
+####################################################################################################
+
+if __name__ == "__main__":
+    dedup_realtime(input("Input file path: "))
+input('Deduplicate Complete')
diff --git a/Engine/Pattern/train.py b/Engine/Pattern/train.py
new file mode 100644
index 0000000..09f7e20
--- /dev/null
+++ b/Engine/Pattern/train.py
@@ -0,0 +1,163 @@
+import tensorflow as tf
+import os, tf2onnx, numpy, random
+from PIL import Image
+from tensorflow.keras import *
+from collections import Counter
+
+####################################################################################################
+
+Image.MAX_IMAGE_PIXELS = None
+tf.keras.mixed_precision.set_global_policy('mixed_float16')
+
+####################################################################################################
+
+def load_dataset(data_dir, image_size=(224, 224), val_split=0.00001, batch_size=256, color_mode="grayscale"):
+    channels = 1 if color_mode == "grayscale" else 3
+    file_paths, labels, class_indices = get_file_list(data_dir)
+    
+    combined = list(zip(file_paths, labels))
+    random.shuffle(combined)
+    file_paths[:], labels[:] = zip(*combined)
+
+    num_val = int(val_split * len(file_paths))
+    train_files = file_paths[num_val:]
+    train_labels = labels[num_val:]
+    val_files = file_paths[:num_val]
+    val_labels = labels[:num_val]
+    num_classes = len(class_indices)
+
+    train_ds = tf.data.Dataset.from_tensor_slices((train_files, train_labels))
+    train_ds = train_ds.map(lambda f, l: parse_fn(f, l, image_size, channels, num_classes), num_parallel_calls=tf.data.AUTOTUNE)
+    train_ds = train_ds.batch(batch_size).prefetch(tf.data.AUTOTUNE)
+
+    val_ds = tf.data.Dataset.from_tensor_slices((val_files, val_labels))
+    val_ds = val_ds.map(lambda f, l: parse_fn(f, l, image_size, channels, num_classes), num_parallel_calls=tf.data.AUTOTUNE)
+    val_ds = val_ds.batch(batch_size).prefetch(tf.data.AUTOTUNE)
+
+    train_ds.class_indices = class_indices
+    return train_ds, val_ds
+
+####################################################################################################
+
+def parse_fn(filename, label, image_size, channels, num_classes):
+    img = tf.io.read_file(filename)
+    img = tf.image.decode_image(img, channels=channels, expand_animations=False)
+    img = tf.cond(tf.reduce_all(tf.equal(tf.shape(img)[:2], image_size)), lambda: tf.cast(img, tf.float32), lambda: tf.image.resize(img, image_size))
+    img = tf.cast(img, tf.float32) / 255.0
+    label = tf.one_hot(label, depth=num_classes)
+    return img, label
+
+def get_file_list(directory):
+    file_paths, labels, class_indices = [], [], {}
+    for i, cls in enumerate(sorted([d for d in os.listdir(directory) if os.path.isdir(os.path.join(directory, d))])):
+        class_indices[cls] = i
+        cls_dir = os.path.join(directory, cls)
+
+        for root, _, files in os.walk(cls_dir):
+            for file in files:
+                if file.lower().endswith(('.jpg', '.jpeg', '.png', '.bmp', '.gif')):
+                    file_paths.append(os.path.join(root, file))
+                    labels.append(i)
+    return file_paths, labels, class_indices
+
+####################################################################################################
+
+def multi_conv(x, strides):
+    convs = []
+    for k in [(1, 7), (1, 1), (3, 3), (5, 5)]:
+        c = layers.DepthwiseConv2D(kernel_size=k, strides=strides, padding='same', activation='gelu')(x)
+        convs.append(c)
+
+    x = layers.Concatenate()(convs)
+    x = layers.BatchNormalization()(x)
+    return layers.Activation('gelu')(x)
+
+def gated_conv(x, strides):
+    c = layers.DepthwiseConv2D(3, strides=strides, padding='same', activation='gelu')(x)
+    g = layers.DepthwiseConv2D(3, strides=strides, padding='same', activation='sigmoid')(x)
+    return layers.Multiply()([c, g])
+
+def coordinate_attention(x, reduction):
+    input_shape = tf.shape(x)
+    h, w = input_shape[1], input_shape[2]
+    filters = x.shape[-1]
+    mip = max(8, filters // reduction)
+
+    x_h = layers.Lambda(lambda t: tf.reduce_mean(t, axis=2, keepdims=True))(x)
+    x_w = layers.Lambda(lambda t: tf.reduce_mean(t, axis=1, keepdims=True))(x)
+    x_w_t = layers.Permute((2, 1, 3))(x_w)
+
+    x_cat = layers.Concatenate(axis=1)([x_h, x_w_t])
+    x_cat = layers.Conv2D(mip, 1, padding='valid', use_bias=False)(x_cat)
+    x_cat = layers.BatchNormalization()(x_cat)
+    x_cat = layers.Activation('gelu')(x_cat)
+
