{ "ml": { "v": "7", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.8928844, "rte": "az", "prob": 0.8928844 }, { "cls": 0, "raw": 0.8141089, "rte": "az/native", "prob": 0.8141089 }, { "cls": 0, "raw": 0.5907809, "rte": "az/pe", "prob": 0.5907809 } ], "prob": 0.8928844, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.892884373664856, "type": "pe" } ], "version": "v18.18", "analyzed_at": "2026-06-14T19:16:47Z" }, "path": "694bde6d01b0e1b5982bd38206ee0a06efcb8243278f8eb08103e1204bb618ff.exe", "raw": { "v": "7", "tv": "061e3", "files": [ { "id": 0, "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000/z\u003e)K4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47", "l": 0, "n": [ { "c": 3, "d": "PE binary has trailing overlay data", "i": "metadata/binary/layout::has-overlay", "o": 0, "z": 25 } ], "x": true }, { "b": "e=U)fmCaQe%nSawA!eU][4L{XB.MzP\u003eT/VkBAH#xEDkD/w]@e%FQMDKB.\u003e(pp6\u003ct{I:W]f4y/e00e6hh2(", "l": 9548, "n": [ { "c": 3, "d": "NSIS self-extracting installer", "i": "file/sfx/nsis", "o": 9564, "z": 17 } ], "x": true }, { "b": "qE%GdA+eW3wLlPWmr?(lk$1:tp!rC#e[w^m005F*q+fw(y?lyYwPzj3x(v(\u003c006b3q+fz\u0026BvG$X", "l": 29490, "n": [ { "c": 2, "d": "Reference to ADVAPI32.dll", "i": "micro-behaviors/os/module/load::advapi32-dll-reference", "o": 29506, "z": 12 } ], "x": true }, { "b": "mSi9NwPyE.v{%E[z/bKPq+ftJoFXBRwnD5ZwDk8oraf\u0026-o\u003ewfhA+e!Z-SeO4l}hinzbUK%x(mL", "l": 29636, "n": [ { "c": 2, "d": "Reference to SHELL32.dll", "i": "micro-behaviors/os/module/load::shell32-dll-reference", "o": 29652, "z": 11 } ], "x": true }, { "b": "m}D^pwPI{3xjT[TA@WfWlT:!Es7#L.z*b2#z^#\u0026GU(NBqs7#L.z*bk@B7]91wDk3%lU{WZwKyoFAai-]A+2dIn=?}5Bvf\u003eUAai-]A+4NDBytdH.2M]vAccv)y?W\u0026$z^^V%008Y[pJf(.lU{EQvSbW}wb@zbrb#zSyFX}*B-p5^zGL{V2()ngAaJ]$o\u003ewi+r@", "l": 30550, "n": [ { "c": 3, "d": "EmptyClipboard string reference", "i": "micro-behaviors/os/clipboard/access::empty-clipboard-text", "o": 30640, "z": 14 }, { "c": 3, "d": "OpenClipboard string reference", "i": "micro-behaviors/os/clipboard/access::open-clipboard-text", "o": 30658, "z": 13 }, { "c": 3, "d": "Win32 clipboard read and write access", "i": "micro-behaviors/os/clipboard/access::win32-clipboard-read-write", "o": 30620, "z": 16 }, { "c": 3, "d": "Clipboard read/write API context", "i": "objectives/collection/clipboard/capture::clipboard-access-api", "o": 30602, "z": 14 }, { "c": 2, "d": "Call window procedure", "i": "micro-behaviors/ui/window/manage/control::call-window-proc", "o": 30566, "z": 15 } ], "x": true }, { "b": "0rM8ewOU1KB8$=5wMF\u003cirz#s:gCQN[y?%7K4GYNuy?m9#pHX6Iv@}XJjowC)Bw#*@Bvf$.z/L", "l": 30856, "n": [ { "c": 2, "d": "Reference to USER32.dll", "i": "micro-behaviors/os/module/load::user32-dll-reference", "o": 30872, "z": 10 } ], "x": true }, { "b": "A@V{Rq!p5qyEr2Rz/L*Tm)]{8ga)9NyYFLUo)7nux)6ERGAazKy?mZ1mRMWIr@*+JmRM:JmG", "l": 31002, "n": [ { "c": 2, "d": "Reference to GDI32.dll", "i": "micro-behaviors/os/module/load::gdi32-dll-reference", "o": 31018, "z": 9 } ], "x": true }, { "b": "006}ty\u0026:Ysv@lg0r@+5SlU{WZwK{lEwnC/S9%kCMBvG$XwMiwXwDjZ\u003clVl*Xvrb{Gx(4uWx(dz", "l": 31338, "n": [ { "c": 2, "d": "Close handle", "i": "micro-behaviors/process/create/spawn::close-handle-dup", "o": 31354, "z": 11 } ], "x": true }, { "b": "v/Y8hBvG$XwM9q?wDmeWm}D^pz!a0bwKZxIwLMVJwMF\u003cilifO/Bvgg\u003eA+fcgp\u0026ZF:wPI[)XD26yx()f(z^@", "l": 31556, "n": [ { "c": 2, "d": "Get module file path", "i": "micro-behaviors/os/module/load::get-module-filename-dup", "o": 31572, "z": 18 } ], "x": true }, { "b": "Cxle^A+e:5z/Qb8007NJm}D^wwO(x.vruf:000Pim}D^fz/6u1zE=BPzE((H(h:y^Bxh%[B7]Mgmr?(l6:4xCBvyj\u003cz/OM\u003cwmU-v+(.^6BAhhezDu/r:]=E3BAg(gD2uW-LML03wmU", "l": 31674, "n": [ { "c": 2, "d": "Suppress error dialogs", "i": "micro-behaviors/os/exception/error-handling::set-error-mode", "o": 31740, "z": 12 }, { "c": 2, "d": "Query Windows version info", "i": "micro-behaviors/os/sysinfo/platform/locale::get-version-ex", "o": 31724, "z": 13 }, { "c": 2, "d": "INI driven file stager with process handoff", "i": "objectives/command-and-control/dropper/execution/loader::ini-driven-file-stager", "o": 31690, "z": 12 } ], "x": true }, { "b": "vrbs=o)7n]x*N8!wDkKcm}D^gx(!5VA+e/XAa9l/r@-Nem@i9MvqF}Yy\u0026r*000095m@i9MvqFRQv}#5AzVAdBwNPW(ra{q-vpPurAreNvBwca:Bvyj\u003cz/L*Tp5)U4wNPW(l${WMv@}", "l": 31786, "n": [ { "c": 3, "d": "Query disk free space", "i": "micro-behaviors/os/sysinfo/hardware::get-disk-space", "o": 31802, "z": 17 }, { "c": 2, "d": "CreateThread API name reference", "i": "micro-behaviors/process/threading/create::create-thread-text", "o": 31852, "z": 12 } ], "x": true }, { "b": "006[sy\u0026:Ysv@lg0k(:{=lVM:DBy^{Qy?lVF!b-6JBw#**A7jLTwLMVJwMF\u003ciQYTXsx()]Qx(4tX-SH3#BAg(gC%IAgz#@:LC4y", "l": 31938, "n": [ { "c": 2, "d": "CreateFile API string reference", "i": "micro-behaviors/fs/file/open::createfile-api", "o": 31954, "z": 10 }, { "c": 2, "d": "Build temporary file name via GetTempFileName", "i": "micro-behaviors/fs/temp/directory::get-temp-file-name", "o": 31968, "z": 16 } ], "x": true }, { "b": "r@/@py\u0026:Ysv{%EX006\u003epm}D^vD2[7sza58UwN/?2A^pZ^PAdL]BwN0@v)KToA+frk004GHm}D^pz!a0bwK{k", "l": 32022, "n": [ { "c": 2, "d": "GetSystemDirectory API string", "i": "micro-behaviors/os/sysinfo/directories::get-system-directory-string", "o": 32038, "z": 19 } ], "x": true }, { "b": "Bvf$SwL^z=v}x.50058.s7b/+mSirCx(mN1wLV=IwN//Zogq-NmnbG)e[w^m000000000000000000000000", "l": 32104, "n": [ { "c": 2, "d": "Wait for process/object", "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "o": 32120, "z": 19 } ], "x": true }, { "b": "ASviZyYE(zBPupVv/Qfxx-J2Jx8\u003c4Ox-J2JA@ZpZve$9zyYF2DASu7te=WH7e=W0]b(?DQb(/j\u003e00000qVHweqVHFhBPuH-wb{JFCk#HXpYLIox-JqRx-I@HwDluywDhYgk(Z(+00000e=Y$[z2!IP00000k(Z(+EGjl=A@Zs.00000aok:Gkl9?D00000q#/R)pYHE}q#/t!o-N#\u002600000oAn#hCk}QytMv.6wDlMEz#Y\u003eraoj4{l\u0026YvI00000p5)SYquf5:00000p5[h)nDqV?aoj?gASyaWzVB!T00000mf4udASy1TASviZCk#T-x-JkPx-J2Jx8\u003c4OBo2\u003eLz2!IPzVB!Tve$rFC(O@!w=MJByYF2De=W0]o-OP4yxd]CaolD.BPuBZwDi?MC(R:.BPuBZaolG-wDlMEz#.0Xw=M-HyYE#CwDl-Jaol9QA@Wr.B]U}JyYFeHwb[jZ00000%nSc0b1s/$=}V?ar7PsPS8=d-4m@!+uJr?3vGlxde=YC.CMqpP00000zVB.RwDlPF00000b(\u00265/e=Wf$BPrY/A@WG^A@Vgu00000c\u0026:kE0000000000000000000000000x8?]i000000000000000v5l9*m5rcGv5l9*fR}2mv5l9*6S14{2=f=^{[QdP2=f=^\u003cFk3v*[Wgn-h2S#*[WgnR#=@0YRE^)We*mcYRE^)TFw8YPRK*MJheYsGRQ\u003cky[%q@GRQ\u003cksFOgZGRQ\u003ckntFGJr+lqGB.bPsr://!wMF\u003cim}D^ix(4uYwPz\u003caz/ec:w]y-Jm}D^ix(4uYwPz\u003caz/ec:w]yQZDsZdTrZ/[+nL-7Yq+fz\u0026BvHg+wmY^Tvruf:00000q+fwNoHIrE00000q+fh%Bz\u003cJ+ze:r5By+BLq+fO-k#pbMq+fz\u0026Bw3H\u0026CwY(*y?d9$pY", "l": 32752, "n": [ { "c": 3, "d": "Reads and writes to INI configuration files", "i": "micro-behaviors/fs/config/system::ini-read-write-cycle", "o": 33104, "z": 24 }, { "c": 3, "d": "Delete files (Windows API)", "i": "micro-behaviors/fs/file/delete::deletefile-w", "o": 33136, "z": 11 }, { "c": 3, "d": "Modify file creation/access/write times", "i": "micro-behaviors/fs/sync/fsync::set-file-time", "o": 33056, "z": 11 }, { "c": 3, "d": "Temp directory staging primitives", "i": "micro-behaviors/fs/temp/directory::temp-file-staging-primitives", "o": 33092, "z": 11 }, { "c": 3, "d": "Clear clipboard contents", "i": "micro-behaviors/os/clipboard/access::empty-clipboard", "o": 33420, "z": 14 }, { "c": 3, "d": "Write data to clipboard", "i": "micro-behaviors/os/clipboard/access::set-clipboard-data", "o": 33236, "z": 16 }, { "c": 3, "d": "RegDeleteValueW registry value deletion", "i": "micro-behaviors/os/registry/manipulate::reg-delete-value-w-symbol", "o": 32788, "z": 15 }, { "c": 3, "d": "Registry open create and write APIs", "i": "micro-behaviors/os/registry/manipulate::registry-write-api-chain", "o": 32768, "z": 15 }, { "c": 3, "d": "Apply file security descriptor", "i": "micro-behaviors/os/security/descriptor::set-file-security", "o": 32808, "z": 16 }, { "c": 3, "d": "Executes file or program via Windows ShellExecute API", "i": "micro-behaviors/process/create/shell/invoke::win-shellexecute", "o": 33160, "z": 15 }, { "c": 3, "d": "Create process (Unicode)", "i": "micro-behaviors/process/create/spawn::create-process-w", "o": 32932, "z": 14 }, { "c": 3, "d": "Shutdown/restart system", "i": "micro-behaviors/ui/window/manage/control::exit-windows-ex", "o": 33332, "z": 13 }, { "c": 2, "d": "wsprintfA user32 string formatting import", "i": "micro-behaviors/data/format/string::wsprintfa-format", "o": 33192, "z": 9 }, { "c": 2, "d": "Set file attributes (Unicode)", "i": "micro-behaviors/fs/file/attributes::set-file-attributes-w", "o": 33024, "z": 18 }, { "c": 2, "d": "Get file size", "i": "micro-behaviors/fs/sync/fsync::get-file-size", "o": 33012, "z": 11 }, { "c": 2, "d": "Create COM object instance", "i": "micro-behaviors/os/com/invoke::co-create-instance", "o": 33440, "z": 16 }, { "c": 2, "d": "Peek message (Unicode)", "i": "micro-behaviors/os/message/queue::peek-message-w", "o": 33280, "z": 12 }, { "c": 2, "d": "Dynamically resolve own modules and exports", "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "o": 32888, "z": 16 }, { "c": 2, "d": "Get Windows installation directory", "i": "micro-behaviors/os/sysinfo/directories::get-windows-directory", "o": 32988, "z": 20 }, { "c": 2, "d": "Delay execution", "i": "micro-behaviors/time/timing/delay::sleep-dup", "o": 32904, "z": 5 }, { "c": 2, "d": "Add masked image", "i": "micro-behaviors/ui/controls/widget::image-list-add-masked", "o": 32836, "z": 19 }, { "c": 2, "d": "Load cursor resource", "i": "micro-behaviors/ui/controls/widget::load-cursor", "o": 33260, "z": 11 }, { "c": 2, "d": "Create brush object", "i": "micro-behaviors/ui/graphics/draw::create-brush-indirect", "o": 32860, "z": 19 }, { "c": 2, "d": "Enable/disable menu item", "i": "micro-behaviors/ui/menu/popup::enable-menu-item", "o": 33292, "z": 14 }, { "c": 2, "d": "Create window (extended)", "i": "micro-behaviors/ui/window/manage/control::create-window-ex", "o": 33316, "z": 15 }, { "c": 2, "d": "Find window by class/title", "i": "micro-behaviors/ui/window/manage/control::find-window-ex", "o": 33372, "z": 13 }, { "c": 2, "d": "Get device context", "i": "micro-behaviors/ui/window/manage/control::get-dc", "o": 33392, "z": 5 }, { "c": 2, "d": "Post quit message", "i": "micro-behaviors/ui/window/manage/control::post-quit-message", "o": 33352, "z": 15 }, { "c": 2, "d": "Send message to window", "i": "micro-behaviors/ui/window/manage/control::send-message", "o": 33408, "z": 12 }, { "c": 2, "d": "Sandbox hardware fingerprint cluster (CPU/RAM/disk/uptime/screen)", "i": "objectives/anti-analysis/sandbox-detect/tool-references::hardware-fingerprint-cluster", "o": 33216, "z": 16 }, { "c": 2, "d": "Self copy append and relaunch", "i": "objectives/command-and-control/dropper/execution/loader::self-copy-relaunch-loader", "o": 32912, "z": 9 }, { "c": 1, "d": "NSIS runtime error title in data", "i": "metadata/binary/installer/script::nsis-error-title-data", "o": 32968, "z": 10 } ], "x": true }, { "b": "y\u0026\u0026VGoKR*KBZX]]00000m}D^gx(!5VA+e/XAa9l/mr?