{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 0.8911781907081604,
        "class": 0,
        "threshold": 0.9987763166427612
      }
    ],
    "prob": 0.8911782,
    "class": 0,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.8911782,
        "class": 0
      },
      {
        "m": "az/native",
        "prob": 0.9812265,
        "class": 0
      },
      {
        "m": "az/pe",
        "prob": 0.82905984,
        "class": 0
      }
    ],
    "version": "v17.17",
    "threshold": 0.9987763,
    "analyzed_at": "2026-05-31T03:59:42Z"
  },
  "path": "08e2b0e469f2809991e59e65177fe994f3aeeea601a2af8aec6c7ae1406debb0.exe",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "H(Cm)Md₂(Bk)",
        "x": 5,
        "ff": {
          "i": [
            [
              "mscoree",
              "CorExeMain"
            ]
          ],
          "m": {
            "pe": {
              "checksum": 0.0,
              "icon_count": 2.0,
              "has_manifest": 1.0,
              "checksum_valid": 0.0,
              "resource_count": 4.0,
              "has_version_info": 1.0,
              "checksum_stripped": 1.0,
              "computed_checksum": 779293.0,
              "bss_like_section_count": 0.0,
              "section_overflow_count": 0.0,
              "misaligned_section_count": 0.0,
              "base_relocation_block_count": 1.0,
              "base_relocation_entry_count": 1.0
            },
            "file": {
              "size": 777216.0,
              "entropy": 6.77,
              "size_bytes": 777216.0
            },
            "binary": {
              "is_pie": 1.0,
              "code_entropy": 6.71,
              "string_count": 5185.0,
              "entropy_variance": 8.98,
              "avg_string_length": 15.91,
              "max_string_length": 47844.0,
              "code_to_data_ratio": 1.0,
              "string_length_stddev": 664.44,
              "largest_section_ratio": 0.85,
              "sentence_string_count": 18.0,
              "sentence_string_ratio": 0.0,
              "high_entropy_string_count": 0.0
            },
            "imports": {
              "count": 1.0
            },
            "sections": {
              "count": 3.0,
              "code_size": 660992.0,
              "entropy_max": 6.71,
              "entropy_mean": 4.33,
              "name_entropy": 3.03,
              "writable_count": 0.0,
              "executable_count": 1.0,
              "nonstandard_count": 0.0,
              "executable_writable_count": 0.0
            },
            "dependencies": {
              "count": 1.0
            }
          },
          "s": [
            [
              77,
              "u8",
              "!This program cannot be run in DOS mode."
            ],
            [
              376,
              "u8",
              ".text"
            ],
            [
              455,
              "u8",
              "@.reloc"
            ],
            [
              3884,
              "u8",
              "*.s8"
            ],
            [
              24972,
              "u8",
              "BSJB"
            ],
            [
              37909,
              "u8",
              "IEnumerable`1"
            ],
            [
              37923,
              "u8",
              "ThreadSafeObjectProvider`1"
            ],
            [
              37957,
              "u8",
              "get_Button1"
            ],
            [
              37969,
              "u8",
              "set_Button1"
            ],
            [
              37981,
              "u8",
              "get_MonthCalendar1"
            ],
            [
              38000,
              "u8",
              "set_MonthCalendar1"
            ],
            [
              38019,
              "u8",
              "get_CheckBox1"
            ],
            [
              38033,
              "u8",
              "set_CheckBox1"
            ],
            [
              38047,
              "u8",
              "get_ComboBox1"
            ],
            [
              38061,
              "u8",
              "set_ComboBox1"
            ],
            [
              38075,
              "u8",
              "get_CheckedListBox1"
            ],
            [
              38095,
              "u8",
              "set_CheckedListBox1"
            ],
            [
              38115,
              "u8",
              "ReadInt32"
            ],
            [
              38125,
              "u8",
              "get_Solo0342"
            ],
            [
              38138,
              "u8",
              "set_Solo0342"
            ],
            [
              38151,
              "u8",
              "get_Solo1342"
            ],
            [
              38164,
              "u8",
              "set_Solo1342"
            ],
            [
              38177,
              "u8",
              "Dictionary`2"
            ],
            [
              38190,
              "u8",
              "Atan2"
            ],
            [
              38196,
              "u8",
              "get_Button2"
            ],
            [
              38208,
              "u8",
              "set_Button2"
            ],
            [
              38220,
              "u8",
              "get_MonthCalendar2"
            ],
            [
              38239,
              "u8",
              "set_MonthCalendar2"
            ],
            [
              38258,
              "u8",
              "Vector2"
            ],
            [
              38266,
              "u8",
              "get_CheckBox2"
            ],
            [
              38280,
              "u8",
              "set_CheckBox2"
            ],
            [
              38294,
              "u8",
              "get_ComboBox2"
            ],
            [
              38308,
              "u8",
              "set_ComboBox2"
            ],
            [
              38322,
              "u8",
              "get_CheckedListBox2"
            ],
            [
              38342,
              "u8",
              "set_CheckedListBox2"
            ],
            [
              38362,
              "u8",
              "Vector3"
            ],
            [
              38378,
              "u8",
              "\u003cModule\u003e"
            ],
            [
              38387,
              "u8",
              "get_NnbAZF"
            ],
            [
              38398,
              "u8",
              "RectangleF"
            ],
            [
              38409,
              "u8",
              "SizeF"
            ],
            [
              38415,
              "u8",
              "PointF"
            ],
            [
              38422,
              "u8",
              "VersionTN"
            ],
            [
              38432,
              "u8",
              "System.IO"
            ],
            [
              38442,
              "u8",
              "objReceivingUDP"
            ],
            [
              38458,
              "u8",
              "strDestIP"
            ],
            [
              38476,
              "u8",
              "iZI7T"
            ],
            [
              38503,
              "u8",
              "ViewOffsetX"
            ],
            [
              38515,
              "u8",
              "get_XY"
            ],
            [
              38522,
              "u8",
              "set_XY"
            ],
            [
              38541,
              "u8",
              "ViewOffsetY"
            ],
            [
              38553,
              "u8",
              "get_XZ"
            ],
            [
              38560,
              "u8",
              "set_XZ"
            ],
            [
              38567,
              "u8",
              "get_YZ"
            ],
            [
              38574,
              "u8",
              "set_YZ"
            ],
            [
              38581,
              "u8",
              "Dispose__Instance__"
            ],
            [
              38601,
              "u8",
              "Create__Instance__"
            ],
            [
              38620,
              "u8",
              "value__"
            ],
            [
              38628,
              "u8",
              "get_Mana"
            ],
            [
              38637,
              "u8",
              "set_Mana"
            ],