+    x_cat_h, x_cat_w = layers.Lambda(lambda t: tf.split(t[0], [t[1], t[2]], axis=1))([x_cat, h, w])
+    x_h_sigmoid = layers.Conv2D(filters, 1, padding='valid', activation='sigmoid')(x_cat_h)
+    x_cat_w = layers.Permute((2, 1, 3))(x_cat_w)
+    x_w_sigmoid = layers.Conv2D(filters, 1, padding='valid', activation='sigmoid')(x_cat_w)
+
+    return layers.Multiply()([x, x_h_sigmoid, x_w_sigmoid])
+
+def build_model(input_shape, num_classes):
+    i = layers.Input(shape=input_shape)
+    x = multi_conv(i, strides=1)
+    x = gated_conv(x, strides=2)
+    x = multi_conv(x, strides=2)
+    x = multi_conv(x, strides=2)
+    x = multi_conv(x, strides=2)
+    x = multi_conv(x, strides=2)
+
+    x = coordinate_attention(x, reduction=4)
+    x = layers.GlobalMaxPooling2D()(x)
+
+    x = layers.Dense(x.shape[-1] // 2, activation='gelu', dtype='float32')(x)
+    o = layers.Dense(num_classes, activation='softmax', dtype='float32')(x)
+    return models.Model(i, o)
+
+####################################################################################################
+
+def calculate_lr_cosine_sq(epoch, total_epochs=30, lr_start=5e-4, lr_end=5e-7):
+    cos_val = 0.5 * (1 + numpy.cos(epoch / total_epochs * numpy.pi))
+    return lr_end + (lr_start - lr_end) * (cos_val ** 2)
+
+def lr_scheduler(epoch):
+    return calculate_lr_cosine_sq(epoch)
+
+def categorical_focal_loss(gamma=2.0, alpha=0.25):
+    def focal_loss(y_true, y_pred):
+        y_pred = tf.clip_by_value(y_pred, tf.keras.backend.epsilon(), 1.0 - tf.keras.backend.epsilon())
+        cross_entropy = -y_true * tf.math.log(y_pred)
+        loss = alpha * tf.math.pow(1.0 - y_pred, gamma) * cross_entropy
+        return tf.reduce_sum(loss, axis=-1)
+    return focal_loss
+
+class CustomModelCheckpoint(callbacks.Callback):
+    def on_epoch_end(self, epoch, logs=False):
+        models.save_model(self.model, f"PYAS_Model_Epoch_{epoch + 1}.h5")
+        spec = (tf.TensorSpec((None,) + train_ds.image_shape, tf.float32),)
+        model_proto, _ = tf2onnx.convert.from_keras(self.model, input_signature=spec, opset=17)
+        with open(f"PYAS_Model_Epoch_{epoch + 1}.onnx", "wb") as f:
+            f.write(model_proto.SerializeToString())
+
+####################################################################################################
+
+train_ds, val_ds = load_dataset(r'.\Image_Full_Pefile')
+for imgs, _ in train_ds.take(1):
+    train_ds.image_shape = imgs.shape[1:]
+    break
+
+try:
+    model = models.load_model('PYAS_Model_Epoch_0.h5')
+    print("Load model from disk")
+except:
+    print("Creating a new model")
+    model = build_model(train_ds.image_shape, len(train_ds.class_indices))
+
+print(f"Total parameters: {model.count_params()}")
+model.compile(optimizer='adam', loss=categorical_focal_loss(gamma=2.0, alpha=0.25), 
+    metrics=['accuracy', metrics.Precision(name='precision'), metrics.Recall(name='recall'),
+    metrics.FalsePositives(name='fp'), metrics.TrueNegatives(name='tn')])
+
+model.fit(train_ds, epochs=30, callbacks=[CustomModelCheckpoint(), callbacks.LearningRateScheduler(lr_scheduler)], validation_data=val_ds)
+input('Training Complete')
diff --git a/Engine/Properties/convert.py b/Engine/Properties/convert.py
new file mode 100644
index 0000000..3ef2672
--- /dev/null
+++ b/Engine/Properties/convert.py
@@ -0,0 +1,513 @@
+import os, sys, time, ctypes, sqlite3, datetime, pefile, math
+import numpy as np
+import ctypes.wintypes
+
+####################################################################################################
+
+DB_PATH = "pe_features.db"
+BATCH_SIZE = 100 
+MAX_FILE_SIZE = 256 * 1024 * 1024 
+TARGET_EXTENSIONS = {
+    '.exe', '.dll', '.sys', '.ocx', '.scr', '.efi', '.acm', '.ax', '.cpl', '.drv', '.com'
+}
+
+####################################################################################################
+
+class Features:
+    SCHEMA = [
+        "FileEntropy", "IsExe", "IsDll", "IsDriver", "Is64Bit", "Machine", "Magic",
+        "TimeDateStamp", "CheckSum", "ImageBase", "SizeOfImage", "SizeOfHeaders",
+        "Characteristics", "DllCharacteristics", "Subsystem", "LoaderFlags",
+        "MajorLinkerVersion", "MinorLinkerVersion", "SizeOfCode", 
+        "SizeOfInitializedData", "SizeOfUninitializedData", "AddressOfEntryPoint",
+        "BaseOfCode", "SectionAlignment", "FileAlignment",
+        "MajorOperatingSystemVersion", "MinorOperatingSystemVersion",
+        "MajorImageVersion", "MinorImageVersion",
+        "MajorSubsystemVersion", "MinorSubsystemVersion",
+        "SizeOfStackReserve", "SizeOfStackCommit", "SizeOfHeapReserve", "SizeOfHeapCommit",
