{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 0.8911781907081604,
        "class": 0,
        "threshold": 0.9987763166427612
      }
    ],
    "prob": 0.8911782,
    "class": 0,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.8911782,
        "class": 0
      },
      {
        "m": "az/native",
        "prob": 0.97402596,
        "class": 0
      },
      {
        "m": "az/pe",
        "prob": 0.6589404,
        "class": 0
      }
    ],
    "version": "v17.17",
    "threshold": 0.9987763,
    "analyzed_at": "2026-05-31T07:51:46Z"
  },
  "path": "5599b3c6b633d903c29de06459acba19fc1cf0615038c01771b0b5f1c4e5cb8b.exe",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "H(Cm)Md₂(Bk)",
        "x": 5,
        "ff": {
          "i": [
            [
              "mscoree",
              "CorExeMain"
            ]
          ],
          "m": {
            "pe": {
              "checksum": 0.0,
              "icon_count": 2.0,
              "has_manifest": 1.0,
              "checksum_valid": 0.0,
              "resource_count": 4.0,
              "has_version_info": 1.0,
              "checksum_stripped": 1.0,
              "computed_checksum": 250558.0,
              "bss_like_section_count": 0.0,
              "section_overflow_count": 0.0,
              "misaligned_section_count": 0.0,
              "base_relocation_block_count": 1.0,
              "base_relocation_entry_count": 1.0
            },
            "file": {
              "size": 190464.0,
              "entropy": 5.31,
              "size_bytes": 190464.0
            },
            "binary": {
              "is_pie": 1.0,
              "code_entropy": 5.86,
              "string_count": 1047.0,
              "entropy_variance": 6.46,
              "avg_string_length": 22.34,
              "max_string_length": 6019.0,
              "code_to_data_ratio": 1.0,
              "string_length_stddev": 208.26,
              "largest_section_ratio": 0.86,
              "sentence_string_count": 8.0,
              "sentence_string_ratio": 0.01,
              "high_entropy_string_count": 0.0
            },
            "imports": {
              "count": 1.0
            },
            "sections": {
              "count": 3.0,
              "code_size": 25600.0,
              "entropy_max": 5.86,
              "entropy_mean": 3.64,
              "name_entropy": 3.03,
              "writable_count": 0.0,
              "executable_count": 1.0,
              "nonstandard_count": 0.0,
              "executable_writable_count": 0.0
            },
            "dependencies": {
              "count": 1.0
            }
          },
          "s": [
            [
              77,
              "u8",
              "!This program cannot be run in DOS mode."
            ],
            [
              376,
              "u8",
              ".text"
            ],
            [
              455,
              "u8",
              "@.reloc"
            ],
            [
              5560,
              "u8",
              "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R"
            ],
            [
              5717,
              "u8",
              "PADPADP"
            ],
            [
              5728,
              "u8",
              "BSJB"
            ],
            [
              8793,
              "u8",
              "B0j9b1ab6f37Ju4A9YSH6eE5aNq2y880"
            ],
            [
              8826,
              "u8",
              "C8dx1auw66559a58b0Ev8fwBj22kK0"
            ],
            [
              8857,
              "u8",
              "A5euyP5P81c84cf7f450a0"
            ],
            [
              8880,
              "u8",
              "2D8cx24289d8Htdce2ta5a0"
            ],
            [
              8904,
              "u8",
              "4smM2ba5Z91Rc2acc12Ib0"
            ],
            [
              8927,
              "u8",
              "5B9L257Z8aq1fd3aaHba984Vu2j5v5s90296q0"
            ],
            [
              8966,
              "u8",
              "C5p4f88b46Wt264p11"
            ],
            [
              8985,
              "u8",
              "BdqB08r46edc65faae193241"
            ],
            [
              9010,
              "u8",
              "FfcaCT1de84ef59cN758cdcn25QY1"
            ],
            [
              9047,
              "u8",
              "ReadOnlyCollection`1"
            ],
            [
              9068,
              "u8",
              "IEnumerator`1"
            ],
            [
              9089,
              "u8",
              "Fc6Z30L29AP34ch93jca596a1"
            ],
            [
              9115,
              "u8",
              "2KTaD6etj4e8u5YfO2fcy4a99ab1"
            ],
            [
              9154,
              "u8",
              "9d8mP186Qb8eoE68L46d94dxa581505l4z014fdJaR64513p1"
            ],
            [
              9204,
              "u8",
              "3ob94441872dfmN8y5q1"
            ],
            [
              9225,
              "u8",
              "FWr67pfAt4d4f4008h5A81sjb0b68Gad0e4ur1"
            ],
            [
              9264,
              "u8",
              "ToInt32"
            ],
            [
              9272,
              "u8",
              "3dXaKf9Je93lR6hf1J16l6f88T5T5d8dc94892"
            ],
            [
              9318,
              "u8",
              "Dictionary`2"
            ],
            [
              9331,
              "u8",
              "52b58cdm419Y6f92F4818jeb8fj0N61oC255Ba9f38nCed2"
            ],
            [
              9379,
              "u8",
              "981f9691I1f9fhad7ba9MUtU68dl201k8Yff6c450f2"
            ],
            [
              9423,
              "u8",
              "DfyLaPaNaf2"
            ],
            [
              9435,
              "u8",
              "176fe0T6c9u9W25137de70u7Mde9xRec3c04SU175ccffn2"
            ],
            [
              9483,
              "u8",
              "W02f0T4X15xy8I88Xfdf6c0zAc10jc45f804g4oe6Pk8x2"
            ],
            [
              9530,
              "u8",
              "get_7ud9fcQfzb73zC93f6dp84393"
            ],
            [
              9567,
              "u8",
              "E92mef2Ieu19I4005vR4uH1E24"
            ],
            [
              9594,
              "u8",
              "72Qq52fQf0Sc6b44"
            ],
            [
              9611,
              "u8",
              "0USIc6bO5cQuh19Rvc6d992q47ka143c3e5hi80h2FM77a4"
            ],
            [
              9659,
              "u8",
              "4O2189I0kg9S55V4sa4"
            ],
            [
              9679,
              "u8",
              "0968c4qdUW06BQ5d830MOS066XG92L5FfQe5b4"
            ],
            [
              9718,
              "u8",
              "98da034UaT10dda21c26yx50ARnfL5Z798c761dEf088f4"
            ],
            [
              9765,
              "u8",
              "7Ff90069eSiB0aXacaei54JM4f4f1a923092d4g0h4"
            ],
            [
              9808,
              "u8",
              "14Rb80Z3e01F9Y9580a8v02n4"
            ],
            [
              9834,
              "u8",
              "Z5q251c32d055B9yH7N3698P8iqdk54aO144x4"
            ],
            [
              9884,
              "u8",
              "R99b408b6FlAc11849NaejVgb0M5"
            ],
            [
              9913,
              "u8",
              "Df2yt6yt47Z2w41412h5"
            ],
            [
              9934,
              "u8",
              "895OAaqj29dca2Uyt830W95rbc27DV9056d1166o46"
            ],
            [
              9977,
              "u8",
              "E864Su5u2a486"
            ],
            [
              9991,
              "u8",
              "2dY55tG6yI6825raXLy0119dgf886"
            ],
            [
              10021,
              "u8",
              "V5SFy7Ov8rd90g0ec1fU96"
            ],
            [
              10044,
              "u8",
              "DK7A7mV912n2Pw41fU408x06cAZGc68T2677"
            ],
            [
              10081,
              "u8",
              "V1Dci85h018"
