新型工控系统恶意软件TRITON：修改SIS增加物理破坏机率(5)

　　$py_crc_06 = "CRC16_CCITT_x1D0F" ascii wide

　　$py_crc_07 = /CRC16_CCITT[^_]/ ascii wide

　　$py_sh_01 = "sh.pyc" nocase ascii wide

　　$py_keyword_01 = " FAILURE" ascii wide

　　$py_keyword_02 = "symbol table" nocase ascii wide

　　$py_TRIDENT_01 = "inject.bin" ascii nocase wide

　　$py_TRIDENT_02 = "imain.bin" ascii nocase wide

　　condition:

　　2 of ($python_*) and 7 of ($py_*) and filesize < 3MB

　　}