+        "NumberOfSections", "NumberOfRvaAndSizes", "PointerToSymbolTable", "NumberOfSymbols",
+        "SizeOfOptionalHeader",
+        
+        "TextSection", "TextSizeRatio", "DataSection", "DataSizeRatio", 
+        "RsrcSection", "RsrcSizeRatio", "SectionCount", "ExecutableSections", 
+        "WritableSections", "ReadableSections", "SectionException",
+        "IconCount", "ApiCount", "ExportCount", "DebugCount", "ExceptionCount",
+        "FileDescriptionLength", "FileVersionLength", "ProductNameLength", 
+        "ProductVersionLength", "CompanyNameLength", "LegalCopyrightLength", 
+        "CommentsLength", "InternalNameLength", "LegalTrademarksLength",
+        "SpecialBuildLength", "PrivateBuildLength",
+        
+        "TrustSigned", "IsDebug", "IsPatched", "IsPrivateBuild", "IsPreRelease", 
+        "IsSpecialBuild", "IsAdmin", "IsInstall", "HasTlsCallbacks", 
+        "HasInvalidTimestamp", "HasRelocationDirectory", "HasPacked", "FileTimeException",
+        
+        "_CorExeMain", "_CorDllMain",
+        
+        "GetDC", "CreateDCW", "CreateDCA", "BitBlt", "StretchBlt", "CreateCompatibleDC",
+        "CreateCompatibleBitmap", "SelectObject", "DeleteDC", "DeleteObject", "GetDeviceCaps",
+        "GetSystemMetrics",
+        
+        "SetWindowsHookExA", "SetWindowsHookExW", "UnhookWindowsHookEx", 
+        "GetAsyncKeyState", "GetKeyState", "GetKeyboardState", 
+        "MapVirtualKeyA", "MapVirtualKeyW", "MapVirtualKeyExA", "MapVirtualKeyExW", 
+        "ToAscii", "ToAsciiEx", "ToUnicode", "ToUnicodeEx", "KeybdEvent", "SendInput",
+        
+        "GetCursorPos", "SetCursorPos", "MouseEvent", "GetDoubleClickTime", 
+        "GetCapture", "SetCapture",
+        
+        "WaveInOpen", "WaveInClose", "WaveInStart", "WaveInStop", 
+        "CapCreateCaptureWindowA", "CapCreateCaptureWindowW", 
+        "OpenClipboard", "CloseClipboard", "GetClipboardData", "SetClipboardData",
+        
+        "GetDesktopWindow", "GetForegroundWindow", "GetWindowDC", "GetWindowRect",
+        "GetClientRect", "PrintWindow", "SetWindowDisplayAffinity", "FindWindowA", "FindWindowW",
+        "EnumWindows", "EnumChildWindows",
+        
+        "Direct3DCreate9", "D3D11CreateDevice", "GdipSaveImageToFile",
+        
+        "CreateProcessA", "CreateProcessW", "CreateThread", "ResumeThread", "SuspendThread",
+        "OpenProcess", "TerminateProcess", "GetCurrentProcess", "GetCurrentProcessId",
+        "ExitProcess", "WinExec", "ShellExecuteA", "ShellExecuteW",
+        
+        "CreateRemoteThread", "QueueUserAPC", "VirtualAlloc", "VirtualAllocEx",
+        "VirtualProtect", "VirtualProtectEx", "WriteProcessMemory", "ReadProcessMemory",
+        "NtUnmapViewOfSection", "SetThreadContext", "GetThreadContext", "Wow64SetThreadContext",
+        "ZwUnmapViewOfSection", "CreateFileMappingA", "CreateFileMappingW", "MapViewOfFile",
+        "UnmapViewOfSection",
+        
+        "LoadLibraryA", "LoadLibraryW", "LoadLibraryExA", "LoadLibraryExW", 
+        "GetProcAddress", "GetModuleHandleA", "GetModuleHandleW", "FreeLibrary",
+        
+        "CreateFileA", "CreateFileW", "WriteFile", "ReadFile", "DeleteFileA", "DeleteFileW",
+        "CopyFileA", "CopyFileW", "MoveFileA", "MoveFileW", "FindFirstFileA", "FindNextFileA",
+        "GetTempPathA", "GetTempPathW", "GetTempFileNameA", "GetTempFileNameW", 
+        "SetFileAttributesA", "SetFileAttributesW", "DeviceIoControl", "SetFileTime",
+        
+        "RegOpenKeyExA", "RegOpenKeyExW", "RegSetValueExA", "RegSetValueExW", 
+        "RegCreateKeyExA", "RegCreateKeyExW", "RegDeleteKeyA", "RegDeleteKeyW",
+        "RegEnumValueA", "RegEnumValueW", "RegQueryValueExA", "RegQueryValueExW",
+        "RegDeleteValueA", "RegDeleteValueW",
+        
+        "OpenSCManagerA", "OpenSCManagerW", "CreateServiceA", "CreateServiceW",
+        "StartServiceA", "StartServiceW", "ControlService", "DeleteService",
+        
+        "AdjustTokenPrivileges", "LookupPrivilegeValueA", "LookupPrivilegeValueW", 
+        "OpenProcessToken", "NetUserAdd", "NetLocalGroupAddMembers",
+        
+        "Socket", "Connect", "Send", "Recv", "WSAStartup", "gethostbyname", "getaddrinfo",
+        "WSAIoctl", "WSASocketA", "WSASocketW",
+        "URLDownloadToFileA", "URLDownloadToFileW", 
+        "InternetOpenA", "InternetOpenW", "InternetConnectA", "InternetConnectW",
+        "InternetOpenUrlA", "InternetOpenUrlW",
+        "HttpOpenRequestA", "HttpOpenRequestW", "HttpSendRequestA", "HttpSendRequestW",
+        "InternetReadFile", "DnsQuery_A", "DnsQuery_W",
+        