            ],
            [
              10093,
              "u8",
              "18ec1h9KfSdfaVLo21T78cf6U1chad184H492c2a00fh248"
            ],
            [
              10141,
              "u8",
              "502dg7998XS68"
            ],
            [
              10155,
              "u8",
              "4ZC7698"
            ],
            [
              10163,
              "u8",
              "4d9Y8655C402j4828b9f7bf35975w0bg52VqCd4ZE8"
            ],
            [
              10206,
              "u8",
              "418k7UGS2kacb82JhP981csecfbaW10acOe869cc1049ofNG8"
            ],
            [
              10256,
              "u8",
              "2bs9MNZW57866f35B8cK4cKF48842aZ0jI58ccg5zcacW06K8"
            ],
            [
              10306,
              "u8",
              "0c9d84xfafU8"
            ],
            [
              10319,
              "u8",
              "095a7cW1MK0Ncb7z28T174ca43LwJGd8lV86QcA0T6b9kM5Z8"
            ],
            [
              10369,
              "u8",
              "Io707eHiId69IMyrn442cKdfSa7d114AGc8"
            ],
            [
              10405,
              "u8",
              "1q04sWaax6qb3WYd9GciHR9fad80Tfc8"
            ],
            [
              10438,
              "u8",
              "J690f061T221795E8m2nF7s01H1m21YEf8248Rcok08c2yc8"
            ],
            [
              10487,
              "u8",
              "Ed4be79md7yc8"
            ],
            [
              10501,
              "u8",
              "C61zMf3zf3dL2y8atd39J89129fTJccid8r91VI2Dc88aU1e8"
            ],
            [
              10551,
              "u8",
              "A9a19817UN6S60211dV9K88wc4a8cC24816gVu904R4c6vFf8"
            ],
            [
              10601,
              "u8",
              "04801878ac9SEf5908af8"
            ],
            [
              10623,
              "u8",
              "6cZd08avb4cK6if8"
            ],
            [
              10648,
              "u8",
              "641144eg9320eay8Icbaqdj557fb29"
            ],
            [
              10679,
              "u8",
              "F80F1dbmXbc7J49"
            ],
            [
              10695,
              "u8",
              "Uf3y7E5b84cn49"
            ],
            [
              10710,
              "u8",
              "8dS21Df5A4cc7V45rf4a8c6c0NR5fc051dU2chf9669"
            ],
            [
              10754,
              "u8",
              "8bNf5BVPC65K1HhcXSd0B8a88dp60345pf9clcWcf779"
            ],
            [
              10799,
              "u8",
              "QVdd8e6sx1dva8cz4fNRg9JfJc80f92d89"
            ],
            [
              10834,
              "u8",
              "NXe4854e9aadkQ7Daa0Ha3ex1c6cW99x8c5a9799"
            ],
            [
              10875,
              "u8",
              "93qR747c7aj7f9nBA4fvuS4H5ofG38cz78899"
            ],
            [
              10913,
              "u8",
              "9a6ed6eaF66d11faf8V49zawmc8a9u88a41db83i6bjci42I9"
            ],
            [
              10963,
              "u8",
              "8Ib1La5212813A459g0dP13xmd480iIV6Yjv67f6sN9"
            ],
            [
              11007,
              "u8",
              "F74c1c1f4hGdBcdsU9"
            ],
            [
              11026,
              "u8",
              "84d38adLm0M0d9xX6T558a9"
            ],
            [
              11050,
              "u8",
              "DXIR921Sc0yf2715ca9"
            ],
            [
              11070,
              "u8",
              "NFaHYDrRc9xf8496D9aY1B901cY2648t0Ke994b9"
            ],
            [
              11111,
              "u8",
              "9f0Na23c52Yf1fdB8PqN6zR0G1RK407c9"
            ],
            [
              11145,
              "u8",
              "DubZWH547sucL82x7d808dKb92978cfT4l9S181a6Dec9"
            ],
            [
              11191,
              "u8",
              "Z2f4O9c81V8feff577fc9"
            ],
            [
              11213,
              "u8",
              "978Ja27085npW59fFYieu1enXW2f9"
            ],
            [
              11243,
              "u8",
              "get_D8D1mbf71F58n877GaUN8859f3063p51Xs9a9e0U5ZX1o12r9"
            ],
            [
              11297,
              "u8",
              "set_D8D1mbf71F58n877GaUN8859f3063p51Xs9a9e0U5ZX1o12r9"
            ],
            [
              11351,
              "u8",
              "Dff3adI04314y89cRfDeP42w4g266G65Yc75cw7B"
            ],
            [
              11392,
              "u8",
              "9g348c9829f8e0de6fb1f8WD"
            ],
            [
              11417,
              "u8",
              "Gd9XOz4d7Z4fU23fb19ZVfe9Z4430cIm8facea9dG"
            ],
            [
              11459,
              "u8",
              "Fc1D8o94fcM75aaj94w90ffbe4f150e58H"
            ],
            [
              11494,
              "u8",
              "F9dfckWIg782y041fac6m4N8ajced47Xd5vfjKaC1ZA0Ib49K"
            ],
            [
              11544,
              "u8",
              "9nI60cI4g19l285y2858f7PjX35fc954M"
            ],
            [
              11578,
              "u8",
              "get_4vc67m472k2e4d3iN4fadfPZ9cb8JE4dthc8efdM"
            ],
            [
              11623,
              "u8",
              "4dLpcDQEd5461Bfs11sN"
            ],
            [
              11644,
              "u8",
              "System.IO"
            ],
            [
              11654,
              "u8",
              "1a4efff45f8eP9fZ345684dcuf2EL7xM861ah7fO"
            ],
            [
              11695,
              "u8",
              "4adah2bse12S8ida3426Rr932dTR"
            ],
            [
              11724,
              "u8",
              "Qad4q47aec27O8993dAuAefzC8TQ1eGa8t1985b072s49T59S"
            ],
            [
              11774,
              "u8",
              "7d29HcI829xafS2TR9579q2Fz821f4G46Z890b8ET"
            ],
            [
              11816,
              "u8",
              "10518w41j87MF4Xp3U5Zb6X4Nf90cd9Nn9f54Aqfx888998MW"
            ],
            [
              11866,
              "u8",
              "D1xM49f40c0cm14724cfZ1f0Y"
            ],
            [
              11892,
              "u8",
              "0826fIXHb6709Z21Jd7d08fc1a"
            ],
            [
              11919,
              "u8",
              "9fJd6Aab18fadLamI0f48Wdfd8dfc48a"
            ],
            [
              11952,
              "u8",
              "0ya0882cbuf3fCa"
            ],
            [
              11968,
              "u8",
              "MU05e13cbGA9Qa"
            ],
            [
              11983,
              "u8",
              "99c4aMlShf4IU87dfd8cf6db70la"
            ],
            [
              12012,
              "u8",
              "4581588484ce2q56ypbc2Y8in0Kd4rEe8483a2hbEfq8ra"
            ],
            [
              12059,
              "u8",
              "A7O9HdwO09cic50za"
            ],
            [
              12077,
              "u8",
              "144Usaa091c11WCcdcf73q7AWAf1848d48ff94s3fAd8a82ab"
            ],
            [
              12127,
              "u8",
              "mscorlib"
            ],
            [
              12136,
              "u8",
              "G6cp361213DT58l70r1c"
            ],
            [
              12157,
              "u8",
              "Waa8821c8nX9fWJ982c"
            ],
            [
              12177,
              "u8",
              "04664a182a8K2YJ9db75V97BbO6cs3c"
            ],
            [
              12209,
              "u8",
              "O518LM8J5YSdd4fO1d402f926DcfgeadYfo0C98dw6L18c"
            ],
            [
              12256,
              "u8",
              "Dd258b197fd8dj98h48z9c"
            ],
            [
              12279,
              "u8",
              "8a29r02k168na5UM69Efe852f81I9a01caa3cv6ds9cVasEc"
            ],
            [
              12328,
              "u8",
              "7cdr82K6HoZccaUf086Gac"
            ],
            [
              12351,
              "u8",
