import "hash"

rule bulwark_https_bulwarkblack_com_offerloader_ppi_commodity_malware_funnel_aware_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/offerloader-ppi-commodity-malware-funnel-aware-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-09-09T15:08:01Z"
        tlp = "TLP:CLEAR"
        indicator_count = "332"
    strings:
        $s0 = "5.xxx.xx.xxx" ascii wide nocase  // Domains
        $s1 = "aa.amazingshield.xyz" ascii wide nocase  // Domains
        $s2 = "achievershelf.space" ascii wide nocase  // Domains
        $s3 = "activitymeal.space" ascii wide nocase  // Domains
        $s4 = "additionplot.cfd" ascii wide nocase  // Domains
        $s5 = "adex-blog.blogspot.com" ascii wide nocase  // Domains
        $s6 = "adviceturn.xyz" ascii wide nocase  // Domains
        $s7 = "afternoonscrew.space" ascii wide nocase  // Domains
        $s8 = "agreementjuice.space" ascii wide nocase  // Domains
        $s9 = "airplaneiron.xyz" ascii wide nocase  // Domains
        $s10 = "airtwig.xyz" ascii wide nocase  // Domains
        $s11 = "amazingshield.xyz" ascii wide nocase  // Domains
        $s12 = "amountfuel.icu" ascii wide nocase  // Domains
        $s13 = "animalrecord.xyz" ascii wide nocase  // Domains
        $s14 = "animalview.xyz" ascii wide nocase  // Domains
        $s15 = "apparatustruck.xyz" ascii wide nocase  // Domains
        $s16 = "apparelplate.space" ascii wide nocase  // Domains
        $s17 = "archairport.xyz" ascii wide nocase  // Domains
        $s18 = "atthelake.info" ascii wide nocase  // Domains
        $s19 = "authoritykittens.info" ascii wide nocase  // Domains
        $s20 = "babyvein.xyz" ascii wide nocase  // Domains
        $s21 = "badgewing.xyz" ascii wide nocase  // Domains
        $s22 = "bagcare.space" ascii wide nocase  // Domains
        $s23 = "basesfile.com" ascii wide nocase  // Domains
        $s24 = "basinpleasure.xyz" ascii wide nocase  // Domains
        $s25 = "basketballyear.xyz" ascii wide nocase  // Domains
        $s26 = "baskethumor.xyz" ascii wide nocase  // Domains
        $s27 = "bedroomdesire.xyz" ascii wide nocase  // Domains
        $s28 = "beliefpicture.xyz" ascii wide nocase  // Domains
        $s29 = "bellplayground.xyz" ascii wide nocase  // Domains
        $s30 = "bikesdonkey.info" ascii wide nocase  // Domains
        $s31 = "birthdaymagic.xyz" ascii wide nocase  // Domains
        $s32 = "boardmagic.info" ascii wide nocase  // Domains
        $s33 = "boatthought.xyz" ascii wide nocase  // Domains
        $s34 = "boundarychickens.xyz" ascii wide nocase  // Domains
        $s35 = "boytank.xyz" ascii wide nocase  // Domains
        $s36 = "branchmorning.xyz" ascii wide nocase  // Domains
        $s37 = "breathdoctor.xyz" ascii wide nocase  // Domains
        $s38 = "bubbleslip.xyz" ascii wide nocase  // Domains
        $s39 = "cabbagemeasure.xyz" ascii wide nocase  // Domains
        $s40 = "cablecanvas.xyz" ascii wide nocase  // Domains
        $s41 = "cardgrape.xyz" ascii wide nocase  // Domains
        $s42 = "cattlegold.xyz" ascii wide nocase  // Domains
        $s43 = "celeryerror.xyz" ascii wide nocase  // Domains
        $s44 = "centscarf.xyz" ascii wide nocase  // Domains
        $s45 = "chalkprose.xyz" ascii wide nocase  // Domains