+        "IsDebuggerPresent", "CheckRemoteDebuggerPresent", "OutputDebugStringA", "OutputDebugStringW",
+        "GetTickCount", "QueryPerformanceCounter", "Sleep", "GetSystemTimeAsFileTime",
+        "GetLocalTime", "GlobalMemoryStatus", "GetVersionExA", "GetVersionExW",
+        "GetComputerNameA", "GetComputerNameW", "GetUserNameA", "GetUserNameW",
+        
+        "CryptAcquireContextA", "CryptAcquireContextW", "CryptCreateHash", "CryptHashData", 
+        "CryptDeriveKey", "CryptEncrypt", "CryptDecrypt", "CryptDestroyKey", "CryptDestroyHash",
+        "CryptReleaseContext", "CryptGenKey", "CryptImportKey", "CryptExportKey",
+        "RtlDecompressBuffer", "ConnectNamedPipe", "PeekNamedPipe"
+    ]
+    
+    SCHEMA_SET = set(SCHEMA)
+    PACKERS = {
+        'upx', 'aspack', 'asprotect', 'pecompact', 'upack', 'fsg', 'mew', 
+        'mpress', 'ezip', 'pklt', 'shrink', 'petite', 'telock',
+        
+        'themida', 'winlicense', 'tmd', 'vmp', 'enigma', 'obsidium', 
+        'pelock', 'exestealth', 'yoda', 'armadillo', 'zprotect',
+        'sforce', 'starforce', 'qihoo', 'wisevec', 'megastop',
+    }
+    INSTALLER_SIGS = [b"Nullsoft.NSIS", b"Inno Setup", b"7-Zip.7zip", b"InstallShield"]
+
+####################################################################################################
+
+def verify_signature(file_path):
+    if os.name != 'nt':
+        return 0
+    try:
+        wintrust = ctypes.windll.wintrust
+        WINTRUST_ACTION_GENERIC_VERIFY_V2 = ctypes.c_char_p(b'\x6b\xc5\xaa\x00\x44\xcd\xd0\x11\x8c\xc2\x00\xc0\x4f\xc2\x95\xee')
+
+        class WINTRUST_FILE_INFO(ctypes.Structure):
+            _fields_ = [
+                ("cbStruct", ctypes.wintypes.DWORD),
+                ("pcwszFilePath", ctypes.wintypes.LPCWSTR),
+                ("hFile", ctypes.wintypes.HANDLE),
+                ("pgKnownSubject", ctypes.wintypes.LPVOID)
+            ]
+
+        class WINTRUST_DATA(ctypes.Structure):
+            _fields_ = [
+                ("cbStruct", ctypes.wintypes.DWORD),
+                ("pPolicyCallbackData", ctypes.wintypes.LPVOID),
+                ("pSIPClientData", ctypes.wintypes.LPVOID),
+                ("dwUIChoice", ctypes.wintypes.DWORD),
+                ("fdwRevocationChecks", ctypes.wintypes.DWORD),
+                ("dwUnionChoice", ctypes.wintypes.DWORD),
+                ("pFile", ctypes.POINTER(WINTRUST_FILE_INFO)),
+                ("dwStateAction", ctypes.wintypes.DWORD),
+                ("hWVTStateData", ctypes.wintypes.HANDLE),
+                ("pwszURLReference", ctypes.wintypes.LPCWSTR),
+                ("dwProvFlags", ctypes.wintypes.DWORD),
+                ("dwUIContext", ctypes.wintypes.DWORD),
+                ("pSignatureSettings", ctypes.wintypes.LPVOID)
+            ]
+
+        fi = WINTRUST_FILE_INFO(ctypes.sizeof(WINTRUST_FILE_INFO), file_path, None, None)
+        td = WINTRUST_DATA(ctypes.sizeof(WINTRUST_DATA), None, None, 2, 1, 1, ctypes.pointer(fi), 0, None, None, 0x00000080, 0, None)
+        action = ctypes.wintypes.GUID.from_buffer_copy(WINTRUST_ACTION_GENERIC_VERIFY_V2)
+        return 1 if wintrust.WinVerifyTrust(None, ctypes.byref(action), ctypes.byref(td)) == 0 else 0
+    except:
+        return 0
+
+####################################################################################################
+
+def safe_float(val):
+    try:
+        f = float(val)
+        if math.isinf(f) or math.isnan(f):
+            return 0.0
+        return f
+    except:
+        return 0.0
+
+def process_single_file(file_path):
+    def _calc_entropy(data):
+        if not data:
+            return 0.0
+        arr = np.frombuffer(data, dtype=np.uint8)
+        counts = np.bincount(arr, minlength=256)
+        probs = counts[counts > 0] / len(arr)
+        return float(-np.sum(probs * np.log2(probs)))
+
+    def _safe_div(n, d):
+        return n / d if d > 0 else 0.0
+
+    try:
+        fsize = os.path.getsize(file_path)
+        if fsize == 0 or fsize > MAX_FILE_SIZE:
+            return None
+    except:
+        return None
+
+    fts = {k: 0 for k in Features.SCHEMA}
+    pe = None
+    try:
+        pe = pefile.PE(file_path, fast_load=True)
+        
+        fts['TrustSigned'] = verify_signature(file_path)
+
+        fh = pe.FILE_HEADER
+        fts['Machine'] = fh.Machine
+        fts['NumberOfSections'] = fh.NumberOfSections
+        fts['TimeDateStamp'] = fh.TimeDateStamp
+        fts['PointerToSymbolTable'] = fh.PointerToSymbolTable
+        fts['NumberOfSymbols'] = fh.NumberOfSymbols
+        fts['SizeOfOptionalHeader'] = fh.SizeOfOptionalHeader