              "System.Collections.Generic"
            ],
            [
              12378,
              "u8",
              "Microsoft.VisualBasic"
            ],
            [
              12400,
              "u8",
              "5df1aE8fY80lc"
            ],
            [
              12414,
              "u8",
              "FromAsync"
            ],
            [
              12424,
              "u8",
              "VW11c8f72e50m814205b9z41d"
            ],
            [
              12450,
              "u8",
              "Dd2d190000j9F19afead1d"
            ],
            [
              12473,
              "u8",
              "Cd8btM0pdF2fMdRh8R12d"
            ],
            [
              12495,
              "u8",
              "Drnbf45j89c9d19Gxh4B6248IKV1hmr8a8a04Nda8Pha15R2d"
            ],
            [
              12545,
              "u8",
              "94DE992bC0018a7L2ad32NE0U42u5d"
            ],
            [
              12586,
              "u8",
              "Thread"
            ],
            [
              12593,
              "u8",
              "7dp78d2fImK0395uA8k98z5t225dd"
            ],
            [
              12627,
              "u8",
              "Versioned"
            ],
            [
              12637,
              "u8",
              "Synchronized"
            ],
            [
              12650,
              "u8",
              "7Pq5Rc758DMhfef4585r62b9fd"
            ],
            [
              12677,
              "u8",
              "Append"
            ],
            [
              12684,
              "u8",
              "UriKind"
            ],
            [
              12692,
              "u8",
              "set_Method"
            ],
            [
              12703,
              "u8",
              "CompareMethod"
            ],
            [
              12717,
              "u8",
              "9VxD119478aep9vb37UH0BfbpCdf2Y92i5Lu23dzqd"
            ],
            [
              12760,
              "u8",
              "64rAY2d0eF9dc7a6Nmr047e"
            ],
            [
              12784,
              "u8",
              "1efLe462cPKfe940cy001kd9e"
            ],
            [
              12810,
              "u8",
              "ImJc541P76bF42c916258hBtq07Fe"
            ],
            [
              12840,
              "u8",
              "5fa0bZ4dR8ae"
            ],
            [
              12853,
              "u8",
              "AhJ1E1i4268c1dbe"
            ],
            [
              12870,
              "u8",
              "Replace"
            ],
            [
              12878,
              "u8",
              "IsNullOrWhiteSpace"
            ],
            [
              12897,
              "u8",
              "Evidence"
            ],
            [
              12906,
              "u8",
              "CredentialCache"
            ],
            [
              12922,
              "u8",
              "O66IJ911uo1f8ejI26696a63ke"
            ],
            [
              12949,
              "u8",
              "IDisposable"
            ],
            [
              12961,
              "u8",
              "RuntimeTypeHandle"
            ],
            [
              12979,
              "u8",
              "GetTypeFromHandle"
            ],
            [
              13008,
              "u8",
              "CallByName"
            ],
            [
              13019,
              "u8",
              "PolicyLevelType"
            ],
            [
              13035,
              "u8",
              "CallType"
            ],
            [
              13044,
              "u8",
              "Capture"
            ],
            [
              13052,
              "u8",
              "ApplicationSettingsBase"
            ],
            [
              13076,
              "u8",
              "WebResponse"
            ],
            [
              13088,
              "u8",
              "EndGetResponse"
            ],
            [
              13103,
              "u8",
              "BeginGetResponse"
            ],
            [
              13120,
              "u8",
              "Dispose"
            ],
            [
              13128,
              "u8",
              "Create"
            ],
            [
              13135,
              "u8",
              "EditorBrowsableState"
            ],
            [
              13156,
              "u8",
              "CompilerGeneratedAttribute"
            ],
            [
              13183,
              "u8",
              "GeneratedCodeAttribute"
            ],
            [
              13206,
              "u8",
              "DebuggerNonUserCodeAttribute"
            ],
            [
              13235,
              "u8",
              "EditorBrowsableAttribute"
            ],
            [
              13260,
              "u8",
              "DefaultSettingValueAttribute"
            ],
            [
              13289,
              "u8",
              "UserScopedSettingAttribute"
            ],
            [
              13316,
              "u8",
              "ParamArrayAttribute"
            ],
            [
              13336,
              "u8",
              "get_Value"
            ],
            [
              13346,
              "u8",
              "value"
            ],
            [
              13352,
              "u8",
              "Save"
            ],
            [
              13357,
              "u8",
              "0c9d84xfafU8.exe"
            ],
            [
              13374,
              "u8",
              "8l8931ze"
            ],
            [
              13383,
              "u8",
              "1Kfak24m2f74d10j6882Xsdx8elz9gD8JX9Vf1U11f"
            ],
            [
              13426,
              "u8",
              "F855589t27DfH08cxSaTff2bV8S22K5ba1f"
            ],
            [
              13462,
              "u8",
              "On6U26vcc2iRy8f4a9821f82d4ueH20fWR4c0id6oaT6a15f"
            ],
            [
              13511,
              "u8",
              "YdHJ5eaDd229B00f98f"
            ],
            [
              13531,
              "u8",
              "C727f2Lh16a8B11fkcaa6d8VHd9971W4pFf"
            ],
            [
              13567,
              "u8",
              "KY883P89A4g55O0a4a04mfed942sPC4fIf"
            ],
            [
              13602,
              "u8",
              "LastIndexOf"
            ],
            [
              13614,
              "u8",
              "get_D9Qdj5a7cbbb1f849hrf47aMGakf018IPtp1o21f4baf"
            ],
            [
              13663,
              "u8",
              "set_D9Qdj5a7cbbb1f849hrf47aMGakf018IPtp1o21f4baf"
            ],
            [
              13712,
              "u8",
              "1afUfTU184edf"
            ],
            [
              13726,
              "u8",
              "GHE8d4r4S4Nrdq1Ke99147cKp998lff"
            ],
            [
              13758,
              "u8",
              "0c8kc8a9bqd9Cu9fHaUz7f91ayf"
            ],
            [
              13786,
              "u8",
              "MN0a7z8O9cR5laKY06ai9932948kU4g"
            ],
            [
              13818,
              "u8",
              "System.Threading"
            ],
            [
              13835,
              "u8",
              "DownloadString"
            ],
            [
              13850,
              "u8",
              "ToString"
            ],
            [
              13859,
              "u8",
              "GetString"
            ],
            [
              13869,
              "u8",
              "Substring"
            ],
            [
              13879,
              "u8",
              "Match"
            ],
            [
              13885,
              "u8",
              "get_AbsolutePath"
            ],
            [
              13902,
              "u8",
              "get_LocalPath"
            ],
            [
              13916,
              "u8",
              "GetFolderPath"
            ],
