{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 0.8911781907081604,
        "class": 0,
        "threshold": 0.9987763166427612
      }
    ],
    "prob": 0.8911782,
    "class": 0,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.8911782,
        "class": 0
      },
      {
        "m": "az/native",
        "prob": 0.97384614,
        "class": 0
      },
      {
        "m": "az/pe",
        "prob": 0.6589404,
        "class": 0
      }
    ],
    "version": "v17.17",
    "threshold": 0.9987763,
    "analyzed_at": "2026-05-31T12:23:41Z"
  },
  "path": "6ac2683bba6a22dc602b3a5f1c5b77f5a342b6e60de3248b626d7c8acf5cb9ed.exe",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "H(Cm)Md₂(Bk)",
        "x": 5,
        "ff": {
          "i": [
            [
              "mscoree",
              "CorExeMain"
            ]
          ],
          "m": {
            "pe": {
              "checksum": 162371.0,
              "icon_count": 2.0,
              "has_manifest": 1.0,
              "checksum_valid": 0.0,
              "resource_count": 4.0,
              "has_version_info": 1.0,
              "computed_checksum": 255661.0,
              "bss_like_section_count": 0.0,
              "section_overflow_count": 0.0,
              "misaligned_section_count": 0.0,
              "base_relocation_block_count": 1.0,
              "base_relocation_entry_count": 1.0
            },
            "file": {
              "size": 208896.0,
              "entropy": 4.82,
              "size_bytes": 208896.0
            },
            "binary": {
              "is_pie": 1.0,
              "code_entropy": 5.2,
              "string_count": 1393.0,
              "entropy_variance": 4.39,
              "avg_string_length": 29.66,
              "max_string_length": 4655.0,
              "code_to_data_ratio": 1.0,
              "string_length_stddev": 180.42,
              "largest_section_ratio": 0.51,
              "sentence_string_count": 9.0,
              "sentence_string_ratio": 0.01,
              "high_entropy_string_count": 0.0
            },
            "imports": {
              "count": 1.0
            },
            "sections": {
              "count": 3.0,
              "code_size": 100352.0,
              "entropy_max": 5.2,
              "entropy_mean": 2.82,
              "name_entropy": 3.03,
              "writable_count": 0.0,
              "executable_count": 1.0,
              "nonstandard_count": 0.0,
              "executable_writable_count": 0.0
            },
            "dependencies": {
              "count": 1.0
            }
          },
          "s": [
            [
              77,
              "u8",
              "!This program cannot be run in DOS mode."
            ],
            [
              376,
              "u8",
              ".text"
            ],
            [
              455,
              "u8",
              "@.reloc"
            ],
            [
              3038,
              "u8",
              "22.22.115.18:4"
            ],
            [
              18968,
              "u8",
              "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R"
            ],
            [
              19125,
              "u8",
              "PADPADP"
            ],
            [
              19320,
              "u8",
              "BSJB"
            ],
            [
              19432,
              "u8",
              "87.23.162.9:1"
            ],
            [
              21844,
              "u8",
              "Microsoft.Win32"
            ],
            [
              21860,
              "u8",
              "ToUInt32"
            ],
            [
              21869,
              "u8",
              "ToInt32"
            ],
            [
              21877,
              "u8",
              "SizeF"
            ],
            [
              21883,
              "u8",
              "System.IO"
            ],
            [
              21893,
              "u8",
              "mscorlib"
            ],
            [
              21902,
              "u8",
              "System.Collections.Generic"
            ],
            [
              21929,
              "u8",
              "Microsoft.VisualBasic"
            ],
            [
              21951,
              "u8",
              "Thread"
            ],
            [
              21962,
              "u8",
              "Versioned"
            ],
            [
              21972,
              "u8",
              "Synchronized"
            ],
            [
              21985,
              "u8",
              "ReadToEnd"
            ],
            [
              21995,
              "u8",
              "Replace"
            ],
            [
              22003,
              "u8",
              "set_AutoScaleMode"
            ],
            [
              22021,
              "u8",
              "set_ColumnHeadersHeightSizeMode"
            ],
            [
              22053,
              "u8",
              "DataGridViewColumnHeadersHeightSizeMode"
            ],
            [
              22093,
              "u8",
              "IDisposable"
            ],
            [
              22105,
              "u8",
              "IDeferredDisposable"
            ],
            [
              22125,
              "u8",
              "RuntimeTypeHandle"
            ],
            [
              22143,
              "u8",
              "GetTypeFromHandle"
            ],
            [
              22161,
              "u8",
              "set_Name"
            ],
            [
              22170,
              "u8",
              "CallByName"
            ],
            [
              22181,
              "u8",
              "CallType"
            ],
            [
              22190,
              "u8",
              "Capture"
            ],
            [
              22198,
              "u8",
              "ApplicationSettingsBase"
            ],
            [
              22222,
              "u8",
              "HttpWebResponse"
            ],
            [
              22238,
              "u8",
              "GetResponse"
            ],
            [
              22250,
              "u8",
              "Dispose"
            ],
            [
              22258,
              "u8",
              "Create"
            ],
            [
              22265,
              "u8",
              "EditorBrowsableState"
            ],
            [
              22286,
              "u8",
              "STAThreadAttribute"
            ],
            [
              22305,
              "u8",
              "CompilerGeneratedAttribute"
            ],
            [
              22332,
              "u8",
              "GeneratedCodeAttribute"
            ],
            [
              22355,
              "u8",
              "DebuggerNonUserCodeAttribute"
            ],
            [
              22384,
              "u8",
              "EditorBrowsableAttribute"
            ],
            [
              22409,
              "u8",
              "DefaultSettingValueAttribute"
            ],
            [