+        fts['Characteristics'] = fh.Characteristics
+
+        curr_ts = datetime.datetime.utcnow().timestamp()
+        fts['HasInvalidTimestamp'] = 1 if (fh.TimeDateStamp < 631152000 or fh.TimeDateStamp > curr_ts + 2592000) else 0
+
+        if hasattr(pe, 'OPTIONAL_HEADER'):
+            op = pe.OPTIONAL_HEADER
+            fts['Magic'] = op.Magic
+            fts['MajorLinkerVersion'] = op.MajorLinkerVersion
+            fts['MinorLinkerVersion'] = op.MinorLinkerVersion
+            fts['SizeOfCode'] = op.SizeOfCode
+            fts['SizeOfInitializedData'] = op.SizeOfInitializedData
+            fts['SizeOfUninitializedData'] = op.SizeOfUninitializedData
+            fts['AddressOfEntryPoint'] = op.AddressOfEntryPoint
+            fts['BaseOfCode'] = op.BaseOfCode
+            fts['ImageBase'] = op.ImageBase
+            fts['SectionAlignment'] = op.SectionAlignment
+            fts['FileAlignment'] = op.FileAlignment
+            fts['MajorOperatingSystemVersion'] = op.MajorOperatingSystemVersion
+            fts['MinorOperatingSystemVersion'] = op.MinorOperatingSystemVersion
+            fts['MajorImageVersion'] = op.MajorImageVersion
+            fts['MinorImageVersion'] = op.MinorImageVersion
+            fts['MajorSubsystemVersion'] = op.MajorSubsystemVersion
+            fts['MinorSubsystemVersion'] = op.MinorSubsystemVersion
+            fts['SizeOfImage'] = op.SizeOfImage
+            fts['SizeOfHeaders'] = op.SizeOfHeaders
+            fts['CheckSum'] = op.CheckSum
+            fts['Subsystem'] = op.Subsystem
+            fts['DllCharacteristics'] = op.DllCharacteristics
+            fts['SizeOfStackReserve'] = op.SizeOfStackReserve
+            fts['SizeOfStackCommit'] = op.SizeOfStackCommit
+            fts['SizeOfHeapReserve'] = op.SizeOfHeapReserve
+            fts['SizeOfHeapCommit'] = op.SizeOfHeapCommit
+            fts['LoaderFlags'] = op.LoaderFlags
+            fts['NumberOfRvaAndSizes'] = op.NumberOfRvaAndSizes
+
+            fts['Is64Bit'] = 1 if fh.Machine == 0x8664 else 0
+            fts['IsExe'] = 1 if pe.is_exe() else 0
+            fts['IsDll'] = 1 if pe.is_dll() else 0
+            fts['IsDriver'] = 1 if pe.is_driver() else 0
+
+            if len(op.DATA_DIRECTORY) > 9 and op.DATA_DIRECTORY[9].VirtualAddress > 0:
+                fts['HasTlsCallbacks'] = 1
+            if len(op.DATA_DIRECTORY) > 5 and op.DATA_DIRECTORY[5].Size > 0:
+                fts['HasRelocationDirectory'] = 1
+
+        pe.parse_sections(pe.FILE_HEADER.NumberOfSections)
+        
+        file_data = pe.get_memory_mapped_image()
+        fts['FileEntropy'] = _calc_entropy(file_data)
+
+        fts['SectionCount'] = len(pe.sections)
+        for section in pe.sections:
+            try:
+                name = section.Name.decode('ascii', 'ignore').strip('\x00')
+            except:
+                name = ""
+            s_data = section.get_data()
+            s_entropy = _calc_entropy(s_data)
+
+            if any(p in name.lower() for p in Features.PACKERS):
+                fts['HasPacked'] = 1
+            if section.Characteristics & 0x20000000:
+                fts['ExecutableSections'] += 1
+            if section.Characteristics & 0x80000000:
+                fts['WritableSections'] += 1
+            if section.Characteristics & 0x40000000:
+                fts['ReadableSections'] += 1
+            if section.SizeOfRawData + section.PointerToRawData > fsize:
+                fts['SectionException'] = 1
+
+            ratio = _safe_div(section.SizeOfRawData, fsize)
+            if name.startswith('.text'):
+                fts['TextSection'] = s_entropy
+                fts['TextSizeRatio'] = ratio
+            elif name.startswith('.data'):
+                fts['DataSection'] = s_entropy
+                fts['DataSizeRatio'] = ratio
+            elif name.startswith('.rsrc'):
+                fts['RsrcSection'] = s_entropy
+                fts['RsrcSizeRatio'] = ratio
+                if b"requireAdministrator" in s_data:
+                    fts['IsAdmin'] = 1
+
+                for sig in Features.INSTALLER_SIGS:
+                    if sig in s_data:
+                        fts['IsInstall'] = 1
+                        break
+
+        pe.parse_data_directories(directories=[
+            pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_IMPORT'],
+            pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_EXPORT'],
+            pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_RESOURCE'],
+            pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_DEBUG']