        $s46 = "chawton.info" ascii wide nocase  // Domains
        $s47 = "cherriestruck.space" ascii wide nocase  // Domains
        $s48 = "chesstail.xyz" ascii wide nocase  // Domains
        $s49 = "chickensmine.space" ascii wide nocase  // Domains
        $s50 = "churchpail.xyz" ascii wide nocase  // Domains
        $s51 = "clothcrib.xyz" ascii wide nocase  // Domains
        $s52 = "clothcurrent.xyz" ascii wide nocase  // Domains
        $s53 = "coatberry.xyz" ascii wide nocase  // Domains
        $s54 = "collartitle.info" ascii wide nocase  // Domains
        $s55 = "connect.activitykitty.xyz" ascii wide nocase  // Domains
        $s56 = "connect.apparatustaste.xyz" ascii wide nocase  // Domains
        $s57 = "connect.armcard.xyz" ascii wide nocase  // Domains
        $s58 = "connect.badgeterritory.xyz" ascii wide nocase  // Domains
        $s59 = "connect.baitmetal.xyz" ascii wide nocase  // Domains
        $s60 = "connect.beefteeth.xyz" ascii wide nocase  // Domains
        $s61 = "connect.believesisters.xyz" ascii wide nocase  // Domains
        $s62 = "connect.boundaryfly.xyz" ascii wide nocase  // Domains
        $s63 = "connect.bubbleappliance.xyz" ascii wide nocase  // Domains
        $s64 = "connect.cableland.xyz" ascii wide nocase  // Domains
        $s65 = "connect.chinexpert.xyz" ascii wide nocase  // Domains
        $s66 = "connect.conditiongrade.xyz" ascii wide nocase  // Domains
        $s67 = "connect.coppersummer.xyz" ascii wide nocase  // Domains
        $s68 = "connect.creatorcreator.xyz" ascii wide nocase  // Domains
        $s69 = "connect.dresstent.xyz" ascii wide nocase  // Domains
        $s70 = "connect.dropjeans.xyz" ascii wide nocase  // Domains
        $s71 = "connect.edgeplayground.xyz" ascii wide nocase  // Domains
        $s72 = "connect.exchangeclub.xyz" ascii wide nocase  // Domains
        $s73 = "connect.existencediscussion.info" ascii wide nocase  // Domains
        $s74 = "connect.expansionsalt.info" ascii wide nocase  // Domains
        $s75 = "connect.fangstitch.xyz" ascii wide nocase  // Domains
        $s76 = "connect.fogparcel.info" ascii wide nocase  // Domains
        $s77 = "connect.foodhook.info" ascii wide nocase  // Domains
        $s78 = "connect.forkcountry.xyz" ascii wide nocase  // Domains
        $s79 = "connect.fuelleg.info" ascii wide nocase  // Domains
        $s80 = "connect.geesepurpose.xyz" ascii wide nocase  // Domains
        $s81 = "connect.giantsdogs.info" ascii wide nocase  // Domains
        $s82 = "connect.giraffetoothpaste.xyz" ascii wide nocase  // Domains
        $s83 = "connect.guitarrobin.xyz" ascii wide nocase  // Domains
        $s84 = "connect.halllunch.info" ascii wide nocase  // Domains
        $s85 = "connect.harborclam.xyz" ascii wide nocase  // Domains
        $s86 = "connect.holecompany.info" ascii wide nocase  // Domains
        $s87 = "connect.knifesea.icu" ascii wide nocase  // Domains
        $s88 = "connect.monthsmoke.info" ascii wide nocase  // Domains
        $s89 = "connect.nosegovernor.xyz" ascii wide nocase  // Domains
        $s90 = "connect.pagesubstance.xyz" ascii wide nocase  // Domains
        $s91 = "connect.poisonblade.xyz" ascii wide nocase  // Domains