(lq!p5swObv[y\u0026\u00266Yy^.#TwN/?2A+P9a00000ogq.", "l": 33568, "n": [ { "c": 3, "d": "Query disk free space", "i": "micro-behaviors/os/sysinfo/hardware::get-disk-space", "o": 33584, "z": 19 } ], "x": true }, { "b": "%nSc0%a%MEm?2!z3ig5a4m%8UqucW$0000100\u0026=e003nASaD2f010Qns-TMy4-nnD", "l": 140371, "n": [ { "c": 2, "d": "PNG and manifest in resources", "i": "metadata/binary/resource::png-and-manifest-rsrc", "o": 140387, "z": 4 } ], "x": true }, { "b": "xAOqn2(\u003c@9003ydgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!000000@@r", "l": 235358, "n": [ { "c": 2, "d": "PE version resource structure", "i": "metadata/package/versioning::pe-version-resource", "o": 235374, "z": 15 } ], "x": true }, { "b": "ve$lDwDl-J002*}7YTNplJz38z2!IPve$fBC(QOtve$cAwDhYg002y!x-IMwA@ZdVx-IVzx-J2", "l": 235610, "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 235626, "z": 11 } ], "x": true }, { "b": "wDlftwDlPF002y!4GDIfmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up0046uBo2.HASygYvGp9", "l": 235690, "n": [ { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 235706, "z": 15 } ], "x": true }, { "b": "wDllvwDl/L003418VP)snDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002{$Bo3jVASx\u003ePwDl-JwDllv", "l": 235758, "n": [ { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 235774, "z": 12 } ], "x": true }, { "b": "wDl@PwDhYg001?Q2MK(9pYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001!Pe=WN9e=WN9e=WN9000", "l": 235846, "n": [ { "c": 2, "d": "PE ProductVersion metadata field", "i": "metadata/package/versioning::pe-productversion-field", "o": 235862, "z": 14 } ], "x": true }, { "b": "Bo31PzVBUP000002)vEnju[7cy-)[jA=U@kzAPf#e?!E(wO#0@wnb{]jT9)9mLcOzaAITkzE^f(z/fbHb6^:vb0OmNvrlH3zdmsbaB4:tzGv@+B-IvXB7n({zddGqze0H2z/Y\u0026eBs?0vz8#9Dz7Y#^a%p-hzFrY]B97C]A=U@kzAPf#e?!FkjyJqLwO\u003e))C$zKTzGGPmC{4owA=U@kzAPf#e?![i", "l": 235960, "n": [ { "c": 3, "d": "Nullsoft NSIS installer marker", "i": "metadata/binary/installer/script::nsis", "o": 235976, "z": 128 } ], "x": true }, { "b": "wPI%8wkEqXC4\u003e=7xjVcFjAt1MB.bSowN[kOwN/\u003e8x(v(.wP?T3az+RjwO:HNvrk1TC5IecAV#SGx*DlswPI]Qb4+n1B7DKGk0gGswPq\u003c7B97#7p\u0026Zn[x(4u[wPH3$flpYmB-IhrC(", "l": 236332, "n": [ { "c": 2, "d": "asInvoker manifest tag in resources", "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "o": 236348, "z": 61 } ], "x": true }, { "b": "1{m\u003cC9%sbGdLJozczhSsb4#7uA5]T9v@=xrv}xX5B.@:Iy+GpuB7nSlfFUvnv@=xtzW3E$1{1(h2ls\u0026dv\u003e.sBc\u003cx@c1{1(h2qugk9b6CoA5]T9B9g@4vj(FdB8SZvwPz)nz7Yspz7)*K2Rc8W1Qbb+0!@dqBAzE.fe4uSAbP/iBz(hBe[nC", "l": 332318, "n": [ { "c": 2, "d": "Certum CRL distribution URL", "i": "micro-behaviors/data/embedded/certificate::certum-crl-url", "o": 332334, "z": 37 }, { "c": 2, "d": "Certum OCSP responder URL", "i": "micro-behaviors/data/embedded/certificate::certum-ocsp-url", "o": 332399, "z": 30 } ], "x": true }, { "b": "163u-1sV2LfErwpPDP4ixMOuniXJc@A+)vrwPz)nz7Y^zfjP9wv{}bBv@=xtyZ7d}1{1(h2ls\u0026du[+[vc\u003cx@c1{1(h2qugk9b6CoA5]T9B9g@4vj(FdB8SZvwPz)nz7Yspz7)ZH2Rc8W1Qbb+0!@4nBAzE.fe4uSAbP/iBz(hBe[nC", "l": 334057, "n": [ { "c": 2, "d": "Certum CRL distribution URL", "i": "micro-behaviors/data/embedded/certificate::certum-crl-url", "o": 334073, "z": 33 }, { "c": 2, "d": "Certum OCSP responder URL", "i": "micro-behaviors/data/embedded/certificate::certum-ocsp-url", "o": 334134, "z": 30 } ], "x": true }, { "b": "163u-1sL@JfEiqnPDF$gxMOuniXJc@A+)vrwPz)nz7Y^zfjP9wv{}01A+)BB1{=Z-0r\u0026Si0rAsgfKlvX1{=Z-0r\u0026SifAD[FxMOuniXJdcBZ!\u0026?e]LlvA4LNhA==Cve[n*pfFJ+qd*u1T1QuZ.H9ZIPBz%n]flgSyz/YSmz/QaQv}t", "l": 335800, "n": [ { "c": 2, "d": "Certum CRL distribution URL", "i": "micro-behaviors/data/embedded/certificate::certum-crl-url", "o": 335816, "z": 32 }, { "c": 2, "d": "Certum OCSP responder URL", "i": "micro-behaviors/data/embedded/certificate::certum-ocsp-url", "o": 335876, "z": 30 } ], "x": true } ], "idn": { "name": { "value": "Storkereden Mouslingly.exe", "source": "pe.version.original_filename", "verified": false }, "trust": "self_signed", "signer": { "issuer": "OU=Cuitling Salimeters\\ ,EMAIL=Uretfrdighedernes@Pottled.Ops,O=Programmeringsfriheders,L=Caen,ST=Normandie,C=FR", "source": "pe.signatures[0]", "subject": "OU=Cuitling Salimeters\\ ,EMAIL=Uretfrdighedernes@Pottled.Ops,O=Programmeringsfriheders,L=Caen,ST=Normandie,C=FR", "organization": "Programmeringsfriheders" }, "version": { "value": "3.0.0.0", "source": "pe.version.file_version", "verified": false }, "unique_ids": { "authenticode_thumbprint_sha256": "9d0263a163312bc57fbd790221741810dfe5c92134a621198b87028d4b0e47b1" }, "organization": { "value": "Programmeringsfriheders", "source": "pe.signatures[0]", "verified": true } }, "mol": "O(Co)H₄(F₅Os₆Po₃U)Md(Bi₂)", "sha": "694bde6d01b0e1b5982bd38206ee0a06efcb8243278f8eb08103e1204bb618ff", "fact": { "id": "pe", "imp": [ [ "advapi32", "RegCreateKeyExW" ], [ "advapi32", "RegEnumKeyW" ], [ "advapi32", "RegQueryValueExW" ], [ "advapi32", "RegSetValueExW" ], [ "advapi32", "RegCloseKey" ], [ "advapi32", "RegDeleteValueW" ], [ "advapi32", "RegDeleteKeyW" ], [ "advapi32", "AdjustTokenPrivileges" ], [ "advapi32", "LookupPrivilegeValueW" ], [ "advapi32", "OpenProcessToken" ], [ "advapi32", "SetFileSecurityW" ], [ "advapi32", "RegOpenKeyExW" ], [ "advapi32", "RegEnumValueW" ], [ "shell32", "SHGetSpecialFolderLocation" ], [ "shell32", "SHFileOperationW" ], [ "shell32", "SHBrowseForFolderW" ], [ "shell32", "SHGetPathFromIDListW" ], [ "shell32", "ShellExecuteExW" ], [ "shell32", "SHGetFileInfoW" ], [ "ole32", "OleInitialize" ], [ "ole32", "OleUninitialize" ], [ "ole32", "CoCreateInstance" ], [ "ole32", "IIDFromString" ], [ "ole32", "CoTaskMemFree" ], [ "comctl32", "ORDINAL 17" ], [ "comctl32", "ImageList_Create" ], [ "comctl32", "ImageList_Destroy" ], [ "comctl32", "ImageList_AddMasked" ], [ "user32", "GetClientRect" ], [ "user32", "EndPaint" ], [ "user32", "DrawTextW" ], [ "user32", "IsWindowEnabled" ], [ "user32", "DispatchMessageW" ], [ "user32", "wsprintfA" ], [ "user32", "CharNextA" ], [ "user32", "CharPrevW" ], [ "user32", "MessageBoxIndirectW" ], [ "user32", "GetDlgItemTextW" ], [ "user32", "SetDlgItemTextW" ], [ "user32", "GetSystemMetrics" ], [ "user32", "FillRect" ], [ "user32", "AppendMenuW" ], [ "user32", "TrackPopupMenu" ], [ "user32", "OpenClipboard" ], [ "user32", "SetClipboardData" ], [ "user32", "CloseClipboard" ], [ "user32", "IsWindowVisible" ], [ "user32", "CallWindowProcW" ], [ "user32", "GetMessagePos" ], [ "user32", "CheckDlgButton" ], [ "user32", "LoadCursorW" ], [ "user32", "SetCursor" ], [ "user32", "GetSysColor" ], [ "user32", "SetWindowPos" ], [ "user32", "GetWindowLongW" ], [ "user32", "PeekMessageW" ], [ "user32", "SetClassLongW" ], [ "user32", "GetSystemMenu" ], [ "user32", "EnableMenuItem" ], [ "user32", "GetWindowRect" ], [ "user32", "ScreenToClient" ], [ "user32", "EndDialog" ], [ "user32", "RegisterClassW" ], [ "user32", "SystemParametersInfoW" ], [ "user32", "CreateWindowExW" ], [ "user32", "GetClassInfoW" ], [ "user32", "DialogBoxParamW" ], [ "user32", "CharNextW" ], [ "user32", "ExitWindowsEx" ], [ "user32", "DestroyWindow" ], [ "user32", "CreateDialogParamW" ], [ "user32", "SetTimer" ], [ "user32", "SetWindowTextW" ], [ "user32", "PostQuitMessage" ], [ "user32", "SetForegroundWindow" ], [ "user32", "ShowWindow" ], [ "user32", "wsprintfW" ], [ "user32", "SendMessageTimeoutW" ], [ "user32", "FindWindowExW" ], [ "user32", "IsWindow" ], [ "user32", "GetDlgItem" ], [ "user32", "SetWindowLongW" ], [ "user32", "LoadImageW" ], [ "user32", "GetDC" ], [ "user32", "ReleaseDC" ], [ "user32", "EnableWindow" ], [ "user32", "InvalidateRect" ], [ "user32", "SendMessageW" ], [ "user32", "DefWindowProcW" ], [ "user32", "BeginPaint" ], [ "user32", "EmptyClipboard" ], [ "user32", "CreatePopupMenu" ], [ "gdi32", "SetBkMode" ], [ "gdi32", "SetBkColor" ], [ "gdi32", "GetDeviceCaps" ], [ "gdi32", "CreateFontIndirectW" ], [ "gdi32", "CreateBrushIndirect" ], [ "gdi32", "DeleteObject" ], [ "gdi32", "SetTextColor" ], [ "gdi32", "SelectObject" ], [ "kernel32", "GetExitCodeProcess" ], [ "kernel32", "WaitForSingleObject" ], [ "kernel32", "GetModuleHandleA" ], [ "kernel32", "GetProcAddress" ], [ "kernel32", "GetSystemDirectoryW" ], [ "kernel32", "lstrcatW" ], [ "kernel32", "Sleep" ], [ "kernel32", "lstrcpyA" ], [ "kernel32", "WriteFile" ], [ "kernel32", "GetTempFileNameW" ], [ "kernel32", "CreateFileW" ], [ "kernel32", "lstrcmpiA" ], [ "kernel32", "RemoveDirectoryW" ], [ "kernel32", "CreateProcessW" ], [ "kernel32", "CreateDirectoryW" ], [ "kernel32", "GetLastError" ], [ "kernel32", "CreateThread" ], [ "kernel32", "GlobalLock" ], [ "kernel32", "GlobalUnlock" ], [ "kernel32", "GetDiskFreeSpaceW" ], [ "kernel32", "WideCharToMultiByte" ], [ "kernel32", "lstrcpynW" ], [ "kernel32", "lstrlenW" ], [ "kernel32", "SetErrorMode" ], [ "kernel32", "GetVersionExW" ], [ "kernel32", "GetCommandLineW" ], [ "kernel32", "GetTempPathW" ], [ "kernel32", "GetWindowsDirectoryW" ], [ "kernel32", "SetEnvironmentVariableW" ], [ "kernel32", "CopyFileW" ], [ "kernel32", "ExitProcess" ], [ "kernel32", "GetCurrentProcess" ], [ "kernel32", "GetModuleFileNameW" ], [ "kernel32", "GetFileSize" ], [ "kernel32", "GetTickCount" ], [ "kernel32", "MulDiv" ], [ "kernel32", "SetFileAttributesW" ], [ "kernel32", "GetFileAttributesW" ], [ "kernel32", "SetCurrentDirectoryW" ], [ "kernel32", "MoveFileW" ], [ "kernel32", "GetFullPathNameW" ], [ "kernel32", "GetShortPathNameW" ], [ "kernel32", "SearchPathW" ], [ "kernel32", "CompareFileTime" ], [ "kernel32", "SetFileTime" ], [ "kernel32", "CloseHandle" ], [ "kernel32", "lstrcmpiW" ], [ "kernel32", "lstrcmpW" ], [ "kernel32", "ExpandEnvironmentStringsW" ], [ "kernel32", "GlobalFree" ], [ "kernel32", "GlobalAlloc" ], [ "kernel32", "GetModuleHandleW" ], [ "kernel32", "LoadLibraryExW" ], [ "kernel32", "MoveFileExW" ], [ "kernel32", "FreeLibrary" ], [ "kernel32", "WritePrivateProfileStringW" ], [ "kernel32", "GetPrivateProfileStringW" ], [ "kernel32", "lstrlenA" ], [ "kernel32", "MultiByteToWideChar" ], [ "kernel32", "ReadFile" ], [ "kernel32", "SetFilePointer" ], [ "kernel32", "FindClose" ], [ "kernel32", "FindNextFileW" ], [ "kernel32", "FindFirstFileW" ], [ "kernel32", "DeleteFileW" ] ], "met": { "pe": { "checksum": 338973.0, "icon_count": 2.0, "has_overlay": 1.0, "overlay_end": 329344.0, "has_manifest": 1.0, "overlay_size": 92288.0, "checksum_valid": 1.0, "overlay_offset": 237056.0, "resource_count": 5.0, "cert_table_size": 7960.0, "overlay_padding": 92288.0, "has_version_info": 1.0, "computed_checksum": 338973.0, "bss_like_section_count": 1.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 3.81, "version.identity_symbol_ratio": 0.0 }, "file": { "size": 337304.0, "entropy": 6.97, "size_bytes": 337304.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "code_entropy": 6.44, "data_entropy": 4.01, "overlay_size": 100248.0, "string_count": 417.0, "overlay_ratio": 0.3, "overall_entropy": 6.97, "overlay_entropy": 7.99, "entropy_variance": 0.91, "avg_string_length": 14.25, "max_string_length": 830.0, "code_to_data_ratio": 0.94, "string_length_stddev": 41.9, "largest_section_ratio": 0.6, "sentence_string_count": 22.0, "sentence_string_ratio": 0.05, "high_entropy_string_count": 0.0 }, "imports": { "count": 165.0 }, "sections": { "count": 5.0, "code_size": 26112.0, "entropy_max": 6.44, "entropy_mean": 5.44, "name_entropy": 2.97, "writable_count": 2.0, "executable_count": 1.0, "nonstandard_count": 1.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 7.0 } }, "sec": [ [ ".text", 1024, 26112, 6.44, "r-x" ], [ ".rdata", 27136, 5120, 5.15, "r--" ], [ ".data", 32256, 1536, 4.01, "rw-" ], [ ".ndata", 0, 0, 0.0, "rw-" ], [ ".rsrc", 33792, 203264, 6.16, "r--" ] ], "str": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 184, "u8", "Rich" ], [ 464, "u8", ".text" ], [ 543, "u8", "@.data" ], [ 584, "u8", ".ndata" ], [ 624, "u8", ".rsrc" ], [ 1703, "u8", "s495L" ], [ 4707, "u8", "jHjZV" ], [ 6117, "u8", "PSWV" ], [ 6486, "u8", "WQSPV" ], [ 6605, "u8", "QWPV" ], [ 6623, "u8", "SQWPV" ], [ 9582, "u8", "softuW" ], [ 11163, "u8", "f91u" ], [ 12654, "u8", "WPWj0" ], [ 12940, "u8", "SUVW" ], [ 13205, "u8", "UUUUW" ], [ 16042, "u8", "u Pj" ], [ 17219, "u8", "WWWWjn" ], [ 18804, "u8", "SVW3" ], [ 18912, "u8", "uDWWh" ], [ 19781, "u8", "PVSW" ], [ 21343, "u8", "QSVW" ], [ 21820, "u8", "WWWS" ], [ 22176, "u8", "PPPU" ], [ 27824, "u8", "UXTHEME" ], [ 27832, "u8", "USERENV" ], [ 27840, "u8", "SETUPAPI" ], [ 27849, "u8", "APPHELP" ], [ 27857, "u8", "PROPSYS" ], [ 27865, "u8", "DWMAPI" ], [ 27872, "u8", "CRYPTBASE" ], [ 27882, "u8", "OLEACC" ], [ 27889, "u8", "CLBCATQ" ], [ 27897, "u8", "NTMARTA" ], [ 27952, "u8", "RichEd32" ], [ 27964, "u8", "RichEd20" ], [ 29270, "u8", "RegEnumValueW" ], [ 29286, "u8", "RegEnumKeyW" ], [ 29300, "u8", "RegQueryValueExW" ], [ 29320, "u8", "RegSetValueExW" ], [ 29338, "u8", "RegCloseKey" ], [ 29352, "u8", "RegDeleteValueW" ], [ 29370, "u8", "RegDeleteKeyW" ], [ 29386, "u8", "AdjustTokenPrivileges" ], [ 29410, "u8", "LookupPrivilegeValueW" ], [ 29434, "u8", "OpenProcessToken" ], [ 29454, "u8", "SetFileSecurityW" ], [ 29474, "u8", "RegOpenKeyExW" ], [ 29490, "u8", "RegCreateKeyExW" ], [ 29506, "u8", "ADVAPI32.dll" ], [ 29522, "u8", "SHFileOperationW" ], [ 29542, "u8", "SHGetFileInfoW" ], [ 29560, "u8", "SHBrowseForFolderW" ], [ 29582, "u8", "SHGetPathFromIDListW" ], [ 29606, "u8", "ShellExecuteExW" ], [ 29624, "u8", "SHGetSpecialFolderLocation" ], [ 29652, "u8", "SHELL32.dll" ], [ 29666, "u8", "CoTaskMemFree" ], [ 29682, "u8", "IIDFromString" ], [ 29698, "u8", "CoCreateInstance" ], [ 29718, "u8", "OleUninitialize" ], [ 29736, "u8", "OleInitialize" ], [ 29750, "u8", "ole32.dll" ], [ 29762, "u8", "ImageList_Destroy" ], [ 29782, "u8", "ImageList_AddMasked" ], [ 29804, "u8", "ImageList_Create" ], [ 29822, "u8", "COMCTL32.dll" ], [ 29838, "u8", "EndPaint" ], [ 29850, "u8", "DrawTextW" ], [ 29862, "u8", "FillRect" ], [ 29874, "u8", "GetClientRect" ], [ 29890, "u8", "BeginPaint" ], [ 29904, "u8", "DefWindowProcW" ], [ 29922, "u8", "SendMessageW" ], [ 29938, "u8", "InvalidateRect" ], [ 29956, "u8", "EnableWindow" ], [ 29972, "u8", "ReleaseDC" ], [ 29984, "u8", "GetDC" ], [ 29992, "u8", "LoadImageW" ], [ 30006, "u8", "SetWindowLongW" ], [ 30024, "u8", "GetDlgItem" ], [ 30038, "u8", "IsWindow" ], [ 30050, "u8", "FindWindowExW" ], [ 30066, "u8", "SendMessageTimeoutW" ], [ 30088, "u8", "wsprintfW" ], [ 30100, "u8", "ShowWindow" ], [ 30114, "u8", "SetForegroundWindow" ], [ 30136, "u8", "PostQuitMessage" ], [ 30154, "u8", "SetWindowTextW" ], [ 30172, "u8", "SetTimer" ], [ 30184, "u8", "CreateDialogParamW" ], [ 30206, "u8", "DestroyWindow" ], [ 30222, "u8", "ExitWindowsEx" ], [ 30238, "u8", "CharNextW" ], [ 30250, "u8", "DialogBoxParamW" ], [ 30268, "u8", "GetClassInfoW" ], [ 30284, "u8", "CreateWindowExW" ], [ 30302, "u8", "SystemParametersInfoW" ], [ 30326, "u8", "RegisterClassW" ], [ 30344, "u8", "EndDialog" ], [ 30356, "u8", "ScreenToClient" ], [ 30374, "u8", "GetWindowRect" ], [ 30390, "u8", "EnableMenuItem" ], [ 30408, "u8", "GetSystemMenu" ], [ 30424, "u8", "SetClassLongW" ], [ 30440, "u8", "IsWindowEnabled" ], [ 30458, "u8", "GetWindowLongW" ], [ 30476, "u8", "SetWindowPos" ], [ 30492, "u8", "GetSysColor" ], [ 30506, "u8", "SetCursor" ], [ 30518, "u8", "LoadCursorW" ], [ 30532, "u8", "CheckDlgButton" ], [ 30550, "u8", "GetMessagePos" ], [ 30566, "u8", "CallWindowProcW" ], [ 30584, "u8", "IsWindowVisible" ], [ 30602, "u8", "CloseClipboard" ], [ 30620, "u8", "SetClipboardData" ], [ 30640, "u8", "EmptyClipboard" ], [ 30658, "u8", "OpenClipboard" ], [ 30674, "u8", "TrackPopupMenu" ], [ 30692, "u8", "AppendMenuW" ], [ 30706, "u8", "CreatePopupMenu" ], [ 30724, "u8", "GetSystemMetrics" ], [ 30744, "u8", "SetDlgItemTextW" ], [ 30762, "u8", "GetDlgItemTextW" ], [ 30780, "u8", "MessageBoxIndirectW" ], [ 30802, "u8", "CharPrevW" ], [ 30814, "u8", "CharNextA" ], [ 30826, "u8", "wsprintfA" ], [ 30838, "u8", "DispatchMessageW" ], [ 30858, "u8", "PeekMessageW" ], [ 30872, "u8", "USER32.dll" ], [ 30886, "u8", "SelectObject" ], [ 30902, "u8", "SetTextColor" ], [ 30918, "u8", "SetBkMode" ], [ 30930, "u8", "CreateFontIndirectW" ], [ 30952, "u8", "CreateBrushIndirect" ], [ 30974, "u8", "DeleteObject" ], [ 30990, "u8", "GetDeviceCaps" ], [ 31006, "u8", "SetBkColor" ], [ 31018, "u8", "GDI32.dll" ], [ 31030, "u8", "MulDiv" ], [ 31040, "u8", "DeleteFileW" ], [ 31054, "u8", "FindFirstFileW" ], [ 31072, "u8", "FindNextFileW" ], [ 31088, "u8", "FindClose" ], [ 31100, "u8", "SetFilePointer" ], [ 31118, "u8", "ReadFile" ], [ 31130, "u8", "MultiByteToWideChar" ], [ 31152, "u8", "lstrlenA" ], [ 31164, "u8", "GetPrivateProfileStringW" ], [ 31192, "u8", "WritePrivateProfileStringW" ], [ 31222, "u8", "FreeLibrary" ], [ 31236, "u8", "LoadLibraryExW" ], [ 31254, "u8", "GetModuleHandleW" ], [ 31274, "u8", "GlobalAlloc" ], [ 31288, "u8", "GlobalFree" ], [ 31302, "u8", "ExpandEnvironmentStringsW" ], [ 31330, "u8", "lstrcmpW" ], [ 31342, "u8", "lstrcmpiW" ], [ 31354, "u8", "CloseHandle" ], [ 31368, "u8", "SetFileTime" ], [ 31382, "u8", "CompareFileTime" ], [ 31400, "u8", "SearchPathW" ], [ 31414, "u8", "GetShortPathNameW" ], [ 31434, "u8", "GetFullPathNameW" ], [ 31454, "u8", "MoveFileW" ], [ 31466, "u8", "SetCurrentDirectoryW" ], [ 31490, "u8", "GetFileAttributesW" ], [ 31512, "u8", "SetFileAttributesW" ], [ 31534, "u8", "Sleep" ], [ 31542, "u8", "GetTickCount" ], [ 31558, "u8", "GetFileSize" ], [ 31572, "u8", "GetModuleFileNameW" ], [ 31594, "u8", "GetCurrentProcess" ], [ 31614, "u8", "ExitProcess" ], [ 31628, "u8", "CopyFileW" ], [ 31640, "u8", "SetEnvironmentVariableW" ], [ 31666, "u8", "GetWindowsDirectoryW" ], [ 31690, "u8", "GetTempPathW" ], [ 31706, "u8", "GetCommandLineW" ], [ 31724, "u8", "GetVersionExW" ], [ 31740, "u8", "SetErrorMode" ], [ 31756, "u8", "lstrlenW" ], [ 31768, "u8", "lstrcpynW" ], [ 31780, "u8", "WideCharToMultiByte" ], [ 31802, "u8", "GetDiskFreeSpaceW" ], [ 31822, "u8", "GlobalUnlock" ], [ 31838, "u8", "GlobalLock" ], [ 31852, "u8", "CreateThread" ], [ 31868, "u8", "GetLastError" ], [ 31884, "u8", "CreateDirectoryW" ], [ 31904, "u8", "CreateProcessW" ], [ 