            [
              38646,
              "u8",
              "get_MaxMana"
            ],
            [
              38658,
              "u8",
              "get_Stamina"
            ],
            [
              38670,
              "u8",
              "set_Stamina"
            ],
            [
              38682,
              "u8",
              "get_MaxStamina"
            ],
            [
              38697,
              "u8",
              "ProjectData"
            ],
            [
              38709,
              "u8",
              "bytData"
            ],
            [
              38717,
              "u8",
              "get_Delta"
            ],
            [
              38727,
              "u8",
              "FromArgb"
            ],
            [
              38736,
              "u8",
              "mscorlib"
            ],
            [
              38745,
              "u8",
              "EXPOrb"
            ],
            [
              38752,
              "u8",
              "System.Collections.Generic"
            ],
            [
              38779,
              "u8",
              "Microsoft.VisualBasic"
            ],
            [
              38801,
              "u8",
              "get_Dead"
            ],
            [
              38810,
              "u8",
              "Thread"
            ],
            [
              38826,
              "u8",
              "MainForm_Load"
            ],
            [
              38844,
              "u8",
              "get_Red"
            ],
            [
              38852,
              "u8",
              "get_PaleVioletRed"
            ],
            [
              38870,
              "u8",
              "get_Collided"
            ],
            [
              38883,
              "u8",
              "set_Collided"
            ],
            [
              38896,
              "u8",
              "get_MaxSpeed"
            ],
            [
              38909,
              "u8",
              "set_MaxSpeed"
            ],
            [
              38922,
              "u8",
              "seed"
            ],
            [
              38927,
              "u8",
              "Interlocked"
            ],
            [
              38939,
              "u8",
              "set_FormattingEnabled"
            ],
            [
              38961,
              "u8",
              "Equipped"
            ],
            [
              38970,
              "u8",
              "Shared"
            ],
            [
              38977,
              "u8",
              "Closed"
            ],
            [
              38984,
              "u8",
              "get_IsDisposed"
            ],
            [
              38999,
              "u8",
              "m_FormBeingCreated"
            ],
            [
              39018,
              "u8",
              "Synchronized"
            ],
            [
              39031,
              "u8",
              "AccountDomainSid"
            ],
            [
              39048,
              "u8",
              "AppendChild"
            ],
            [
              39060,
              "u8",
              "UpdateWorld"
            ],
            [
              39072,
              "u8",
              "DrawWorld"
            ],
            [
              39086,
              "u8",
              "Send"
            ],
            [
              39091,
              "u8",
              "Round"
            ],
            [
              39097,
              "u8",
              "DrawBackground"
            ],
            [
              39112,
              "u8",
              "TargetMethod"
            ],
            [
              39125,
              "u8",
              "IUserInterface"
            ],
            [
              39140,
              "u8",
              "Replace"
            ],
            [
              39148,
              "u8",
              "CreateInstance"
            ],
            [
              39163,
              "u8",
              "get_GetInstance"
            ],
            [
              39179,
              "u8",
              "defaultInstance"
            ],
            [
              39195,
              "u8",
              "instance"
            ],
            [
              39204,
              "u8",
              "GetHashCode"
            ],
            [
              39216,
              "u8",
              "get_KeyCode"
            ],
            [
              39228,
              "u8",
              "set_AutoScaleMode"
            ],
            [
              39246,
              "u8",
              "FileMode"
            ],
            [
              39255,
              "u8",
              "XmlNode"
            ],
            [
              39263,
              "u8",
              "FromImage"
            ],
            [
              39273,
              "u8",
              "DrawImage"
            ],
            [
              39283,
              "u8",
              "get_Message"
            ],
            [
              39295,
              "u8",
              "add_GameObjectChange"
            ],
            [
              39316,
              "u8",
              "remove_GameObjectChange"
            ],
            [
              39340,
              "u8",
              "CompareExchange"
            ],
            [
              39356,
              "u8",
              "range"
            ],
            [
              39362,
              "u8",
              "EndInvoke"
            ],
            [
              39372,
              "u8",
              "BeginInvoke"
            ],
            [
              39384,
              "u8",
              "get_Collidable"
            ],
            [
              39399,
              "u8",
              "IComparable"
            ],
            [
              39411,
              "u8",
              "get_Invulnerable"
            ],
            [
              39428,
              "u8",
              "IDisposable"
            ],
            [
              39440,
              "u8",
              "Hashtable"
            ],
            [
              39450,
              "u8",
              "get_Visible"
            ],
            [
              39462,
              "u8",
              "ToDouble"
            ],
            [
              39471,
              "u8",
              "get_Middle"
            ],
            [
              39482,
              "u8",
              "RuntimeTypeHandle"
            ],
            [
              39500,
              "u8",
              "GetTypeFromHandle"
            ],
            [
              39518,
              "u8",
              "FillRectangle"
            ],
            [
              39532,
              "u8",
              "DrawRectangle"
            ],
            [
              39546,
              "u8",
              "File"
            ],
            [
              39551,
              "u8",
              "IGame"
            ],
            [
              39557,
              "u8",
              "StopGame"
            ],
            [
              39566,
              "u8",
              "get_Name"
            ],
            [
              39575,
              "u8",
              "set_Name"
            ],
            [
              39584,
              "u8",
              "GetFileName"
            ],
            [
              39596,
              "u8",
              "get_FullName"
            ],
            [
              39609,
              "u8",
              "ResourcesName"
            ],
            [
              39623,
              "u8",
              "Filename"
            ],
            [
              39632,
              "u8",
              "SingleFrame"
            ],
            [
              39644,
              "u8",
              "ReceiveFrame"
            ],
            [
              39657,
              "u8",
              "get_CurrentFrame"
            ],
            [
              39674,
              "u8",
              "bmpCurrentFrame"
            ],
            [
              39690,
              "u8",
              "ElapsedTime"
            ],
            [
              39702,
              "u8",
              "TargetTime"
            ],
            [
              39713,
              "u8",
              "Combine"
            ],
            [
              39721,
