{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8251519203186035, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8251519, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8251519, "class": 0 }, { "m": "az/native", "prob": 0.07450331, "class": 0 }, { "m": "az/pe", "prob": 0.0017241379, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T04:56:56Z" }, "path": "702a41bb6a337f2d7ed036a9697294167abca7da0087431cf9800424bde1a412.exe", "raw": { "v": "5", "fs": [ { "f": "O(Er)H(Po)", "x": 9, "ff": { "i": [ [ "msvcp_win", "??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ" ], [ "msvcp_win", "??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ" ], [ "msvcp_win", "?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z" ], [ "msvcp_win", "??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ" ], [ "msvcp_win", "?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ" ], [ "msvcp_win", "?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ" ], [ "msvcp_win", "?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ" ], [ "msvcp_win", "?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ" ], [ "msvcp_win", "?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ" ], [ "msvcp_win", "?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ" ], [ "msvcp_win", "?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z" ], [ "msvcp_win", "?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z" ], [ "msvcp_win", "?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ" ], [ "msvcp_win", "?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA" ], [ "msvcp_win", "Mtx_init_in_situ" ], [ "msvcp_win", "?_Xbad_function_call@std@@YAXXZ" ], [ "msvcp_win", "Mtx_unlock" ], [ "msvcp_win", "?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z" ], [ "msvcp_win", "?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z" ], [ "msvcp_win", "?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z" ], [ "msvcp_win", "?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z" ], [ "msvcp_win", "??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ" ], [ "msvcp_win", "??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@H@Z" ], [ "msvcp_win", "??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ" ], [ "msvcp_win", "??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@N@Z" ], [ "msvcp_win", "??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@M@Z" ], [ "msvcp_win", "??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@_K@Z" ], [ "msvcp_win", "??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@_J@Z" ], [ "msvcp_win", "??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@F@Z" ], [ "msvcp_win", "??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@I@Z" ], [ "msvcp_win", "??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z" ], [ "msvcp_win", "?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ" ], [ "msvcp_win", "Mtx_lock" ], [ "msvcp_win", "?_Throw_C_error@std@@YAXH@Z" ], [ "msvcp_win", "Mtx_destroy_in_situ" ], [ "api-ms-win-crt-runtime-l1-1-0", "initterm" ], [ "api-ms-win-crt-runtime-l1-1-0", "initterm_e" ], [ "api-ms-win-crt-runtime-l1-1-0", "invoke_watson" ], [ "api-ms-win-crt-private-l1-1-0", "o__initialize_narrow_environment" ], [ "api-ms-win-crt-private-l1-1-0", "o__initialize_onexit_table" ], [ "api-ms-win-crt-private-l1-1-0", "o__invalid_parameter_noinfo" ], [ "api-ms-win-crt-private-l1-1-0", "o__invalid_parameter_noinfo_noreturn" ], [ "api-ms-win-crt-private-l1-1-0", "o__purecall" ], [ "api-ms-win-crt-private-l1-1-0", "o__register_onexit_function" ], [ "api-ms-win-crt-private-l1-1-0", "o__seh_filter_dll" ], [ "api-ms-win-crt-private-l1-1-0", "memmove" ], [ "api-ms-win-crt-private-l1-1-0", "o_ceilf" ], [ "api-ms-win-crt-private-l1-1-0", "o_floor" ], [ "api-ms-win-crt-private-l1-1-0", "o_free" ], [ "api-ms-win-crt-private-l1-1-0", "o_malloc" ], [ "api-ms-win-crt-private-l1-1-0", "o_realloc" ], [ "api-ms-win-crt-private-l1-1-0", "C_specific_handler" ], [ "api-ms-win-crt-private-l1-1-0", "o__execute_onexit_table" ], [ "api-ms-win-crt-private-l1-1-0", "o__errno" ], [ "api-ms-win-crt-private-l1-1-0", "o___stdio_common_vswprintf" ], [ "api-ms-win-crt-private-l1-1-0", "o___stdio_common_vsnprintf_s" ], [ "api-ms-win-crt-private-l1-1-0", "o___std_type_info_destroy_list" ], [ "api-ms-win-crt-private-l1-1-0", "o___std_exception_destroy" ], [ "api-ms-win-crt-private-l1-1-0", "o___std_exception_copy" ], [ "api-ms-win-crt-private-l1-1-0", "o__cexit" ], [ "api-ms-win-crt-private-l1-1-0", "o__crt_atexit" ], [ "api-ms-win-crt-private-l1-1-0", "o__configure_narrow_argv" ], [ "api-ms-win-crt-private-l1-1-0", "CxxThrowException" ], [ "api-ms-win-crt-private-l1-1-0", "memcmp" ], [ "api-ms-win-crt-private-l1-1-0", "memcpy" ], [ "api-ms-win-crt-private-l1-1-0", "std_terminate" ], [ "api-ms-win-crt-private-l1-1-0", "CxxFrameHandler4" ], [ "api-ms-win-crt-private-l1-1-0", "wcsstr" ], [ "api-ms-win-crt-string-l1-1-0", "memset" ], [ "api-ms-win-core-libraryloader-l1-2-0", "GetModuleFileNameA" ], [ "api-ms-win-core-libraryloader-l1-2-0", "FindResourceExW" ], [ "api-ms-win-core-libraryloader-l1-2-0", "GetModuleHandleW" ], [ "api-ms-win-core-libraryloader-l1-2-0", "LoadResource" ], [ "api-ms-win-core-libraryloader-l1-2-0", "DisableThreadLibraryCalls" ], [ "api-ms-win-core-libraryloader-l1-2-0", "FreeLibrary" ], [ "api-ms-win-core-libraryloader-l1-2-0", "LoadLibraryExW" ], [ "api-ms-win-core-libraryloader-l1-2-0", "GetProcAddress" ], [ "api-ms-win-core-libraryloader-l1-2-0", "GetModuleHandleExW" ], [ "api-ms-win-core-libraryloader-l1-2-0", "LockResource" ], [ "api-ms-win-core-featurestaging-l1-1-0", "UnsubscribeFeatureStateChangeNotification" ], [ "api-ms-win-core-featurestaging-l1-1-0", "SubscribeFeatureStateChangeNotification" ], [ "api-ms-win-core-featurestaging-l1-1-0", "RecordFeatureUsage" ], [ "api-ms-win-core-featurestaging-l1-1-0", "GetFeatureEnabledState" ], [ "api-ms-win-core-synch-l1-1-0", "InitializeSRWLock" ], [ "api-ms-win-core-synch-l1-1-0", "AcquireSRWLockShared" ], [ "api-ms-win-core-synch-l1-1-0", "InitializeCriticalSectionEx" ], [ "api-ms-win-core-synch-l1-1-0", "ReleaseSRWLockShared" ], [ "api-ms-win-core-synch-l1-1-0", "ReleaseSemaphore" ], [ "api-ms-win-core-synch-l1-1-0", "CreateSemaphoreExW" ], [ "api-ms-win-core-synch-l1-1-0", "OpenSemaphoreW" ], [ "api-ms-win-core-synch-l1-1-0", "WaitForSingleObject" ], [ "api-ms-win-core-synch-l1-1-0", "ReleaseMutex" ], [ "api-ms-win-core-synch-l1-1-0", "ReleaseSRWLockExclusive" ], [ "api-ms-win-core-synch-l1-1-0", "WaitForSingleObjectEx" ], [ "api-ms-win-core-synch-l1-1-0", "AcquireSRWLockExclusive" ], [ "api-ms-win-core-synch-l1-1-0", "CreateEventW" ], [ "api-ms-win-core-synch-l1-1-0", "ResetEvent" ], [ "api-ms-win-core-synch-l1-1-0", "SetEvent" ], [ "api-ms-win-core-synch-l1-1-0", "DeleteCriticalSection" ], [ "api-ms-win-core-synch-l1-1-0", "InitializeCriticalSectionAndSpinCount" ], [ "api-ms-win-core-synch-l1-1-0", "LeaveCriticalSection" ], [ "api-ms-win-core-synch-l1-1-0", "EnterCriticalSection" ], [ "api-ms-win-core-synch-l1-1-0", "CreateMutexExW" ], [ "api-ms-win-core-heap-l1-1-0", "HeapAlloc" ], [ "api-ms-win-core-heap-l1-1-0", "HeapSize" ], [ "api-ms-win-core-heap-l1-1-0", "HeapFree" ], [ "api-ms-win-core-heap-l1-1-0", "GetProcessHeap" ], [ "api-ms-win-core-errorhandling-l1-1-0", "GetLastError" ], [ "api-ms-win-core-errorhandling-l1-1-0", "RaiseException" ], [ "api-ms-win-core-errorhandling-l1-1-0", "SetLastError" ], [ "api-ms-win-core-errorhandling-l1-1-0", "UnhandledExceptionFilter" ], [ "api-ms-win-core-errorhandling-l1-1-0", "SetUnhandledExceptionFilter" ], [ "api-ms-win-core-threadpool-l1-2-0", "SetThreadpoolTimer" ], [ "api-ms-win-core-threadpool-l1-2-0", "WaitForThreadpoolTimerCallbacks" ], [ "api-ms-win-core-threadpool-l1-2-0", "CreateThreadpoolTimer" ], [ "api-ms-win-core-threadpool-l1-2-0", "CloseThreadpoolTimer" ], [ "api-ms-win-core-processthreads-l1-1-0", "GetCurrentProcess" ], [ "api-ms-win-core-processthreads-l1-1-0", "TerminateProcess" ], [ "api-ms-win-core-processthreads-l1-1-0", "GetCurrentThreadId" ], [ "api-ms-win-core-processthreads-l1-1-0", "GetCurrentProcessId" ], [ "api-ms-win-core-processthreads-l1-1-0", "TlsFree" ], [ "api-ms-win-core-processthreads-l1-1-0", "TlsGetValue" ], [ "api-ms-win-core-processthreads-l1-1-0", "TlsSetValue" ], [ "api-ms-win-core-localization-l1-2-0", "FormatMessageW" ], [ "api-ms-win-core-localization-l1-2-0", "SetProcessPreferredUILanguages" ], [ "api-ms-win-core-debug-l1-1-0", "OutputDebugStringW" ], [ "api-ms-win-core-debug-l1-1-0", "DebugBreak" ], [ "api-ms-win-core-debug-l1-1-0", "IsDebuggerPresent" ], [ "api-ms-win-core-handle-l1-1-0", "CloseHandle" ], [ "api-ms-win-eventing-provider-l1-1-0", "EventSetInformation" ], [ "api-ms-win-eventing-provider-l1-1-0", "EventRegister" ], [ "api-ms-win-eventing-provider-l1-1-0", "EventUnregister" ], [ "api-ms-win-eventing-provider-l1-1-0", "EventWriteTransfer" ], [ "api-ms-win-core-libraryloader-l1-2-1", "LoadLibraryW" ], [ "api-ms-win-core-winrt-error-l1-1-0", "RoOriginateErrorW" ], [ "api-ms-win-core-winrt-error-l1-1-0", "SetRestrictedErrorInfo" ], [ "api-ms-win-core-winrt-error-l1-1-0", "RoOriginateError" ], [ "api-ms-win-core-winrt-error-l1-1-0", "RoTransformError" ], [ "api-ms-win-core-util-l1-1-0", "EncodePointer" ], [ "api-ms-win-core-util-l1-1-0", "DecodePointer" ], [ "api-ms-win-core-synch-l1-2-0", "InitOnceExecuteOnce" ], [ "api-ms-win-core-winrt-errorprivate-l1-1-0", "RoFailFastWithErrorContextInternal2" ], [ "api-ms-win-core-winrt-string-l1-1-0", "WindowsConcatString" ], [ "api-ms-win-core-winrt-string-l1-1-0", "WindowsCreateStringReference" ], [ "api-ms-win-core-winrt-string-l1-1-0", "WindowsDeleteString" ], [ "api-ms-win-core-winrt-string-l1-1-0", "WindowsCreateString" ], [ "api-ms-win-core-winrt-string-l1-1-0", "WindowsGetStringRawBuffer" ], [ "api-ms-win-core-winrt-string-l1-1-0", "WindowsStringHasEmbeddedNull" ], [ "api-ms-win-core-winrt-string-l1-1-0", "WindowsIsStringEmpty" ], [ "api-ms-win-core-winrt-string-l1-1-0", "WindowsDuplicateString" ], [ "api-ms-win-core-winrt-string-l1-1-0", "WindowsCompareStringOrdinal" ], [ "api-ms-win-core-winrt-error-l1-1-1", "IsErrorPropagationEnabled" ], [ "api-ms-win-core-winrt-error-l1-1-1", "RoClearError" ], [ "api-ms-win-core-winrt-error-l1-1-1", "RoGetMatchingRestrictedErrorInfo" ], [ "api-ms-win-core-winrt-error-l1-1-1", "RoReportFailedDelegate" ], [ "api-ms-win-core-com-l1-1-0", "CoTaskMemAlloc" ], [ "api-ms-win-core-com-l1-1-0", "StringFromGUID2" ], [ "api-ms-win-core-com-l1-1-0", "CoTaskMemFree" ], [ "api-ms-win-core-com-l1-1-0", "CoCreateInstance" ], [ "api-ms-win-core-com-l1-1-0", "CoCreateFreeThreadedMarshaler" ], [ "api-ms-win-core-com-l1-1-0", "CoGetApartmentType" ], [ "api-ms-win-core-rtlsupport-l1-1-0", "RtlLookupFunctionEntry" ], [ "api-ms-win-core-rtlsupport-l1-1-0", "RtlVirtualUnwind" ], [ "api-ms-win-core-rtlsupport-l1-1-0", "RtlCaptureContext" ], [ "api-ms-win-core-winrt-l1-1-0", "RoGetActivationFactory" ], [ "api-ms-win-core-winrt-l1-1-0", "RoActivateInstance" ], [ "api-ms-win-eventing-classicprovider-l1-1-0", "TraceEvent" ], [ "api-ms-win-core-sysinfo-l1-1-0", "GetSystemTimeAsFileTime" ], [ "api-ms-win-core-processthreads-l1-1-1", "IsProcessorFeaturePresent" ], [ "api-ms-win-core-profile-l1-1-0", "QueryPerformanceCounter" ], [ "api-ms-win-core-profile-l1-1-0", "QueryPerformanceFrequency" ], [ "api-ms-win-core-interlocked-l1-1-0", "InitializeSListHead" ], [ "ntdll", "RtlCaptureStackBackTrace" ], [ "api-ms-win-core-registry-l1-1-0", "RegOpenKeyExW" ], [ "api-ms-win-core-registry-l1-1-0", "RegQueryValueExW" ], [ "api-ms-win-core-registry-l1-1-0", "RegCloseKey" ], [ "api-ms-win-core-registry-l1-1-0", "RegGetValueW" ], [ "api-ms-win-core-errorhandling-l1-1-3", "TerminateProcessOnMemoryExhaustion" ], [ "api-ms-win-core-quirks-l1-1-0", "QuirkIsEnabled" ], [ "api-ms-win-rtcore-ntuser-private-l1-1-7", "IsOneCoreTransformMode" ], [ "bcp47langs", "GetApplicationLanguages" ], [ "bcp47langs", "LanguageListAsMuiForm" ], [ "combase", "ORDINAL 157" ], [ "combase", "ORDINAL 90" ], [ "api-ms-win-core-apiquery-l1-1-0", "ApiSetQueryApiSetPresence" ], [ "api-ms-win-core-delayload-l1-1-1", "ResolveDelayLoadedAPI" ], [ "api-ms-win-core-delayload-l1-1-0", "DelayLoadFailureHook" ], [ "ext-ms-win-xaml-pal-l1-1-0", "XamlBehaviorEnabled" ], [ "ext-ms-win-xaml-pal-l1-1-0", "CreatePhoneAppBarProxy" ] ], "m": { "pe": { "has_cfg": 1.0, "checksum": 1703841.0, "checksum_valid": 0.0, "resource_count": 9.0, "has_version_info": 1.0, "computed_checksum": 1654426.0, "delay_import_count": 2.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "base_relocation_block_count": 23.0, "base_relocation_entry_count": 9612.0, "security_directory_out_of_bounds": 1.0 }, "file": { "size": 1638400.0, "entropy": 6.46, "size_bytes": 1638400.0 }, "binary": { "is_pie": 1.0, "code_entropy": 6.46, "data_entropy": 1.32, "string_count": 4004.0, "entropy_variance": 4.31, "avg_string_length": 14.72, "max_string_length": 152.0, "code_to_data_ratio": 0.99, "string_length_stddev": 17.06, "largest_section_ratio": 0.83, "sentence_string_count": 14.0, "sentence_string_ratio": 0.0, "high_entropy_string_count": 0.0 }, "exports": { "count": 14.0 }, "imports": { "count": 189.0 }, "sections": { "count": 7.0, "code_size": 1355776.0, "entropy_max": 6.46, "entropy_mean": 4.06, "name_entropy": 3.27, "writable_count": 2.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 40.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 528, "u8", ".text" ], [ 607, "u8", "@.data" ], [ 648, "u8", ".pdata" ], [ 687, "u8", "@.didat" ], [ 728, "u8", ".rsrc" ], [ 767, "u8", "@.reloc" ], [ 8783, "u8", "L$ SVWAVH" ], [ 8899, "u8", "L$ SUVWH" ], [ 9022, "u8", "\\$ UVWAVAWH" ], [ 10078, "u8", "\\$ UVWH" ], [ 11286, "u8", "UVWATAUAVAWH" ], [ 11546, "u8", "f98u" ], [ 12747, "u8", "l$ VWAVH" ], [ 13469, "u8", "x UAVAWH" ], [ 13915, "u8", "HcD$ H" ], [ 14224, "u8", "L97sKI" ], [ 14561, "u8", "x AVH" ], [ 14774, "u8", "uPH9i" ], [ 17272, "u8", "|$ UATAUAVAWH" ], [ 21894, "u8", "UWAVH" ], [ 31173, "u8", "x ATAVAWH" ], [ 31238, "u8", "vb'vb'v" ], [ 44133, "u8", "UVWH" ], [ 76865, "u8", "p AWH" ], [ 77427, "u8", "x 8\\$8u" ], [ 126248, "u8", "qYWX6" ], [ 146769, "u8", "x AUAVAWH" ], [ 147051, "u8", "20ES" ], [ 151485, "u8", "USWH" ], [ 151622, "u8", "M E3" ], [ 156997, "u8", "x UATAUAVAWH" ], [ 158797, "u8", "p WATAWH" ], [ 167120, "u8", "@USVWATAUAVAWH" ], [ 168164, "u8", "@SUVWATAVAWH" ], [ 175798, "u8", "pCZ6V" ], [ 181839, "u8", "GPD8m" ], [ 182092, "u8", "t$ WAVAWH" ], [ 187854, "u8", "AL9AH" ], [ 