        $s92 = "connect.prosesalt.xyz" ascii wide nocase  // Domains
        $s93 = "connect.purposethings.info" ascii wide nocase  // Domains
        $s94 = "connect.quiltgirls.xyz" ascii wide nocase  // Domains
        $s95 = "connect.reactionbit.info" ascii wide nocase  // Domains
        $s96 = "connect.rewardrun.xyz" ascii wide nocase  // Domains
        $s97 = "connect.riceapparel.xyz" ascii wide nocase  // Domains
        $s98 = "connect.seashoreletters.info" ascii wide nocase  // Domains
        $s99 = "connect.selectiondogs.xyz" ascii wide nocase  // Domains
        $s100 = "connect.shapeboot.info" ascii wide nocase  // Domains
        $s101 = "connect.shoptax.xyz" ascii wide nocase  // Domains
        $s102 = "connect.stopfinger.info" ascii wide nocase  // Domains
        $s103 = "connect.structurekiss.xyz" ascii wide nocase  // Domains
        $s104 = "connect.tanksuggestion.xyz" ascii wide nocase  // Domains
        $s105 = "connect.thingbrass.xyz" ascii wide nocase  // Domains
        $s106 = "connect.thoughtslave.xyz" ascii wide nocase  // Domains
        $s107 = "connect.threadfuel.xyz" ascii wide nocase  // Domains
        $s108 = "connect.trailcontrol.xyz" ascii wide nocase  // Domains
        $s109 = "connect.trickbushes.info" ascii wide nocase  // Domains
        $s110 = "connect.vacationthought.xyz" ascii wide nocase  // Domains
        $s111 = "connect.viewschool.xyz" ascii wide nocase  // Domains
        $s112 = "connect.voyagelaugh.xyz" ascii wide nocase  // Domains
        $s113 = "connect.woolreward.xyz" ascii wide nocase  // Domains
        $s114 = "connect.yearicicle.xyz" ascii wide nocase  // Domains
        $s115 = "connect.zebratransport.xyz" ascii wide nocase  // Domains
        $s116 = "controlprice.xyz" ascii wide nocase  // Domains
        $s117 = "coughcoal.icu" ascii wide nocase  // Domains
        $s118 = "countrypipe.space" ascii wide nocase  // Domains
        $s119 = "cowsfoot.xyz" ascii wide nocase  // Domains
        $s120 = "crackfood.space" ascii wide nocase  // Domains
        $s121 = "creamfurniture.space" ascii wide nocase  // Domains
        $s122 = "creditchickens.xyz" ascii wide nocase  // Domains
        $s123 = "crediteducation.cfd" ascii wide nocase  // Domains
        $s124 = "crimestreet.xyz" ascii wide nocase  // Domains
        $s125 = "crimesupport.cfd" ascii wide nocase  // Domains
        $s126 = "crowdstri.com" ascii wide nocase  // Domains
        $s127 = "curvebite.xyz" ascii wide nocase  // Domains
        $s128 = "deathrock.xyz" ascii wide nocase  // Domains
        $s129 = "deathshop.xyz" ascii wide nocase  // Domains
        $s130 = "decisionreaction.xyz" ascii wide nocase  // Domains
        $s131 = "dinosaursjam.cfd" ascii wide nocase  // Domains
        $s132 = "distancebedroom.xyz" ascii wide nocase  // Domains
        $s133 = "distributiontheory.cfd" ascii wide nocase  // Domains
        $s134 = "dolldebt.xyz" ascii wide nocase  // Domains
        $s135 = "doorsoap.cfd" ascii wide nocase  // Domains
        $s136 = "drelto.info" ascii wide nocase  // Domains
        $s137 = "dustprotest.icu" ascii wide nocase  // Domains
        $s138 = "dw.xrsdownload.com" ascii wide nocase  // Domains
        $s139 = "expansionsalt.info" ascii wide nocase  // Domains