31922, "u8", "RemoveDirectoryW" ], [ 31942, "u8", "lstrcmpiA" ], [ 31954, "u8", "CreateFileW" ], [ 31968, "u8", "GetTempFileNameW" ], [ 31988, "u8", "WriteFile" ], [ 32000, "u8", "lstrcpyA" ], [ 32012, "u8", "MoveFileExW" ], [ 32026, "u8", "lstrcatW" ], [ 32038, "u8", "GetSystemDirectoryW" ], [ 32060, "u8", "GetProcAddress" ], [ 32078, "u8", "GetModuleHandleA" ], [ 32098, "u8", "GetExitCodeProcess" ], [ 32120, "u8", "WaitForSingleObject" ], [ 32140, "u8", "KERNEL32.dll" ], [ 33352, "u8", "VerQueryValueW" ], [ 33368, "u8", "GetFileVersionInfoW" ], [ 33388, "u8", "GetFileVersionInfoSizeW" ], [ 33412, "u8", "VERSION" ], [ 33420, "u8", "SHGetFolderPathW" ], [ 33440, "u8", "SHFOLDER" ], [ 33452, "u8", "SHAutoComplete" ], [ 33468, "u8", "SHLWAPI" ], [ 33476, "u8", "SHGetKnownFolderPath" ], [ 33500, "u8", "SHELL32" ], [ 33508, "u8", "InitiateShutdownW" ], [ 33528, "u8", "RegDeleteKeyExW" ], [ 33544, "u8", "ADVAPI32" ], [ 33556, "u8", "GetUserDefaultUILanguage" ], [ 33584, "u8", "GetDiskFreeSpaceExW" ], [ 33604, "u8", "SetDefaultDllDirectories" ], [ 33632, "u8", "KERNEL32" ], [ 33668, "u8", "[Rename]" ], [ 103564, "u8", "14.3.11.110:599" ], [ 140387, "u8", "IHDR" ], [ 140434, "u8", "IDATx" ], [ 141794, "u8", "2y85y" ], [ 143332, "u8", "Zk qgq" ], [ 143347, "u8", "7iDcx" ], [ 143632, "u8", "kvM9J" ], [ 143869, "u8", "ygwjK" ], [ 147321, "u8", "eaMd" ], [ 148638, "u8", "IDAT" ], [ 150502, "u8", "KJGA" ], [ 150995, "u8", "X993" ], [ 152422, "u8", "t Rn" ], [ 153112, "u8", "d2h8" ], [ 155546, "u8", "`Ug`" ], [ 156305, "u8", "Ls}[" ], [ 157578, "u8", "EJ10" ], [ 157821, "u8", "n6`-9 k" ], [ 159139, "u8", "hLqpo" ], [ 159265, "u8", "dW Ea" ], [ 164409, "u8", "YD9A" ], [ 168393, "u8", ".xfk" ], [ 169631, "u8", "tFmt7" ], [ 171909, "u8", "DLs0H" ], [ 172156, "u8", "s8x8" ], [ 173687, "u8", "YwdWm0" ], [ 174142, "u8", "11.108.239.14:53354" ], [ 174442, "u8", "eGF9X9" ], [ 175059, "u8", "Fvkk" ], [ 175259, "u8", "L{}e" ] ], "val": { "file.stem": "694bde6d01b0e1b5982bd38206ee0a06efcb8243278f8eb08103e1204bb618ff", "pe.imphash": "9b386e0d70497af81fe2b12c185a8bd7", "pe.machine": "i386", "pe.rich.key": 3529920745, "pe.rich.hash": "f05a488cd83d3aa2b72c1ddefe58cfce", "pe.subsystem": "windows_gui", "pe.timestamp": 1632606949, "file.basename": "694bde6d01b0e1b5982bd38206ee0a06efcb8243278f8eb08103e1204bb618ff.exe", "pe.image_base": 4194304, "pe.image_size": 659456, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.version.os": "unknown", "pe.entry_point": 13559, "pe.headers_size": 1024, "pe.version.type": "app", "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.file_alignment": 512, "pe.image_hash.sha1": "2fe0c3c6b3314766290bd3ab60ca198d03070e9d", "pe.version.company": "Diaspidinae Arusa Heben", "pe.version.comments": "Notationsregler Phlyctenule Newspaper", "pe.image_hash.sha256": "74271e78978c671ceb209cb8dbed2fc105bffba9ba658ca0b9d2653859620917", "pe.image_hash.sha384": "75b6b79ad35ea213b6a6093a3a7aaeacf21301195c98a0abd83adb3f7a3e1f4fe238ef6ba4242d7ceb152058fd1c2090", "pe.image_hash.sha512": "e5aa64c7a0006b48f970fb979e65cbf844ca15ee2ca15337d44ca087290229e8b0d3f0da3158ad7a0bee97e16cd020a16712d4d1f07221e6ce27fff154fe4327", "pe.resource_types[0]": "RT_ICON", "pe.resource_types[1]": "RT_DIALOG", "pe.resource_types[2]": "RT_GROUP_ICON", "pe.resource_types[3]": "RT_VERSION", "pe.resource_types[4]": "RT_MANIFEST", "pe.section_alignment": 4096, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "relocs_stripped", "pe.characteristics[1]": "executable_image", "pe.characteristics[2]": "32bit_machine", "pe.manifest.ui_access": "false", "pe.characteristics_raw": 271, "pe.version.description": "startbilledet", "pe.inflated_sections[0]": ".data", "pe.linker_major_version": 6, "pe.manifest.description": "Nullsoft Install System v3.08", "pe.signatures[0].issuer": "OU=Cuitling Salimeters\\ ,EMAIL=Uretfrdighedernes@Pottled.Ops,O=Programmeringsfriheders,L=Caen,ST=Normandie,C=FR", "pe.signatures[0].serial": "483efd46f20aea05", "build.toolchain.compiler": "msvc", "pe.signatures[0].subject": "OU=Cuitling Salimeters\\ ,EMAIL=Uretfrdighedernes@Pottled.Ops,O=Programmeringsfriheders,L=Caen,ST=Normandie,C=FR", "pe.version.internal_name": "Storkereden Mouslingly.exe", "pe.dll_characteristics[0]": "dynamic_base", "pe.dll_characteristics[1]": "nx_compat", "pe.dll_characteristics[2]": "no_seh", "pe.dll_characteristics[3]": "terminal_server_aware", "pe.signatures[0].verified": true, "pe.version.company_offset": 235652, "pe.data_directories[0].rva": 34052, "pe.data_directories[1].rva": 454656, "pe.data_directories[2].rva": 329344, "pe.data_directories[3].rva": 32768, "pe.dll_characteristics_raw": 34112, "pe.number_of_rva_and_sizes": 16, "pe.signatures[0].not_after": "2025-09-09T13:32:44Z", "pe.version.comments_offset": 235544, "pe.version.product_version": "3.0.0.0", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 160, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 203016, "pe.data_directories[2].name": "certificate", "pe.data_directories[2].size": 7960, "pe.data_directories[3].name": "iat", "pe.data_directories[3].size": 688, "pe.manifest.supported_os[0]": "{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}", "pe.manifest.supported_os[1]": "{1f676c76-80e1-4239-95bb-83d0f6d0da78}", "pe.manifest.supported_os[2]": "{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}", "pe.manifest.supported_os[3]": "{35138b9a-5d96-4fbd-8e2d-a2440225f93a}", "pe.rich.entries[0].build_id": 95, "pe.rich.entries[1].build_id": 1, "pe.rich.entries[2].build_id": 93, "pe.rich.entries[3].build_id": 48, "pe.rich.entries[4].build_id": 6, "pe.signatures[0].not_before": "2022-09-10T13:32:44Z", "pe.rich.entries[0].use_count": 2, "pe.rich.entries[1].use_count": 165, "pe.rich.entries[2].use_count": 15, "pe.rich.entries[3].use_count": 10, "pe.rich.entries[4].use_count": 1, "pe.signatures[0].self_issued": true, "pe.coff.dos_header_pe_pointer": 216, "pe.rich.entries[0].product_id": 4035, "pe.rich.entries[2].product_id": 4035, "pe.rich.entries[3].product_id": 9044, "pe.rich.entries[4].product_id": 1735, "pe.version.description_offset": 235740, "pe.version.internal_name_offset": 235800, "pe.signatures[0].thumbprint_sha1": "a9886ce93eee9dc5fd73ea6d77a216e096740fa5", "pe.signatures[0].cert_chain_depth": 1, "pe.signatures[0].digest_algorithm": "sha256", "pe.signatures[0].signature_digest": "74271e78978c671ceb209cb8dbed2fc105bffba9ba658ca0b9d2653859620917", "pe.version.product_version_offset": 235892, "pe.manifest.assembly_identity.name": "Nullsoft.NSIS.exehead", "pe.signatures[0].thumbprint_sha256": "9d0263a163312bc57fbd790221741810dfe5c92134a621198b87028d4b0e47b1", "pe.signatures[0].signature_algorithm": "sha256WithRSAEncryption", "pe.manifest.assembly_identity.version": "1.0.0.0", "pe.manifest.requested_execution_level": "asInvoker", "pe.signatures[0].signature_digest_algorithm": "sha256" } }, "find": [ { "id": "file/sfx/nsis", "atk": "T1059", "conf": 0.8999999761581421, "crit": 3, "desc": "NSIS self-extracting installer" }, { "id": "micro-behaviors/os/clipboard/access::open-clipboard", "conf": 0.75, "crit": 3, "desc": "Open clipboard access" }, { "id": "micro-behaviors/ui/window/manage/control::screen-to-client", "conf": 0.699999988079071, "crit": 2, "desc": "Convert screen to client coordinates" }, { "id": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "conf": 0.800000011920929, "crit": 1, "desc": "Regex component marker" }, { "id": "micro-behaviors/ui/graphics/draw::delete-object", "conf": 0.699999988079071, "crit": 2, "desc": "Delete GDI object" }, { "id": "micro-behaviors/data/embedded/certificate::certum-ocsp-url", "conf": 0.949999988079071, "crit": 2, "desc": "Certum OCSP responder URL" }, { "id": "metadata/signed/certificate::pe-signature-verified-kv", "conf": 1.0, "crit": 2, "desc": "PE Authenticode signature verified metadata" }, { "id": "micro-behaviors/data/text/keywords/clipboard::clipboard-token", "conf": 0.6000000238418579, "crit": 1, "desc": "Clipboard keyword" }, { "id": "micro-behaviors/fs/sync/fsync::get-file-size", "conf": 0.6499999761581421, "crit": 2, "desc": "Get file size" }, { "id": "micro-behaviors/os/registry/manipulate::reg-close-key", "conf": 0.8999999761581421, "crit": 2, "desc": "Close registry key" }, { "id": "micro-behaviors/data/embedded/certificate::certum-crl-url", "conf": 0.949999988079071, "crit": 2, "desc": "Certum CRL distribution URL" }, { "id": "metadata/binary/resource::pe-resource-icon-list", "conf": 1.0, "crit": 2, "desc": "PE has RT_ICON in resources list" }, { "id": "micro-behaviors/ui/window/manage/control::set-timer", "conf": 0.699999988079071, "crit": 2, "desc": "Create window timer" }, { "id": "metadata/binary/resource::pe-resource-dialog-list", "conf": 1.0, "crit": 1, "desc": "PE has RT_DIALOG in resources list" }, { "id": "metadata/binary/resource::asinvoker-resource-manifest-flex", "conf": 0.8600000143051147, "crit": 2, "desc": "asInvoker manifest tag in resources" }, { "id": "micro-behaviors/os/registry/access::reg-query-value-ex-w-symbol", "atk": "T1112", "conf": 0.8999999761581421, "crit": 2, "desc": "Query registry value via import symbol" }, { "id": "objectives/command-and-control/dropper/execution/installer::dominant-overlay-high-entropy", "atk": "T1105", "mbc": "B0022", "conf": 0.8999999761581421, "crit": 1, "desc": "Dominant high entropy overlay" }, { "id": "micro-behaviors/ui/window/manage/control::call-window-proc", "atk": "T1106", "conf": 0.8799999952316284, "crit": 2, "desc": "Call window procedure" }, { "id": "metadata/package/versioning::pe-internalname-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE InternalName metadata field" }, { "id": "micro-behaviors/os/com/invoke::ole-uninitialize", "conf": 0.75, "crit": 2, "desc": "Uninitialize OLE/COM