              "u8",
              "None"
            ],
            [
              39726,
              "u8",
              "ValueType"
            ],
            [
              39736,
              "u8",
              "GetType"
            ],
            [
              39744,
              "u8",
              "get_Culture"
            ],
            [
              39756,
              "u8",
              "set_Culture"
            ],
            [
              39768,
              "u8",
              "resourceCulture"
            ],
            [
              39784,
              "u8",
              "GroundTexture"
            ],
            [
              39798,
              "u8",
              "WallTexture"
            ],
            [
              39810,
              "u8",
              "MethodBase"
            ],
            [
              39821,
              "u8",
              "ConsoleApplicationBase"
            ],
            [
              39844,
              "u8",
              "ButtonBase"
            ],
            [
              39855,
              "u8",
              "ApplicationSettingsBase"
            ],
            [
              39879,
              "u8",
              "Close"
            ],
            [
              39885,
              "u8",
              "Dispose"
            ],
            [
              39893,
              "u8",
              "StrReverse"
            ],
            [
              39904,
              "u8",
              "Update"
            ],
            [
              39911,
              "u8",
              "Create"
            ],
            [
              39918,
              "u8",
              "MulticastDelegate"
            ],
            [
              39936,
              "u8",
              "DelegateAsyncState"
            ],
            [
              39955,
              "u8",
              "DebuggerBrowsableState"
            ],
            [
              39978,
              "u8",
              "EditorBrowsableState"
            ],
            [
              39999,
              "u8",
              "DoorState"
            ],
            [
              40009,
              "u8",
              "IsComplete"
            ],
            [
              40020,
              "u8",
              "Write"
            ],
            [
              40026,
              "u8",
              "Sprite"
            ],
            [
              40033,
              "u8",
              "ThreadStaticAttribute"
            ],
            [
              40055,
              "u8",
              "STAThreadAttribute"
            ],
            [
              40074,
              "u8",
              "CompilerGeneratedAttribute"
            ],
            [
              40101,
              "u8",
              "DesignerGeneratedAttribute"
            ],
            [
              40128,
              "u8",
              "GuidAttribute"
            ],
            [
              40142,
              "u8",
              "HelpKeywordAttribute"
            ],
            [
              40163,
              "u8",
              "GeneratedCodeAttribute"
            ],
            [
              40186,
              "u8",
              "DebuggerNonUserCodeAttribute"
            ],
            [
              40215,
              "u8",
              "DebuggableAttribute"
            ],
            [
              40235,
              "u8",
              "DebuggerBrowsableAttribute"
            ],
            [
              40262,
              "u8",
              "EditorBrowsableAttribute"
            ],
            [
              40287,
              "u8",
              "ComVisibleAttribute"
            ],
            [
              40307,
              "u8",
              "AssemblyTitleAttribute"
            ],
            [
              40330,
              "u8",
              "StandardModuleAttribute"
            ],
            [
              40354,
              "u8",
              "HideModuleNameAttribute"
            ],
            [
              40378,
              "u8",
              "DebuggerStepThroughAttribute"
            ],
            [
              40407,
              "u8",
              "AssemblyTrademarkAttribute"
            ],
            [
              40434,
              "u8",
              "TargetFrameworkAttribute"
            ],
            [
              40459,
              "u8",
              "DebuggerHiddenAttribute"
            ],
            [
              40483,
              "u8",
              "AssemblyFileVersionAttribute"
            ],
            [
              40512,
              "u8",
              "MyGroupCollectionAttribute"
            ],
            [
              40539,
              "u8",
              "AssemblyDescriptionAttribute"
            ],
            [
              40568,
              "u8",
              "CompilationRelaxationsAttribute"
            ],
            [
              40600,
              "u8",
              "AssemblyProductAttribute"
            ],
            [
              40625,
              "u8",
              "GetAttribute"
            ],
            [
              40638,
              "u8",
              "SetAttribute"
            ],
            [
              40651,
              "u8",
              "AssemblyCopyrightAttribute"
            ],
            [
              40678,
              "u8",
              "AssemblyCompanyAttribute"
            ],
            [
              40703,
              "u8",
              "RuntimeCompatibilityAttribute"
            ],
            [
              40733,
              "u8",
              "AccessedThroughPropertyAttribute"
            ],
            [
              40766,
              "u8",
              "get_Blue"
            ],
            [
              40775,
              "u8",
              "get_LightBlue"
            ],
            [
              40789,
              "u8",
              "m_ThreadStaticValue"
            ],
            [
              40809,
              "u8",
              "WithEventsValue"
            ],
            [
              40825,
              "u8",
              "GetObjectValue"
            ],
            [
              40840,
              "u8",
              "value"
            ],
            [
              40846,
              "u8",
              "Save"
            ],
            [
              40851,
              "u8",
              "Receive"
            ],
            [
              40859,
              "u8",
              "get_IsActive"
            ],
            [
              40872,
              "u8",
              "m_isactive"
            ],
            [
              40883,
              "u8",
              "SurvivalTimeObjective"
            ],
            [
              40905,
              "u8",
              "KillAllEnemiesObjective"
            ],
            [
              40929,
              "u8",
              "MouseMove"
            ],
            [
              40939,
              "u8",
              "Remove"
            ],
            [
              40946,
              "u8",
              "iZI7T.exe"
            ],
            [
              40956,
              "u8",
              "set_Size"
            ],
            [
              40965,
              "u8",
              "set_AutoSize"
            ],
            [
              40978,
              "u8",
              "get_ClientSize"
            ],
            [
              40993,
              "u8",
              "set_ClientSize"
            ],
            [
              41008,
              "u8",
              "Normalize"
            ],
            [
              41018,
              "u8",
              "Resize"
            ],
            [
              41029,
              "u8",
              "get_Png"
            ],
            [
              41037,
              "u8",
              "System.Threading"
            ],
            [
              41054,
              "u8",
              "LateBinding"
            ],
            [
              41066,
              "u8",
              "System.Drawing.Imaging"
            ],
            [
              41089,
              "u8",
              "IsNothing"
            ],
            [
              41099,
              "u8",
              "Ceiling"
            ],
            [
              41107,
              "u8",
              "GameRunning"