+        ])
+
+        if hasattr(pe, 'DIRECTORY_ENTRY_IMPORT'):
+            for entry in pe.DIRECTORY_ENTRY_IMPORT:
+                for imp in entry.imports:
+                    fts['ApiCount'] += 1
+                    if not imp or not hasattr(imp, 'name') or not imp.name:
+                        continue
+                    try:
+                        name = imp.name.decode('ascii', 'ignore')
+                        if name in Features.SCHEMA_SET:
+                            fts[name] = 1
+                    except:
+                        pass
+
+        if hasattr(pe, 'DIRECTORY_ENTRY_EXPORT'):
+            fts['ExportCount'] = len(pe.DIRECTORY_ENTRY_EXPORT.symbols)
+        
+        if hasattr(pe, 'DIRECTORY_ENTRY_RESOURCE'):
+            for entry in pe.DIRECTORY_ENTRY_RESOURCE.entries:
+                if entry.id == 3 and hasattr(entry, 'directory'):
+                    fts['IconCount'] = len(entry.directory.entries)
+                    break
+        
+        if hasattr(pe, 'DIRECTORY_ENTRY_DEBUG'):
+            fts['DebugCount'] = len(pe.DIRECTORY_ENTRY_DEBUG)
+
+        for k in fts:
+            fts[k] = safe_float(fts[k])
+
+        return fts
+
+    except Exception:
+        return None
+    finally:
+        if pe:
+            pe.close()
+
+####################################################################################################
+
+def init_db():
+    conn = sqlite3.connect(DB_PATH)
+    conn.execute("PRAGMA synchronous = OFF")
+    conn.execute("PRAGMA journal_mode = WAL")
+    conn.execute("PRAGMA cache_size = 10000")
+    cols = ", ".join([f"{c} REAL" for c in Features.SCHEMA])
+    conn.execute(f"CREATE TABLE IF NOT EXISTS PeData ({cols}, Label INTEGER)")
+    conn.commit()
+    return conn
+
+def prune_db_duplicates(conn):
+    try:
+        print("\n[*] Post-processing: Checking for and removing duplicate entries...")
+        all_cols = ", ".join(Features.SCHEMA + ["Label"])
+        
+        sql_count_before = "SELECT COUNT(*) FROM PeData"
+        before = conn.execute(sql_count_before).fetchone()[0]
+        
+        sql_dedup = f"""
+            DELETE FROM PeData 
+            WHERE rowid NOT IN (
+                SELECT MIN(rowid) 
+                FROM PeData 
+                GROUP BY {all_cols}
+            )
+        """
+        conn.execute(sql_dedup)
+        conn.commit()
+        
+        after = conn.execute(sql_count_before).fetchone()[0]
+        removed = before - after
+        
+        if removed > 0:
+            print(f"[+] Deduplication complete. Removed {removed} duplicate rows.")
+            print("    (Duplicates occur if the same file is scanned multiple times)")
+        else:
+            print("[+] Deduplication complete. No duplicates found.")
+            
+    except Exception as e:
+        print(f"[-] Deduplication Warning: {e}")
+
+####################################################################################################
+
+def scan_and_save(conn, path, label):
+    print(f"\n[*] Scanning: {path} (Label={label})")
+    print(f"[*] Config: Max File Size = {MAX_FILE_SIZE/1024/1024:.0f} MB")
+    
+    files = []
+    print("[*] Walking directory tree...")
+    if os.path.isfile(path): 
+        files.append(path)
+    else:
+        for r, _, fs in os.walk(path):
+            for f in fs:
+                if os.path.splitext(f)[1].lower() in TARGET_EXTENSIONS:
+                    files.append(os.path.join(r, f))
+    
+    total = len(files)
+    if total == 0:
+        print("[-] No valid PE files found in this path.")
+        return
+
+    print(f"[*] Found {total} files. Processing...")
+    
+    batch = []
+    count = 0
+    errors = 0
+    start_time = time.time()
+    
+    placeholders = ",".join(["?"] * (len(Features.SCHEMA) + 1))
+    sql = f"INSERT INTO PeData VALUES ({placeholders})"
+    
+    try:
+        for i, file_path in enumerate(files):
+            res = process_single_file(file_path)
+            
+            if res:
+                vals = [res.get(c, 0.0) for c in Features.SCHEMA]
+                vals.append(float(label))
+                batch.append(tuple(vals))
+                count += 1
+            else:
+                errors += 1
+            
+            if len(batch) >= BATCH_SIZE:
+                try:
+                    conn.executemany(sql, batch)
+                    conn.commit()
+                    batch = []
+                except Exception as batch_err:
+                    print(f"\n[-] Batch Error: {batch_err}. Retrying strictly...")