              22438,
              "u8",
              "UserScopedSettingAttribute"
            ],
            [
              22465,
              "u8",
              "AllowPartiallyTrustedCallersAttribute"
            ],
            [
              22503,
              "u8",
              "ParamArrayAttribute"
            ],
            [
              22523,
              "u8",
              "WriteByte"
            ],
            [
              22533,
              "u8",
              "ToByte"
            ],
            [
              22540,
              "u8",
              "get_Value"
            ],
            [
              22550,
              "u8",
              "GetObjectValue"
            ],
            [
              22565,
              "u8",
              "value"
            ],
            [
              22571,
              "u8",
              "Save"
            ],
            [
              22702,
              "u8",
              ".exe"
            ],
            [
              22707,
              "u8",
              "set_Size"
            ],
            [
              22716,
              "u8",
              "ISupportInitialize"
            ],
            [
              22735,
              "u8",
              "System.Threading"
            ],
            [
              22752,
              "u8",
              "GetEncoding"
            ],
            [
              22764,
              "u8",
              "ToString"
            ],
            [
              22773,
              "u8",
              "disposing"
            ],
            [
              22783,
              "u8",
              "System.Drawing"
            ],
            [
              22798,
              "u8",
              "IsMatch"
            ],
            [
              22806,
              "u8",
              "get_Length"
            ],
            [
              22817,
              "u8",
              "System.ComponentModel"
            ],
            [
              22839,
              "u8",
              "ContainerControl"
            ],
            [
              22856,
              "u8",
              "UserControl"
            ],
            [
              22868,
              "u8",
              "GetResponseStream"
            ],
            [
              22886,
              "u8",
              "MemoryStream"
            ],
            [
              22899,
              "u8",
              "get_Item"
            ],
            [
              22908,
              "u8",
              "set_Item"
            ],
            [
              22917,
              "u8",
              "System"
            ],
            [
              22924,
              "u8",
              "Boolean"
            ],
            [
              22932,
              "u8",
              "EventToken"
            ],
            [
              22943,
              "u8",
              "set_Location"
            ],
            [
              22956,
              "u8",
              "System.Configuration"
            ],
            [
              22977,
              "u8",
              "System.Globalization"
            ],
            [
              22998,
              "u8",
              "System.Reflection"
            ],
            [
              23016,
              "u8",
              "MatchCollection"
            ],
            [
              23032,
              "u8",
              "ControlCollection"
            ],
            [
              23050,
              "u8",
              "GroupCollection"
            ],
            [
              23066,
              "u8",
              "ContractException"
            ],
            [
              23084,
              "u8",
              "DSASignatureDescription"
            ],
            [
              23108,
              "u8",
              "CultureInfo"
            ],
            [
              23120,
              "u8",
              "Sleep"
            ],
            [
              23126,
              "u8",
              "Group"
            ],
            [
              23132,
              "u8",
              "HebrewCalendar"
            ],
            [
              23147,
              "u8",
              "ToChar"
            ],
            [
              23154,
              "u8",
              "StreamReader"
            ],
            [
              23167,
              "u8",
              "TextReader"
            ],
            [
              23178,
              "u8",
              "ResourceManager"
            ],
            [
              23194,
              "u8",
              "System.CodeDom.Compiler"
            ],
            [
              23218,
              "u8",
              "IContainer"
            ],
            [
              23229,
              "u8",
              "MemberFilter"
            ],
            [
              23242,
              "u8",
              "IEnumerator"
            ],
            [
              23254,
              "u8",
              "GetEnumerator"
            ],
            [
              23268,
              "u8",
              ".ctor"
            ],
            [
              23274,
              "u8",
              ".cctor"
            ],
            [
              23281,
              "u8",
              "System.Diagnostics"
            ],
            [
              23300,
              "u8",
              "Microsoft.VisualBasic.CompilerServices"
            ],
            [
              23339,
              "u8",
              "System.Runtime.CompilerServices"
            ],
            [
              23371,
              "u8",
              "System.Resources"
            ],
            [
              23418,
              "u8",
              ".UserControl1.resources"
            ],
            [
              23472,
              "u8",
              ".Properties.Resources.resources"
            ],
            [
              23504,
              "u8",
              "Matches"
            ],
            [
              23512,
              "u8",
              "get_Controls"
            ],
            [
              23525,
              "u8",
              "System.Windows.Forms"
            ],
            [
              23546,
              "u8",
              "Contains"
            ],
            [
              23555,
              "u8",
              "set_AutoScaleDimensions"
            ],
            [
              23579,
              "u8",
              "System.Text.RegularExpressions"
            ],
            [
              23610,
              "u8",
              "System.Collections"
            ],
            [
              23629,
              "u8",
              "get_Groups"
            ],
            [
              23640,
              "u8",
              "get_Chars"
            ],
            [
              23650,
              "u8",
              "RuntimeHelpers"
            ],
            [
              23665,
              "u8",
              "System.Diagnostics.Contracts"
            ],
            [
              23694,
              "u8",