            ],
            [
              41119,
              "u8",
              "System.Runtime.Versioning"
            ],
            [
              41145,
              "u8",
              "ReadString"
            ],
            [
              41156,
              "u8",
              "GetResourceString"
            ],
            [
              41174,
              "u8",
              "CompareString"
            ],
            [
              41188,
              "u8",
              "ToString"
            ],
            [
              41197,
              "u8",
              "DrawString"
            ],
            [
              41208,
              "u8",
              "disposing"
            ],
            [
              41218,
              "u8",
              "get_IsMoving"
            ],
            [
              41231,
              "u8",
              "System.Drawing"
            ],
            [
              41246,
              "u8",
              "ResourceCatalog"
            ],
            [
              41262,
              "u8",
              "get_DownPlug"
            ],
            [
              41286,
              "u8",
              "get_LeftPlug"
            ],
            [
              41299,
              "u8",
              "get_RightPlug"
            ],
            [
              41313,
              "u8",
              "Watch"
            ],
            [
              41319,
              "u8",
              "Stopwatch"
            ],
            [
              41329,
              "u8",
              "SolidBrush"
            ],
            [
              41340,
              "u8",
              "GroundBrush"
            ],
            [
              41352,
              "u8",
              "ShadeBrush"
            ],
            [
              41363,
              "u8",
              "TextureBrush"
            ],
            [
              41376,
              "u8",
              "WallBrush"
            ],
            [
              41386,
              "u8",
              "Math"
            ],
            [
              41391,
              "u8",
              "Path"
            ],
            [
              41396,
              "u8",
              "get_Width"
            ],
            [
              41406,
              "u8",
              "RoomWidth"
            ],
            [
              41416,
              "u8",
              "ScreenWidth"
            ],
            [
              41428,
              "u8",
              "get_Length"
            ],
            [
              41439,
              "u8",
              "set_Length"
            ],
            [
              41450,
              "u8",
              "CollidedWith"
            ]
          ],
          "v": {
            "file.stem": "08e2b0e469f2809991e59e65177fe994f3aeeea601a2af8aec6c7ae1406debb0",
            "pe.imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
            "pe.machine": "i386",
            "pe.subsystem": "windows_gui",
            "pe.timestamp": 1644889659,
            "file.basename": "08e2b0e469f2809991e59e65177fe994f3aeeea601a2af8aec6c7ae1406debb0.exe",
            "pe.image_base": 4194304,
            "pe.image_size": 802816,
            "pe.machine_id": 332,
            "pe.os_version": "4.0",
            "pe.version.os": "unknown",
            "pe.entry_point": 668706,
            "pe.headers_size": 512,
            "pe.version.type": "app",
            "pe.entry_section": ".text",
            "pe.subsystem_raw": 2,
            "pe.clr.is_il_only": 1,
            "pe.file_alignment": 512,
            "pe.image_hash.sha1": "5e3cc03da2520da265c893555580883db9335f7a",
            "pe.version.company": "Microsoft",
            "pe.image_hash.sha256": "b1c92bcbe65c19202dc7f8241ea4b1acc95272e42c0b98b4e10ec7d2698e4307",
            "pe.image_hash.sha384": "a84a903d41054bc1130ba98fd07a5c80e8cecc8ee30b80e1b26a4f595fe8badbfdeca56d328a5eef4f30add2b0eb0bb0",
            "pe.image_hash.sha512": "03ddb7f3f32891689280a802f520717c77690f5971f898cd531a462398fd9fdee485b5dab7c4de8729b3570c8d3b0e49ec040065f85922b955b9a5983d3286e7",
            "pe.resource_types[0]": "RT_ICON",
            "pe.resource_types[1]": "RT_GROUP_ICON",
            "pe.resource_types[2]": "RT_VERSION",
            "pe.resource_types[3]": "RT_MANIFEST",
            "pe.section_alignment": 8192,
            "pe.subsystem_version": "4.0",
            "pe.version.copyright": "Copyright ©  2015 - 2022",
            "pe.characteristics[0]": "executable_image",
            "pe.characteristics[1]": "32bit_machine",
            "pe.manifest.ui_access": "false",
            "pe.characteristics_raw": 258,
            "pe.clr.runtime_version": "2.5",
            "pe.version.description": "Jack Toolbox",
            "pe.linker_major_version": 80,
            "pe.version.file_version": "1.0.0.0",
            "pe.version.product_name": "Jack Toolbox",
            "pe.version.internal_name": "iZI7T.exe",
            "pe.dll_characteristics[0]": "dynamic_base",
            "pe.dll_characteristics[1]": "nx_compat",
            "pe.dll_characteristics[2]": "no_seh",
            "pe.dll_characteristics[3]": "terminal_server_aware",
            "pe.data_directories[0].rva": 668624,
            "pe.data_directories[1].rva": 671744,
            "pe.data_directories[2].rva": 794624,
            "pe.data_directories[3].rva": 8192,
            "pe.data_directories[4].rva": 8200,
            "pe.dll_characteristics_raw": 34112,
            "pe.number_of_rva_and_sizes": 16,
            "pe.version.product_version": "1.0.0.0",
            "pe.data_directories[0].name": "import",
            "pe.data_directories[0].size": 79,
            "pe.data_directories[1].name": "resource",
            "pe.data_directories[1].size": 114928,
            "pe.data_directories[2].name": "base_relocation",
            "pe.data_directories[2].size": 12,
            "pe.data_directories[3].name": "iat",
            "pe.data_directories[3].size": 8,
            "pe.data_directories[4].name": "clr_runtime_header",
            "pe.data_directories[4].size": 72,
            "pe.version.original_filename": "iZI7T.exe",
            "pe.coff.dos_header_pe_pointer": 128,
            "pe.base_relocations.block_count": 1,
            "pe.base_relocations.entry_count": 1,
            "pe.base_relocations.padding_count": 1,
            "pe.manifest.assembly_identity.name": "MyApplication.app",
            "pe.manifest.assembly_identity.version": "1.0.0.0",
            "pe.manifest.requested_execution_level": "asInvoker"
          },
          "id": "pe",
          "sc": [
            [
              ".text",
              512,
              660992,
              6.71,
              "r-x"
            ],
            [
              ".rsrc",
              661504,
              115200,
              6.17,
              "r--"
            ],
            [
              ".reloc",
              776704,
              512,
              0.1,
              "r--"
            ]
          ]
        },
        "id": 0,
        "sz": 777216,
        "ts": [
          {
            "c": 1.0,
            "d": ".NET assembly detected via BSJB CLR metadata signature",
            "e": [
              "BSJB at offset 0x618c"
            ],
            "i": "metadata/dotnet/bsjb-signature",
            "l": 2,
            "el": [
              "0x618c"
            ]
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "08e2b0e469f2809991e59e65177fe994f3aeeea601a2af8aec6c7ae1406debb0.exe"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "PE LegalCopyright field is populated",
            "e": [
              "Copyright ©  2015 - 2022"
            ],
            "i": "metadata/package/versioning::pe-legal-copyright-present",
            "l": 1,
            "el": [
              "value:pe.version.copyright"
            ]
          },
          {
            "c": 0.75,
            "d": "Runtime interop services",
            "e": [
              "System.Runtime.InteropServices"
            ],
            "i": "metadata/lang/compiler/managed::runtime-interop",
            "l": 2,
            "el": [
              "0xaa25"
            ]
          },
          {
            "a": "T1140",
            "c": 0.8999999761581421,
            "d": "VB LateGet dispatch token",
            "e": [
              "LateGet"
            ],
            "i": "objectives/command-and-control/dropper/staging/embedded::vb-lateget-token",