            [
              13930,
              "u8",
              "get_Length"
            ],
            [
              13941,
              "u8",
              "EndsWith"
            ],
            [
              13950,
              "u8",
              "StartsWith"
            ],
            [
              13976,
              "u8",
              "Cd0m9e58ja5c0d29ce25f59620a4dff48429j"
            ],
            [
              14014,
              "u8",
              "AsyncCallback"
            ],
            [
              14028,
              "u8",
              "Task"
            ],
            [
              14033,
              "u8",
              "NetworkCredential"
            ],
            [
              14051,
              "u8",
              "GetCredential"
            ],
            [
              14065,
              "u8",
              "System.Collections.ObjectModel"
            ],
            [
              14096,
              "u8",
              "System.ComponentModel"
            ],
            [
              14118,
              "u8",
              "PolicyLevel"
            ],
            [
              14130,
              "u8",
              "get_Item"
            ],
            [
              14139,
              "u8",
              "System"
            ],
            [
              14146,
              "u8",
              "Trim"
            ],
            [
              14151,
              "u8",
              "4o9Hg03zrW2wz1T758dH5iQct57W7dd9Z5cH6n"
            ],
            [
              14190,
              "u8",
              "Boolean"
            ],
            [
              14198,
              "u8",
              "TimeSpan"
            ],
            [
              14207,
              "u8",
              "Join"
            ],
            [
              14212,
              "u8",
              "IPermission"
            ],
            [
              14224,
              "u8",
              "System.Configuration"
            ],
            [
              14245,
              "u8",
              "System.Globalization"
            ],
            [
              14266,
              "u8",
              "System.Reflection"
            ],
            [
              14284,
              "u8",
              "MatchCollection"
            ],
            [
              14300,
              "u8",
              "FormCollection"
            ],
            [
              14315,
              "u8",
              "GroupCollection"
            ],
            [
              14331,
              "u8",
              "WebHeaderCollection"
            ],
            [
              14351,
              "u8",
              "WebException"
            ],
            [
              14364,
              "u8",
              "MissingManifestResourceException"
            ],
            [
              14397,
              "u8",
              "IndexOutOfRangeException"
            ],
            [
              14422,
              "u8",
              "AggregateException"
            ],
            [
              14441,
              "u8",
              "FormatException"
            ],
            [
              14457,
              "u8",
              "TimeoutException"
            ],
            [
              14474,
              "u8",
              "StringComparison"
            ],
            [
              14491,
              "u8",
              "CultureInfo"
            ],
            [
              14503,
              "u8",
              "25bacCdf1p"
            ],
            [
              14514,
              "u8",
              "Sleep"
            ],
            [
              14520,
              "u8",
              "Group"
            ],
            [
              14526,
              "u8",
              "Char"
            ],
            [
              14531,
              "u8",
              "StringBuilder"
            ],
            [
              14545,
              "u8",
              "SpecialFolder"
            ],
            [
              14559,
              "u8",
              "System.Resources.ResourceManager"
            ],
            [
              14592,
              "u8",
              "System.CodeDom.Compiler"
            ],
            [
              14616,
              "u8",
              "IEnumerator"
            ],
            [
              14628,
              "u8",
              "GetEnumerator"
            ],
            [
              14642,
              "u8",
              ".ctor"
            ],
            [
              14648,
              "u8",
              ".cctor"
            ],
            [
              14655,
              "u8",
              "E20UOFd85gPU9v982LKs"
            ],
            [
              14676,
              "u8",
              "System.Diagnostics"
            ],
            [
              14695,
              "u8",
              "FromSeconds"
            ],
            [
              14707,
              "u8",
              "Microsoft.VisualBasic.CompilerServices"
            ],
            [
              14746,
              "u8",
              "System.Runtime.CompilerServices"
            ],
            [
              14778,
              "u8",
              "System.Resources"
            ],
            [
              14795,
              "u8",
              "1a4efff45f8eP9fZ345684dcuf2EL7xM861ah7fO.Properties.Resources.resources"
            ],
            [
              14867,
              "u8",
              "Matches"
            ],
            [
              14875,
              "u8",
              "Strings"
            ],
            [
              14883,
              "u8",
              "System.Threading.Tasks"
            ],
            [
              14906,
              "u8",
              "ICredentials"
            ],
            [
              14919,
              "u8",
              "set_Credentials"
            ],
            [
              14935,
              "u8",
              "get_DefaultNetworkCredentials"
            ],
            [
              14965,
              "u8",
              "set_UseDefaultCredentials"
            ],
            [
              14991,
              "u8",
              "Equals"
            ],
            [
              14998,
              "u8",
              "System.Windows.Forms"
            ],
            [
              15019,
              "u8",
              "System.Text.RegularExpressions"
            ],
            [
              15050,
              "u8",
              "System.Security.Permissions"
            ]
          ],
          "v": {
            "file.stem": "5599b3c6b633d903c29de06459acba19fc1cf0615038c01771b0b5f1c4e5cb8b",
            "pe.imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
            "pe.machine": "i386",
            "pe.subsystem": "windows_gui",
            "pe.timestamp": 3899310314,
            "file.basename": "5599b3c6b633d903c29de06459acba19fc1cf0615038c01771b0b5f1c4e5cb8b.exe",
            "pe.image_base": 4194304,
            "pe.image_size": 212992,
            "pe.machine_id": 332,
            "pe.os_version": "4.0",
            "pe.version.os": "unknown",
            "pe.entry_point": 33390,
            "pe.headers_size": 512,
            "pe.version.type": "app",
            "pe.entry_section": ".text",
            "pe.subsystem_raw": 2,
            "pe.clr.is_il_only": 1,
            "pe.file_alignment": 512,
            "pe.image_hash.sha1": "7169b47e3bed94b26df7a65c184cf76e7cb7ef99",
            "pe.image_hash.sha256": "a9082da8ac011f9294dec2cf9162522c0d7e57f7f50095de6c50917123dbb801",
            "pe.image_hash.sha384": "1e3e74a4a1e4907165d74379aa5a9b94458bb38f49b3268e9bc70f462513a20880b8d7eb2f20ce615100997310e59539",
            "pe.image_hash.sha512": "605e30c72a34699c5a67ccdf72f0324e84f421eefdf1fb730a4cbd06c40c7db4b56234f06b7e3993d5b68da39213277319e25e9cd865de88e3d6cb60be208a21",
            "pe.resource_types[0]": "RT_ICON",
            "pe.resource_types[1]": "RT_GROUP_ICON",