              "Concat"
            ],
            [
              23701,
              "u8",
              "Format"
            ],
            [
              23708,
              "u8",
              "Object"
            ],
            [
              23715,
              "u8",
              "System.Net"
            ],
            [
              23726,
              "u8",
              "get_CharacterSet"
            ],
            [
              23743,
              "u8",
              "Split"
            ],
            [
              23749,
              "u8",
              "System.Reflection.Emit"
            ],
            [
              23772,
              "u8",
              "EndInit"
            ],
            [
              23780,
              "u8",
              "BeginInit"
            ],
            [
              23790,
              "u8",
              "set_UserAgent"
            ],
            [
              23804,
              "u8",
              "get_Current"
            ],
            [
              23816,
              "u8",
              "Point"
            ],
            [
              23822,
              "u8",
              "Convert"
            ],
            [
              23830,
              "u8",
              "HttpWebRequest"
            ],
            [
              23845,
              "u8",
              "SuspendLayout"
            ],
            [
              23859,
              "u8",
              "ResumeLayout"
            ],
            [
              23872,
              "u8",
              "MoveNext"
            ],
            [
              23881,
              "u8",
              "System.Text"
            ],
            [
              23893,
              "u8",
              "DataGridView"
            ],
            [
              23906,
              "u8",
              "set_TabIndex"
            ],
            [
              23919,
              "u8",
              "Regex"
            ],
            [
              23925,
              "u8",
              "ToArray"
            ],
            [
              23933,
              "u8",
              "System.Security.Cryptography"
            ],
            [
              23962,
              "u8",
              "get_Assembly"
            ],
            [
              23975,
              "u8",
              "Registry"
            ],
            [
              23984,
              "u8",
              "System.Security"
            ],
            [
              24000,
              "u8",
              "Empty"
            ],
            [
              32902,
              "wide",
              "dataGridView1"
            ],
            [
              32930,
              "wide",
              "UserControl1"
            ],
            [
              32956,
              "wide",
              "WindowsFormsApp1.Properties.Resources"
            ],
            [
              33078,
              "wide",
              "etoJpwgFuQ"
            ],
            [
              34416,
              "wide",
              "TOiEXehIkUQZGYRjPpkZymNztuOFcixWrQwAQykMbQSKcbFCTlabZGbIlCpCGbxUHpivJZQZnwUPqticiXwVqsjuREWUjvOvPvMwhklkaOCkgTVjgz:TOiEXehIkUQZG"
            ],
            [
              35110,
              "wide",
              "xeaZrXZaSuTfdaIyZVGLVYLmUCPZnXJNJYJvQdOxgrRqVKCBIUaCvEytNePiaNULgrtcYdjRSoOGUWZRmxFdJlsfzqHLoGwtxfkDrADELiKgPSyQ/xeaZrXZaSuTfdaI"
            ],
            [
              35790,
              "wide",
              "fXVChRcUZnCHwxClRvjPMvAMUbsABmpHRQGqLUlGcpEdXVinFyotIJeJxiIgyCtMXUQFQmzXjCMwQwOZTeUcXW/fXVChRcUZnCHwxClRvjPMvAMUbsABmpHRQGqLUlGc"
            ],
            [
              36436,
              "wide",
              "hAWRfdfCwtYqjgXHTbuJmtHrPbWITsXMevmAYqLUrIBdGMSkedRiCSNSEcdgxICabEfKg/hAWRfdfCwtYqjgXHTbuJmtHrPbWITsXMevmAYqLUrIBdGMSkedRiCSNSEc"
            ],
            [
              36862,
              "wide",
              "UKIOVLgnipdxPQBOjlHuVWmExIfAbcGhzXjhANXcLrUOcZSMznuUdqlXydrmGlgJWXSGtnvoFIEcyBxQsaOHLeiLlJwKvfNfgcZgfZGxIGVZBU/UKIOVLgnipdxPQBOj"
            ],
            [
              37582,
              "wide",
              "wnFxzXROguKRZEjCzotvRmUOIfGAfpJVCnhzHohpnSLviZcof:wnFxzXROguKRZEjCzotvRmUOIfGAfpJVCnhzHohpnSLviZcof"
            ],
            [
              37782,
              "wide",
              "wnFxzXROguKRZEjCzotvRmUOIfGAfpJVCnhzHohpnSLviZcof"
            ],
            [
              38436,
              "wide",
              "hHGgyFbKJQSknbfbVxqbcRZlfhYBzFJcsuXHcOdIgPXypeZQGumBMmcpIvarGAkehPSTexYhuHVnTAWbhUfshqgsHZHNMbFETqzmgMivfgeqPvhyZjyFfLZzLAwyqtIF"
            ],
            [
              39118,
              "wide",
              "KnblPDlRiNDaziqaAFqKeLyagvXckidTvxYnWXkHiFecpjRUwovfbFBCNPxPUgDvzgeKrNEIfdWgtwKWDdFWMYSPWwAgAvNbcJDj"
            ],
            [
              39320,
              "wide",
              "fgCIKMaXIviqeBmQBGI/fgCIKMaXIviqeBmQBGI"
            ],
            [
              39400,
              "wide",
              "fgCIKMaXIviqeBmQBGI"
            ],
            [
              39826,
              "wide",
              "BuvHIRFZeTAXvIntjPMzotGVatzCJfZsTwOnrJQFXLKwdxnTgOdSrUThOzHprdp/BuvHIRFZeTAXvIntjPMzotGVatzCJfZsTwOnrJQFXLKwdxnTgOdSrUThOzHprdp"
            ],
            [
              40082,
              "wide",
              "BuvHIRFZeTAXvIntjPMzotGVatzCJfZsTwOnrJQFXLKwdxnTgOdSrUThOzHprdp"
            ],
            [
              94938,
              "wide",
              "FvUbhaYCHyScAoTvLCUtoagNETlsqxEHejMHuYLhfwlAjxSIhYGXjRFphwoPGljUkXrCmbMQMnSOFEhvsJjzYKVsgrnBxszkcGY"
            ],
            [
              95484,
              "wide",
              "zgqwglPkWZQKDpTwWcJWAcZvUNktuNHMYFIocndoizYtqHKmDVDisKywhUCsawPireLXHEtJYvNadGemdYPzk"
            ],
            [
              99695,
              "u8",
              "3System.Resources.Tools.StronglyTypedResourceBuilder"
            ],
            [
              99775,
              "u8",
              "KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator"
            ],
            [
              100111,
              "u8",
              "29.28.5.32:3598"
            ],
            [
              100382,
              "u8",
              "mscoree.dll"
            ],
            [
              101419,
              "u8",
              "IHDR"
            ],
            [
              101445,
              "u8",
              "IDATx"
            ],
            [
              101502,
              "u8",
              "JBHJ"
            ],
            [
              102223,
              "u8",
              "l1KO1"
            ],
            [
              102292,
              "u8",
              "gXej"
            ],
            [
              103557,
              "u8",
              "2nJOq"
            ],
            [
              105415,
              "u8",
              "/1IK"
            ],
            [
              105973,
              "u8",
              "d2aq"
            ],
            [
              106537,
              "u8",
              "IEND"
            ],
            [
              206238,
              "wide",