            "l": 1,
            "m": "B0030",
            "el": [
              "0xae06"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "Reflection method namespace token",
            "e": [
              "System.Reflection"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/invoke::namespace-import",
            "l": 1,
            "el": [
              "0xa4dc"
            ]
          },
          {
            "c": 1.0,
            "d": ".NET Metadata Root (BSJB)",
            "e": [
              "BSJB"
            ],
            "i": "metadata/binary/framework::dotnet-metadata",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "PE FileDescription field is populated",
            "e": [
              "Jack Toolbox"
            ],
            "i": "metadata/package/versioning::pe-file-description-present",
            "l": 1,
            "el": [
              "value:pe.version.description"
            ]
          },
          {
            "c": 0.6000000238418579,
            "d": "Copyright notice",
            "e": [
              "Copyright"
            ],
            "i": "metadata/package/license::copyright-word",
            "l": 2,
            "el": [
              "0x17a44"
            ]
          },
          {
            "c": 1.0,
            "d": "Modification of HTTP context items",
            "e": [
              "set_Item"
            ],
            "i": "micro-behaviors/communications/http/server/managed::http-item-setter",
            "l": 1,
            "el": [
              "0xa33a"
            ]
          },
          {
            "c": 0.9200000166893005,
            "d": "PE FileVersion resembles IPv4",
            "e": [
              "1.0.0.0"
            ],
            "i": "metadata/package/versioning::pe-file-version-ipv4-shape",
            "l": 1,
            "el": [
              "value:pe.version.file_version"
            ]
          },
          {
            "a": "T1027.003",
            "c": 0.8600000143051147,
            "d": "Encoded PE resource section",
            "e": [
              ".rsrc (size: 115200, entropy: 6.17)"
            ],
            "i": "objectives/anti-static/obfuscation/payload/container::moderately-encoded-rsrc",
            "l": 1,
            "m": "F0001.006"
          },
          {
            "c": 0.7200000286102295,
            "d": "Path combination helper token",
            "e": [
              "Combine"
            ],
            "i": "micro-behaviors/fs/temp/directory::path-combine-token",
            "l": 1,
            "el": [
              "0x9b21"
            ]
          },
          {
            "d": ".dll extension reference",
            "e": [
              ".dll"
            ],
            "i": "micro-behaviors/fs/path/extension::dll-dup",
            "l": 2,
            "el": [
              "0xa1612"
            ]
          },
          {
            "c": 0.8600000143051147,
            "d": "asInvoker manifest tag in resources",
            "e": [
              "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"/\u003e"
            ],
            "i": "metadata/binary/resource::asinvoker-resource-manifest-flex",
            "l": 2,
            "el": [
              "0xbd85d"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE has few sections",
            "e": [
              "sections.count = 3.00"
            ],
            "i": "metadata/binary/layout::legacy-few-sections",
            "l": 2
          },
          {
            "a": "T1027.003",
            "c": 0.7799999713897705,
            "d": ".NET resource manager reference",
            "e": [
              "ComponentResourceManager",
              "get_ResourceManager"
            ],
            "i": "micro-behaviors/data/embedded/payload/image::dotnet-resource-manager-token",
            "l": 1,
            "m": "F0001.006",
            "el": [
              "0xa82c",
              "0xa818"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "Dynamic object instantiation via Activator",
            "e": [
              "Activator"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/invoke::activator",
            "l": 1,
            "el": [
              "0xa964"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "PE ProductName field is populated",
            "e": [
              "Jack Toolbox"
            ],
            "i": "metadata/package/versioning::pe-product-name-present",
            "l": 1,
            "el": [
              "value:pe.version.product_name"
            ]
          },
          {
            "c": 0.8199999928474426,
            "d": "Elevated text section entropy",
            "e": [
              ".text (entropy: 6.71)"
            ],
            "i": "metadata/binary/section/metrics::elevated-text-entropy-section",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE file uses .exe extension",
            "e": [
              "08e2b0e469f2809991e59e65177fe994f3aeeea601a2af8aec6c7ae1406debb0.exe"
            ],
            "i": "metadata/binary/framework::exe-extension",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "Delegate BeginInvoke token",
            "e": [
              "BeginInvoke"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/invoke::begininvoke-token",
            "l": 1,
            "el": [
              "0x99cc"
            ]
          },
          {
            "c": 1.0,
            "d": "Binary has 1000 or more strings",
            "e": [
              "binary.string_count = 5185.00"
            ],
            "i": "metadata/binary/metrics/threshold::string-count-1000-plus",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "mscorlib reference",
            "e": [
              "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R",
              "mscorlib"
            ],
            "i": "metadata/lang/compiler/managed::mscorlib",
            "l": 2,
            "el": [
              "0x17d88",
              "0x9750"
            ]
          },
          {
            "a": "T1140",
            "c": 0.8399999737739563,
            "d": "CreateInstance activation token",
            "e": [
              "CreateInstance"
            ],
            "i": "objectives/command-and-control/dropper/staging/embedded::createinstance-token",
            "l": 1,
            "m": "B0030",
            "el": [
              "0x98ec"
            ]
          },
          {
            "a": "T1546.012",
            "c": 0.8999999761581421,
            "d": "IFEO Debugger registry value",
            "e": [
              "Debugger"
            ],
            "i": "objectives/persistence/login/ifeo/debugger::ifeo-debugger-value",
            "l": 1,
            "m": "F0012",
            "el": [
              "0xa84f"
            ]
          },
          {
            "c": 1.0,
            "d": "PE has RT_ICON in resources list",
            "e": [
              "[RT_ICON, RT_GROUP_ICON, RT_VERSION, RT_MANIFEST]"
            ],
            "i": "metadata/binary/resource::pe-resource-icon-list",
            "l": 2,
            "el": [
              "value:pe.resource_types"
            ]
          },
          {
            "c": 0.7799999713897705,
            "d": ".NET SOAP HTTP client class",
            "e": [
              "System.Web.Services.Protocols.SoapHttpClientProtocol"
            ],
            "i": "micro-behaviors/communications/http/client/managed::soap-http-client-protocol",
            "l": 3,
            "el": [
              "0x17cb4"
            ]
          },
          {
            "a": "T1027",
            "c": 0.9900000095367432,
            "d": "PE version resource text",
            "e": [
              "VS_VERSION_INFO"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info",
            "l": 1,
            "m": "B0032",
            "el": [
              "0xbd3ce"
            ]
          },
          {
            "a": "T1027.007",
            "c": 0.699999988079071,
            "d": "Polynomial hash multiply-by-31 instruction (modified djb2)",
            "e": [
              "c5"
            ],
            "i": "objectives/anti-static/obfuscation/imports::djb2-multiply-31",
            "l": 1,
            "m": "B0032.014",
            "el": [
              "0x708b0"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE has many readable strings",
            "e": [
              "binary.string_count = 5185.00"
            ],
