aolipsniffer

rule aolipsniffer {
   meta:
      description = "Auto-generated rule on file aolipsniffer.exe"
      author = "yarGen Yara Rule Generator by Florian Roth"
      hash = "51565754ea43d2d57b712d9f0a3e62b8"
      id = "f7cc0f31-6ba4-504b-82de-0334257b8a95"
   strings:
      $s0 = "C:\\Program Files\\Microsoft Visual Studio\\VB98\\VB6.OLB"
      $s1 = "dwGetAddressForObject"
      $s2 = "Color Transfer Settings"
      $s3 = "FX Global Lighting Angle"
      $s4 = "Version compatibility info"
      $s5 = "New Windows Thumbnail"
      $s6 = "Layer ID Generator Base"
      $s7 = "Color Halftone Settings"
      $s8 = "C:\\WINDOWS\\SYSTEM\\MSWINSCK.oca"
   condition:
      all of them
}