            "pe.resource_types[2]": "RT_VERSION",
            "pe.resource_types[3]": "RT_MANIFEST",
            "pe.section_alignment": 8192,
            "pe.subsystem_version": "4.0",
            "pe.version.copyright": "Copyright ©  2021",
            "pe.characteristics[0]": "executable_image",
            "pe.characteristics[1]": "large_address_aware",
            "pe.manifest.ui_access": "false",
            "pe.characteristics_raw": 34,
            "pe.clr.runtime_version": "2.5",
            "pe.version.description": "first",
            "pe.linker_major_version": 48,
            "pe.version.file_version": "1.0.0.0",
            "pe.version.product_name": "first",
            "pe.version.internal_name": "first.exe",
            "pe.dll_characteristics[0]": "dynamic_base",
            "pe.dll_characteristics[1]": "nx_compat",
            "pe.dll_characteristics[2]": "no_seh",
            "pe.dll_characteristics[3]": "terminal_server_aware",
            "pe.data_directories[0].rva": 33300,
            "pe.data_directories[1].rva": 40960,
            "pe.data_directories[2].rva": 204800,
            "pe.data_directories[3].rva": 8192,
            "pe.data_directories[4].rva": 8200,
            "pe.dll_characteristics_raw": 34112,
            "pe.number_of_rva_and_sizes": 16,
            "pe.version.product_version": "1.0.0.0",
            "pe.data_directories[0].name": "import",
            "pe.data_directories[0].size": 87,
            "pe.data_directories[1].name": "resource",
            "pe.data_directories[1].size": 163744,
            "pe.data_directories[2].name": "base_relocation",
            "pe.data_directories[2].size": 12,
            "pe.data_directories[3].name": "iat",
            "pe.data_directories[3].size": 8,
            "pe.data_directories[4].name": "clr_runtime_header",
            "pe.data_directories[4].size": 72,
            "pe.version.original_filename": "first.exe",
            "pe.coff.dos_header_pe_pointer": 128,
            "pe.base_relocations.block_count": 1,
            "pe.base_relocations.entry_count": 1,
            "pe.base_relocations.padding_count": 1,
            "pe.manifest.assembly_identity.name": "MyApplication.app",
            "pe.manifest.assembly_identity.version": "1.0.0.0",
            "pe.manifest.requested_execution_level": "asInvoker"
          },
          "id": "pe",
          "sc": [
            [
              ".text",
              512,
              25600,
              5.86,
              "r-x"
            ],
            [
              ".rsrc",
              26112,
              163840,
              4.98,
              "r--"
            ],
            [
              ".reloc",
              189952,
              512,
              0.08,
              "r--"
            ]
          ]
        },
        "id": 0,
        "sz": 190464,
        "ts": [
          {
            "c": 1.0,
            "d": ".NET assembly detected via BSJB CLR metadata signature",
            "e": [
              "BSJB at offset 0x1660"
            ],
            "i": "metadata/dotnet/bsjb-signature",
            "l": 2,
            "el": [
              "0x1660"
            ]
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "5599b3c6b633d903c29de06459acba19fc1cf0615038c01771b0b5f1c4e5cb8b.exe"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "PE LegalCopyright field is populated",
            "e": [
              "Copyright ©  2021"
            ],
            "i": "metadata/package/versioning::pe-legal-copyright-present",
            "l": 1,
            "el": [
              "value:pe.version.copyright"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "Reflection method namespace token",
            "e": [
              "System.Reflection"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/invoke::namespace-import",
            "l": 1,
            "el": [
              "0x37ba"
            ]
          },
          {
            "c": 1.0,
            "d": ".NET Metadata Root (BSJB)",
            "e": [
              "BSJB"
            ],
            "i": "metadata/binary/framework::dotnet-metadata",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.8199999928474426,
            "d": ".NET StringBuilder Append use",
            "e": [
              "StringBuilder"
            ],
            "i": "objectives/command-and-control/dropper/staging/encrypted::dotnet-stringbuilder-append",
            "l": 1,
            "m": "C0025",
            "el": [
              "0x38c3"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "PE FileDescription field is populated",
            "e": [
              "first"
            ],
            "i": "metadata/package/versioning::pe-file-description-present",
            "l": 1,
            "el": [
              "value:pe.version.description"
            ]
          },
          {
            "a": "T1027",
            "c": 0.8199999928474426,
            "d": "Randomized executable name string",
            "e": [
              "0c9d84xfafU8.exe"
            ],
            "i": "objectives/anti-static/obfuscation/string/junking::randomized-exe-name",
            "l": 1,
            "m": "B0032",
            "el": [
              "0x342d"
            ]
          },
          {
            "c": 0.8600000143051147,
            "d": "VB CallByName late binding",
            "e": [
              "43 61 6C 6C 42 79 4E 61 6D 65"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/invoke::vb-callbyname-token",
            "l": 1,
            "el": [
              "0x32d0"
            ]
          },
          {
            "c": 0.6000000238418579,
            "d": "Copyright notice",
            "e": [
              "Copyright"
            ],
            "i": "metadata/package/license::copyright-word",
            "l": 2,
            "el": [
              "0x2e290"
            ]
          },
          {
            "c": 0.9200000166893005,
            "d": "PE FileVersion resembles IPv4",
            "e": [
              "1.0.0.0"
            ],
            "i": "metadata/package/versioning::pe-file-version-ipv4-shape",
            "l": 1,
            "el": [
              "value:pe.version.file_version"
            ]
          },
          {
            "d": ".dll extension reference",
            "e": [
              ".dll"
            ],
            "i": "micro-behaviors/fs/path/extension::dll-dup",
            "l": 2,
            "el": [
              "0x645e"
            ]
          },
          {
            "c": 0.8600000143051147,
            "d": "asInvoker manifest tag in resources",
            "e": [
              "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"/\u003e"
            ],
            "i": "metadata/binary/resource::asinvoker-resource-manifest-flex",
            "l": 2,
            "el": [
              "0x2e50d"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE has few sections",
            "e": [
              "sections.count = 3.00"
            ],
            "i": "metadata/binary/layout::legacy-few-sections",
            "l": 2
          },
          {
            "a": "T1027.003",
            "c": 0.7799999713897705,
            "d": ".NET resource manager reference",
            "e": [
              "System.Resources.ResourceManager"
            ],
            "i": "micro-behaviors/data/embedded/payload/image::dotnet-resource-manager-token",
            "l": 1,
            "m": "F0001.006",
            "el": [
              "0x38df"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "PE ProductName field is populated",
            "e": [
              "first"
            ],
            "i": "metadata/package/versioning::pe-product-name-present",
            "l": 1,
            "el": [
              "value:pe.version.product_name"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE file uses .exe extension",
            "e": [
              "5599b3c6b633d903c29de06459acba19fc1cf0615038c01771b0b5f1c4e5cb8b.exe"
            ],
            "i": "metadata/binary/framework::exe-extension",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Regex component marker",