subsystem" }, { "id": "micro-behaviors/ui/menu/popup::append-menu", "conf": 0.699999988079071, "crit": 2, "desc": "Add item to menu" }, { "id": "objectives/anti-static/obfuscation/payload/registry::reg-query-value", "atk": "T1112", "mbc": "B0032", "conf": 0.8999999761581421, "crit": 1, "desc": "RegQueryValueEx API" }, { "id": "micro-behaviors/process/terminate/kill::exit-process", "conf": 0.8999999761581421, "crit": 2, "desc": "Exit current process" }, { "id": "micro-behaviors/fs/path/check::get-file-attributes", "conf": 0.8500000238418579, "crit": 2, "desc": "Query file attributes or existence" }, { "id": "metadata/binary/metrics/structural::many-imports", "conf": 0.800000011920929, "crit": 2, "desc": "High number of imported symbols (\u003e80)" }, { "id": "micro-behaviors/fs/path/check::get-short-path-name", "conf": 0.8999999761581421, "crit": 2, "desc": "Canonicalize Windows 8.3 short path" }, { "id": "micro-behaviors/ui/window/manage/control::destroy-window", "conf": 0.699999988079071, "crit": 2, "desc": "Destroy window" }, { "id": "micro-behaviors/os/clipboard/access::empty-clipboard", "conf": 0.75, "crit": 3, "desc": "Clear clipboard contents" }, { "id": "micro-behaviors/ui/controls/widget::image-list-create", "conf": 0.699999988079071, "crit": 2, "desc": "Create image list" }, { "id": "metadata/binary/metrics/threshold::many-imports-20", "conf": 1.0, "crit": 1, "desc": "Binary has 20+ imports" }, { "id": "micro-behaviors/os/clipboard/access::set-clipboard-data", "conf": 0.800000011920929, "crit": 3, "desc": "Write data to clipboard" }, { "id": "micro-behaviors/data/format/string::wsprintfa-format", "conf": 0.75, "crit": 2, "desc": "wsprintfA user32 string formatting import" }, { "id": "micro-behaviors/fs/temp/directory::get-temp-file-name", "conf": 0.75, "crit": 2, "desc": "Build temporary file name via GetTempFileName" }, { "id": "micro-behaviors/os/registry/access::reg-create-key-ex-w", "atk": "T1112", "conf": 0.8500000238418579, "crit": 2, "desc": "Create registry key via WinAPI" }, { "id": "micro-behaviors/fs/file/read::read-file", "conf": 0.8999999761581421, "crit": 2, "desc": "Read data from file handle" }, { "id": "micro-behaviors/ui/window/manage/control::send-message-timeout", "conf": 0.699999988079071, "crit": 2, "desc": "Send message with timeout" }, { "id": "micro-behaviors/ui/controls/widget::system-parameters-info-string", "conf": 1.0, "crit": 1, "desc": "Query/set system parameters (string)" }, { "id": "micro-behaviors/ui/menu/popup::enable-menu-item", "conf": 0.699999988079071, "crit": 2, "desc": "Enable/disable menu item" }, { "id": "micro-behaviors/ui/dialog/prompt::get-dialog-item", "conf": 0.6499999761581421, "crit": 2, "desc": "Get dialog control handle" }, { "id": "micro-behaviors/ui/dialog/prompt::get-dialog-item-text", "conf": 0.6499999761581421, "crit": 2, "desc": "Get text from dialog control" }, { "id": "metadata/binary/metrics/threshold::many-imports-25", "conf": 1.0, "crit": 1, "desc": "Binary has 25+ imports" }, { "id": "metadata/binary/metrics/structural::sentence-strings-20-plus", "conf": 0.8999999761581421, "crit": 2, "desc": "Binary has 20+ sentence strings" }, { "id": "metadata/binary/layout::pe-checksum-valid", "conf": 1.0, "crit": 1, "desc": "PE checksum matches computed value" }, { "id": "objectives/impact/infect/binary/rewrite::tmp-extension-staging", "conf": 0.8500000238418579, "crit": 1, "desc": "Uses temporary .tmp staging file" }, { "id": "micro-behaviors/ui/dialog/prompt::message-box-indirect", "conf": 0.699999988079071, "crit": 2, "desc": "Custom message box display" }, { "id": "metadata/binary/metrics/threshold::many-imports-30", "conf": 1.0, "crit": 1, "desc": "Binary has 30+ imports" }, { "id": "micro-behaviors/fs/directory/rmdir::remove-directory-w", "conf": 0.699999988079071, "crit": 2, "desc": "Remove directory (Unicode)" }, { "id": "metadata/binary/installer/script::nullsoft-install-system-rsrc", "conf": 0.949999988079071, "crit": 1, "desc": "Nullsoft Install System in resources" }, { "id": "metadata/binary/section/metrics::tiny-data-section", "conf": 0.800000011920929, "crit": 1, "desc": "Tiny writable data section" }, { "id": "micro-behaviors/ui/menu/popup::create-popup-menu", "conf": 0.699999988079071, "crit": 2, "desc": "Create popup/context menu" }, { "id": "micro-behaviors/ui/graphics/draw::get-device-caps", "conf": 0.699999988079071, "crit": 2, "desc": "Query device capabilities" }, { "id": "micro-behaviors/ui/window/manage/control::get-dc", "conf": 0.699999988079071, "crit": 2, "desc": "Get device context" }, { "id": "objectives/anti-static/obfuscation/payload/registry::reg-open-key", "atk": "T1112", "mbc": "B0032", "conf": 0.8999999761581421, "crit": 1, "desc": "RegOpenKeyEx API" }, { "id": "micro-behaviors/fs/file/open::file-create-win", "conf": 0.8999999761581421, "crit": 2, "desc": "Windows file creation/open API" }, { "id": "micro-behaviors/fs/sync/fsync::compare-file-time", "conf": 0.699999988079071, "crit": 2, "desc": "Compare file modification times" }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference" }, { "id": "metadata/file/extension::exe", "conf": 1.0, "crit": 2, "desc": "Windows executable extension" }, { "id": "micro-behaviors/ui/graphics/draw::set-bk-color", "conf": 0.699999988079071, "crit": 2, "desc": "Set background color" }, { "id": "micro-behaviors/os/privilege/token::open-process-token", "conf": 0.75, "crit": 2, "desc": "Open process access token" }, { "id": "micro-behaviors/fs/file/move::move-file", "conf": 0.8999999761581421, "crit": 2, "desc": "Move or rename file" }, { "id": "micro-behaviors/os/api-resolution/manual::gettempfilename-staged", "atk": "T1027.007", "conf": 0.8999999761581421, "crit": 1, "desc": "GetTempFileName name staged for runtime resolution" }, { "id": "metadata/binary/framework::exe-extension", "conf": 0.8999999761581421, "crit": 1, "desc": "PE file uses .exe extension" }, { "id": "micro-behaviors/process/create/exec::shell-execute-ex", "atk": "T1059.001", "conf": 0.75, "crit": 3, "desc": "Execute shell command (ShellExecuteExW)" }, { "id": "metadata/binary/resource::pe-resource-group-icon-list", "conf": 1.0, "crit": 2, "desc": "PE has RT_GROUP_ICON in resources list" }, { "id": "micro-behaviors/ui/window/manage/control::is-window", "conf": 0.699999988079071, "crit": 2, "desc": "Check if window exists" }, { "id": "micro-behaviors/os/clipboard/access::open-clipboard-text", "conf": 0.7400000095367432, "crit": 3, "desc": "OpenClipboard string reference" }, { "id": "micro-behaviors/os/clipboard/access::close-clipboard", "conf": 0.6499999761581421, "crit": 3, "desc": "Close clipboard" }, { "id": "micro-behaviors/os/exception/error-handling::set-error-mode", "conf": 0.800000011920929, "crit": 2, "desc": "Suppress error dialogs" }, { "id": "objectives/anti-static/obfuscation/binary-metrics/overlay::large-pe-resource-section", "conf": 0.800000011920929, "crit": 1, "desc": "Large PE resource section (\u003e150KB)" }, { "id": "metadata/binary/metrics/threshold::many-imports-50", "conf": 1.0, "crit": 1, "desc": "Binary has 50+ imports" }, { "id": "micro-behaviors/fs/enumerate/directory::find-next-file", "conf": 0.8999999761581421, "crit": 2, "desc": "Directory enumeration" }, { "id": "micro-behaviors/process/create/spawn::wait-for-single-object", "conf": 0.8999999761581421, "crit": 2, "desc": "Wait for process/object" }, { "id": "objectives/command-and-control/channel/http/stego::uuid-format-route-segment", "atk": "T1071.001", "mbc": "B0030", "conf": 0.8600000143051147, "crit": 1, "desc": "UUID formatted route segment" }, { "id": "metadata/binary/metrics/threshold::many-imports-40", "conf": 1.0, "crit": 1, "desc": "Binary has 40+ imports" }, { "id": "micro-behaviors/fs/temp/directory::get-temp-path-dup", "conf": 0.6600000262260437, "crit": 2, "desc": "Look up temp directory via GetTempPath" }, { "id": "micro-behaviors/process/create/spawn::get-exit-code-process", "conf": 0.8999999761581421, "crit": 2, "desc": "Get process exit code" }, { "id": "micro-behaviors/ui/window/manage/control::get-window-rect", "conf": 0.699999988079071, "crit": 2, "desc": "Get window rectangle" }, { "id": "micro-behaviors/process/create/spawn::create-process-w", "atk": "T1106", "conf": 0.949999988079071, "crit": 3, "desc": "Create process (Unicode)" }, { "id": "metadata/hardening/mitigation::pe-aslr", "conf": 1.0, "crit": 2, "desc": "ASLR enabled (DYNAMIC_BASE)" }, { "id": "micro-behaviors/os/sysinfo/directories::get-system-directory-string", "conf": 0.8199999928474426, "crit": 2, "desc": "GetSystemDirectory API string" }, { "id": "micro-behaviors/os/module/load::get-current-process", "conf": 0.699999988079071, "crit": 2, "desc": "Get current process handle" }, { "id": "metadata/binary/resource::png-resource-marker", "conf": 0.8399999737739563, "crit": 2, "desc": "PNG image data in PE resources" }, { "id": "micro-behaviors/os/exception/error-handling::get-last-error", "conf": 0.699999988079071, "crit": 2, "desc": "Get system error code" }, { "id": "metadata/binary/metrics/structural::normal-code-entropy", "conf": 0.800000011920929, "crit": 2, "desc": "Binary code entropy above 5.5" }, { "id": "metadata/binary/section/names::pe-runtime-standard-section", "conf": 0.8999999761581421, "crit": 1, "desc": "PE standard runtime section" }, { "id": "micro-behaviors/ui/window/manage/control::char-prev", "conf": 0.699999988079071, "crit": 2, "desc": "Move to previous character" }, { "id": "micro-behaviors/os/module/load::get-module-filename-dup", "conf": 0.699999988079071, "crit": 2, "desc": "Get module file path" }, { "id": "micro-behaviors/ui/graphics/draw::select-object", "conf": 0.699999988079071, "crit": 2, "desc": "Select GDI object" }, { "id": "metadata/binary/framework::is-binary", "conf": 