+                    for row in batch:
+                        try:
+                            conn.execute(sql, row)
+                        except Exception:
+                            errors += 1
+                            count -= 1 
+                    conn.commit()
+                    batch = []
+            
+            elapsed = time.time() - start_time
+            rate = (i + 1) / elapsed if elapsed > 0 else 0
+            sys.stdout.write(f"\r[{i+1}/{total}] OK: {count} | Skip/Err: {errors} | {rate:.1f} files/s")
+            sys.stdout.flush()
+
+    except KeyboardInterrupt:
+        print("\n\n[-] Interrupted by user.")
+    except Exception as e:
+        print(f"\n[-] Unexpected Error: {e}")
+    finally:
+        if batch:
+            print(f"\n[*] Saving remaining {len(batch)} items...")
+            try:
+                conn.executemany(sql, batch)
+                conn.commit()
+            except Exception as final_err:
+                print(f"[-] Final Batch Error: {final_err}. Retrying strictly...")
+                for row in batch:
+                    try:
+                        conn.execute(sql, row)
+                    except Exception:
+                        pass
+                conn.commit()
+        
+        print(f"\n[+] Scan finished/stopped. Total added: {count}")
+        prune_db_duplicates(conn)
+
+####################################################################################################
+
+if __name__ == "__main__":
+    print("\n---------------- PE Dataset Builder v2.6 ----------------\n")
+    print("Type 'exit' or 'q' at any prompt to quit.")
+    
+    if os.path.exists(DB_PATH):
+        print(f"[-] Note: If SCHEMA changed, please delete {DB_PATH} before running.")
+
+    conn = init_db()
+    try:
+        while True:
+            print("\n---------------------------------------------------------\n")
+            raw_path = input("[*] Enter Path (File or Folder): ").strip()
+            target_path = raw_path.strip('"').strip("'")
+
+            if target_path.lower() in ['exit', 'q']:
+                break
+
+            if not target_path or not os.path.exists(target_path):
+                print("[-] Invalid path. Please try again.")
+                continue
+
+            while True:
+                label_input = input("[*] Enter Label (0=Safe, 1=Malware): ").strip()
+                if label_input.lower() in ['exit', 'q']:
+                    conn.close()
+                    sys.exit()
+
+                if label_input in ['0', '1']:
+                    label = int(label_input)
+                    break
+                else:
+                    print("[-] Please enter 0 or 1.")
+
+            scan_and_save(conn, target_path, label)
+    except KeyboardInterrupt:
+        print("\n\n[-] Interrupted.")
+    finally:
+        conn.close()
+        print(f"\n[+] Database saved to: {os.path.abspath(DB_PATH)}")
diff --git a/Engine/Properties/train.py b/Engine/Properties/train.py
new file mode 100644
index 0000000..5c24e93
--- /dev/null
+++ b/Engine/Properties/train.py
@@ -0,0 +1,195 @@
+import os, sys, time, sqlite3, re, json
+import pandas as pd
+import numpy as np
+import lightgbm as lgb
+import onnxmltools
+from onnxmltools.convert.common.data_types import FloatTensorType
+from sklearn.model_selection import train_test_split
+from sklearn.metrics import classification_report, accuracy_score, roc_auc_score
+
+####################################################################################################
+
+DB_PATH = "pe_features.db"
+MODEL_FILE = "pe_malware_lgbm.txt"
+ONNX_FILE = "pe_malware.onnx"
+FEATURE_FILE = "features.json"
+TEST_SIZE = 0.0001
+RANDOM_SEED = 42
+
+LGBM_PARAMS = {
+    'objective': 'binary',
+    'metric': ['binary_logloss', 'auc'],
+    'boosting_type': 'gbdt',
+    'num_leaves': 63,
+    'learning_rate': 0.05,
+    'feature_fraction': 0.8,
+    'bagging_fraction': 0.8,
+    'bagging_freq': 5,
+    'verbose': -1,
+    'seed': RANDOM_SEED,
+    'n_jobs': -1,
+    'max_depth': -1,
+    'min_data_in_leaf': 20,
+    'lambda_l1': 0.1,
+    'lambda_l2': 0.1
+}
+
+####################################################################################################
+
+def get_raw_schema(db_path):
+    if not os.path.exists(db_path):
+        return None
+    conn = sqlite3.connect(db_path)
+    try:
+        cursor = conn.cursor()
+        cursor.execute("PRAGMA table_info(PeData)")
+        columns = [row[1] for row in cursor.fetchall()]
+        exclude_lower = {'label', 'id', 'filename', 'filelength', 'rowid', 'probability', 'predictedlabel', 'score'}
+        return [c for c in columns if c.lower().strip() not in exclude_lower]
+    except:
+        return None
+    finally:
+        conn.close()
+
+def load_and_clean_data(db_path, raw_cols):
+    print(f"[*] Connecting to database: {db_path}")
+    conn = sqlite3.connect(db_path)
+    req_cols = list(set(raw_cols + ['Label']))
+    sql = f"SELECT {', '.join(req_cols)} FROM PeData"
+    
+    try:
+        df = pd.read_sql_query(sql, conn)
+        if df.empty: return None, None, None
+
+        label_col = next((c for c in df.columns if c.lower().strip() == 'label'), None)
+        if not label_col:
+            print("[-] Critical Error: Label column not found.")