            "e": [
              "DownloadString"
            ],
            "i": "micro-behaviors/communications/http/client/managed::webclient--rx-5",
            "l": 1,
            "el": [
              "0x360b"
            ]
          },
          {
            "c": 1.0,
            "d": "Binary has 1000 or more strings",
            "e": [
              "binary.string_count = 1047.00"
            ],
            "i": "metadata/binary/metrics/threshold::string-count-1000-plus",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "mscorlib reference",
            "e": [
              "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R",
              "mscorlib"
            ],
            "i": "metadata/lang/compiler/managed::mscorlib",
            "l": 2,
            "el": [
              "0x15b8",
              "0x2f5f"
            ]
          },
          {
            "c": 1.0,
            "d": "PE has RT_ICON in resources list",
            "e": [
              "[RT_ICON, RT_GROUP_ICON, RT_VERSION, RT_MANIFEST]"
            ],
            "i": "metadata/binary/resource::pe-resource-icon-list",
            "l": 2,
            "el": [
              "value:pe.resource_types"
            ]
          },
          {
            "a": "T1027",
            "c": 0.9900000095367432,
            "d": "PE version resource text",
            "e": [
              "VS_VERSION_INFO"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info",
            "l": 1,
            "m": "B0032",
            "el": [
              "0x2e0be"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE has many readable strings",
            "e": [
              "binary.string_count = 1047.00"
            ],
            "i": "metadata/binary/layout::many-readable-strings",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "PE CompanyName metadata field",
            "e": [
              "CompanyName"
            ],
            "i": "metadata/package/versioning::pe-companyname-field",
            "l": 2,
            "el": [
              "0x2e1b6"
            ]
          },
          {
            "a": "T1027",
            "c": 1.0,
            "d": "Binary has normal code entropy (\u003e5.5)",
            "e": [
              "binary.code_entropy = 5.86"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.800000011920929,
            "d": "WebClient.DownloadString method",
            "e": [
              "DownloadString"
            ],
            "i": "micro-behaviors/communications/http/client/managed::downloadstring",
            "l": 3,
            "el": [
              "0x360b"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard code/data section",
            "e": [
              ".text"
            ],
            "i": "metadata/binary/section/names::pe-code-data-standard-section",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "requestedExecutionLevel is asInvoker",
            "e": [
              "asInvoker"
            ],
            "i": "metadata/build/manifest::pe-as-invoker",
            "l": 2,
            "el": [
              "value:pe.manifest.requested_execution_level"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "Regex component marker",
            "e": [
              "WebClient"
            ],
            "i": "micro-behaviors/communications/http/client/managed::webclient--rx-4",
            "l": 1,
            "el": [
              "0x3b94"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE import table has exactly one entry",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "metadata/binary/symbols/imports::single-import-raw",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "PE carries side-by-side assembly manifest",
            "e": [
              "{\"requested_execution_level\":\"asInvoker\",\"ui_access\":\"false\",\"assembly_identity\":{\"name\":\"MyApplication.app\",\"version\":\"1.0.0.0\""
            ],
            "i": "metadata/build/manifest::pe-has-manifest",
            "l": 2,
            "el": [
              "value:pe.manifest"
            ]
          },
          {
            "c": 1.0,
            "d": "Binary has 4 or fewer sections",
            "e": [
              "sections.count = 3.00"
            ],
            "i": "objectives/command-and-control/infrastructure/config::max-sections-4",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Access to Headers getter",
            "e": [
              "get_Headers"
            ],
            "i": "micro-behaviors/communications/http/server/managed::http-headers-getter",
            "l": 1,
            "el": [
              "0x3b35"
            ]
          },
          {
            "c": 0.9200000166893005,
            "d": "PE ProductVersion resembles IPv4",
            "e": [
              "1.0.0.0"
            ],
            "i": "metadata/package/versioning::pe-product-version-ipv4-shape",
            "l": 1,
            "el": [
              "value:pe.version.product_version"
            ]
          },
          {
            "c": 1.0,
            "d": "NO_SEH (SafeSEH not used)",
            "e": [
              "[dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-no-seh",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Code section dominates file layout",
            "e": [
              "binary.largest_section_ratio = 0.86"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.699999988079071,
            "d": "PE InternalName metadata field",
            "e": [
              "InternalName"
            ],
            "i": "metadata/package/versioning::pe-internalname-field",
            "l": 2,
            "el": [
              "0x2e23e"
            ]
          },
          {
            "c": 0.8199999928474426,
            "d": "Repeated padding marker string block",
            "e": [
              "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING",
              "\u003c/assembly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…",
              "…embly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…",
              "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDING",
              "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…"
            ],
            "i": "objectives/anti-static/obfuscation/string/junking::repeated-padding-marker",
            "l": 1,
            "el": [
              "0x2e593",
              "0x2e593",
              "0x2e593",
              "0x2e593",
              "0x2e593"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "PE version info numeric fields present",
            "e": [
              "1.0.0.0"
            ],
            "i": "metadata/binary/anomaly/format::version-info-file-version-present",
            "l": 1,
            "el": [
              "value:pe.version.file_version"
            ]
          },
          {
            "a": "T1620",
            "c": 0.949999988079071,
            "d": "mscoree DLL string reference",
            "e": [
              "mscoree.dll"
            ],
            "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere",
            "l": 1,
            "m": "B0032",
            "el": [
              "0x645e"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE OriginalFilename metadata field",
            "e": [
              "OriginalFilename"
            ],
            "i": "metadata/package/versioning::pe-originalfilename-field",
            "l": 2,
            "el": [
              "0x2e2e6"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "Windows Forms UI framework",
            "e": [
              "System.Windows.Forms"
            ],
            "i": "metadata/lang/compiler/managed::winforms-ui",
            "l": 2,
            "el": [
              "0x3a96"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": ".NET WPF namespace reference",
            "e": [
              "System.Windows"
            ],
            "i": "well-known/game/mod::wpf-namespace-ref",
            "l": 1,
            "el": [
              "0x3a96"
            ]
          },
          {