187867, "u8", "Bx9ATt" ], [ 188055, "u8", "Ex9GTt6" ], [ 189097, "u8", "Ex9GDtV" ], [ 190020, "u8", "9NTtlA" ], [ 190329, "u8", "k VWAVH" ], [ 193645, "u8", "p WATAUAVAWH" ], [ 194237, "u8", "p WAVAWH" ], [ 221738, "u8", "p PTl" ], [ 221784, "u8", "q PTl" ], [ 227722, "u8", "piSZq" ], [ 227768, "u8", "qiSZq" ], [ 232379, "u8", "VWAVH" ], [ 244145, "u8", "Y E3" ], [ 264527, "u8", "pxQVY" ], [ 264730, "u8", "pkYrK" ], [ 264776, "u8", "qkYrK" ], [ 273050, "u8", "pjYp" ], [ 273096, "u8", "qjYp" ], [ 293352, "u8", "qsSP1" ], [ 293566, "u8", "psSP1" ], [ 307542, "u8", "UWATH" ], [ 315546, "u8", "pkYt" ], [ 315592, "u8", "qkYt" ], [ 362586, "u8", "pcRPQ" ], [ 362632, "u8", "qcRPQ" ], [ 381050, "u8", "p8RRa" ], [ 381096, "u8", "q8RRa" ], [ 384218, "u8", "pxXp" ], [ 384264, "u8", "qxXp" ], [ 392474, "u8", "psT8w" ], [ 392520, "u8", "qsT8w" ], [ 406589, "u8", "V86I" ], [ 409209, "u8", "pzWv" ], [ 409272, "u8", "qzWv" ], [ 414959, "u8", "pkSp" ], [ 418042, "u8", "pbPT3" ], [ 418088, "u8", "qbPT3" ], [ 418728, "u8", "qcTz" ], [ 423138, "u8", "2\u003e\u003ed" ], [ 426415, "u8", "pqVt" ], [ 426472, "u8", "qqVt" ], [ 430255, "u8", "pYYre" ], [ 430312, "u8", "qYYre" ], [ 445343, "u8", "pAZ0N" ], [ 445400, "u8", "qAZ0N" ], [ 466207, "u8", "pjQt" ], [ 477615, "u8", "pAX8269" ], [ 477672, "u8", "qAX8269" ], [ 518562, "u8", "psQ8F6" ], [ 518616, "u8", "qsQ8F6" ], [ 542079, "u8", "piQvi" ], [ 542136, "u8", "qiQvi" ], [ 555423, "u8", "ppTt" ], [ 555480, "u8", "qpTt" ], [ 558306, "u8", "z170" ], [ 559263, "u8", "pcQtp" ], [ 559320, "u8", "qcQtp" ], [ 563451, "u8", "X H9P" ], [ 573721, "u8", "` AUAVAWH" ], [ 593449, "u8", "USVWAVH" ], [ 596295, "u8", "t$ UWAVH" ], [ 613088, "u8", "@USVWATAVAWH" ], [ 620738, "u8", "Zq.x" ], [ 682667, "u8", "E7E3" ], [ 684148, "u8", "M7H3" ], [ 706229, "u8", "LcI L" ], [ 718913, "u8", "p0TTN.D" ], [ 728148, "u8", "xFD8m" ], [ 729696, "u8", "|$ UAVAWH" ], [ 736239, "u8", "M09M" ], [ 747604, "u8", "M9 M" ], [ 753135, "u8", "SVWH" ], [ 754789, "u8", "piUp" ], [ 781053, "u8", "EH9E" ], [ 822786, "u8", "\\$ UVWATAUAVAWH" ], [ 822824, "u8", "E E3" ], [ 826469, "u8", "M H3" ], [ 828281, "u8", "p UWAVH" ], [ 842276, "u8", "YHE3" ], [ 855076, "u8", "9N4tlA" ], [ 881762, "u8", "\\$ VWAVH" ], [ 883346, "u8", "H91A" ], [ 886961, "u8", "uBD9R" ], [ 892472, "u8", "qxQVY" ], [ 930572, "u8", "pPtz" ], [ 930845, "u8", "8Aft0" ], [ 931072, "u8", "|$ UAUAVH" ], [ 931800, "u8", "EPE3" ], [ 934830, "u8", "MPH3" ], [ 950361, "u8", "X UVWATAUAVAWH" ], [ 968791, "u8", "t$ UWATAVAWH" ], [ 980944, "u8", "H9u uIH9u(uC" ], [ 987032, "u8", "qqZv" ], [ 998015, "u8", "M8E3" ], [ 999702, "u8", "M9nhu" ], [ 1015767, "u8", "L$ UVWAVAWH" ], [ 1020085, "u8", "pqQt" ], [ 1034868, "u8", "pqZv" ], [ 1075432, "u8", "qkSp" ], [ 1075894, "u8", "H9wHtEH" ], [ 1111769, "u8", "pYVzW" ], [ 1155517, "u8", "M tIH" ], [ 1169205, "u8", "UVAVH" ], [ 1177017, "u8", "h UAVAWH" ], [ 1179115, "u8", "L$ UVWATAUAVAWH" ], [ 1179645, "u8", "97tKA" ], [ 1212401, "u8", "9x s" ], [ 1213553, "u8", "p Wp" ], [ 1220216, "u8", "xpH9w" ], [ 1221560, "u8", "L$ HiW" ], [ 1222962, "u8", "EH8EPtyH" ], [ 1237249, "u8", "H;Q sUH" ], [ 1244555, "u8", "M0H9M" ], [ 1251240, "u8", "qjQt" ], [ 1302682, "u8", "pASxi" ], [ 1303983, "u8", "USVWATAUAVAWH" ], [ 1312941, "u8", "P E3" ], [ 1315989, "u8", "v D89u" ], [ 1325223, "u8", "D$ HcH" ], [ 1325798, "u8", "pYWX6" ], [ 1327053, "u8", "I9Khs" ], [ 1329674, "u8", "L8HH" ], [ 1329990, "u8", "QP@8qeu8@8q\\t" ], [ 1330413, "u8", "x AWH" ], [ 1331481, "u8", "s WAVAWH" ], [ 1333277, "u8", "D8yetJ" ], [ 1335800, "u8", "u:8Ydu58Y\\t" ], [ 1336997, "u8", "H UVWATAUAVAWH" ], [ 1339595, "u8", "t$ WATAUAVAWH" ], [ 1341335, "u8", "L$ SVWH" ], [ 1341887, "u8", "fD94Ou" ], [ 1342641, "u8", "EXE3" ], [ 1348367, "u8", "uxHc" ], [ 1349532, "u8", "M H1E" ], [ 1350285, "u8", "ntelA" ], [ 1350292, "u8", "ineID" ], [ 1350315, "u8", "Genu" ], [ 1465952, "wide", "api-ms-win-core-synch-l1-2-0.dll" ], [ 1466024, "wide", "kernel32.dll" ], [ 1466056, "u8", "SleepConditionVariableCS" ], [ 1466088, "u8", "WakeAllConditionVariable" ], [ 1466128, "u8", "ext-ms-win-xaml-pal-l1-1-0.dll" ], [ 1466160, "wide", "ext-ms-win-xaml-pal-l1-1-0" ], [ 1466240, "u8", "Exception" ], [ 1466256, "u8", "ReturnNt" ], [ 1466272, "u8", "ReturnHr" ], [ 1466284, "u8", "LogNt" ], [ 1466292, "u8", "LogHr" ], [ 1466304, "u8", "FailFast" ], [ 1466320, "wide", "%hs(%u)\\%hs!%p:" ], [ 1466384, "wide", "(caller: %p)" ], [ 1466416, "wide", "%hs(%d) tid(%x) %08X %ws" ], [ 1466512, "wide", "CallContext:[%hs]" ], [ 1466552, "wide", "[%hs(%hs)]" ], [ 1466600, "wide", "kernelbase.dll" ], [ 1466632, "u8", "RaiseFailFastException" ], [ 1466688, "wide", "ntdll.dll" ], [ 1466712, "u8", "RtlNtStatusToDosErrorNoTeb" ], [ 1466744, "u8", "RtlDllShutdownInProgress" ], [ 1466776, "u8", "RtlDisownModuleHeapAllocation" ], [ 1466808, "wide", "Local\\SM0:%lu:%lu:%hs" ], [ 1466944, "wide", "Windows.UI.Xaml.Media.Animation.ThemeAnimationBase" ], [ 1467072, "wide", "Windows.UI.Xaml.Media.Animation.DiscreteObjectKeyFrame" ], [ 1467216, "wide", "Windows.UI.Xaml.Media.Animation.DoubleAnimationUsingKeyFrames" ], [ 1467360, "wide", "Windows.UI.Xaml.Automation.ScrollPatternIdentifiers" ], [ 1467488, "wide", "Windows.UI.Xaml.Automation.Peers.ItemsControlAutomationPeer" ], [ 1467728, "wide", "Windows.UI.Xaml.Media.Animation.ObjectAnimationUsingKeyFrames" ], [ 1467872, "wide", "Windows.UI.Xaml.Controls.Canvas" ], [ 1467952, "wide", "Windows.UI.Xaml.Media.VisualTreeHelper" ], [ 1468064, "wide", "Windows.UI.Xaml.Controls.SelectionChangedEventArgs" ], [ 1468248, "wide", "Windows.Globalization.Calendar" ], [ 1468320, "wide", "Windows.Globalization.DateTimeFormatting.DateTimeFormatter" ], [ 1468448, "wide", "Windows.UI.Xaml.Controls.ItemsControl" ], [ 1468624, "wide", "Windows.UI.Xaml.Media.Animation.Storyboard" ], [ 1468736, "wide", "Windows.UI.Xaml.ElementSoundPlayer" ], [ 1468816, "wide", "Windows.UI.Xaml.Media.Animation.LinearDoubleKeyFrame" ], [ 1468928, "wide", "Windows.UI.Xaml.Data.Binding" ], [ 1469008, "wide", "Windows.UI.Xaml.Automation.Peers.ItemAutomationPeer" ], [ 1469232, "wide", "Windows.UI.Xaml.Controls.ContentControl" ], [ 1469341, "u8", "SDME" ], [ 1469392, "wide", "Windows.UI.Xaml.Media.Animation.EasingDoubleKeyFrame" ], [ 1469520, "wide", "Windows.UI.Xaml.Input.FindNextElementOptions" ], [ 1469712, "wide", "Windows.UI.Xaml.VisualStateManager" ], [ 1469808, "wide", "Windows.UI.Xaml.Controls.AppBarToggleButton" ], [ 1469920, "wide", "Windows.UI.Xaml.Hosting.ElementCompositionPreview" ], [ 1470144, "wide", "Windows.UI.Xaml.Automation.ExpandCollapsePatternIdentifiers" ], [ 1470272, "wide", "Windows.UI.Xaml.Controls.Primitives.FlyoutBase" ], [ 1470432, "wide", "Windows.UI.Xaml.Media.Animation.DoubleAnimation" ], [ 1470560, "wide", "Windows.UI.Xaml.Automation.Peers.FrameworkElementAutomationPeer" ], [ 1470736, "wide", "Windows.UI.Xaml.Window" ], [ 1470832, "wide", "Windows.UI.Xaml.Media.CompositionTarget" ], [ 1470912, "wide", "Windows.UI.Xaml.Controls.Control" ], [ 1471096, "wide", "Windows.UI.Xaml.Application" ], [ 1471232, "wide", "Windows.UI.Xaml.Automation.Peers.AutomationPeer" ], [ 1471376, "wide", "Windows.UI.Xaml.Controls.Panel" ], [ 1471520, "wide", "Windows.UI.Xaml.DependencyProperty" ], [ 