        $s140 = "extentrack.com" ascii wide nocase  // Domains
        $s141 = "fallbeginner.xyz" ascii wide nocase  // Domains
        $s142 = "fangbear.xyz" ascii wide nocase  // Domains
        $s143 = "filescenter.cloud" ascii wide nocase  // Domains
        $s144 = "filescloud.pro" ascii wide nocase  // Domains
        $s145 = "filesilo.cloud" ascii wide nocase  // Domains
        $s146 = "filexstorage.site" ascii wide nocase  // Domains
        $s147 = "finersto.com" ascii wide nocase  // Domains
        $s148 = "fingerbasketball.xyz" ascii wide nocase  // Domains
        $s149 = "flavorwood.xyz" ascii wide nocase  // Domains
        $s150 = "fleshfrog.xyz" ascii wide nocase  // Domains
        $s151 = "fleshplants.xyz" ascii wide nocase  // Domains
        $s152 = "fleshproduce.xyz" ascii wide nocase  // Domains
        $s153 = "foodrock.space" ascii wide nocase  // Domains
        $s154 = "forkmice.xyz" ascii wide nocase  // Domains
        $s155 = "friendjewel.cfd" ascii wide nocase  // Domains
        $s156 = "geeseairport.xyz" ascii wide nocase  // Domains
        $s157 = "girlsgrain.xyz" ascii wide nocase  // Domains
        $s158 = "glassmove.xyz" ascii wide nocase  // Domains
        $s159 = "goldsteel.cfd" ascii wide nocase  // Domains
        $s160 = "governmentyard.cfd" ascii wide nocase  // Domains
        $s161 = "grandfatherquiver.xyz" ascii wide nocase  // Domains
        $s162 = "gripcollar.xyz" ascii wide nocase  // Domains
        $s163 = "gripsleep.xyz" ascii wide nocase  // Domains
        $s164 = "gunbear.xyz" ascii wide nocase  // Domains
        $s165 = "hairreward.xyz" ascii wide nocase  // Domains
        $s166 = "hatescale.info" ascii wide nocase  // Domains
        $s167 = "healthiron.space" ascii wide nocase  // Domains
        $s168 = "holemuscle.xyz" ascii wide nocase  // Domains
        $s169 = "homecub.cfd" ascii wide nocase  // Domains
        $s170 = "homefireman.xyz" ascii wide nocase  // Domains
        $s171 = "honeyfear.xyz" ascii wide nocase  // Domains
        $s172 = "igk.filexspace.com" ascii wide nocase  // Domains
        $s173 = "ikx.filexspace.com" ascii wide nocase  // Domains
        $s174 = "ilesilo.cloud" ascii wide nocase  // Domains
        $s175 = "instrumentvolcano.space" ascii wide nocase  // Domains
        $s176 = "kittenschalk.xyz" ascii wide nocase  // Domains
        $s177 = "kittensgrade.cfd" ascii wide nocase  // Domains
        $s178 = "kittensrobin.info" ascii wide nocase  // Domains
        $s179 = "landerror.xyz" ascii wide nocase  // Domains
        $s180 = "lesilo.cloud" ascii wide nocase  // Domains
        $s181 = "liptendency.info" ascii wide nocase  // Domains
        $s182 = "liquidtoes.xyz" ascii wide nocase  // Domains
        $s183 = "liquidwrench.cfd" ascii wide nocase  // Domains
        $s184 = "lockettrail.xyz" ascii wide nocase  // Domains
        $s185 = "lumberbaseball.xyz" ascii wide nocase  // Domains
        $s186 = "memorycompany.xyz" ascii wide nocase  // Domains
        $s187 = "micesisters.xyz" ascii wide nocase  // Domains
        $s188 = "mifilesx.site" ascii wide nocase  // Domains
        $s189 = "milkname.xyz" ascii wide nocase  // Domains
        $s190 = "minewave.info" ascii wide nocase  // Domains
