diff --git a/kiwi_passwords.yar b/kiwi_passwords.yar index 3a3548a..7946e66 100644 --- a/kiwi_passwords.yar +++ b/kiwi_passwords.yar @@ -100,5 +100,5 @@ rule power_pe_injection $str_loadlib = "0x53, 0x48, 0x89, 0xe3, 0x48, 0x83, 0xec, 0x20, 0x66, 0x83, 0xe4, 0xc0, 0x48, 0xb9" condition: - $str_loadlib or $hex_loadlib + $str_loadlib } \ No newline at end of file