1471696, "wide", "Windows.UI.Xaml.Automation.SelectionItemPatternIdentifiers" ], [ 1471825, "u8", "tZQlX" ], [ 1471856, "wide", "Windows.UI.Xaml.Internal.LayoutTransitionElementUtilities" ], [ 1471984, "wide", "Windows.UI.Xaml.Controls.CommandBar" ], [ 1472104, "wide", "Windows.UI.Xaml.RectHelper" ], [ 1472240, "wide", "Windows.UI.Xaml.Automation.AutomationElementIdentifiers" ], [ 1472560, "wide", "Windows.UI.Xaml.Media.Imaging.RenderTargetBitmap" ], [ 1472712, "wide", "Windows.System.DispatcherQueue" ], [ 1472784, "wide", "Windows.UI.Xaml.Media.Animation.NavigationTransitionInfo" ], [ 1472944, "wide", "Windows.UI.Xaml.Media.Animation.Transition" ], [ 1473032, "wide", "Windows.UI.Xaml.PropertyPath" ], [ 1473240, "wide", "Windows.UI.Xaml.Controls.Grid" ], [ 1473344, "wide", "Windows.UI.Xaml.Media.Animation.SplineDoubleKeyFrame" ], [ 1473472, "wide", "Windows.UI.Xaml.Media.Animation.PowerEase" ], [ 1473640, "wide", "Windows.UI.Xaml.UIElement" ], [ 1473696, "wide", "Windows.UI.Xaml.Input.FocusManager" ], [ 1473824, "wide", "Windows.Foundation.PropertyValue" ], [ 1473936, "wide", "Windows.UI.Xaml.Automation.AutomationProperties" ], [ 1474352, "wide", "Windows.UI.Xaml.Media.Animation.ExponentialEase" ], [ 1474576, "wide", "Windows.UI.Xaml.Media.TranslateTransform" ], [ 1474672, "wide", "Windows.UI.Xaml.Media.PlaneProjection" ] ], "v": { "file.stem": "702a41bb6a337f2d7ed036a9697294167abca7da0087431cf9800424bde1a412", "pe.imphash": "70c385d82df781409a70c5b7a4071024", "pe.machine": "x86_64", "pe.rich.key": 1762223418, "pe.rich.hash": "dcabf871ab065668c2626eefda4d1ea8", "pe.subsystem": "windows_cui", "pe.timestamp": 2043588590, "file.basename": "702a41bb6a337f2d7ed036a9697294167abca7da0087431cf9800424bde1a412.exe", "pe.image_base": 6442450944, "pe.image_size": 1646592, "pe.machine_id": 34404, "pe.os_version": "10.0", "pe.version.os": "windows_nt_windows32", "pe.entry_point": 1347168, "pe.headers_size": 4096, "pe.version.type": "dll", "pe.debug.pdb.age": 1, "pe.entry_section": ".text", "pe.subsystem_raw": 3, "pe.debug.pdb.guid": "c9421496-8753-bbef-0734-b936349de89d", "pe.debug.pdb.path": "Windows.UI.Xaml.Phone.pdb", "pe.debug.pdb.stem": "Windows.UI.Xaml.Phone", "pe.file_alignment": 4096, "pe.cert_table_size": 24144, "pe.image_hash.sha1": "8481785738c79f8ddcefb2482c1a1a20dcd54148", "pe.version.company": "Microsoft Corporation", "pe.export_timestamp": 2043588590, "pe.load_config.size": 320, "pe.image_hash.sha256": "1a2fa8eb31c79c03da5f6f4ea38f6406c6c133aa9715a18ba86bcdbd84d7d3b5", "pe.image_hash.sha384": "0cc8595b1129c77fa5ef84b68e92f64785f959a7f06e1c2a366f01750131ad2efd364b3df8b3874944f35125d1aea3d9", "pe.image_hash.sha512": "7dc2b63d0faf5a7b72231517e7c6baad2f6f62431b51aa234d6d3108f4b4a7aa0ecc51fb4a047cef176efcd73f711487034012eaf1087f9dae5bd9fdf2b6bd4d", "pe.resource_types[0]": "RT_VERSION", "pe.resource_types[1]": "RT_UNKNOWN", "pe.resource_types[2]": "RT_UNKNOWN", "pe.resource_types[3]": "RT_UNKNOWN", "pe.resource_types[4]": "RT_UNKNOWN", "pe.resource_types[5]": "RT_UNKNOWN", "pe.resource_types[6]": "RT_UNKNOWN", "pe.resource_types[7]": "RT_UNKNOWN", "pe.section_alignment": 4096, "pe.subsystem_version": "10.0", "pe.version.copyright": "© Microsoft Corporation. All rights reserved.", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "large_address_aware", "pe.characteristics[2]": "dll", "pe.debug.pdb.basename": "Windows.UI.Xaml.Phone.pdb", "pe.characteristics_raw": 8226, "pe.debug.pdb.timestamp": 2043588590, "pe.version.description": "Windows UI XAML Phone API", "pe.delay_imports[0].dll": "ext-ms-win-xaml-pal-l1-1-0.dll", "pe.linker_major_version": 14, "pe.linker_minor_version": 30, "pe.version.file_version": "10.0.22621.5415 (WinBuild.160101.0800)", "pe.version.product_name": "Microsoft® Windows® Operating System", "build.toolchain.compiler": "msvc", "pe.debug.entries[0].type": "codeview", "pe.debug.entries[1].type": "pogo", "pe.debug.entries[2].type": "repro", "pe.debug.entries[3].type": "ex_dllcharacteristics", "pe.version.internal_name": "Windows UI XAML Phone API", "pe.dll_characteristics[0]": "high_entropy_va", "pe.dll_characteristics[1]": "dynamic_base", "pe.dll_characteristics[2]": "nx_compat", "pe.dll_characteristics[3]": "guard_cf", "pe.data_directories[0].rva": 1529472, "pe.data_directories[1].rva": 1530120, "pe.data_directories[2].rva": 1609728, "pe.data_directories[3].rva": 1552384, "pe.data_directories[4].rva": 1638400, "pe.data_directories[5].rva": 1626112, "pe.data_directories[6].rva": 1510592, "pe.data_directories[7].rva": 1436656, "pe.data_directories[8].rva": 1436336, "pe.data_directories[9].rva": 1436696, "pe.dll_characteristics_raw": 16736, "pe.number_of_rva_and_sizes": 16, "pe.version.product_version": "10.0.22621.5415", "pe.data_directories[0].name": "export", "pe.data_directories[0].size": 648, "pe.data_directories[10].rva": 1529312, "pe.data_directories[1].name": "import", "pe.data_directories[1].size": 820, "pe.data_directories[2].name": "resource", "pe.data_directories[2].size": 13184, "pe.data_directories[3].name": "exception", "pe.data_directories[3].size": 51708, "pe.data_directories[4].name": "certificate", "pe.data_directories[4].size": 24144, "pe.data_directories[5].name": "base_relocation", "pe.data_directories[5].size": 19416, "pe.data_directories[6].name": "debug", "pe.data_directories[6].size": 112, "pe.data_directories[7].name": "tls", "pe.data_directories[7].size": 40, "pe.data_directories[8].name": "load_config", "pe.data_directories[8].size": 320, "pe.data_directories[9].name": "iat", "pe.data_directories[9].size": 1816, "pe.debug.entries[0].type_id": 2, "pe.debug.entries[1].type_id": 13, "pe.debug.entries[2].type_id": 16, "pe.debug.entries[3].type_id": 20, "pe.rich.entries[0].build_id": 147, "pe.rich.entries[1].build_id": 260, "pe.rich.entries[2].build_id": 259, "pe.rich.entries[3].build_id": 261, "pe.rich.entries[4].build_id": 1, "pe.rich.entries[5].build_id": 257, "pe.rich.entries[6].build_id": 256, "pe.rich.entries[7].build_id": 264, "pe.rich.entries[8].build_id": 253, "pe.rich.entries[9].build_id": 255, "pe.data_directories[10].name": "delay_import", "pe.data_directories[10].size": 64, "pe.rich.entries[0].use_count": 88, "pe.rich.entries[10].build_id": 258, "pe.rich.entries[1].use_count": 10, "pe.rich.entries[2].use_count": 4, "pe.rich.entries[3].use_count": 20, "pe.rich.entries[4].use_count": 1287, "pe.rich.entries[5].use_count": 9, "pe.rich.entries[6].use_count": 1, "pe.rich.entries[7].use_count": 87, "pe.rich.entries[8].use_count": 1, "pe.rich.entries[9].use_count": 1, "pe.version.original_filename": "Windows.UI.XAML.Phone.dll", "pe.coff.dos_header_pe_pointer": 264, "pe.delay_imports[0].rva_based": true, "pe.load_config.guard_flags[0]": "cf_instrumented", "pe.load_config.guard_flags[1]": "function_table_present", "pe.load_config.guard_flags[2]": "protect_delayload_iat", "pe.load_config.guard_flags[3]": "longjump_table_present", "pe.load_config.guard_flags[4]": "eh_continuation_table_present", "pe.load_config.guard_flags[5]": "xfg_enabled", "pe.rich.entries[0].product_id": 30729, "pe.rich.entries[10].use_count": 1, "pe.rich.entries[1].product_id": 30795, "pe.rich.entries[2].product_id": 30795, "pe.rich.entries[3].product_id": 30795, "pe.rich.entries[5].product_id": 30795, "pe.rich.entries[6].product_id": 