            "a": "T1485",
            "c": 0.8999999761581421,
            "d": "Preserves .exe .gho .bak files",
            "e": [
              ".exe"
            ],
            "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist",
            "l": 1,
            "m": "C0047",
            "el": [
              "0x342d"
            ]
          },
          {
            "c": 0.6499999761581421,
            "d": ".NET Diagnostics namespace token",
            "e": [
              "System.Diagnostics"
            ],
            "i": "micro-behaviors/process/create/spawn::diagnostics-namespace-token-dotnet",
            "l": 1,
            "el": [
              "0x3954"
            ]
          },
          {
            "c": 0.7799999713897705,
            "d": "Assembly accessor token (get_Assembly)",
            "e": [
              "get_Assembly"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/invoke::get-assembly-token",
            "l": 1,
            "el": [
              "0x3cd3"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "SOCKS5 client greeting bytes",
            "e": [
              "05 01 00"
            ],
            "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes",
            "l": 1,
            "el": [
              "0x156f"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "System namespace reference",
            "e": [
              "System.Net",
              "System.Security",
              "System.IO"
            ],
            "i": "metadata/lang/compiler/managed::system-namespace",
            "l": 2,
            "el": [
              "0x3b5d",
              "0x3aca",
              "0x2d7c"
            ]
          },
          {
            "a": "T1562.001",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "value",
              "DefaultSettingValueAttribute",
              "get_Value"
            ],
            "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3",
            "l": 1,
            "m": "B0047",
            "el": [
              "0x3422",
              "0x33cc",
              "0x3418"
            ]
          },
          {
            "c": 1.0,
            "d": "DEP / NX enabled (NX_COMPAT)",
            "e": [
              "[dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-dep",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE .reloc section presence",
            "e": [
              ".reloc"
            ],
            "i": "metadata/binary/section/names::reloc-section-presence",
            "l": 2
          },
          {
            "a": "T1027.009",
            "c": 0.8600000143051147,
            "d": ".NET ResourceReader payload access",
            "e": [
              "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.…"
            ],
            "i": "micro-behaviors/data/embedded/payload/resource::dotnet-resource-reader",
            "l": 1,
            "el": [
              "0x15b8"
            ]
          },
          {
            "c": 1.0,
            "d": "PE has RT_GROUP_ICON in resources list",
            "e": [
              "[RT_ICON, RT_GROUP_ICON, RT_VERSION, RT_MANIFEST]"
            ],
            "i": "metadata/binary/resource::pe-resource-group-icon-list",
            "l": 2,
            "el": [
              "value:pe.resource_types"
            ]
          },
          {
            "c": 1.0,
            "d": "ASLR enabled (DYNAMIC_BASE)",
            "e": [
              "[dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-aslr",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "Regex component marker",
            "e": [
              "set_Credentials",
              "set_UseDefaultCredentials",
              "get_DefaultNetworkCredentials",
              "ICredentials"
            ],
            "i": "micro-behaviors/communications/http/client/managed::webclient--rx-2",
            "l": 1,
            "el": [
              "0x3a47",
              "0x3a75",
              "0x3a57",
              "0x3a3a"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE ProductName metadata field",
            "e": [
              "ProductName"
            ],
            "i": "metadata/package/versioning::pe-productname-field",
            "l": 2,
            "el": [
              "0x2e322"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE resource section",
            "e": [
              ".rsrc"
            ],
            "i": "metadata/binary/section/names::pe-resource-section",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard runtime section",
            "e": [
              ".reloc"
            ],
            "i": "metadata/binary/section/names::pe-runtime-standard-section",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Regex component marker",
            "e": [
              "GetString",
              "StringSplitOptions",
              "StringFileInfo",
              "ToString",
              "DownloadString",
              "StringBuilder",
              "Strings",
              "StringComparison",
              "Substring"
            ],
            "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7",
            "l": 1,
            "el": [
              "0x3623",
              "0x3af9",
              "0x2e15e",
              "0x361a",
              "0x360b",
              "0x38c3",
              "0x3a1b",
              "0x388a",
              "0x362d"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "Large PE resource section (\u003e150KB)",
            "e": [
              ".rsrc (size: 163840)"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics/overlay::large-pe-resource-section",
            "l": 1
          },
          {
            "c": 0.8500000238418579,
            "d": "Visual Basic runtime reference",
            "e": [
              "Microsoft.VisualBasic",
              "Microsoft.VisualBasic.CompilerServices"
            ],
            "i": "metadata/lang/compiler/managed::visual-basic-runtime",
            "l": 2,
            "el": [
              "0x305a",
              "0x3973"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE has under ten imports",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE with six or fewer imports",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "metadata/binary/symbols/imports::pe-imports-max-six",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "WCF generated code attribute",
            "e": [
              "GeneratedCodeAttribute"
            ],
            "i": "micro-behaviors/communications/ipc/wcf::dotnet-wcf-generated-code-attribute",
            "l": 1,
            "el": [
              "0x337f"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "CodeDom compiler access",
            "e": [
              "System.CodeDom.Compiler"
            ],
            "i": "metadata/lang/compiler/managed::codedom-compiler",
            "l": 2,
            "el": [
              "0x3900"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Manifest is MyApplication template name",
            "e": [
              "MyApplication.app"
            ],
            "i": "metadata/build/manifest::pe-manifest-myapplication-template",
            "l": 3,
            "el": [
              "value:pe.manifest.assembly_identity.name"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "Regex component marker",
            "e": [
              "get_Headers"
            ],
            "i": "micro-behaviors/communications/http/client/managed::webclient--rx-6",
            "l": 1,
            "el": [
              "0x3b35"
            ]
          },
          {
            "c": 0.8500000238418579,
            "d": "IPv4-like .NET assembly version",
            "e": [
              "Version=4.0.0.0"
            ],
            "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version",
            "l": 2,
            "el": [
              "0x15b8"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE FileDescription metadata field",
            "e": [
              "FileDescription"
            ],
            "i": "metadata/package/versioning::pe-filedescription-field",