        $s191 = "minuteblade.xyz" ascii wide nocase  // Domains
        $s192 = "mountainsurprise.cfd" ascii wide nocase  // Domains
        $s193 = "mouthfruit.cfd" ascii wide nocase  // Domains
        $s194 = "mqsearch.com" ascii wide nocase  // Domains
        $s195 = "needcherries.online" ascii wide nocase  // Domains
        $s196 = "noiseship.cfd" ascii wide nocase  // Domains
        $s197 = "northbox.xyz" ascii wide nocase  // Domains
        $s198 = "partpipe.xyz" ascii wide nocase  // Domains
        $s199 = "partyfriends.cfd" ascii wide nocase  // Domains
        $s200 = "passengerbrake.space" ascii wide nocase  // Domains
        $s201 = "peacejewel.xyz" ascii wide nocase  // Domains
        $s202 = "peacetongue.xyz" ascii wide nocase  // Domains
        $s203 = "petminister.xyz" ascii wide nocase  // Domains
        $s204 = "pictureporter.cfd" ascii wide nocase  // Domains
        $s205 = "pieplant.space" ascii wide nocase  // Domains
        $s206 = "pizzasthread.xyz" ascii wide nocase  // Domains
        $s207 = "placespoon.xyz" ascii wide nocase  // Domains
        $s208 = "pleasurewaves.info" ascii wide nocase  // Domains
        $s209 = "popcornregret.xyz" ascii wide nocase  // Domains
        $s210 = "porterdebt.xyz" ascii wide nocase  // Domains
        $s211 = "powerbushes.xyz" ascii wide nocase  // Domains
        $s212 = "profitfact.xyz" ascii wide nocase  // Domains
        $s213 = "prosetoothbrush.xyz" ascii wide nocase  // Domains
        $s214 = "quincepage.xyz" ascii wide nocase  // Domains
        $s215 = "raintexture.xyz" ascii wide nocase  // Domains
        $s216 = "rakepurpose.xyz" ascii wide nocase  // Domains
        $s217 = "raterake.cfd" ascii wide nocase  // Domains
        $s218 = "ravexoffical.blogspot.com" ascii wide nocase  // Domains
        $s219 = "readingscience.xyz" ascii wide nocase  // Domains
        $s220 = "reasonachiever.xyz" ascii wide nocase  // Domains
        $s221 = "recessgiraffe.xyz" ascii wide nocase  // Domains
        $s222 = "recordhistory.xyz" ascii wide nocase  // Domains
        $s223 = "reg.pcsdkflyer.ca" ascii wide nocase  // Domains
        $s224 = "regretsquirrel.xyz" ascii wide nocase  // Domains
        $s225 = "restbucket.xyz" ascii wide nocase  // Domains
        $s226 = "ricestar.xyz" ascii wide nocase  // Domains
        $s227 = "rifledog.xyz" ascii wide nocase  // Domains
        $s228 = "ringsparcel.xyz" ascii wide nocase  // Domains
        $s229 = "roadyear.xyz" ascii wide nocase  // Domains
        $s230 = "rockcredit.space" ascii wide nocase  // Domains
        $s231 = "rollglass.xyz" ascii wide nocase  // Domains
        $s232 = "roofbattle.xyz" ascii wide nocase  // Domains
        $s233 = "roofreaction.xyz" ascii wide nocase  // Domains
        $s234 = "rosegrip.xyz" ascii wide nocase  // Domains
        $s235 = "routeletters.xyz" ascii wide nocase  // Domains
        $s236 = "runhouses.xyz" ascii wide nocase  // Domains
        $s237 = "scarecrowcare.xyz" ascii wide nocase  // Domains
        $s238 = "scentrod.info" ascii wide nocase  // Domains
        $s239 = "screwbirth.xyz" ascii wide nocase  // Domains
        $s240 = "seatlace.space" ascii wide nocase  // Domains
        $s241 = "seaword.xyz" ascii wide nocase  // Domains
