rule TAXHAUL {
	meta:
		author = "Mandiant"
		created = "04/03/2023"
		modified = "04/03/2023"
		version = "1.0"
	strings:
		$p00_0 = { 41 0F 45 FE 4C 8D 3D [4] EB ?? 45 33 F6 4C 8D 3D [4] EB ?? 45 33 F6 4C 8D 3D [4] EB }
		$p00_1 = { 4D 39 26 48 8B 01 40 0F 94 C6 FF 90 [4] 41 B9 [4] EB ?? 8B DE 48 85 C0 74 }
	condition:
		uint16(0) == 0x5A4D and any of them
}