rule pico {
        strings:
                $a = "llenge" wide ascii
                $b = "LookupPriv" wide ascii
                $c = "IsDebuggerP" wide ascii
                $d = {4D 5A 90 00}
                $e = "Startup" wide ascii
        condition:
                $a and $b and $c and $d and $e
}