        $s242 = "servantadvice.xyz" ascii wide nocase  // Domains
        $s243 = "shiptank.cfd" ascii wide nocase  // Domains
        $s244 = "shirtexample.xyz" ascii wide nocase  // Domains
        $s245 = "shoesearthquake.xyz" ascii wide nocase  // Domains
        $s246 = "sinkwash.space" ascii wide nocase  // Domains
        $s247 = "skirtloss.xyz" ascii wide nocase  // Domains
        $s248 = "slipvegetable.xyz" ascii wide nocase  // Domains
        $s249 = "smokecar.space" ascii wide nocase  // Domains
        $s250 = "songtheory.xyz" ascii wide nocase  // Domains
        $s251 = "spadeleg.xyz" ascii wide nocase  // Domains
        $s252 = "sparkrice.space" ascii wide nocase  // Domains
        $s253 = "sparkrub.xyz" ascii wide nocase  // Domains
        $s254 = "spoonducks.cfd" ascii wide nocase  // Domains
        $s255 = "springdogs.xyz" ascii wide nocase  // Domains
        $s256 = "spybaseball.space" ascii wide nocase  // Domains
        $s257 = "startmonkey.cfd" ascii wide nocase  // Domains
        $s258 = "statementservant.xyz" ascii wide nocase  // Domains
        $s259 = "statementtouch.xyz" ascii wide nocase  // Domains
        $s260 = "steamhouses.cfd" ascii wide nocase  // Domains
        $s261 = "stopzinc.xyz" ascii wide nocase  // Domains
        $s262 = "storage.ggclicker.com" ascii wide nocase  // Domains
        $s263 = "structurelinen.xyz" ascii wide nocase  // Domains
        $s264 = "stryper.info" ascii wide nocase  // Domains
        $s265 = "suggestioncemetery.xyz" ascii wide nocase  // Domains
        $s266 = "suitsoap.xyz" ascii wide nocase  // Domains
        $s267 = "suitstraw.info" ascii wide nocase  // Domains
        $s268 = "swimrest.xyz" ascii wide nocase  // Domains
        $s269 = "tablechess.info" ascii wide nocase  // Domains
        $s270 = "tailsilk.xyz" ascii wide nocase  // Domains
        $s271 = "territorycaption.xyz" ascii wide nocase  // Domains
        $s272 = "texturebadge.xyz" ascii wide nocase  // Domains
        $s273 = "thrillducks.xyz" ascii wide nocase  // Domains
        $s274 = "throneback.xyz" ascii wide nocase  // Domains
        $s275 = "tinsofa.xyz" ascii wide nocase  // Domains
        $s276 = "toespiders.xyz" ascii wide nocase  // Domains
        $s277 = "toothpastesense.xyz" ascii wide nocase  // Domains
        $s278 = "toothpastesun.xyz" ascii wide nocase  // Domains
        $s279 = "townquiver.xyz" ascii wide nocase  // Domains
        $s280 = "trampdonkey.icu" ascii wide nocase  // Domains
        $s281 = "treesboard.xyz" ascii wide nocase  // Domains
        $s282 = "trickflag.info" ascii wide nocase  // Domains
        $s283 = "truckpig.cfd" ascii wide nocase  // Domains
        $s284 = "truckshat.xyz" ascii wide nocase  // Domains
        $s285 = "turnclass.xyz" ascii wide nocase  // Domains
        $s286 = "umbrellavessel.xyz" ascii wide nocase  // Domains
        $s287 = "uy.basesfiles.com" ascii wide nocase  // Domains
        $s288 = "vacationengine.xyz" ascii wide nocase  // Domains
        $s289 = "velfps.blogspot.com" ascii wide nocase  // Domains
        $s290 = "velvoxlab.blogspot.com" ascii wide nocase  // Domains
        $s291 = "vendralo.info" ascii wide nocase  // Domains