              "VS_VERSION_INFO"
            ],
            [
              206330,
              "wide",
              "StringFileInfo"
            ],
            [
              206366,
              "wide",
              "040904e4"
            ],
            [
              206390,
              "wide",
              "Comments"
            ],
            [
              206482,
              "wide",
              "CompanyName"
            ],
            [
              206594,
              "wide",
              "FileDescription"
            ],
            [
              206702,
              "wide",
              "FileVersion"
            ],
            [
              206762,
              "wide",
              "InternalName"
            ],
            [
              206854,
              "wide",
              ".exe"
            ],
            [
              206870,
              "wide",
              "LegalCopyright"
            ],
            [
              206900,
              "wide",
              "All Rights Reserved"
            ],
            [
              206946,
              "wide",
              "LegalTrademarks"
            ],
            [
              207054,
              "wide",
              "OriginalFilename"
            ],
            [
              207170,
              "wide",
              "ProductName"
            ],
            [
              207270,
              "wide",
              "ProductVersion"
            ],
            [
              207334,
              "wide",
              "Assembly Version"
            ],
            [
              207402,
              "wide",
              "VarFileInfo"
            ],
            [
              207434,
              "wide",
              "Translation"
            ],
            [
              207467,
              "u8",
              "\u003c?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?\u003e"
            ],
            [
              207526,
              "u8",
              "\u003cassembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"\u003e"
            ],
            [
              207601,
              "u8",
              "\u003cassemblyIdentity version=\"1.0.0.0\" name=\"MyApplication.app\"/\u003e"
            ],
            [
              207667,
              "u8",
              "\u003ctrustInfo xmlns=\"urn:schemas-microsoft-com:asm.v2\"\u003e"
            ],
            [
              207723,
              "u8",
              "\u003csecurity\u003e"
            ],
            [
              207739,
              "u8",
              "\u003crequestedPrivileges xmlns=\"urn:schemas-microsoft-com:asm.v3\"\u003e"
            ],
            [
              207809,
              "u8",
              "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"/\u003e"
            ],
            [
              207880,
              "u8",
              "\u003c/requestedPrivileges\u003e"
            ],
            [
              207910,
              "u8",
              "\u003c/security\u003e"
            ],
            [
              207927,
              "u8",
              "\u003c/trustInfo\u003e"
            ],
            [
              207943,
              "u8",
              "\u003c/assembly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPAD"
            ]
          ],
          "v": {
            "file.stem": "6ac2683bba6a22dc602b3a5f1c5b77f5a342b6e60de3248b626d7c8acf5cb9ed",
            "pe.imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
            "pe.machine": "i386",
            "pe.subsystem": "windows_gui",
            "pe.timestamp": 3421570029,
            "file.basename": "6ac2683bba6a22dc602b3a5f1c5b77f5a342b6e60de3248b626d7c8acf5cb9ed.exe",
            "pe.image_base": 4194304,
            "pe.image_size": 237568,
            "pe.machine_id": 332,
            "pe.os_version": "4.0",
            "pe.version.os": "unknown",
            "pe.entry_point": 108078,
            "pe.headers_size": 512,
            "pe.version.type": "dll",
            "pe.entry_section": ".text",
            "pe.subsystem_raw": 2,
            "pe.clr.is_il_only": 1,
            "pe.file_alignment": 512,
            "pe.cert_table_size": 5416,
            "pe.image_hash.sha1": "2de68b7da802c920c6c789588d44a9938c1833d4",
            "pe.version.company": "⼔⼥⼪⼔⼅⼯⼭⼕⼹⼷⼺⼼⼥⼕⼭⼰⼻⼲⼤⼥⼕⼺⼣⼆⼎⼬⼳⼖⼆⼭⼨⼭⼘ Inc.",
            "pe.version.comments": "⼔⼥⼪⼔⼅⼯⼭⼕⼹⼷⼺⼼⼥⼕⼭⼰⼻⼲⼤⼥⼕⼺⼣⼆⼎⼬⼳⼖⼆⼭⼨⼭⼘",
            "pe.image_hash.sha256": "fdccb548266b76109e7a32f34b5471f2629204210f5c1a9eadfcdf0c4165dd00",
            "pe.image_hash.sha384": "7b0609be205e3515869320b30774762757afda139d3e8ae828fd72736ee0bed22146d64125c070030c8408c4cba08e5e",
            "pe.image_hash.sha512": "0ef3556d929d2bffcfb6cb769b38c6ed5a90ec7ce55ad915b388fdc8d67fa2c0a1838bcde3eb27a4da6093eb18cfea2393ced20c80b3136413451af812e40d70",
            "pe.resource_types[0]": "RT_ICON",
            "pe.resource_types[1]": "RT_GROUP_ICON",
            "pe.resource_types[2]": "RT_VERSION",
            "pe.resource_types[3]": "RT_MANIFEST",
            "pe.section_alignment": 8192,
            "pe.subsystem_version": "4.0",
            "pe.version.copyright": "All Rights Reserved",
            "pe.characteristics[0]": "executable_image",
            "pe.characteristics[1]": "large_address_aware",
            "pe.manifest.ui_access": "false",
            "pe.version.trademarks": "⼔⼥⼪⼔⼅⼯⼭⼕⼹⼷⼺⼼⼥⼕⼭⼰⼻⼲⼤⼥⼕⼺⼣⼆⼎⼬⼳⼖⼆⼭⼨⼭⼘",
            "pe.characteristics_raw": 34,
            "pe.clr.runtime_version": "2.5",
            "pe.version.description": "⼔⼥⼪⼔⼅⼯⼭⼕⼹⼷⼺⼼⼥⼕⼭⼰⼻⼲⼤⼥⼕⼺⼣⼆⼎⼬⼳⼖⼆⼭⼨⼭⼘",
            "pe.linker_major_version": 48,
            "pe.version.file_version": "2.24.590.909",
            "pe.version.product_name": "⼔⼥⼪⼔⼅⼯⼭⼕⼹⼷⼺⼼⼥⼕⼭⼰⼻⼲⼤⼥⼕⼺⼣⼆⼎⼬⼳⼖⼆⼭⼨⼭⼘",
            "pe.version.internal_name": "⼔⼥⼪⼔⼅⼯⼭⼕⼹⼷⼺⼼⼥⼕⼭⼰⼻⼲⼤⼥⼕⼺⼣⼆⼎⼬⼳⼖⼆⼭⼨⼭⼘.exe",
            "pe.dll_characteristics[0]": "dynamic_base",
            "pe.dll_characteristics[1]": "nx_compat",
            "pe.dll_characteristics[2]": "no_seh",
            "pe.dll_characteristics[3]": "terminal_server_aware",
            "pe.data_directories[0].rva": 107992,
            "pe.data_directories[1].rva": 114688,
            "pe.data_directories[2].rva": 103424,
            "pe.data_directories[3].rva": 229376,
            "pe.data_directories[4].rva": 8192,
            "pe.data_directories[5].rva": 8200,
            "pe.dll_characteristics_raw": 34112,
            "pe.number_of_rva_and_sizes": 16,
            "pe.version.product_version": "2.24.590.909",
            "pe.data_directories[0].name": "import",
            "pe.data_directories[0].size": 83,
            "pe.data_directories[1].name": "resource",
            "pe.data_directories[1].size": 107092,
            "pe.data_directories[2].name": "certificate",
            "pe.data_directories[2].size": 5416,
            "pe.data_directories[3].name": "base_relocation",
            "pe.data_directories[3].size": 12,
            "pe.data_directories[4].name": "iat",
            "pe.data_directories[4].size": 8,
            "pe.data_directories[5].name": "clr_runtime_header",