            "i": "metadata/binary/layout::many-readable-strings",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary is 500KB+",
            "e": [
              "08e2b0e469f2809991e59e65177fe994f3aeeea601a2af8aec6c7ae1406debb0.exe"
            ],
            "i": "metadata/binary/metrics/threshold::large-binary-500k",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE CompanyName metadata field",
            "e": [
              "CompanyName"
            ],
            "i": "metadata/package/versioning::pe-companyname-field",
            "l": 2,
            "el": [
              "0xbd4c6"
            ]
          },
          {
            "a": "T1027",
            "c": 1.0,
            "d": "Binary has normal code entropy (\u003e5.5)",
            "e": [
              "binary.code_entropy = 6.71"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard code/data section",
            "e": [
              ".text"
            ],
            "i": "metadata/binary/section/names::pe-code-data-standard-section",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "requestedExecutionLevel is asInvoker",
            "e": [
              "asInvoker"
            ],
            "i": "metadata/build/manifest::pe-as-invoker",
            "l": 2,
            "el": [
              "value:pe.manifest.requested_execution_level"
            ]
          },
          {
            "a": "T1027.009",
            "c": 0.7200000286102295,
            "d": ".NET resource GetObject token",
            "e": [
              "GetObject"
            ],
            "i": "micro-behaviors/data/embedded/payload/resource::dotnet-getobject-token",
            "l": 1,
            "el": [
              "0xadd2"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PNG image magic in text section",
            "e": [
              "89 50 4E 47 0D 0A 1A 0A"
            ],
            "i": "metadata/binary/resource::png-magic-in-text",
            "l": 1,
            "el": [
              "0x4e01b"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE import table has exactly one entry",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "metadata/binary/symbols/imports::single-import-raw",
            "l": 1
          },
          {
            "a": "T1041",
            "c": 0.8600000143051147,
            "d": "Notification config wording",
            "e": [
              "sender"
            ],
            "i": "objectives/exfiltration/messaging/webhook::notification-config-word",
            "l": 1,
            "m": "B0030",
            "el": [
              "0xa7fc"
            ]
          },
          {
            "c": 1.0,
            "d": "PE carries side-by-side assembly manifest",
            "e": [
              "{\"requested_execution_level\":\"asInvoker\",\"ui_access\":\"false\",\"assembly_identity\":{\"name\":\"MyApplication.app\",\"version\":\"1.0.0.0\""
            ],
            "i": "metadata/build/manifest::pe-has-manifest",
            "l": 2,
            "el": [
              "value:pe.manifest"
            ]
          },
          {
            "c": 1.0,
            "d": "Binary has 4 or fewer sections",
            "e": [
              "sections.count = 3.00"
            ],
            "i": "objectives/command-and-control/infrastructure/config::max-sections-4",
            "l": 1
          },
          {
            "c": 0.8500000238418579,
            "d": ".NET Framework reference",
            "e": [
              ".NETFramework,Version=v4.0"
            ],
            "i": "metadata/lang/compiler/managed::framework-reference",
            "l": 2,
            "el": [
              "0x17a9a"
            ]
          },
          {
            "c": 0.6000000238418579,
            "d": "GetMethods call reference",
            "e": [
              "GetMethods"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/invoke::get-methods-call",
            "l": 1,
            "el": [
              "0xa9b4"
            ]
          },
          {
            "c": 0.9200000166893005,
            "d": "PE ProductVersion resembles IPv4",
            "e": [
              "1.0.0.0"
            ],
            "i": "metadata/package/versioning::pe-product-version-ipv4-shape",
            "l": 1,
            "el": [
              "value:pe.version.product_version"
            ]
          },
          {
            "a": "T1036.005",
            "c": 0.8199999928474426,
            "d": "Microsoft short company name",
            "e": [
              "Microsoft"
            ],
            "i": "objectives/evasion/masquerade/version-resource/claim::microsoft-company-name-short",
            "l": 1,
            "el": [
              "0xbd4e0"
            ]
          },
          {
            "c": 1.0,
            "d": "NO_SEH (SafeSEH not used)",
            "e": [
              "[dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-no-seh",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Code section dominates file layout",
            "e": [
              "binary.largest_section_ratio = 0.85"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.699999988079071,
            "d": "PE InternalName metadata field",
            "e": [
              "InternalName"
            ],
            "i": "metadata/package/versioning::pe-internalname-field",
            "l": 2,
            "el": [
              "0xbd56e"
            ]
          },
          {
            "c": 0.8199999928474426,
            "d": "Repeated padding marker string block",
            "e": [
              "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING",
              "\u003c/assembly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…",
              "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…",
              "…embly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…"
            ],
            "i": "objectives/anti-static/obfuscation/string/junking::repeated-padding-marker",
            "l": 1,
            "el": [
              "0xbd8e3",
              "0xbd8e3",
              "0xbd8e3",
              "0xbd8e3"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "PE version info numeric fields present",
            "e": [
              "1.0.0.0"
            ],
            "i": "metadata/binary/anomaly/format::version-info-file-version-present",
            "l": 1,
            "el": [
              "value:pe.version.file_version"
            ]
          },
          {
            "a": "T1027.003",
            "c": 0.8199999928474426,
            "d": ".NET Bitmap type reference",
            "e": [
              "System.Drawing.Bitmap"
            ],
            "i": "micro-behaviors/data/embedded/payload/image::dotnet-bitmap-type-token",
            "l": 1,
            "m": "F0001.006",
            "el": [
              "0x4dfe8"
            ]
          },
          {
            "a": "T1620",
            "c": 0.949999988079071,
            "d": "mscoree DLL string reference",
            "e": [
              "mscoree.dll"
            ],
            "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere",
            "l": 1,
            "m": "B0032",
            "el": [
              "0xa1612"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE OriginalFilename metadata field",
            "e": [
              "OriginalFilename"
            ],
            "i": "metadata/package/versioning::pe-originalfilename-field",
            "l": 2,
            "el": [
              "0xbd626"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "Windows Forms UI framework",
            "e": [
              "System.Windows.Forms.Form",
              "System.Windows.Forms"
            ],
            "i": "metadata/lang/compiler/managed::winforms-ui",
            "l": 2,
            "el": [
              "0x17c5b",
              "0xac05"
            ]
          },
          {
            "a": "T1027.007",
            "c": 0.699999988079071,
            "d": "DJB2 hash multiply-by-33 instruction",
            "e": [
              "cd"
            ],
            "i": "objectives/anti-static/obfuscation/imports::djb2-multiply-33",
            "l": 1,
            "m": "B0032.014",
            "el": [
              "0x7a0aa"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": ".NET WPF namespace reference",
            "e": [
              "System.Windows"
            ],
            "i": "well-known/game/mod::wpf-namespace-ref",
            "l": 1,
            "el": [
              "0xac05"