1.0, "crit": 1, "desc": "File is a compiled binary" }, { "id": "micro-behaviors/fs/shell-ops::browse-for-folder", "conf": 0.699999988079071, "crit": 3, "desc": "Display folder browse dialog" }, { "id": "micro-behaviors/ui/window/manage/control::set-class-long", "conf": 0.699999988079071, "crit": 2, "desc": "Set window class data" }, { "id": "micro-behaviors/fs/enumerate/directory::find-first-file", "conf": 0.8999999761581421, "crit": 2, "desc": "Begin directory enumeration" }, { "id": "micro-behaviors/fs/shell-ops::shell-get-special-folder-location", "conf": 0.800000011920929, "crit": 2, "desc": "Resolve special folder location via Shell32" }, { "id": "metadata/hardening/mitigation::pe-no-seh", "conf": 1.0, "crit": 2, "desc": "NO_SEH (SafeSEH not used)" }, { "id": "metadata/package/files::exe-extension-basename", "conf": 0.949999988079071, "crit": 1, "desc": "Filename ends with .exe" }, { "id": "micro-behaviors/os/module/load::free-library", "conf": 0.699999988079071, "crit": 2, "desc": "Unload dynamic library" }, { "id": "objectives/anti-static/obfuscation/payload/container::moderately-encoded-rsrc", "atk": "T1027.003", "mbc": "F0001.006", "conf": 0.8600000143051147, "crit": 1, "desc": "Encoded PE resource section" }, { "id": "micro-behaviors/os/message/queue::peek-message-w", "conf": 0.8500000238418579, "crit": 2, "desc": "Peek message (Unicode)" }, { "id": "objectives/evasion/masquerade/identity/fabricated::identity-nondegenerate-entropy", "atk": "T1036.005", "conf": 0.6000000238418579, "crit": 1, "desc": "identity nondegenerate entropy" }, { "id": "micro-behaviors/process/info/current::get-module-filename", "conf": 0.699999988079071, "crit": 2, "desc": "GetModuleFileName API call" }, { "id": "micro-behaviors/ui/dialog/prompt::create-dialog-param", "conf": 0.699999988079071, "crit": 2, "desc": "Create modeless dialog" }, { "id": "micro-behaviors/ui/controls/widget::get-system-metrics", "conf": 0.699999988079071, "crit": 2, "desc": "Query system metrics" }, { "id": "micro-behaviors/os/registry/access::reg-open-key-ex-w-symbol", "atk": "T1112", "conf": 0.8999999761581421, "crit": 2, "desc": "Open registry key via import symbol" }, { "id": "metadata/binary/section/metrics::medium-overlay-pe", "conf": 0.8600000143051147, "crit": 1, "desc": "PE has medium sized overlay" }, { "id": "micro-behaviors/os/env/vars/access::temp-var", "crit": 2, "desc": "TEMP environment variable" }, { "id": "micro-behaviors/fs/shell-ops::get-file-info", "conf": 0.699999988079071, "crit": 2, "desc": "Get file information and icon" }, { "id": "micro-behaviors/ui/window/manage/control::is-window-enabled", "conf": 0.699999988079071, "crit": 2, "desc": "Check if window is enabled" }, { "id": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::import-count-over-120", "atk": "T1027", "mbc": "B0032", "conf": 0.8799999952316284, "crit": 1, "desc": "Large PE imports over 120" }, { "id": "micro-behaviors/os/sysinfo/platform/locale::get-version-ex", "atk": "T1082", "conf": 0.8999999761581421, "crit": 2, "desc": "Query Windows version info" }, { "id": "micro-behaviors/os/registry/access::reg-set-value-ex-w", "atk": "T1112", "conf": 0.8500000238418579, "crit": 2, "desc": "Set registry value via WinAPI" }, { "id": "micro-behaviors/os/com/invoke::iid-from-string", "conf": 0.75, "crit": 2, "desc": "Convert GUID string to IID" }, { "id": "micro-behaviors/ui/window/manage/control::def-window-proc", "conf": 0.699999988079071, "crit": 2, "desc": "Default window procedure" }, { "id": "micro-behaviors/fs/file/move::move-file-ex", "conf": 0.8999999761581421, "crit": 2, "desc": "Move or rename file with options" }, { "id": "metadata/binary/layout::large-overlay-64k", "conf": 0.949999988079071, "crit": 3, "desc": "Overlay size at least 64 KiB" }, { "id": "micro-behaviors/ui/menu/popup::track-popup-menu", "conf": 0.699999988079071, "crit": 2, "desc": "Display popup menu" }, { "id": "micro-behaviors/fs/enumerate/directory::find-close", "conf": 0.8999999761581421, "crit": 2, "desc": "Close directory enumeration handle" }, { "id": "micro-behaviors/fs/file/handle::set-file-pointer", "conf": 0.8999999761581421, "crit": 2, "desc": "Set file position" }, { "id": "metadata/binary/installer/script::nsis-manifest-exehead", "conf": 0.9800000190734863, "crit": 1, "desc": "NSIS exehead assembly manifest" }, { "id": "micro-behaviors/ui/window/manage/control::enable-window", "conf": 0.699999988079071, "crit": 2, "desc": "Enable/disable window" }, { "id": "micro-behaviors/fs/path/check::get-module-filename", "conf": 0.8500000238418579, "crit": 2, "desc": "Query current module path" }, { "id": "metadata/binary/section/names::pe-code-data-standard-section", "conf": 0.8999999761581421, "crit": 1, "desc": "PE standard code/data section" }, { "id": "micro-behaviors/process/threading/create::create-thread-text", "conf": 0.699999988079071, "crit": 2, "desc": "CreateThread API name reference" }, { "id": "micro-behaviors/data/embedded/payload/header::inline-pe-header-walk", "conf": 0.800000011920929, "crit": 1, "desc": "Inline PE header walk sequence" }, { "id": "metadata/package/versioning::pe-product-version-ipv4-shape", "conf": 0.9200000166893005, "crit": 1, "desc": "PE ProductVersion resembles IPv4" }, { "id": "micro-behaviors/ui/window/manage/control::is-window-visible", "conf": 0.699999988079071, "crit": 2, "desc": "Check if window is visible" }, { "id": "micro-behaviors/fs/shell-ops::get-path-from-idlist", "conf": 0.699999988079071, "crit": 2, "desc": "Extract file path" }, { "id": "micro-behaviors/os/com/invoke::co-create-instance", "conf": 0.800000011920929, "crit": 2, "desc": "Create COM object instance" }, { "id": "micro-behaviors/fs/file/write/direct::write-file", "conf": 0.8999999761581421, "crit": 2, "desc": "Write data to file handle" }, { "id": "micro-behaviors/ui/controls/widget::image-list-add-masked", "conf": 0.699999988079071, "crit": 2, "desc": "Add masked image" }, { "id": "micro-behaviors/ui/controls/widget::load-cursor", "conf": 0.699999988079071, "crit": 2, "desc": "Load cursor resource" }, { "id": "micro-behaviors/ui/graphics/draw::set-text-color", "conf": 0.699999988079071, "crit": 2, "desc": "Set text color" }, { "id": "micro-behaviors/fs/config/system::write-private-profile", "conf": 0.75, "crit": 2, "desc": "Write to INI config file" }, { "id": "metadata/binary/section/metrics::high-import-count-pe", "conf": 0.8399999737739563, "crit": 1, "desc": "High PE import count" }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range" }, { "id": "micro-behaviors/os/module/load::get-module-handle-ansi", "conf": 0.699999988079071, "crit": 2, "desc": "Get module handle ANSI" }, { "id": "micro-behaviors/process/info/commandline::get-command-line", "conf": 0.8199999928474426, "crit": 2, "desc": "Query current process command line" }, { "id": "metadata/binary/installer/script::nsis-manifest-identity", "conf": 0.949999988079071, "crit": 1, "desc": "NSIS installer manifest identity" }, { "id": "objectives/command-and-control/dropper/staging/embedded::registry-powershell-byte-payload--rx-4", "atk": "T1027,T1112,T1059.001", "conf": 0.8999999761581421, "crit": 1, "desc": "Regex component marker" }, { "id": "objectives/anti-static/obfuscation/reflection/invoke::dotnet-createinstance-token", "conf": 0.7200000286102295, "crit": 1, "desc": "Activator.CreateInstance instantiation token" }, { "id": "micro-behaviors/os/module/load::gdi32-dll-reference", "conf": 1.0, "crit": 2, "desc": "Reference to GDI32.dll" }, { "id": "micro-behaviors/os/sysinfo/directories::get-windows-directory", "conf": 0.8999999761581421, "crit": 2, "desc": "Get Windows installation directory" }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field" }, { "id": "micro-behaviors/ui/window/manage/control::set-window-text", "conf": 0.699999988079071, "crit": 2, "desc": "Set window title/text" }, { "id": "micro-behaviors/os/clipboard/access::close-clipboard-text", "conf": 0.699999988079071, "crit": 3, "desc": "CloseClipboard string reference" }, { "id": "micro-behaviors/ui/window/manage/control::send-message", "conf": 0.699999988079071, "crit": 2, "desc": "Send message to window" }, { "id": "metadata/package/versioning::pe-file-description-present", "conf": 0.949999988079071, "crit": 1, "desc": "PE FileDescription field is populated" }, { "id": "micro-behaviors/os/module/load::shell32-dll-reference", "conf": 1.0, "crit": 2, "desc": "Reference to SHELL32.dll" }, { "id": "metadata/binary/section/metrics::five-section-pe", "conf": 0.800000011920929, "crit": 1, "desc": "Five section PE layout" }, { "id": "micro-behaviors/ui/dialog/prompt::set-dialog-item-text", "conf": 0.6499999761581421, "crit": 2, "desc": "Set text in dialog control" }, { "id": "micro-behaviors/ui/window/manage/control::set-window-pos", "conf": 0.699999988079071, "crit": 2, "desc": "Change window position/size" }, { "id": "metadata/binary/metrics/threshold::many-imports-100", "conf": 1.0, "crit": 1, "desc": "Binary has 100+ imports" }, { "id": "micro-behaviors/ui/dialog/prompt::dialog-box-param", "conf": 0.699999988079071, "crit": 2, "desc": "Create modal dialog box" }, { "id": "micro-behaviors/fs/directory/mkdir::create-directory-w", "conf": 0.6600000262260437, "crit": 2, "desc": "Create directories (Windows API Unicode)" }, { "id": "metadata/binary/installer/script::nsis-error-url-data", "conf": 1.0, "crit": 1, "desc": "NSIS runtime error URL in data" }, { "id": "micro-behaviors/ui/window/manage/control::char-next", "conf": 0.699999988079071, "crit": 2, "desc": "Move to next character" }, { "id": "metadata/hardening/mitigation::pe-dep", "conf": 1.0, "crit": 2, "desc": "DEP / NX enabled (NX_COMPAT)" }, { "id": "micro-behaviors/ui/window/manage/control::find-window-ex", "conf": 