            "pe.data_directories[5].size": 72,
            "pe.version.original_filename": "⼔⼥⼪⼔⼅⼯⼭⼕⼹⼷⼺⼼⼥⼕⼭⼰⼻⼲⼤⼥⼕⼺⼣⼆⼎⼬⼳⼖⼆⼭⼨⼭⼘.exe",
            "pe.coff.dos_header_pe_pointer": 128,
            "pe.base_relocations.block_count": 1,
            "pe.base_relocations.entry_count": 1,
            "pe.base_relocations.padding_count": 1,
            "pe.manifest.assembly_identity.name": "MyApplication.app",
            "pe.manifest.assembly_identity.version": "1.0.0.0",
            "pe.manifest.requested_execution_level": "asInvoker"
          },
          "id": "pe",
          "sc": [
            [
              ".text",
              512,
              100352,
              5.2,
              "r-x"
            ],
            [
              ".rsrc",
              100864,
              107520,
              3.16,
              "r--"
            ],
            [
              ".reloc",
              208384,
              512,
              0.1,
              "r--"
            ]
          ]
        },
        "id": 0,
        "sz": 208896,
        "ts": [
          {
            "c": 1.0,
            "d": ".NET assembly detected via BSJB CLR metadata signature",
            "e": [
              "BSJB at offset 0x4b78"
            ],
            "i": "metadata/dotnet/bsjb-signature",
            "l": 2,
            "el": [
              "0x4b78"
            ]
          },
          {
            "c": 1.0,
            "d": "Binary has 4 or fewer sections",
            "e": [
              "sections.count = 3.00"
            ],
            "i": "objectives/command-and-control/infrastructure/config::max-sections-4",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has 1000 or more strings",
            "e": [
              "binary.string_count = 1393.00"
            ],
            "i": "metadata/binary/metrics/threshold::string-count-1000-plus",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "PE ProductName metadata field",
            "e": [
              "ProductName"
            ],
            "i": "metadata/package/versioning::pe-productname-field",
            "l": 2,
            "el": [
              "0x32942"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "PE version info numeric fields present",
            "e": [
              "2.24.590.909"
            ],
            "i": "metadata/binary/anomaly/format::version-info-file-version-present",
            "l": 1,
            "el": [
              "value:pe.version.file_version"
            ]
          },
          {
            "c": 0.9200000166893005,
            "d": "PE FileVersion resembles IPv4",
            "e": [
              "2.24.590.909"
            ],
            "i": "metadata/package/versioning::pe-file-version-ipv4-shape",
            "l": 1,
            "el": [
              "value:pe.version.file_version"
            ]
          },
          {
            "a": "T1620",
            "c": 0.949999988079071,
            "d": "mscoree DLL string reference",
            "e": [
              "mscoree.dll"
            ],
            "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere",
            "l": 1,
            "m": "B0032",
            "el": [
              "0x1881e"
            ]
          },
          {
            "d": ".dll extension reference",
            "e": [
              ".dll"
            ],
            "i": "micro-behaviors/fs/path/extension::dll-dup",
            "l": 2,
            "el": [
              "0x1881e"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "System namespace reference",
            "e": [
              "System.Security",
              "System.Net",
              "System.IO"
            ],
            "i": "metadata/lang/compiler/managed::system-namespace",
            "l": 2,
            "el": [
              "0x5d7d",
              "0x5ca3",
              "0x557b"
            ]
          },
          {
            "c": 0.8600000143051147,
            "d": "VB CallByName late binding",
            "e": [
              "43 61 6C 6C 42 79 4E 61 6D 65"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/invoke::vb-callbyname-token",
            "l": 1,
            "el": [
              "0x569a"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard code/data section",
            "e": [
              ".text"
            ],
            "i": "metadata/binary/section/names::pe-code-data-standard-section",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE FileDescription metadata field",
            "e": [
              "FileDescription"
            ],
            "i": "metadata/package/versioning::pe-filedescription-field",
            "l": 2,
            "el": [
              "0x32702"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE has many readable strings",
            "e": [
              "binary.string_count = 1393.00"
            ],
            "i": "metadata/binary/layout::many-readable-strings",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "mscorlib reference",
            "e": [
              "mscorlib",
              "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R"
            ],
            "i": "metadata/lang/compiler/managed::mscorlib",
            "l": 2,
            "el": [
              "0x5585",
              "0x4a18"
            ]
          },
          {
            "a": "T1027",
            "c": 0.8399999737739563,
            "d": "VB6 PE with three sections",
            "e": [
              "sections.count = 3.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027.003",
            "c": 0.7799999713897705,
            "d": ".NET resource manager reference",
            "e": [
              "ResourceManager"
            ],
            "i": "micro-behaviors/data/embedded/payload/image::dotnet-resource-manager-token",
            "l": 1,
            "m": "F0001.006",
            "el": [
              "0x5a8a"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "PE ProductName field is populated",
            "e": [
              "⼔⼥⼪⼔⼅⼯⼭⼕⼹⼷⼺⼼⼥⼕⼭⼰⼻⼲⼤⼥⼕⼺⼣⼆⼎⼬⼳⼖⼆⼭⼨⼭⼘"
            ],
            "i": "metadata/package/versioning::pe-product-name-present",
            "l": 1,
            "el": [
              "value:pe.version.product_name"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE with six or fewer imports",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "metadata/binary/symbols/imports::pe-imports-max-six",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE has under ten imports",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10",
            "l": 1
          },
          {
            "c": 0.7799999713897705,
            "d": "Assembly accessor token (get_Assembly)",
            "e": [
              "get_Assembly"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/invoke::get-assembly-token",
            "l": 1,
            "el": [
              "0x5d9a"
            ]
          },
          {
            "c": 1.0,
            "d": ".NET Metadata Root (BSJB)",
            "e": [
              "BSJB"
            ],
            "i": "metadata/binary/framework::dotnet-metadata",
            "l": 2
          },
          {