30795, "pe.rich.entries[7].product_id": 30795, "pe.rich.entries[8].product_id": 30795, "pe.rich.entries[9].product_id": 30795, "pe.debug.entries[0].size_bytes": 50, "pe.debug.entries[1].size_bytes": 1284, "pe.debug.entries[2].size_bytes": 36, "pe.debug.entries[3].size_bytes": 4, "pe.load_config.guard_flags_raw": 281113856, "pe.load_config.security_cookie": 6443994728, "pe.rich.entries[10].product_id": 30795, "pe.base_relocations.block_count": 23, "pe.base_relocations.entry_count": 9612, "pe.delay_imports[0].import_count": 2, "pe.base_relocations.padding_count": 4, "pe.debug.entries[0].timestamp_unix": 2043588590, "pe.debug.entries[1].timestamp_unix": 2043588590, "pe.debug.entries[2].timestamp_unix": 2043588590, "pe.debug.entries[3].timestamp_unix": 2043588590, "pe.load_config.guard_cf_function_count": 5280, "pe.load_config.guard_cf_function_table": 6443890432, "pe.load_config.guard_cf_check_function_pointer": 6443889456, "pe.load_config.guard_cf_dispatch_function_pointer": 6443889472, "pe.load_config.guard_address_taken_iat_entry_count": 4, "pe.load_config.guard_address_taken_iat_entry_table": 6443916832 }, "x": [ [ "CreateApplicationBarProxy" ], [ "DllCanUnloadNow" ], [ "DllGetActivationFactory" ], [ "DllGetClassObject" ], [ "GetDependencyLocatorStorage" ], [ "SendTelemetryOnSuspend" ], [ "XamlControlsCalculateFlyoutPlacement" ], [ "XamlControlsGetDatePickerSelection" ], [ "XamlControlsGetListPickerSelection" ], [ "XamlControlsGetPlatformMetadataProvider" ], [ "XamlControlsGetPlatformResourcesModuleHandle" ], [ "XamlControlsGetTimePickerSelection" ], [ "XamlControlsTestHookCreateLoopingSelector" ], [ "XamlTestHookFreePhoneResourceLibrary" ] ], "id": "pe", "sc": [ [ ".text", 4096, 1355776, 6.46, "r-x" ], [ ".rdata", 1359872, 180224, 4.98, "r--" ], [ ".data", 1540096, 4096, 2.61, "rw-" ], [ ".pdata", 1544192, 53248, 5.73, "r--" ], [ ".didat", 1597440, 4096, 0.03, "rw-" ], [ ".rsrc", 1601536, 16384, 3.24, "r--" ], [ ".reloc", 1617920, 20480, 5.38, "r--" ] ] }, "id": 0, "sz": 1638400, "ts": [ { "c": 0.8999999761581421, "d": "Memory copy operation", "e": [ "memcpy" ], "i": "micro-behaviors/mem/c-runtime/functions::memcpy", "l": 2, "el": [ "0x15f148" ] }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "702a41bb6a337f2d7ed036a9697294167abca7da0087431cf9800424bde1a412.exe" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "c": 1.0, "d": "File larger than 1MB", "e": [ "702a41bb6a337f2d7ed036a9697294167abca7da0087431cf9800424bde1a412.exe" ], "i": "metadata/binary/metrics/size::large-file-1mb", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "702a41bb6a337f2d7ed036a9697294167abca7da0087431cf9800424bde1a412.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.949999988079071, "d": "PE LegalCopyright field is populated", "e": [ "© Microsoft Corporation. All rights reserved." ], "i": "metadata/package/versioning::pe-legal-copyright-present", "l": 1, "el": [ "value:pe.version.copyright" ] }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionEx", "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2, "el": [ "0x15eeb8", "0x15ef28" ] }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2, "el": [ "0x15ed30" ] }, { "c": 0.8999999761581421, "d": "Reference to api-ms- Windows API string", "e": [ "api-ms-win-crt-string-l1-1-0.dll", "api-ms-win-core-featurestaging-l1-1-0.dll", "api-ms-win-core-debug-l1-1-0.dll", "api-ms-win-crt-runtime-l1-1-0.dll", "api-ms-win-core-libraryloader-l1-2-1.dll", "api-ms-win-core-processthreads-l1-1-0.dll", "api-ms-win-core-synch-l1-2-0.dll", "api-ms-win-core-localization-l1-2-0.dll", "api-ms-win-core-handle-l1-1-0.dll", "api-ms-win-core-errorhandling-l1-1-0.dll", "api-ms-win-crt-private-l1-1-0.dll", "api-ms-win-core-synch-l1-1-0.dll", "api-ms-win-core-threadpool-l1-2-0.dll", "api-ms-win-eventing-provider-l1-1-0.dll", "api-ms-win-core-libraryloader-l1-2-0.dll", "api-ms-win-core-heap-l1-1-0.dll" ], "i": "micro-behaviors/os/api-resolution/manual::api-ms-string-reference", "l": 1, "el": [ "0x176672", "0x176dd2", "0x176ee0", "0x176406", "0x176f4c", "0x176e8e", "0x165e60", "0x176eb8", "0x176f02", "0x176e3e", "0x176650", "0x176dfc", "0x176e68", "0x176f24", "0x176da8", "0x176e1e" ] }, { "c": 0.949999988079071, "d": "PE FileDescription field is populated", "e": [ "Windows UI XAML Phone API" ], "i": "metadata/package/versioning::pe-file-description-present", "l": 1, "el": [ "value:pe.version.description" ] }, { "a": "T1027", "c": 0.8799999952316284, "d": "Large PE imports over 120", "e": [ "imports.count = 189.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::import-count-over-120", "l": 1, "m": "B0032" }, { "a": "T1112", "c": 0.8999999761581421, "d": "RegOpenKeyEx API", "e": [ "RegOpenKeyExW" ], "i": "objectives/anti-static/obfuscation/payload/registry::reg-open-key", "l": 1, "m": "B0032", "el": [ "0x15ee60" ] }, { "a": "T1036.005", "c": 0.8999999761581421, "d": "Microsoft Corporation company in version info", "e": [ "Microsoft Corporation" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-microsoft-company", "l": 1, "m": "F0004", "el": [ "value:pe.version.company" ] }, { "a": "T1036.005", "c": 0.949999988079071, "d": "Microsoft company version identity", "e": [ "Microsoft Corporation" ], "i": "objectives/evasion/masquerade/version-resource/contradiction::microsoft-company-versioninfo-kv", "l": 1, "el": [ "value:pe.version.company" ] }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0x165e60" ] }, { "c": 0.8999999761581421, "d": "DLL exports ten to twenty-five APIs", "e": [ "exports.count = 14.00" ], "i": "metadata/binary/symbols/exports::sideload-export-cluster-size-10-25", "l": 1 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2, "el": [ "0x15ed68" ] }, { "a": "T1622", "c": 0.8500000238418579, "d": "PEB.BeingDebugged byte cmp (multiple sites)", "e": [ "80 78 02 00" ], "i": "objectives/anti-analysis/debugger-detect/check::peb-being-debugged-cmp-multi", "l": 1, "m": "B0001", "el": [ "0x4aea7" ] }, { "c": 0.8999999761581421, "d": "CreateMutexEx API call (extended)", "e": [ "CreateMutexExW" ], "i": "micro-behaviors/process/sync/mutex::create-mutex-ex", "l": 2, "m": "C0042", "el": [ "0x15ef40" ] }, { "c": 1.0, "d": "Control Flow Guard enabled", "e": [ "[high_entropy_va, dynamic_base, nx_compat, guard_cf]" ], "i": "metadata/hardening/mitigation::pe-cfg", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "imports.count = 189.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "imports.count = 189.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "imports.count = 189.00" ], "i": "metadata/binary/metrics/structural::many-imports", "l": 2 }, { "c": 0.9700000286102295, "d": "Microsoft ImageHlp company metadata", "e": [ "Microsoft Corporation" ], "i": "well-known/lib/microsoft-imagehlp::imagehlp-company", "l": 2, "el": [ "value:pe.version.company" ] }, { "c": 0.8500000238418579, "d": "Inline MZ header validation constant", "e": [ "B8 4D 5A 00 00" ], "i": "micro-behaviors/data/embedded/payload/header::inline-mz-magic-check", "l": 1, "el": [ "0x149303" ] }, { "c": 0.8500000238418579, "d": "Open named semaphore object", "e": [ "OpenSemaphoreW" ], "i": "micro-behaviors/process/sync/semaphore::open-semaphore", "l": 2, "m": "C0042", "el": [ "0x15eed8" ] }, { "c": 0.949999988079071, "d": "PE ProductName field is populated", "e": [ "Microsoft® Windows® Operating System" ], "i": "metadata/package/versioning::pe-product-name-present", "l": 1, "el": [ "value:pe.version.product_name" ] }, { "c": 0.800000011920929, "d": "Create COM object instance", "e": [ "CoCreateInstance" ], "i": "micro-behaviors/os/com/invoke::co-create-instance", "l": 2, "el": [ "0x15ec58" ] }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.46)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 1.0, "d": "Binary has 9+ exports", "e": [ "exports.count = 14.00" ], "i": "metadata/binary/metrics/threshold::many-exports-9", "l": 1 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "702a41bb6a337f2d7ed036a9697294167abca7da0087431cf9800424bde1a412.