            ]
          },
          {
            "c": 0.6000000238418579,
            "d": "MethodBase class reference",
            "e": [
              "MethodBase"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/invoke::dotnet-methodbase-token",
            "l": 1,
            "el": [
              "0x9b82"
            ]
          },
          {
            "a": "T1485",
            "c": 0.8999999761581421,
            "d": "Preserves .exe .gho .bak files",
            "e": [
              ".exe"
            ],
            "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist",
            "l": 1,
            "m": "C0047",
            "el": [
              "0x9ff2"
            ]
          },
          {
            "c": 0.6000000238418579,
            "d": "SOCKS5 UDP ASSOCIATE request opcode",
            "e": [
              "05 03 00"
            ],
            "i": "micro-behaviors/communications/proxy/socks::socks5-udp-associate-byte",
            "l": 1,
            "el": [
              "0xd621"
            ]
          },
          {
            "c": 0.6499999761581421,
            "d": ".NET Diagnostics namespace token",
            "e": [
              "System.Diagnostics"
            ],
            "i": "micro-behaviors/process/create/spawn::diagnostics-namespace-token-dotnet",
            "l": 1,
            "el": [
              "0xa996"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "Delegate EndInvoke token",
            "e": [
              "EndInvoke"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/invoke::endinvoke-token",
            "l": 1,
            "el": [
              "0x99c2"
            ]
          },
          {
            "c": 0.7799999713897705,
            "d": "Assembly accessor token (get_Assembly)",
            "e": [
              "get_Assembly"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/invoke::get-assembly-token",
            "l": 1,
            "el": [
              "0xb199"
            ]
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "High plaintext string count",
            "e": [
              "binary.string_count = 5185.00"
            ],
            "i": "objectives/anti-static/pack/polymorphic::high-string-count-2000",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "SOCKS5 client greeting bytes",
            "e": [
              "05 01 00"
            ],
            "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes",
            "l": 1,
            "el": [
              "0x44df"
            ]
          },
          {
            "c": 1.0,
            "d": "Binary has 2000+ strings",
            "e": [
              "binary.string_count = 5185.00"
            ],
            "i": "metadata/binary/metrics/threshold::many-strings-2000",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "System namespace reference",
            "e": [
              "System.IO",
              "System.Net"
            ],
            "i": "metadata/lang/compiler/managed::system-namespace",
            "l": 2,
            "el": [
              "0x9620",
              "0xad0c"
            ]
          },
          {
            "a": "T1562.001",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "m_ThreadStaticValue",
              "WithEventsValue",
              "GetObjectValue",
              "ValueType",
              "value__",
              "value",
              "Value"
            ],
            "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3",
            "l": 1,
            "m": "B0047",
            "el": [
              "0x9f55",
              "0x9f69",
              "0x9f79",
              "0x9b2e",
              "0x96dc",
              "0x9f88",
              "0x166d1"
            ]
          },
          {
            "c": 1.0,
            "d": "DEP / NX enabled (NX_COMPAT)",
            "e": [
              "[dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-dep",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE .reloc section presence",
            "e": [
              ".reloc"
            ],
            "i": "metadata/binary/section/names::reloc-section-presence",
            "l": 2
          },
          {
            "a": "T1027.009",
            "c": 0.8600000143051147,
            "d": ".NET ResourceReader payload access",
            "e": [
              "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.…"
            ],
            "i": "micro-behaviors/data/embedded/payload/resource::dotnet-resource-reader",
            "l": 1,
            "el": [
              "0x17d88"
            ]
          },
          {
            "c": 1.0,
            "d": "PE has RT_GROUP_ICON in resources list",
            "e": [
              "[RT_ICON, RT_GROUP_ICON, RT_VERSION, RT_MANIFEST]"
            ],
            "i": "metadata/binary/resource::pe-resource-group-icon-list",
            "l": 2,
            "el": [
              "value:pe.resource_types"
            ]
          },
          {
            "c": 1.0,
            "d": "ASLR enabled (DYNAMIC_BASE)",
            "e": [
              "[dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-aslr",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "c": 0.6800000071525574,
            "d": "Chromium Preferences file",
            "e": [
              "Preferences"
            ],
            "i": "micro-behaviors/fs/path/sensitive/browser::chromium-preferences-file",
            "l": 1,
            "el": [
              "0xaa8b"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE ProductName metadata field",
            "e": [
              "ProductName"
            ],
            "i": "metadata/package/versioning::pe-productname-field",
            "l": 2,
            "el": [
              "0xbd662"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE resource section",
            "e": [
              ".rsrc"
            ],
            "i": "metadata/binary/section/names::pe-resource-section",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard runtime section",
            "e": [
              ".reloc"
            ],
            "i": "metadata/binary/section/names::pe-runtime-standard-section",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Regex component marker",
            "e": [
              "StringFileInfo",
              "ToString",
              "Strings",
              "GetResourceString",
              "DrawString",
              "ReadString",
              "CompareString"
            ],
            "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7",
            "l": 1,
            "el": [
              "0xbd46e",
              "0xa0e4",
              "0xab8d",
              "0xa0c4",
              "0xa0ed",
              "0xa0b9",
              "0xa0d6"
            ]
          },
          {
            "c": 0.8500000238418579,
            "d": "Visual Basic runtime reference",
            "e": [
              "Microsoft.VisualBasic",
              "Microsoft.VisualBasic.Devices",
              "Microsoft.VisualBasic.CompilerServices",
              "Microsoft.VisualBasic.ApplicationServices"
            ],
            "i": "metadata/lang/compiler/managed::visual-basic-runtime",
            "l": 2,
            "el": [
              "0x977b",
              "0xa9bf",
              "0xaa44",
              "0xa9fb"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE has under ten imports",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE with six or fewer imports",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "metadata/binary/symbols/imports::pe-imports-max-six",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "WCF generated code attribute",
            "e": [
              "GeneratedCodeAttribute"
            ],
            "i": "micro-behaviors/communications/ipc/wcf::dotnet-wcf-generated-code-attribute",
            "l": 1,
            "el": [
              "0x9ce3"
            ]
          },
          {
            "c": 0.6000000238418579,
            "d": "GetTypes method reference",
            "e": [
              "GetTypes"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/invoke::dotnet-gettypes-token",
            "l": 1,
            "el": [
              "0xab52"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "CodeDom compiler access",
            "e": [
              "System.CodeDom.Compiler"
            ],
            "i": "metadata/lang/compiler/managed::codedom-compiler",
            "l": 2,