            "c": 0.8399999737739563,
            "d": "PNG image data in PE resources",
            "e": [
              "IHDR"
            ],
            "i": "metadata/binary/resource::png-resource-marker",
            "l": 2,
            "el": [
              "0x18c2b"
            ]
          },
          {
            "c": 1.0,
            "d": "PE carries side-by-side assembly manifest",
            "e": [
              "{\"requested_execution_level\":\"asInvoker\",\"ui_access\":\"false\",\"assembly_identity\":{\"name\":\"MyApplication.app\",\"version\":\"1.0.0.0\""
            ],
            "i": "metadata/build/manifest::pe-has-manifest",
            "l": 2,
            "el": [
              "value:pe.manifest"
            ]
          },
          {
            "c": 1.0,
            "d": "requestedExecutionLevel is asInvoker",
            "e": [
              "asInvoker"
            ],
            "i": "metadata/build/manifest::pe-as-invoker",
            "l": 2,
            "el": [
              "value:pe.manifest.requested_execution_level"
            ]
          },
          {
            "c": 0.8199999928474426,
            "d": "Repeated padding marker string block",
            "e": [
              "…embly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…",
              "\u003c/assembly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…",
              "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…"
            ],
            "i": "objectives/anti-static/obfuscation/string/junking::repeated-padding-marker",
            "l": 1,
            "el": [
              "0x32c47",
              "0x32c47",
              "0x32c47"
            ]
          },
          {
            "c": 1.0,
            "d": "Modification of HTTP context items",
            "e": [
              "set_Item"
            ],
            "i": "micro-behaviors/communications/http/server/managed::http-item-setter",
            "l": 1,
            "el": [
              "0x597c"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "Reflection.Emit namespace reference",
            "e": [
              "System.Reflection.Emit"
            ],
            "i": "metadata/lang/compiler/managed::reflection-emit-namespace",
            "l": 1,
            "el": [
              "0x5cc5"
            ]
          },
          {
            "c": 0.9200000166893005,
            "d": "PE ProductVersion resembles IPv4",
            "e": [
              "2.24.590.909"
            ],
            "i": "metadata/package/versioning::pe-product-version-ipv4-shape",
            "l": 1,
            "el": [
              "value:pe.version.product_version"
            ]
          },
          {
            "c": 0.8500000238418579,
            "d": "Visual Basic runtime reference",
            "e": [
              "Microsoft.VisualBasic",
              "Microsoft.VisualBasic.CompilerServices"
            ],
            "i": "metadata/lang/compiler/managed::visual-basic-runtime",
            "l": 2,
            "el": [
              "0x55a9",
              "0x5b04"
            ]
          },
          {
            "c": 1.0,
            "d": "DEP / NX enabled (NX_COMPAT)",
            "e": [
              "[dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-dep",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE InternalName metadata field",
            "e": [
              "InternalName"
            ],
            "i": "metadata/package/versioning::pe-internalname-field",
            "l": 2,
            "el": [
              "0x327aa"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "Reflection method namespace token",
            "e": [
              "System.Reflection",
              "System.Reflection.Emit"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/invoke::namespace-import",
            "l": 1,
            "el": [
              "0x59d6",
              "0x5cc5"
            ]
          },
          {
            "c": 0.8500000238418579,
            "d": "IPv4-like .NET assembly version",
            "e": [
              "Version=4.0.0.0"
            ],
            "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version",
            "l": 2,
            "el": [
              "0x4a18"
            ]
          },
          {
            "c": 0.8600000143051147,
            "d": "asInvoker manifest tag in resources",
            "e": [
              "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"/\u003e"
            ],
            "i": "metadata/binary/resource::asinvoker-resource-manifest-flex",
            "l": 2,
            "el": [
              "0x32bc1"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE .reloc section presence",
            "e": [
              ".reloc"
            ],
            "i": "metadata/binary/section/names::reloc-section-presence",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "PE OriginalFilename metadata field",
            "e": [
              "OriginalFilename"
            ],
            "i": "metadata/package/versioning::pe-originalfilename-field",
            "l": 2,
            "el": [
              "0x328ce"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "PE FileDescription field is populated",
            "e": [
              "⼔⼥⼪⼔⼅⼯⼭⼕⼹⼷⼺⼼⼥⼕⼭⼰⼻⼲⼤⼥⼕⼺⼣⼆⼎⼬⼳⼖⼆⼭⼨⼭⼘"
            ],
            "i": "metadata/package/versioning::pe-file-description-present",
            "l": 1,
            "el": [
              "value:pe.version.description"
            ]
          },
          {
            "a": "T1027.009",
            "c": 0.8600000143051147,
            "d": ".NET ResourceReader payload access",
            "e": [
              "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.…"
            ],
            "i": "micro-behaviors/data/embedded/payload/resource::dotnet-resource-reader",
            "l": 1,
            "el": [
              "0x4a18"
            ]
          },
          {
            "c": 0.6000000238418579,
            "d": "SOCKS5 BIND request opcode",
            "e": [
              "05 02 00"
            ],
            "i": "micro-behaviors/communications/proxy/socks::socks5-bind-command-byte",
            "l": 1,
            "el": [
              "0x314f"
            ]
          },
          {
            "a": "T1027",
            "c": 0.9900000095367432,
            "d": "PE version resource text",
            "e": [
              "VS_VERSION_INFO"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info",
            "l": 1,
            "m": "B0032",
            "el": [
              "0x3259e"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE import table has exactly one entry",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "metadata/binary/symbols/imports::single-import-raw",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Windows Forms UI framework",
            "e": [
              "System.Windows.Forms"
            ],
            "i": "metadata/lang/compiler/managed::winforms-ui",
            "l": 2,
            "el": [
              "0x5be5"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard runtime section",
            "e": [