0.699999988079071, "crit": 2, "desc": "Find window by class/title" }, { "id": "micro-behaviors/ui/graphics/draw::create-font-indirect", "conf": 0.699999988079071, "crit": 2, "desc": "Create font object" }, { "id": "micro-behaviors/ui/menu/popup::get-system-menu", "conf": 0.699999988079071, "crit": 2, "desc": "Get window system menu" }, { "id": "micro-behaviors/ui/controls/widget::system-parameters-info-symbol", "conf": 1.0, "crit": 1, "desc": "Query/set system parameters (symbol)" }, { "id": "micro-behaviors/os/sysinfo/disk::freespace", "atk": "T1082", "crit": 2, "desc": "Disk free space query" }, { "id": "micro-behaviors/ui/window/manage/control::set-foreground-window", "conf": 0.699999988079071, "crit": 2, "desc": "Bring window to foreground" }, { "id": "micro-behaviors/data/text/keywords/lexicon::tmp", "conf": 0.20000000298023224, "crit": 1, "desc": "tmp keyword" }, { "id": "micro-behaviors/ui/dialog/prompt::check-dialog-button", "conf": 0.6499999761581421, "crit": 2, "desc": "Check/uncheck dialog button" }, { "id": "micro-behaviors/os/module/load::advapi32-dll-reference", "conf": 1.0, "crit": 2, "desc": "Reference to ADVAPI32.dll" }, { "id": "objectives/anti-static/obfuscation/payload/registry::hkcu-software-text", "atk": "T1112", "mbc": "B0032", "conf": 0.699999988079071, "crit": 1, "desc": "HKCU\\Software path string" }, { "id": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "atk": "T1005", "conf": 0.75, "crit": 1, "desc": "Regex component marker" }, { "id": "micro-behaviors/process/thread/create::create-thread", "atk": "T1129", "conf": 0.949999988079071, "crit": 2, "desc": "Create thread in current process" }, { "id": "micro-behaviors/ui/controls/widget::image-list-destroy", "conf": 0.699999988079071, "crit": 2, "desc": "Destroy image list" }, { "id": "micro-behaviors/ui/window/manage/control::get-message-pos", "conf": 0.699999988079071, "crit": 2, "desc": "Get message cursor position" }, { "id": "micro-behaviors/fs/file/attributes::set-file-attributes-w", "conf": 0.8999999761581421, "crit": 2, "desc": "Set file attributes (Unicode)" }, { "id": "micro-behaviors/os/sysinfo/hardware::get-disk-space", "atk": "T1082", "conf": 0.8999999761581421, "crit": 3, "desc": "Query disk free space" }, { "id": "metadata/package/versioning::pe-companyname-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE CompanyName metadata field" }, { "id": "micro-behaviors/ui/graphics/draw::set-bk-mode", "conf": 0.699999988079071, "crit": 2, "desc": "Set background mode (opaque/transparent)" }, { "id": "micro-behaviors/fs/config/system::read-private-profile", "conf": 0.6499999761581421, "crit": 2, "desc": "Read from INI config file" }, { "id": "micro-behaviors/communications/http/client/managed::webclient--rx-5", "conf": 0.800000011920929, "crit": 1, "desc": "Regex component marker" }, { "id": "micro-behaviors/fs/file/delete::deletefile-w", "conf": 0.6600000262260437, "crit": 3, "desc": "Delete files (Windows API)" }, { "id": "micro-behaviors/ui/graphics/draw::create-brush-indirect", "conf": 0.699999988079071, "crit": 2, "desc": "Create brush object" }, { "id": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "atk": "T1027", "mbc": "B0032", "conf": 0.9900000095367432, "crit": 1, "desc": "PE version resource text" }, { "id": "micro-behaviors/process/create/spawn::close-handle-dup", "conf": 0.8999999761581421, "crit": 2, "desc": "Close handle" }, { "id": "micro-behaviors/time/query::get-tick-count", "conf": 0.8999999761581421, "crit": 2, "desc": "Get tick count" }, { "id": "metadata/binary/installer/script::nsis-v3-banner-rsrc", "conf": 0.9599999785423279, "crit": 1, "desc": "NSIS v3 banner in resources" }, { "id": "micro-behaviors/ui/window/manage/control::invalidate-rect", "conf": 0.699999988079071, "crit": 2, "desc": "Invalidate window region" }, { "id": "metadata/binary/layout::has-overlay", "conf": 1.0, "crit": 3, "desc": "PE binary has trailing overlay data" }, { "id": "micro-behaviors/ui/window/manage/control::register-class", "conf": 0.699999988079071, "crit": 2, "desc": "Register window class" }, { "id": "micro-behaviors/ui/controls/widget::set-cursor", "conf": 0.699999988079071, "crit": 2, "desc": "Set cursor" }, { "id": "metadata/binary/symbols/imports::imports-advapi32-dll", "conf": 0.949999988079071, "crit": 1, "desc": "Binary imports ADVAPI32.dll" }, { "id": "micro-behaviors/os/module/load::get-module-handle-wide", "conf": 0.7799999713897705, "crit": 2, "desc": "Get module handle Unicode" }, { "id": "micro-behaviors/ui/window/manage/control::get-class-info", "conf": 0.699999988079071, "crit": 2, "desc": "Get window class information" }, { "id": "objectives/anti-static/pack/upx::no-compression-grade-section", "atk": "T1027.002", "mbc": "F0001.008", "conf": 0.8999999761581421, "crit": 1, "desc": "No section reaches compression-grade entropy" }, { "id": "micro-behaviors/fs/shell-ops::shell-file-operation", "conf": 0.75, "crit": 3, "desc": "Perform file operation through shell" }, { "id": "metadata/build/manifest::pe-has-manifest", "conf": 1.0, "crit": 2, "desc": "PE carries side-by-side assembly manifest" }, { "id": "micro-behaviors/ui/window/manage/control::show-window", "conf": 0.699999988079071, "crit": 2, "desc": "Show or hide window" }, { "id": "micro-behaviors/time/timing/delay::sleep-dup", "conf": 0.699999988079071, "crit": 2, "desc": "Delay execution" }, { "id": "micro-behaviors/ui/dialog/prompt::end-dialog", "conf": 0.6499999761581421, "crit": 2, "desc": "Close dialog and return result" }, { "id": "micro-behaviors/ui/window/manage/control::post-quit-message", "conf": 0.699999988079071, "crit": 2, "desc": "Post quit message" }, { "id": "micro-behaviors/os/com/invoke::ole-initialize", "conf": 0.75, "crit": 2, "desc": "Initialize OLE/COM subsystem" }, { "id": "metadata/binary/layout::many-readable-strings", "conf": 0.699999988079071, "crit": 2, "desc": "PE has many readable strings" }, { "id": "metadata/package/versioning::pe-filedescription-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileDescription metadata field" }, { "id": "metadata/binary/section/names::pe-resource-section", "conf": 0.8999999761581421, "crit": 1, "desc": "PE resource section" }, { "id": "micro-behaviors/ui/window/manage/control::release-dc", "conf": 0.699999988079071, "crit": 2, "desc": "Release device context" }, { "id": "metadata/binary/metrics/threshold::high-overall-entropy-binary", "conf": 0.8999999761581421, "crit": 1, "desc": "Binary has high overall entropy (packed/encrypted)" }, { "id": "metadata/binary/section/metrics::elevated-text-entropy-section", "conf": 0.8199999928474426, "crit": 1, "desc": "Elevated text section entropy" }, { "id": "micro-behaviors/ui/window/manage/control::dispatch-message", "conf": 0.699999988079071, "crit": 2, "desc": "Dispatch window message" }, { "id": "metadata/binary/symbols/exports::gui-import-cluster-beginpaint", "conf": 0.8999999761581421, "crit": 1, "desc": "GUI import cluster BeginPaint" }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure" }, { "id": "micro-behaviors/os/com/invoke::co-task-mem-free", "conf": 0.699999988079071, "crit": 2, "desc": "Free COM memory allocation" }, { "id": "micro-behaviors/ui/window/manage/control::get-window-long", "conf": 0.699999988079071, "crit": 2, "desc": "Get window data" }, { "id": "micro-behaviors/process/sync/mutex::short-uppercase-token", "mbc": "C0042", "conf": 0.7200000286102295, "crit": 1, "desc": "Short uppercase mutex token" }, { "id": "micro-behaviors/fs/sync/fsync::set-file-time", "conf": 0.8500000238418579, "crit": 3, "desc": "Modify file creation/access/write times" }, { "id": "metadata/binary/layout::cert-table-present", "conf": 0.8999999761581421, "crit": 1, "desc": "PE certificate table entry populated" }, { "id": "micro-behaviors/os/clipboard/access::empty-clipboard-text", "conf": 0.7400000095367432, "crit": 3, "desc": "EmptyClipboard string reference" }, { "id": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "atk": "T1485", "mbc": "C0047", "conf": 0.8999999761581421, "crit": 1, "desc": "Preserves .exe .gho .bak files" }, { "id": "micro-behaviors/ui/window/manage/control::set-window-long", "conf": 0.699999988079071, "crit": 2, "desc": "Set window data" }, { "id": "micro-behaviors/os/module/load::user32-dll-reference", "conf": 1.0, "crit": 2, "desc": "Reference to USER32.dll" }, { "id": "metadata/binary/installer/script::nsis-error-title-data", "conf": 1.0, "crit": 1, "desc": "NSIS runtime error title in data" }, { "id": "micro-behaviors/os/clipboard/access::set-clipboard-data-text", "conf": 0.7799999713897705, "crit": 3, "desc": "SetClipboardData string reference" }, { "id": "micro-behaviors/ui/window/manage/control::exit-windows-ex", "conf": 0.8500000238418579, "crit": 3, "desc": "Shutdown/restart system" }, { "id": "metadata/build/manifest::pe-as-invoker", "conf": 1.0, "crit": 2, "desc": "requestedExecutionLevel is asInvoker" }, { "id": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "atk": "T1562.001", "mbc": "B0047", "conf": 0.949999988079071, "crit": 1, "desc": "MOTW stream value component" }, { "id": "micro-behaviors/os/registry/manipulate::reg-delete-value-w-symbol", "atk": "T1112", "conf": 0.8799999952316284, "crit": 3, "desc": "RegDeleteValueW registry value deletion" }, { "id": "objectives/command-and-control/backdoor/shell/com::get-window-rect-import", "atk": "T1071", "mbc": "B0025", "conf": 1.0, "crit": 1, "desc": "GetWindow / GetWindowRect import" }, { "id": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "atk": "T1553.002", "conf": 0.8500000238418579, "crit": 1, "desc": "PE lacks VS_VERSION_INFO resource" }, { "id": "micro-behaviors/ui/window/manage/control::create-window-ex", "conf": 0.8500000238418579, "crit": 