Signatures are definitely not hashes. They usually match families of malware or methods of obfuscation. Nor do any respectable AVs scan after something has star

Signatures are definitely not hashes. They usually match families of malware or methods of obfuscation. Nor do any respectable AVs scan after something has started running... AVs usually upload suspicious files from user PCs for further analysis to help aid in discovering new variants/types. The odds your AV has seen it is proportional to the odds of you running into it. The industry is moving away from signatures regardless. Now AVs use runtime heuristics to spot bad behavior of executables and block them even if they've never been seen; Cylance literally only does this and it's pretty effective.