Hello, Just made a new sig : VBS.Dwnl:7:*:6d61726b6574706c616365203d20726466676f28 It seems rather odd but so far catched a lot (see samples, for decrypting with openssl : openssl enc -d -aes256 -in sample.tar.gz.enc -out sample.tar.gz) Regards, JB