            "el": [
              "0xa892"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Manifest is MyApplication template name",
            "e": [
              "MyApplication.app"
            ],
            "i": "metadata/build/manifest::pe-manifest-myapplication-template",
            "l": 3,
            "el": [
              "value:pe.manifest.assembly_identity.name"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": ".NET Socket Send/Receive methods",
            "e": [
              "Receive",
              "Send"
            ],
            "i": "micro-behaviors/communications/socket/create::socket-receive-send-str",
            "l": 1,
            "el": [
              "0x9f93",
              "0x98ae"
            ]
          },
          {
            "c": 0.8500000238418579,
            "d": "IPv4-like .NET assembly version",
            "e": [
              "Version=4.0.0.0"
            ],
            "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version",
            "l": 2,
            "el": [
              "0x17d88"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE FileDescription metadata field",
            "e": [
              "FileDescription"
            ],
            "i": "metadata/package/versioning::pe-filedescription-field",
            "l": 2,
            "el": [
              "0xbd4fa"
            ]
          },
          {
            "a": "T1027",
            "c": 0.8399999737739563,
            "d": "VB6 PE with three sections",
            "e": [
              "sections.count = 3.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.699999988079071,
            "d": "High string count over 1000",
            "e": [
              "binary.string_count = 5185.00"
            ],
            "i": "metadata/binary/metrics/threshold::high-string-count-1000",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.8199999928474426,
            "d": "Packed loader largest section ratio above 0.65",
            "e": [
              "binary.largest_section_ratio = 0.85"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8399999737739563,
            "d": "Binary has 80 or fewer imports",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics/imports::max-80-imports",
            "l": 1
          },
          {
            "a": "T1612",
            "c": 0.8500000238418579,
            "d": "PE has few icon resources",
            "e": [
              "pe.icon_count = 2.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six",
            "l": 1,
            "m": "B0023"
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)",
            "e": [
              "pe.resource_count = 4.00"
            ],
            "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources",
            "l": 1
          },
          {
            "a": "T1105",
            "c": 0.800000011920929,
            "d": "Compact PE import table",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table",
            "l": 1,
            "m": "E1105"
          },
          {
            "a": "T1055",
            "c": 0.800000011920929,
            "d": "Executable section with very low entropy",
            "e": [
              ".text (size: 660992, perms: r-x)"
            ],
            "i": "objectives/anti-static/obfuscation/binary-structure::low-entropy-executable",
            "l": 1
          },
          {
            "c": 1.0,
            "d": ".NET BSJB metadata marker",
            "e": [
              "BSJB"
            ],
            "i": "metadata/binary/framework::bsjb-marker",
            "l": 1
          },
          {
            "c": 0.4000000059604645,
            "d": "XOR decryption loop byte pattern",
            "e": [
              "0f 4b 41 fc 7b"
            ],
            "i": "objectives/anti-analysis/self-modify/runtime::xor-loop-pattern",
            "l": 1,
            "el": [
              "0x542c6"
            ]
          },
          {
            "c": 0.8399999737739563,
            "d": "Large binary with few DLL dependencies",
            "e": [
              "dependencies.count = 1.00"
            ],
            "i": "metadata/package/metrics::import-count-under-80",
            "l": 2
          },
          {
            "a": "T1055",
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571",
            "l": 1,
            "m": "C0041"
          },
          {
            "c": 0.949999988079071,
            "d": "Filename has EXE extension",
            "e": [
              "08e2b0e469f2809991e59e65177fe994f3aeeea601a2af8aec6c7ae1406debb0.exe"
            ],
            "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe",
            "l": 1
          },
          {
            "d": ".exe extension reference",
            "e": [
              ".exe"
            ],
            "i": "micro-behaviors/fs/path/extension::exe-dup",
            "l": 2,
            "el": [
              "0x9ff2"
            ]
          },
          {
            "a": "T1027",
            "c": 0.8600000143051147,
            "d": "Long mixed-case identifiers cluster",
            "e": [
              "DebuggableAttribute",
              "DesignerGeneratedAttribute",
              "EditorBrowsableAttribute",
              "CompilerGeneratedAttribute",
              "DebuggerBrowsableAttribute",
              "DebuggerNonUserCodeAttribute",
              "HideModuleNameAttribute",
              "AssemblyTitleAttribute",
              "DebuggerStepThroughAttribute",
              "GeneratedCodeAttribute",
              "ThreadStaticAttribute",
              "ComVisibleAttribute",
              "StandardModuleAttribute",
              "HelpKeywordAttribute",
              "ApplicationSettingsBase",
              "ThreadSafeObjectProvider"
            ],
            "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers",
            "l": 1,
            "m": "B0032",
            "el": [
              "0x9d17",
              "0x9ca5",
              "0x9d46",
              "0x9c8a",
              "0x9d2b",
              "0x9cfa",
              "0x9da2",
              "0x9d73",
              "0x9dba",
              "0x9ce3",
              "0x9c61",
              "0x9d5f",
              "0x9d8a",
              "0x9cce",
              "0x9baf",
              "0x9423"
            ]
          },
          {
            "a": "T1027",
            "c": 0.8500000238418579,
            "d": "Sparse import table",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-import-count",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "binary.largest_section_ratio = 0.85"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.949999988079071,
            "d": "links mscoree (CorExeMain)",
            "e": [
              "mscoree"
            ],
            "i": "metadata/dylib::mscoree",
            "l": 2,
            "el": [
              "1 symbols"
            ]
          },
          {
            "a": "T1036.005",
            "c": 0.9399999976158142,
            "d": "Two dotted-quad version strings",
            "e": [
              "1.0.0.0"
            ],
            "i": "objectives/evasion/masquerade/identity/fabricated::dotted-quad-version-pair",
            "l": 1,
            "el": [
              "value:pe.version.file_version"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "PE version numbers look like IPv4",
            "e": [
              "1.0.0.0"
            ],
            "i": "metadata/package/versioning::version-number-ipv4-metadata",
            "l": 1,
            "el": [
              "value:pe.version.file_version"
            ]
          },
          {
            "a": "T1036.005",
            "c": 0.8199999928474426,
            "d": "Low-import PE without dominant resources",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/evasion/masquerade/version-resource/claim::low-import-pe-without-heavy-rsrc",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Encoded payload detected: hex → base64",
            "e": [
              "\u003cbinary data\u003e \u003chex+base64\u003e"
            ],
            "i": "metadata/encoded-payload/hex-base64",
            "l": 3,
            "el": [
              "offset:114847"
            ]
          }
        ],
        "sha": "08e2b0e469f2809991e59e65177fe994f3aeeea601a2af8aec6c7ae1406debb0",
        "path": "08e2b0e469f2809991e59e65177fe994f3aeeea601a2af8aec6c7ae1406debb0.exe",
        "type": "pe"
      }
    ],
    "tv": "52045"
  }
}