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "appbar.download.png" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-5", "l": 1, "el": [ "0x170258" ] }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 4004.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize thread-safe list header", "e": [ "InitializeSListHead" ], "i": "micro-behaviors/mem/sync/mutex::initialize-slist-head", "l": 2, "el": [ "0x15ed58" ] }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Load PE resource payload", "e": [ "LoadResource" ], "i": "micro-behaviors/data/embedded/payload/resource::load-resource", "l": 2, "el": [ "0x15ed80" ] }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2, "el": [ "0x15ef38" ] }, { "c": 1.0, "d": "PE first resource is RT_VERSION", "e": [ "RT_VERSION" ], "i": "metadata/binary/resource::pe-resource-version-first", "l": 2, "el": [ "value:pe.resource_types[0]" ] }, { "a": "T1140", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "LogStagedFeatureUsage" ], "i": "objectives/command-and-control/dropper/staging/encrypted::staged-payload-file-name--rx-3", "l": 1, "m": "B0023", "el": [ "0x16f760" ] }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032", "el": [ "0x187336" ] }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "imports.count = 189.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 4004.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "702a41bb6a337f2d7ed036a9697294167abca7da0087431cf9800424bde1a412.exe" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2, "el": [ "0x1873ce" ] }, { "a": "T1112", "c": 0.8999999761581421, "d": "RegQueryValueEx API", "e": [ "RegQueryValueExW" ], "i": "objectives/anti-static/obfuscation/payload/registry::reg-query-value", "l": 1, "m": "B0032", "el": [ "0x15ee68" ] }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2, "el": [ "0x15ecd8" ] }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 6.46" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2, "el": [ "0x15ef20" ] }, { "c": 0.9700000286102295, "d": "Windows OS product metadata", "e": [ "Microsoft® Windows® Operating System" ], "i": "well-known/app/windows-boot::windows-os-product", "l": 2, "el": [ "value:pe.version.product_name" ] }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2, "el": [ "0x15ed90" ] }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2, "el": [ "0x15ef98" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 1.0, "d": "High-entropy ASLR (64-bit)", "e": [ "[high_entropy_va, dynamic_base, nx_compat, guard_cf]" ], "i": "metadata/hardening/mitigation::pe-high-entropy-va", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "imports.count = 189.00" ], "i": "metadata/binary/metrics/threshold::many-imports-100", "l": 1 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2, "el": [ "0x15ed78" ] }, { "a": "T1006", "c": 0.8999999761581421, "d": "Virtual unwind stack frame", "e": [ "RtlVirtualUnwind" ], "i": "micro-behaviors/os/exception/handler::virtual-unwind", "l": 2, "el": [ "0x15ee90" ] }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2, "el": [ "0x15ee10" ] }, { "c": 0.8500000238418579, "d": "Create named event object", "e": [ "CreateEventW" ], "i": "micro-behaviors/process/sync/event::create-event", "l": 2, "m": "C0039", "el": [ "0x15ef08" ] }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2, "el": [ "0x15ed68" ] }, { "c": 0.6000000238418579, "d": "References to worker pools", "e": [ "threadpool", "Threadpool" ], "i": "micro-behaviors/process/create/workers::worker-pool", "l": 2, "el": [ "0x176e68", "0x17678e" ] }, { "a": "T1622", "c": 0.9200000166893005, "d": "ProcessDebugFlags info class (mov edx, 0x1F)", "e": [ "BA 1F 00 00 00" ], "i": "objectives/anti-analysis/debugger-detect/check::nt-process-debug-flags-info-class", "l": 1, "m": "B0001", "el": [ "0x2fa0e" ] }, { "c": 0.8999999761581421, "d": "Memory move with overlap", "e": [ "memmove" ], "i": "micro-behaviors/mem/c-runtime/functions::memmove", "l": 2, "el": [ "0x15f0b0" ] }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "appbar.upload.png" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-8", "l": 1, "el": [ "0x1708e0" ] }, { "c": 0.6000000238418579, "d": "SOCKS5 BIND request opcode", "e": [ "05 02 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-bind-command-byte", "l": 1, "el": [ "0xc2ed" ] }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2, "el": [ "0x15ecb8" ] }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol", "e": [ "RegOpenKeyExW" ], "i": "micro-behaviors/os/registry/access::reg-open-key-ex-w-symbol", "l": 2, "el": [ "0x15ee60" ] }, { "a": "T1622", "c": 0.8999999761581421, "d": "combase.dll resolved at runtime", "e": [ "combase.dll" ], "i": "objectives/anti-analysis/debugger-detect/stub::combase-runtime-resolve-string", "l": 1, "el": [ "0x177cd0" ] }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2, "el": [ "0x15ef60" ] }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.83" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2, "el": [ "0x1874e6" ] }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "10.0.22621.5415 (WinBuild.160101.0800)" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "Windows.UI.Xaml.Phone.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024", "el": [ "0x171eb4" ] }, { "c": 0.800000011920929, "d": "Reset event object state", "e": [ "ResetEvent" ], "i": "micro-behaviors/process/sync/event::reset-event", "l": 2, "m": "C0039", "el": [ "0x15ef10" ] }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "Windows operating system product string", "e": [ "Microsoft® Windows® Operating System" ], "i": "objectives/evasion/masquerade/version-resource/claim::getmac-product-string", "l": 1, "el": [ "0x187630" ] }, { "a": "T1622", "c": 0.8199999928474426, "d": "OutputDebugString anti-debug API", "e": [ "OutputDebugStringW" ], "i": "objectives/anti-analysis/debugger-detect/check::output-debug-string", "l": 1, "m": "B0001", "el": [ "0x176828" ] }, { "a": "T1622", "c": 0.9200000166893005, "d": "ProcessDebugObjectHandle info class (mov edx, 0x1E)", "e": [ "BA 1E 00 00 00" ], "i": "objectives/anti-analysis/debugger-detect/check::nt-process-debug-object-info-class", "l": 1, "m": "B0001", "el": [ "0x1bf36" ] }, { "a": "T1112", "c": 0.8500000238418579, "d": "Query registry value API string", "e": [ "RegQueryValueExW" ], "i": "micro-behaviors/os/registry/access::reg-query-value-ex-w-text", "l": 2, "el": [ "0x177a00" ] }, { "c": 0.949999988079071, "d": "PE security directory RVA out of bounds", "e": [ "pe.security_directory_out_of_bounds = 1.00" ], "i": "metadata/binary/layout::security-dir-out-of-bounds", "l": 1 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2, "el": [ "0x1875ba" ] }, { "a": "T1129", "c": 0.6499999761581421, "d": "SRW shared lock read", "e": [ "ReleaseSRWLockShared", "AcquireSRWLockShared" ], "i": "micro-behaviors/process/threading/advanced-sync::srw-lock-shared", "l": 2, "el": [ "0x15eec0", "0x15eeb0" ] }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "imports.count = 189.