+            return None, None, None
+
+        y = df[label_col].astype(int)
+        X = df.drop(columns=[label_col], errors='ignore')
+        
+        valid_features = [c for c in raw_cols if c in X.columns]
+        X = X[valid_features].copy()
+        
+        X = X.rename(columns=lambda x: re.sub('[^A-Za-z0-9_]+', '', x))
+        
+        if X.isnull().values.any():
+            X = X.fillna(X.median(numeric_only=True))
+
+        final_features = X.columns.tolist()
+        return X, y, final_features
+    finally:
+        conn.close()
+
+####################################################################################################
+
+def train_process(X, y):
+    print(f"[*] Dataset shape: {X.shape}")
+    
+    X_train, X_test, y_train, y_test = train_test_split(
+        X, y, test_size=TEST_SIZE, random_state=RANDOM_SEED, stratify=y
+    )
+    
+    n_pos = (y_train == 1).sum()
+    n_neg = (y_train == 0).sum()
+    
+    base_weight = n_neg / n_pos if n_pos > 0 else 1.0
+    
+    weight_ratio_base = 1.0
+    weight_ratio_target = 0.1
+    final_pos_weight = base_weight * (weight_ratio_target / weight_ratio_base)
+    
+    print(f"[*] Balance Report: Safe={n_neg}, Malware={n_pos}")
+    print(f"[*] Weight Config: Base Balanced={base_weight:.4f}, Final Adjusted (Favor Safe)={final_pos_weight:.4f}")
+    
+    train_data = lgb.Dataset(X_train, label=y_train)
+    valid_data = lgb.Dataset(X_test, label=y_test, reference=train_data)
+    
+    params = LGBM_PARAMS.copy()
+    params['scale_pos_weight'] = final_pos_weight
+
+    print("\n[*] Starting LightGBM training (Full Force, No Early Stopping)...")
+    start_time = time.time()
+    
+    model = lgb.train(
+        params,
+        train_data,
+        valid_sets=[valid_data],
+        num_boost_round=1000,
+        callbacks=[
+            lgb.log_evaluation(period=100)
+        ]
+    )
+    
+    elapsed = time.time() - start_time
+    print(f"\n[+] Training finished in {elapsed:.2f}s")
+    
+    return model, X_test, y_test
+
+def export_onnx_model(model, feature_names):
+    print(f"[*] Exporting ONNX model to {ONNX_FILE}...")
+    try:
+        initial_type = [('float_input', FloatTensorType([None, len(feature_names)]))]
+        onnx_model = onnxmltools.convert_lightgbm(model, initial_types=initial_type)
+        onnxmltools.utils.save_model(onnx_model, ONNX_FILE)
+        
+        with open(FEATURE_FILE, 'w') as f:
+            json.dump(feature_names, f)
+            
+        print(f"[+] ONNX export success. Features synced to {FEATURE_FILE}")
+    except Exception as e:
+        print(f"[-] ONNX export failed: {e}")
+
+def evaluate_and_save(model, X_test, y_test):
+    print("\n------------------- Evaluation Report -------------------\n")
+    y_prob = model.predict(X_test, num_iteration=model.best_iteration)
+    y_pred = (y_prob > 0.5).astype(int)
+    
+    acc = accuracy_score(y_test, y_pred)
+    auc = roc_auc_score(y_test, y_prob)
+    
+    print(f"Accuracy : {acc:.4f}")
+    print(f"ROC AUC  : {auc:.4f}")
+    print("\n" + classification_report(y_test, y_pred, zero_division=0))
+
+    print("---------------------------------------------------------\n")
+    print("[*] Top 20 Features (Importance by Gain):")
+    
+    feature_names = model.feature_name()
+    importance = model.feature_importance(importance_type='gain')
+    feature_imp = pd.DataFrame(sorted(zip(importance, feature_names), reverse=True), columns=['Value', 'Feature'])
+    print(feature_imp.head(20).to_string(index=False))
+    
+    print("\n---------------------------------------------------------\n")
+    
+    model.save_model(MODEL_FILE)
+    print(f"[+] Native model saved to: {os.path.abspath(MODEL_FILE)}")
+    
+    export_onnx_model(model, feature_names)
+
+####################################################################################################
+
+if __name__ == "__main__":
+    print("\n---------------- PE Malware Trainer v3.0 ----------------\n")
+
+    if not os.path.exists(DB_PATH):
+        print(f"[-] Error: Database {DB_PATH} not found.")
+        sys.exit(1)
+
+    raw_schema = get_raw_schema(DB_PATH)
+    if not raw_schema:
+        print("[-] Error: Could not read schema.")
+        sys.exit(1)
+
+    X, y, _ = load_and_clean_data(DB_PATH, raw_schema)
+    if X is None:
+        sys.exit(1)
+
+    try:
+        model, X_test, y_test = train_process(X, y)
+        evaluate_and_save(model, X_test, y_test)
+    except KeyboardInterrupt:
+        print("\n\n[-] Training interrupted.")
+    except Exception as e:
+        print(f"\n[-] Critical Error: {e}")