alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP AdWare.MSIL.Solimba.b GET"; flow:established,to_server; http.method; content:"GET"; nocase; http.uri; content:"/dmr/access/"; http.user_agent; content:"DownloadMR"; nocase; depth:10; reference:url,virustotal.com/en/file/93236b781e147e3ac983be1374a5f807fabd27ee2b92e6d99e293a6eb070ac2b/analysis/; reference:md5,0da0d8e664f44400c19898b4c9e71456; classtype:pup-activity; sid:2016905; rev:6; metadata:created_at 2013_05_21, signature_severity Minor, updated_at 2020_08_31;)