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "imports.count = 189.00" ], "i": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "l": 1 }, { "a": "T1497.003", "c": 0.699999988079071, "d": "QueryPerformanceFrequency timing", "e": [ "QueryPerformanceFrequency" ], "i": "micro-behaviors/time/timing/check::query-performance-frequency", "l": 2, "m": "B0003.003", "el": [ "0x15ee40" ] }, { "c": 0.8999999761581421, "d": "Dense api-ms-win-core string cluster", "e": [ "api-ms-win-core-threadpool-l1-2-0", "api-ms-win-core-handle-l1-1-0", "api-ms-win-core-debug-l1-1-0", "api-ms-win-core-errorhandling-l1-1-0", "api-ms-win-core-localization-l1-2-0", "api-ms-win-core-synch-l1-1-0", "api-ms-win-core-winrt-error-l1-1-0", "api-ms-win-core-util-l1-1-0", "api-ms-win-core-processthreads-l1-1-0", "api-ms-win-core-libraryloader-l1-2-1", "api-ms-win-core-winrt-errorprivate-l1-1-0", "api-ms-win-core-featurestaging-l1-1-0", "api-ms-win-core-libraryloader-l1-2-0", "api-ms-win-core-heap-l1-1-0", "api-ms-win-core-synch-l1-2-0" ], "i": "metadata/binary/linking/api-set::api-set-core-cluster", "l": 1, "el": [ "0x176e68", "0x176f02", "0x176ee0", "0x176e3e", "0x176eb8", "0x176dfc", "0x176f76", "0x176f9e", "0x176e8e", "0x176f4c", "0x176fe0", "0x176dd2", "0x176da8", "0x176e1e", "0x165e60" ] }, { "a": "T1005", "c": 0.8999999761581421, "d": "Capture CPU context/registers", "e": [ "RtlCaptureContext" ], "i": "micro-behaviors/os/exception/handler::capture-context", "l": 2, "el": [ "0x15ee98" ] }, { "c": 0.8399999737739563, "d": "High PE import count", "e": [ "imports.count = 189.00" ], "i": "metadata/binary/section/metrics::high-import-count-pe", "l": 1 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047", "el": [ "0x16ae40" ] }, { "c": 0.6000000238418579, "d": "SOCKS5 UDP ASSOCIATE request opcode", "e": [ "05 03 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-udp-associate-byte", "l": 1, "el": [ "0x5aebc" ] }, { "c": 0.8500000238418579, "d": "LoadLibraryExW with LOAD_LIBRARY_SEARCH_SYSTEM32", "e": [ "41 B8 00 08 00 00" ], "i": "micro-behaviors/os/api-resolution/manual::load-library-ex-system32", "l": 1, "el": [ "0x1474f8" ] }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "imports.count = 189.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 0.8199999928474426, "d": "Get extended module handle", "e": [ "GetModuleHandleExW" ], "i": "micro-behaviors/os/module/load::get-module-handle-ex", "l": 2, "el": [ "0x15eda8" ] }, { "c": 0.800000011920929, "d": "Inline PE header walk sequence", "e": [ "41", "4b", "46", "43", "49", "40" ], "i": "micro-behaviors/data/embedded/payload/header::inline-pe-header-walk", "l": 1, "el": [ "0x16b51", "0x8dee4", "0x19fe3", "0x8df02", "0x8ded3", "0x8db1b" ] }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2, "el": [ "0x15ee08" ] }, { "a": "T1027", "c": 0.8999999761581421, "d": "High plaintext string count", "e": [ "binary.string_count = 4004.00" ], "i": "objectives/anti-static/pack/polymorphic::high-string-count-2000", "l": 1 }, { "c": 0.30000001192092896, "d": "XGETBV instruction bytes", "e": [ "0F 01 D0" ], "i": "metadata/binary/instruction::xgetbv-instr", "l": 2, "el": [ "0x149b8a" ] }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "0xaa3a" ] }, { "a": "T1006", "c": 0.8500000238418579, "d": "Lookup function entry point", "e": [ "RtlLookupFunctionEntry" ], "i": "micro-behaviors/os/exception/handler::lookup-function-entry", "l": 2, "el": [ "0x15ee88" ] }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 4004.00" ], "i": "metadata/binary/metrics/threshold::many-strings-2000", "l": 1 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2, "el": [ "0x15ecc8" ] }, { "c": 0.8500000238418579, "d": "Direct NT API access", "e": [ "ntdll.dll" ], "i": "micro-behaviors/os/syscall/invoke::ntdll-import", "l": 2, "el": [ "0x166140" ] }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2, "el": [ "0x15edf8" ] }, { "a": "T1129", "c": 0.6499999761581421, "d": "SRW lock release", "e": [ "ReleaseSRWLockExclusive" ], "i": "micro-behaviors/process/threading/advanced-sync::srw-lock-release", "l": 2, "el": [ "0x15eef0" ] }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2, "el": [ "0x176696" ] }, { "a": "T1574.002", "c": 0.8799999952316284, "d": "LoadLibraryExW API string", "e": [ "LoadLibraryExW" ], "i": "micro-behaviors/dylib/load/runtime::load-library-ex-w-string", "l": 2, "el": [ "0x1779de" ] }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "value", "RegQueryValueExW", "SelectedValuePath", "Windows.Foundation.PropertyValue", "TlsGetValue", "TestGetFeatureValue", "RegGetValueW", "TlsSetValue", "SelectedValue" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047", "el": [ "0x16c848", "0x177a00", "0x16cd88", "0x167d20", "0x17798c", "0x16afb8", "0x1779b2", "0x17799a", "0x16cd28" ] }, { "c": 0.8500000238418579, "d": "Release semaphore count", "e": [ "ReleaseSemaphore" ], "i": "micro-behaviors/process/sync/semaphore::release-semaphore", "l": 2, "m": "C0042", "el": [ "0x15eec8" ] }, { "a": "T1112", "c": 0.8999999761581421, "d": "Query registry value via import symbol", "e": [ "RegQueryValueExW" ], "i": "micro-behaviors/os/registry/access::reg-query-value-ex-w-symbol", "l": 2, "el": [ "0x15ee68" ] }, { "a": "T1129", "c": 0.6499999761581421, "d": "SRW lock acquisition", "e": [ "AcquireSRWLockExclusive" ], "i": "micro-behaviors/process/threading/advanced-sync::srw-lock-acquire", "l": 2, "el": [ "0x15ef00" ] }, { "a": "T1070", "c": 0.6000000238418579, "d": "Vectorized zero-fill blocks (xorps + movups stores)", "e": [ "0F 57 C0 0F 11" ], "i": "objectives/evasion/indicator-removal/cleanup::vectorized-zero-density", "l": 1, "el": [ "0x23e45" ] }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[high_entropy_va, dynamic_base, nx_compat, guard_cf]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2, "el": [ "0x15ecd0" ] }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[high_entropy_va, dynamic_base, nx_compat, guard_cf]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.699999988079071, "d": "Free COM memory allocation", "e": [ "CoTaskMemFree" ], "i": "micro-behaviors/os/com/invoke::co-task-mem-free", "l": 2, "el": [ "0x15ec50" ] }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2, "el": [ "0x15ecc0" ] }, { "c": 0.9599999785423279, "d": "Microsoft company metadata", "e": [ "Microsoft Corporation" ], "i": "well-known/app/drivers::microsoft-company", "l": 2, "el": [ "value:pe.version.company" ] }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2, "el": [ "0x15ed48" ] }, { "a": "T1027.002", "c": 0.8799999952316284, "d": "Unknown exception decoy string", "e": [ "Unknown exception" ], "i": "well-known/malware/trojan/guloader::unknown-exception-decoy", "l": 1, "m": "F0001", "el": [ "0x170a28" ] }, { "d": "overflow