              ".reloc"
            ],
            "i": "metadata/binary/section/names::pe-runtime-standard-section",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Regex component marker",
            "e": [
              "ToString",
              "StringFileInfo"
            ],
            "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7",
            "l": 1,
            "el": [
              "0x58ec",
              "0x325fa"
            ]
          },
          {
            "a": "T1485",
            "c": 0.8999999761581421,
            "d": "Preserves .exe .gho .bak files",
            "e": [
              ".exe"
            ],
            "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist",
            "l": 1,
            "m": "C0047",
            "el": [
              "0x58ae"
            ]
          },
          {
            "c": 1.0,
            "d": "NO_SEH (SafeSEH not used)",
            "e": [
              "[dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-no-seh",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE resource section",
            "e": [
              ".rsrc"
            ],
            "i": "metadata/binary/section/names::pe-resource-section",
            "l": 1
          },
          {
            "a": "T1562.001",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "DefaultSettingValueAttribute",
              "value",
              "get_Value",
              "GetObjectValue"
            ],
            "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3",
            "l": 1,
            "m": "B0047",
            "el": [
              "0x5789",
              "0x5825",
              "0x580c",
              "0x5816"
            ]
          },
          {
            "c": 1.0,
            "d": "PE has RT_GROUP_ICON in resources list",
            "e": [
              "[RT_ICON, RT_GROUP_ICON, RT_VERSION, RT_MANIFEST]"
            ],
            "i": "metadata/binary/resource::pe-resource-group-icon-list",
            "l": 2,
            "el": [
              "value:pe.resource_types"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": ".NET WPF namespace reference",
            "e": [
              "System.Windows"
            ],
            "i": "well-known/game/mod::wpf-namespace-ref",
            "l": 1,
            "el": [
              "0x5be5"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "SOCKS5 client greeting bytes",
            "e": [
              "05 01 00"
            ],
            "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes",
            "l": 1,
            "el": [
              "0x254f"
            ]
          },
          {
            "c": 0.8199999928474426,
            "d": "System.Net.HttpWebRequest class usage",
            "e": [
              "HttpWebRequest"
            ],
            "i": "micro-behaviors/communications/http/client/managed::httpwebrequest",
            "l": 3,
            "el": [
              "0x5d16"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "CodeDom compiler access",
            "e": [
              "System.CodeDom.Compiler"
            ],
            "i": "metadata/lang/compiler/managed::codedom-compiler",
            "l": 2,
            "el": [
              "0x5a9a"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Manifest is MyApplication template name",
            "e": [
              "MyApplication.app"
            ],
            "i": "metadata/build/manifest::pe-manifest-myapplication-template",
            "l": 3,
            "el": [
              "value:pe.manifest.assembly_identity.name"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "PE LegalCopyright field is populated",
            "e": [
              "All Rights Reserved"
            ],
            "i": "metadata/package/versioning::pe-legal-copyright-present",
            "l": 1,
            "el": [
              "value:pe.version.copyright"
            ]
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "6ac2683bba6a22dc602b3a5f1c5b77f5a342b6e60de3248b626d7c8acf5cb9ed.exe"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Regex component marker",
            "e": [
              "DataGridViewColumnHeadersHeightSizeMode",
              "set_ColumnHeadersHeightSizeMode"
            ],
            "i": "micro-behaviors/communications/http/client/managed::webclient--rx-6",
            "l": 1,
            "el": [
              "0x5625",
              "0x5605"
            ]
          },
          {
            "c": 0.7200000286102295,
            "d": "HTTP response retrieval method",
            "e": [
              "GetResponse"
            ],
            "i": "micro-behaviors/communications/http/client/managed::getresponse",
            "l": 3,
            "el": [
              "0x56de"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE file uses .exe extension",
            "e": [
              "6ac2683bba6a22dc602b3a5f1c5b77f5a342b6e60de3248b626d7c8acf5cb9ed.exe"
            ],
            "i": "metadata/binary/framework::exe-extension",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE CompanyName metadata field",
            "e": [
              "CompanyName"
            ],
            "i": "metadata/package/versioning::pe-companyname-field",
            "l": 2,
            "el": [
              "0x32692"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "WCF generated code attribute",
            "e": [
              "GeneratedCodeAttribute"
            ],
            "i": "micro-behaviors/communications/ipc/wcf::dotnet-wcf-generated-code-attribute",
            "l": 1,
            "el": [
              "0x573c"
            ]
          },
          {
            "c": 0.6000000238418579,
            "d": "SOCKS5 UDP ASSOCIATE request opcode",
            "e": [
              "05 03 00"
            ],
            "i": "micro-behaviors/communications/proxy/socks::socks5-udp-associate-byte",
            "l": 1,
            "el": [
              "0x3d6d"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE has few sections",
            "e": [
              "sections.count = 3.00"
            ],
            "i": "metadata/binary/layout::legacy-few-sections",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "ASLR enabled (DYNAMIC_BASE)",
            "e": [
              "[dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-aslr",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "c": 0.6499999761581421,
            "d": ".NET Diagnostics namespace token",
            "e": [
              "System.Diagnostics"
            ],
            "i": "micro-behaviors/process/create/spawn::diagnostics-namespace-token-dotnet",
            "l": 1,
            "el": [
              "0x5af1"
            ]
          },
          {
            "c": 1.0,
            "d": "PE has RT_ICON in resources list",
            "e": [
              "[RT_ICON, RT_GROUP_ICON, RT_VERSION, RT_MANIFEST]"
            ],
            "i": "metadata/binary/resource::pe-resource-icon-list",
            "l": 2,
            "el": [
              "value:pe.resource_types"
            ]
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)",