2, "desc": "Create window (extended)" }, { "id": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "conf": 0.949999988079071, "crit": 1, "desc": "Filename has EXE extension" }, { "id": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "atk": "T1612", "mbc": "B0023", "conf": 0.8500000238418579, "crit": 1, "desc": "PE has few icon resources" }, { "id": "objectives/impact/services/stop::versioned-service-stop-context", "atk": "T1489", "conf": 0.699999988079071, "crit": 1, "desc": "Versioned service stop context" }, { "id": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "conf": 0.800000011920929, "crit": 1, "desc": "Five or more PE sections" }, { "id": "micro-behaviors/os/privilege/token::shutdown-privilege-name", "atk": "T1134.001", "conf": 0.7799999713897705, "crit": 3, "desc": "Shutdown privilege name string" }, { "id": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "atk": "T1027", "mbc": "B0032", "conf": 0.8600000143051147, "crit": 1, "desc": "Long mixed-case identifiers cluster" }, { "id": "objectives/evasion/process/injection/hollowing::create-process-string", "atk": "T1055.012", "mbc": "E1055.012", "conf": 0.800000011920929, "crit": 1, "desc": "Spawns process to host injected code" }, { "id": "micro-behaviors/os/module/load::get-proc-address-import", "conf": 0.8999999761581421, "crit": 2, "desc": "Resolve exports with GetProcAddress" }, { "id": "objectives/evasion/anti-av/gui-decoy::minimal-pe-resources", "atk": "T1027", "conf": 0.800000011920929, "crit": 1, "desc": "Few PE resource entries" }, { "id": "objectives/anti-static/obfuscation/binary-metrics/shape::has-overlay", "atk": "T1027", "mbc": "B0032", "crit": 1, "desc": "Binary has overlay data" }, { "id": "micro-behaviors/os/security/descriptor::set-file-security", "conf": 0.8799999952316284, "crit": 3, "desc": "Apply file security descriptor" }, { "id": "objectives/command-and-control/backdoor/shell/com::is-window-state-import", "atk": "T1071", "mbc": "B0025", "conf": 1.0, "crit": 1, "desc": "IsWindowVisible / IsWindowEnabled import" }, { "id": "micro-behaviors/fs/path/extension::exe-dup", "crit": 1, "desc": ".exe extension reference" }, { "id": "objectives/anti-static/obfuscation/binary-metrics/shape::medium-overlay-size", "atk": "T1027", "mbc": "B0032", "conf": 0.7200000286102295, "crit": 1, "desc": "Overlay large enough for stage data" }, { "id": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-5", "atk": "T1053.005", "mbc": "F0012", "conf": 0.8799999952316284, "crit": 1, "desc": "Task action path property" }, { "id": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "conf": 0.8999999761581421, "crit": 1, "desc": "SOCKS5 client greeting bytes" }, { "id": "micro-behaviors/communications/ip/endpoint::external-ipv4-port-pe", "conf": 0.8799999952316284, "crit": 1, "desc": "Hardcoded external IPv4 port in PE binary" }, { "id": "micro-behaviors/os/privilege/token::adjust-token-privileges", "conf": 0.800000011920929, "crit": 3, "desc": "Enable/disable privileges in access token" }, { "id": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "atk": "T1055", "conf": 0.949999988079071, "crit": 1, "desc": "Huge null run in executable (128+ bytes)" }, { "id": "micro-behaviors/fs/file/open::createfile-api", "conf": 0.8999999761581421, "crit": 2, "desc": "CreateFile API string reference" }, { "id": "micro-behaviors/os/privilege/token::lookup-privilege-value", "conf": 0.75, "crit": 3, "desc": "Lookup privilege name to LUID" }, { "id": "metadata/binary/installer/script::nsis", "conf": 0.949999988079071, "crit": 3, "desc": "Nullsoft NSIS installer marker" }, { "id": "objectives/evasion/indicator-removal/timestamps::timestomp-with-file-copy", "atk": "T1070.006", "mbc": "F0006", "conf": 0.8500000238418579, "crit": 2, "desc": "File timestamp modification with file operations" }, { "id": "micro-behaviors/fs/temp/directory::temp-file-staging-primitives", "conf": 0.800000011920929, "crit": 3, "desc": "Temp directory staging primitives" }, { "id": "micro-behaviors/os/privilege/token::lookup-privilege-value-any", "conf": 0.800000011920929, "crit": 3, "desc": "Lookup privilege name to LUID" }, { "id": "micro-behaviors/os/clipboard/access::win32-clipboard-read-write", "conf": 0.8199999928474426, "crit": 3, "desc": "Win32 clipboard read and write access" }, { "id": "metadata/binary/installer/script::nsis-error-title", "conf": 1.0, "crit": 1, "desc": "NSIS runtime error title marker" }, { "id": "micro-behaviors/os/registry/access::registry-create-key-api", "atk": "T1112", "conf": 0.8999999761581421, "crit": 3, "desc": "Registry key creation API" }, { "id": "metadata/signed/trust-level::signer-evidence-present", "conf": 1.0, "crit": 1, "desc": "Platform or developer signing evidence" }, { "id": "objectives/collection/clipboard/capture::clipboard-context", "conf": 0.699999988079071, "crit": 2, "desc": "Clipboard handling context" }, { "id": "micro-behaviors/fs/config/system::ini-read-write-cycle", "conf": 0.800000011920929, "crit": 3, "desc": "Reads and writes to INI configuration files" }, { "id": "micro-behaviors/os/registry/access::registry-set-value-api", "atk": "T1112", "conf": 0.8999999761581421, "crit": 3, "desc": "Registry value write API" }, { "id": "micro-behaviors/os/registry/access::registry-open-key-api", "atk": "T1112", "conf": 0.8999999761581421, "crit": 2, "desc": "Registry key open API" }, { "id": "micro-behaviors/process/create/shell/invoke::win-shellexecute", "atk": "T1059.003", "mbc": "E1059.003", "conf": 0.8999999761581421, "crit": 3, "desc": "Executes file or program via Windows ShellExecute API" }, { "id": "objectives/impact/ransom/file-operations::has-file-operations", "conf": 0.800000011920929, "crit": 1, "desc": "Has file operation capabilities" }, { "id": "objectives/lateral-movement/worm/file-copy::win32-file-copy-worm", "atk": "T1091", "conf": 0.8500000238418579, "crit": 2, "desc": "Win32 file-copy worm pattern" }, { "id": "micro-behaviors/os/registry/access::registry-query-value-api", "atk": "T1112", "conf": 0.8799999952316284, "crit": 2, "desc": "Registry value query API" }, { "id": "micro-behaviors/process/create/shell/invoke::win-createprocess", "atk": "T1059.003", "mbc": "E1059.003", "conf": 0.8999999761581421, "crit": 3, "desc": "Creates new process via Windows API" }, { "id": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "conf": 0.9200000166893005, "crit": 2, "desc": "Dynamically resolve own modules and exports" }, { "id": "metadata/binary/resource::png-and-manifest-rsrc", "conf": 0.8600000143051147, "crit": 2, "desc": "PNG and manifest in resources" }, { "id": "micro-behaviors/fs/enumerate/directory::find-file-walker-wide", "conf": 0.9200000166893005, "crit": 2, "desc": "Directory walker using Win32 wide APIs" }, { "id": "micro-behaviors/os/privilege/token::adjust-token-privileges-any", "conf": 0.8199999928474426, "crit": 3, "desc": "Enable or disable token privileges" }, { "id": "micro-behaviors/os/registry/access::registry-write-api-chain", "atk": "T1112", "conf": 0.8999999761581421, "crit": 2, "desc": "Registry key and value write chain" }, { "id": "metadata/binary/installer/family::known-benign-installer", "conf": 0.949999988079071, "crit": 1, "desc": "Known benign installer framework" }, { "id": "micro-behaviors/os/registry/access::registry-read-api-chain", "atk": "T1112", "conf": 0.8999999761581421, "crit": 2, "desc": "Registry key open and query chain" }, { "id": "objectives/command-and-control/dropper/execution/loader::common-windows-installer-profile", "conf": 0.75, "crit": 1, "desc": "Common Windows installer false positive profile" }, { "id": "micro-behaviors/process/create/shell/invoke::shell-execution-comp", "atk": "T1059", "mbc": "E1059", "conf": 0.8999999761581421, "crit": 3, "desc": "Shell command execution capability detected" }, { "id": "micro-behaviors/os/registry/manipulate::registry-write-api-chain", "atk": "T1112", "conf": 0.9200000166893005, "crit": 3, "desc": "Registry open create and write APIs" }, { "id": "objectives/command-and-control/dropper/execution/loader::self-copy-relaunch-loader", "atk": "T1129", "mbc": "B0030", "conf": 0.9399999976158142, "crit": 2, "desc": "Self copy append and relaunch" }, { "id": "objectives/collection/clipboard/capture::clipboard-session-transfer", "conf": 0.8799999952316284, "crit": 1, "desc": "Clipboard read or write transfer behavior" }, { "id": "objectives/impact/system/shutdown::shutdown-privilege-reboot-api", "atk": "T1529", "mbc": "B0029", "conf": 0.9399999976158142, "crit": 1, "desc": "Privilege-enabled reboot API use" }, { "id": "objectives/command-and-control/dropper/execution/loader::ini-driven-file-stager", "atk": "T1106", "mbc": "B0030", "conf": 0.9200000166893005, "crit": 2, "desc": "INI driven file stager with process handoff" }, { "id": "objectives/anti-analysis/sandbox-detect/tool-references::hardware-fingerprint-cluster", "atk": "T1497.001", "mbc": "B0007", "conf": 0.8500000238418579, "crit": 2, "desc": "Sandbox hardware fingerprint cluster (CPU/RAM/disk/uptime/screen)" }, { "id": "objectives/collection/file-targeting/enumeration::file-enumeration-targeting", "atk": "T1083", "mbc": "C0000", "conf": 0.8500000238418579, "crit": 1, "desc": "File system enumeration pattern" }, { "id": "objectives/collection/clipboard/capture::clipboard-access-api", "conf": 0.800000011920929, "crit": 3, "desc": "Clipboard read/write API context" }, { "id": "objectives/collection/file-targeting/enumeration::file-enumeration-with-access", "atk": "T1083", "mbc": "C0000", "conf": 0.8999999761581421, "crit": 2, "desc": "File enumeration + access combination" } ], "path": "694bde6d01b0e1b5982bd38206ee0a06efcb8243278f8eb08103e1204bb618ff.exe", "risk": 20, "size": 337304, "type": "pe" } ] } }