            "l": 2,
            "el": [
              "0x2e1da"
            ]
          },
          {
            "a": "T1027",
            "c": 0.8399999737739563,
            "d": "VB6 PE with three sections",
            "e": [
              "sections.count = 3.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027.009",
            "c": 0.550000011920929,
            "d": ".NET resource manager access",
            "e": [
              "ResourceManager"
            ],
            "i": "micro-behaviors/data/embedded/payload/resource::dotnet-resourcemanager",
            "l": 1,
            "el": [
              "0x38df"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "High string count over 1000",
            "e": [
              "binary.string_count = 1047.00"
            ],
            "i": "metadata/binary/metrics/threshold::high-string-count-1000",
            "l": 2
          },
          {
            "a": "T1053.005",
            "c": 0.8799999952316284,
            "d": "Regex component marker",
            "e": [
              "get_AbsolutePath",
              "GetFolderPath",
              "get_LocalPath"
            ],
            "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-5",
            "l": 1,
            "m": "F0012",
            "el": [
              "0x363d",
              "0x365c",
              "0x364e"
            ]
          },
          {
            "a": "T1027",
            "c": 0.8199999928474426,
            "d": "Packed loader largest section ratio above 0.65",
            "e": [
              "binary.largest_section_ratio = 0.86"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1612",
            "c": 0.8500000238418579,
            "d": "PE has few icon resources",
            "e": [
              "pe.icon_count = 2.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six",
            "l": 1,
            "m": "B0023"
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)",
            "e": [
              "pe.resource_count = 4.00"
            ],
            "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources",
            "l": 1
          },
          {
            "a": "T1105",
            "c": 0.800000011920929,
            "d": "Compact PE import table",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table",
            "l": 1,
            "m": "E1105"
          },
          {
            "c": 1.0,
            "d": ".NET BSJB metadata marker",
            "e": [
              "BSJB"
            ],
            "i": "metadata/binary/framework::bsjb-marker",
            "l": 1
          },
          {
            "a": "T1055",
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571",
            "l": 1,
            "m": "C0041"
          },
          {
            "c": 0.949999988079071,
            "d": "Filename has EXE extension",
            "e": [
              "5599b3c6b633d903c29de06459acba19fc1cf0615038c01771b0b5f1c4e5cb8b.exe"
            ],
            "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe",
            "l": 1
          },
          {
            "d": ".exe extension reference",
            "e": [
              ".exe"
            ],
            "i": "micro-behaviors/fs/path/extension::exe-dup",
            "l": 2,
            "el": [
              "0x342d"
            ]
          },
          {
            "c": 0.8799999952316284,
            "d": "Large low-entropy PE resources",
            "e": [
              ".rsrc (size: 163840, entropy: 4.98)"
            ],
            "i": "metadata/binary/resource::resource-heavy-low-entropy-rsrc",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.8600000143051147,
            "d": "Long mixed-case identifiers cluster",
            "e": [
              "UserScopedSettingAttribute",
              "WebHeaderCollection",
              "AggregateException",
              "ParamArrayAttribute",
              "IndexOutOfRangeException",
              "EditorBrowsableAttribute",
              "SettingsSingleFileGenerator",
              "DefaultSettingValueAttribute",
              "DebuggerNonUserCodeAttribute",
              "CompilerGeneratedAttribute",
              "GeneratedCodeAttribute",
              "ApplicationSettingsBase",
              "MissingManifestResourceException",
              "StronglyTypedResourceBuilder"
            ],
            "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers",
            "l": 1,
            "m": "B0032",
            "el": [
              "0x33e9",
              "0x37fb",
              "0x3856",
              "0x3404",
              "0x383d",
              "0x33b3",
              "0x612c",
              "0x33cc",
              "0x3396",
              "0x3364",
              "0x337f",
              "0x32fc",
              "0x381c",
              "0x60d7"
            ]
          },
          {
            "a": "T1140",
            "c": 0.8500000238418579,
            "d": "Regex component marker",
            "e": [
              "CredentialCache"
            ],
            "i": "objectives/command-and-control/dropper/staging/encrypted::staged-payload-file-name--rx-2",
            "l": 1,
            "m": "B0023",
            "el": [
              "0x326a"
            ]
          },
          {
            "a": "T1027",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "binary.largest_section_ratio = 0.86"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.949999988079071,
            "d": "links mscoree (CorExeMain)",
            "e": [
              "mscoree"
            ],
            "i": "metadata/dylib::mscoree",
            "l": 2,
            "el": [
              "1 symbols"
            ]
          },
          {
            "c": 1.0,
            "d": "System.Net.WebClient class usage",
            "e": [
              "ICredentials",
              "get_Headers",
              "get_DefaultNetworkCredentials",
              "StringSplitOptions",
              "StringComparison",
              "Strings",
              "ToString",
              "set_Credentials",
              "Substring",
              "DownloadString",
              "WebClient",
              "GetString",
              "set_UseDefaultCredentials",
              "StringFileInfo",
              "StringBuilder"
            ],
            "i": "micro-behaviors/communications/http/client/managed::webclient",
            "l": 2,
            "el": [
              "0x3a3a",
              "0x3b35",
              "0x3a57",
              "0x3af9",
              "0x388a",
              "0x3a1b",
              "0x361a",
              "0x3a47",
              "0x362d",
              "0x360b",
              "0x3b94",
              "0x3623",
              "0x3a75",
              "0x2e15e",
              "0x38c3"
            ]
          },
          {
            "a": "T1036.005",
            "c": 0.9399999976158142,
            "d": "Two dotted-quad version strings",
            "e": [
              "1.0.0.0"
            ],
            "i": "objectives/evasion/masquerade/identity/fabricated::dotted-quad-version-pair",
            "l": 1,
            "el": [
              "value:pe.version.file_version"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "PE version numbers look like IPv4",
            "e": [
              "1.0.0.0"
            ],
            "i": "metadata/package/versioning::version-number-ipv4-metadata",
            "l": 1,
            "el": [
              "value:pe.version.file_version"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Encoded payload detected: xor",
            "e": [
              "UUU5bbb0zzz=\t\t\t:///\u0026444\"444,444/ \u003cxor\u003e"
            ],
            "i": "metadata/encoded-payload/xor",
            "l": 3,
            "el": [
              "offset:87356"
            ]
          }
        ],
        "sha": "5599b3c6b633d903c29de06459acba19fc1cf0615038c01771b0b5f1c4e5cb8b",
        "path": "5599b3c6b633d903c29de06459acba19fc1cf0615038c01771b0b5f1c4e5cb8b.exe",
        "type": "pe"
      }
    ],
    "tv": "52045"
  }
}