            "e": [
              "pe.resource_count = 4.00"
            ],
            "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "High string count over 1000",
            "e": [
              "binary.string_count = 1393.00"
            ],
            "i": "metadata/binary/metrics/threshold::high-string-count-1000",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "PE with many long base64/hex-like strings",
            "e": [
              "xeaZrXZaSuTfdaIyZVGLVYLmUCPZnXJNJYJvQdOxgrRqVKCBIUaCvEytNePiaNULgrtcYdjRSoOGUWZRmxFdJlsfzqHLoGwtxfkDrADELiKgPSyQ/xeaZrXZaSuTfdaI",
              "UKIOVLgnipdxPQBOjlHuVWmExIfAbcGhzXjhANXcLrUOcZSMznuUdqlXydrmGlgJWXSGtnvoFIEcyBxQsaOHLeiLlJwKvfNfgcZgfZGxIGVZBU/UKIOVLgnipdxPQBOj",
              "hAWRfdfCwtYqjgXHTbuJmtHrPbWITsXMevmAYqLUrIBdGMSkedRiCSNSEcdgxICabEfKg/hAWRfdfCwtYqjgXHTbuJmtHrPbWITsXMevmAYqLUrIBdGMSkedRiCSNSEc",
              "fXVChRcUZnCHwxClRvjPMvAMUbsABmpHRQGqLUlGcpEdXVinFyotIJeJxiIgyCtMXUQFQmzXjCMwQwOZTeUcXW/fXVChRcUZnCHwxClRvjPMvAMUbsABmpHRQGqLUlGc",
              "BuvHIRFZeTAXvIntjPMzotGVatzCJfZsTwOnrJQFXLKwdxnTgOdSrUThOzHprdp/BuvHIRFZeTAXvIntjPMzotGVatzCJfZsTwOnrJQFXLKwdxnTgOdSrUThOzHprdp"
            ],
            "i": "metadata/file/encoded::pe-dense-base64-like-blobs",
            "l": 3,
            "el": [
              "0x8926",
              "0x8ffe",
              "0x8e54",
              "0x8bce",
              "0x9b92"
            ]
          },
          {
            "a": "T1027",
            "c": 0.8600000143051147,
            "d": "Long mixed-case identifiers cluster",
            "e": [
              "CompilerGeneratedAttribute",
              "BuvHIRFZeTAXvIntjPMzotGVatzCJfZsTwOnrJQFXLKwdxnTgOdSrUThOzHprdp",
              "UserScopedSettingAttribute",
              "StronglyTypedResourceBuilder",
              "SettingsSingleFileGenerator",
              "DebuggerNonUserCodeAttribute",
              "GeneratedCodeAttribute",
              "DataGridViewColumnHeadersHeightSizeMode",
              "EditorBrowsableAttribute",
              "DefaultSettingValueAttribute",
              "AllowPartiallyTrustedCallersAttribute",
              "KnblPDlRiNDaziqaAFqKeLyagvXckidTvxYnWXkHiFecpjRUwovfbFBCNPxPUgDvzgeKrNEIfdWgtwKWDdFWMYSPWwAgAvNbcJDj",
              "ApplicationSettingsBase",
              "ParamArrayAttribute"
            ],
            "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers",
            "l": 1,
            "m": "B0032",
            "el": [
              "0x5721",
              "0x9b92",
              "0x57a6",
              "0x1856f",
              "0x185bf",
              "0x5753",
              "0x573c",
              "0x5625",
              "0x5770",
              "0x5789",
              "0x57c1",
              "0x98ce",
              "0x56b6",
              "0x57e7"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "Filename has EXE extension",
            "e": [
              "6ac2683bba6a22dc602b3a5f1c5b77f5a342b6e60de3248b626d7c8acf5cb9ed.exe"
            ],
            "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe",
            "l": 1
          },
          {
            "a": "T1612",
            "c": 0.8500000238418579,
            "d": "PE has few icon resources",
            "e": [
              "pe.icon_count = 2.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six",
            "l": 1,
            "m": "B0023"
          },
          {
            "c": 0.8799999952316284,
            "d": "Large low-entropy PE resources",
            "e": [
              ".rsrc (size: 107520, entropy: 3.16)"
            ],
            "i": "metadata/binary/resource::resource-heavy-low-entropy-rsrc",
            "l": 2
          },
          {
            "c": 1.0,
            "d": ".NET BSJB metadata marker",
            "e": [
              "BSJB"
            ],
            "i": "metadata/binary/framework::bsjb-marker",
            "l": 1
          },
          {
            "a": "T1055",
            "c": 0.800000011920929,
            "d": "Executable section with very low entropy",
            "e": [
              ".text (size: 100352, perms: r-x)"
            ],
            "i": "objectives/anti-static/obfuscation/binary-structure::low-entropy-executable",
            "l": 1
          },
          {
            "a": "T1055",
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571",
            "l": 1,
            "m": "C0041"
          },
          {
            "a": "T1027.009",
            "c": 0.550000011920929,
            "d": ".NET resource manager access",
            "e": [
              "ResourceManager"
            ],
            "i": "micro-behaviors/data/embedded/payload/resource::dotnet-resourcemanager",
            "l": 1,
            "el": [
              "0x5a8a"
            ]
          },
          {
            "c": 0.8799999952316284,
            "d": "Hardcoded external IPv4 port in PE binary",
            "e": [
              "29.28.5.32:3598"
            ],
            "i": "micro-behaviors/communications/ip/endpoint::external-ipv4-port-pe",
            "l": 1,
            "el": [
              "0x1870f"
            ]
          },
          {
            "a": "T1105",
            "c": 0.800000011920929,
            "d": "Compact PE import table",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table",
            "l": 1,
            "m": "E1105"
          },
          {
            "c": 0.949999988079071,
            "d": "links mscoree (CorExeMain)",
            "e": [
              "mscoree"
            ],
            "i": "metadata/dylib::mscoree",
            "l": 2,
            "el": [
              "1 symbols"
            ]
          },
          {
            "a": "T1036.005",
            "c": 0.9399999976158142,
            "d": "Two dotted-quad version strings",
            "e": [
              "2.24.590.909"
            ],
            "i": "objectives/evasion/masquerade/identity/fabricated::dotted-quad-version-pair",
            "l": 1,
            "el": [
              "value:pe.version.file_version"
            ]
          },
          {
            "c": 0.8600000143051147,
            "d": "PNG and manifest in resources",
            "e": [
              "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"/\u003e",
              "IHDR"
            ],
            "i": "metadata/binary/resource::png-and-manifest-rsrc",
            "l": 2,
            "el": [
              "0x32bc1",
              "0x18c2b"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "PE version numbers look like IPv4",
            "e": [
              "2.24.590.909"
            ],
            "i": "metadata/package/versioning::version-number-ipv4-metadata",
            "l": 1,
            "el": [
              "value:pe.version.file_version"
            ]
          }
        ],
        "sha": "6ac2683bba6a22dc602b3a5f1c5b77f5a342b6e60de3248b626d7c8acf5cb9ed",
        "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2021-03/6ac2683bba6a22dc602b3a5f1c5b77f5a342b6e60de3248b626d7c8acf5cb9ed.exe",
        "type": "pe"
      }
    ],
    "tv": "52045"
  }
}