        $s292 = "venrx.blogspot.com" ascii wide nocase  // Domains
        $s293 = "venrx.xyz" ascii wide nocase  // Domains
        $s294 = "venrxhub.blogspot.com" ascii wide nocase  // Domains
        $s295 = "vesselsystem.xyz" ascii wide nocase  // Domains
        $s296 = "vestthings.cfd" ascii wide nocase  // Domains
        $s297 = "volcanopin.xyz" ascii wide nocase  // Domains
        $s298 = "voyagemist.space" ascii wide nocase  // Domains
        $s299 = "wastereading.xyz" ascii wide nocase  // Domains
        $s300 = "wasteturkey.xyz" ascii wide nocase  // Domains
        $s301 = "wastewine.xyz" ascii wide nocase  // Domains
        $s302 = "watchadvance.com" ascii wide nocase  // Domains
        $s303 = "wavepan.xyz" ascii wide nocase  // Domains
        $s304 = "whistlebook.cfd" ascii wide nocase  // Domains
        $s305 = "whistlesong.xyz" ascii wide nocase  // Domains
        $s306 = "wormspark.xyz" ascii wide nocase  // Domains
        $s307 = "woundsecretary.xyz" ascii wide nocase  // Domains
        $s308 = "wrenobservation.xyz" ascii wide nocase  // Domains
        $s309 = "yamsmell.xyz" ascii wide nocase  // Domains
        $s310 = "yardvalue.cfd" ascii wide nocase  // Domains
        $s311 = "zephyrhall.cfd" ascii wide nocase  // Domains
        $s312 = "zippyfiles.net" ascii wide nocase  // Domains
        $s313 = "http://aa.amazingshield.xyz/33244556546.py" ascii wide nocase  // URLs
        $s314 = "https://stryper.info/aa.js" ascii wide nocase  // URLs
        $s315 = "https://stryper.info/t.ps1" ascii wide nocase  // URLs
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "06e0afd01bbc6c9d5dc16c3165089b233dc071e1f251abd06235d1b9166cdac5" or
        hash.sha256(0, filesize) == "25558ea78c4aa0fdd0f45fafcaa546d3115dc5806809d144a5801a40e48fd4c5" or
        hash.sha256(0, filesize) == "2c6e11027b011042c9a118fc20728f8f4ebb6be8795cc84cc9a45622c297d354" or
        hash.sha256(0, filesize) == "3052bd320a34e12ee694811ed0578797477dfd480c664491e509ed15ce1a6961" or
        hash.sha256(0, filesize) == "553ce594c9c6afdd4794fddc28c194e3bc3c1b052310e5099c58ac15bab72104" or
        hash.sha256(0, filesize) == "62d49d0c78207ec2452cc8a30501db771c9edbae89889e41a7dd227551243e8e" or
        hash.sha256(0, filesize) == "7f792c45de1e28fd42ac44c9444f157a2161742d130bac336c0e991aabbb112c" or
        hash.sha256(0, filesize) == "9b0d9cbc0fd4a7bae8b78a15dfbe63052779414ad725845732c4a0083008da69" or
        hash.sha256(0, filesize) == "aaebc8c07de485be6d1bfa956668c5e18aa1ff5588dfe84672e20ae90b4560f1" or
        hash.sha256(0, filesize) == "b367762140ae7f5098230b8a5da738c9241f286281ec9439dd6ca581fc87989c" or
        hash.sha256(0, filesize) == "ceb30a5eb9ad9d9c6712c80726df16f96f99d9fc0753be241b00b4d636eb576e" or
        hash.sha256(0, filesize) == "cf184d04ca31fb2b6b7efd85399c29c1136b539153e137ceb3877b1b905791de" or
        hash.sha256(0, filesize) == "d8d783f8e050a6e394f3c0aa5e2bc73a38d822e55fbc39c0648cbff566de3cdf" or
        hash.sha256(0, filesize) == "e05bc22afbc5ddd50b49c85ee169dd13318000d38286de2b8bcff98217256a8d" or
        hash.sha256(0, filesize) == "fc485882626512e7ff82a1d7cd8e8fb3e9751b026d97e682d6908aefff1f2d73" or
        hash.sha256(0, filesize) == "fdcc95b7791c0d6590dcf1a412dc9fcc92ad2095818d1b78368b31efad012007"
}