keyword", "e": [ "appbar.overflowdots.png" ], "i": "micro-behaviors/data/text/keywords/lexicon::overflow", "l": 1, "el": [ "0x1704d8" ] }, { "c": 0.949999988079071, "d": "COM unload export present", "e": [ "DllCanUnloadNow" ], "i": "metadata/binary/symbols/exports::export-dll-can-unload-now", "l": 1, "el": [ "0x6240" ] }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2, "el": [ "0x187616" ] }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.9200000166893005, "d": "Disable DLL thread notifications", "e": [ "DisableThreadLibraryCalls" ], "i": "micro-behaviors/os/module/load::disable-thread-library-calls", "l": 1, "el": [ "0x15ed88" ] }, { "c": 0.800000011920929, "d": "Set event object state", "e": [ "SetEvent" ], "i": "micro-behaviors/process/sync/event::set-event", "l": 2, "m": "C0039", "el": [ "0x15ef18" ] }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2, "el": [ "0x17689a" ] }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".pdata", ".reloc", ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "WindowsCompareStringOrdinal", "api-ms-win-core-winrt-string-l1-1-0.dll", "WindowsDeleteString", "StringFileInfo", "Windows.Foundation.String", "WindowsCreateStringReference", "WindowsDuplicateString", "WindowsStringHasEmbeddedNull", "api-ms-win-crt-string-l1-1-0.dll", "WindowsConcatString", "StringFromGUID2", "WindowsGetStringRawBuffer", "WindowsCreateString", "OutputDebugStringW", "StringOverflow", "WindowsIsStringEmpty" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x177b50", "0x17700e", "0x176b00", "0x187392", "0x16c8b0", "0x176b28", "0x177b36", "0x176a76", "0x176672", "0x177bae", "0x177be2", "0x176aaa", "0x176aea", "0x176828", "0x171dc5", "0x176a5e" ] }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2, "el": [ "0x15ef30" ] }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_READWRITE (0x04) into r8d/r9d", "e": [ "b9", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-readwrite-arg-x64", "l": 1, "el": [ "0x1495ac", "0xf215a" ] }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2, "el": [ "0x15ee18" ] }, { "c": 0.800000011920929, "d": "Low ratio of sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.00" ], "i": "metadata/binary/metrics/pe-details::low-sentence-string-ratio", "l": 2 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Windows GetProcAddress API string", "e": [ "GetProcAddress" ], "i": "micro-behaviors/dylib/lookup::get-proc-address-text", "l": 2, "el": [ "0x1768e2" ] }, { "c": 0.8999999761581421, "d": "Microsoft vendor marker in resource section", "e": [ "Microsoft Corporation" ], "i": "metadata/binary/vendor::microsoft-corp-marker-rsrc", "l": 1, "el": [ "0x1873e8" ] }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryW" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1, "el": [ "0x15edc0" ] }, { "c": 0.8999999761581421, "d": "ext-ms Windows API-set cluster", "e": [ "ext-ms-win-xaml-pal-l1-1-0" ], "i": "metadata/binary/linking/api-set::api-set-ext-cluster", "l": 2, "el": [ "0x165f10" ] }, { "c": 0.949999988079071, "d": "COM class factory export", "e": [ "DllGetClassObject" ], "i": "metadata/binary/symbols/exports::export-dll-get-class-object", "l": 1, "el": [ "0x6130" ] }, { "c": 0.8999999761581421, "d": "Memory compare", "e": [ "memcmp" ], "i": "micro-behaviors/mem/c-runtime/functions::memcmp", "l": 2, "el": [ "0x15f140" ] }, { "a": "T1027.009", "c": 0.8500000238418579, "d": "Locate PE resource entry with language", "e": [ "FindResourceExW" ], "i": "micro-behaviors/data/embedded/payload/resource::find-resource-ex-w", "l": 2, "el": [ "0x15ed70" ] }, { "a": "T1562.001", "c": 0.9800000190734863, "d": "AMSI scan buffer memory patch bytes (E_INVALIDARG)", "e": [ "b8 57 00 07 80 c3" ], "i": "objectives/evasion/anti-av/platform/defender::amsi-memory-patch-hex-bytes", "l": 1, "el": [ "0x1edf5" ] }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 4096)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READWRITE (0x40) into r8d/r9d (x64 ABI)", "e": [ "b9" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-readwrite-arg-x64", "l": 1, "el": [ "0x28ae" ] }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2, "el": [ "0x15ed40" ] }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2, "el": [ "0x15ee70" ] }, { "c": 0.8999999761581421, "d": "Memory fill operation", "e": [ "memset" ], "i": "micro-behaviors/mem/c-runtime/functions::memset", "l": 2, "el": [ "0x15f190" ] }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2, "el": [ "0x1767b0" ] }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "HeaderStatic", "ItemHeaders" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-6", "l": 1, "el": [ "0x16e678", "0x1897ee" ] }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2, "el": [ "0x18741a" ] }, { "c": 0.8999999761581421, "d": "Padodor COM instance string", "e": [ "CoCreateInstance" ], "i": "well-known/malware/trojan/shellobject/padodor::padodor-cocreateinstance-string", "l": 1, "el": [ "0x177b22" ] }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Access PE resource data pointer", "e": [ "LockResource" ], "i": "micro-behaviors/data/embedded/payload/resource::lock-resource", "l": 2, "el": [ "0x15edb0" ] }, { "c": 0.7599999904632568, "d": "Convert GUID to string", "e": [ "StringFromGUID2" ], "i": "micro-behaviors/os/com/invoke::string-from-guid2", "l": 2, "el": [ "0x15ec48" ] }, { "c": 0.8999999761581421, "d": "Create semaphore object", "e": [ "CreateSemaphoreExW" ], "i": "micro-behaviors/process/sync/semaphore::create-semaphore", "l": 2, "m": "C0042", "el": [ "0x15eed0" ] }, { "c": 0.800000011920929, "d": "ReleaseMutex API call", "e": [ "ReleaseMutex" ], "i": "micro-behaviors/process/sync/mutex::release-mutex", "l": 2, "m": "C0042", "el": [ "0x15eee8" ] }, { "c": 0.800000011920929, "d": "Binary has many exports (\u003e10)", "e": [ "exports.count = 14.00" ], "i": "metadata/binary/metrics/structural::many-exports", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2, "el": [ "0x15ee00" ] }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2, "el": [ "0x15ede8" ] }, { "c": 0.8999999761581421, "d": "Check processor features (potential VM detection)", "e": [ "IsProcessorFeaturePresent" ], "i": "objectives/anti-analysis/vm-detect/processor-features::is-processor-feature-present", "l": 1, "m": "B0009", "el": [ "0x15ee28" ] }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 4004.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 3, "m": "B0033", "el": [ "0x15edf0" ] }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "DisplayMemberPath", "SelectedValuePath", "Windows.UI.Xaml.PropertyPath" ], "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-5", "l": 1, "m": "F0012", "el": [ "0x16cbf0", "0x16cd88", "0x167a08" ] }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.83" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "Encoded HTML tag fragment", "e": [ "Windows.Foundation.Collections.IVector`1\u003cObject\u003e", "Windows.Foundation.IAsyncOperation`1\u003cBoolean\u003e Windows.UI.Xaml.Controls.PickerFlyout.ShowAtAsync", "Windows.Foundation.IAsyncOperation`1\u003cInt32\u003e", "Windows.Foundation.IAsyncOperation`1\u003cWindows.Foundation.Collections.IVectorView`1\u003cObject\u003e\u003e Windows.U...", "Windows.Foundation.IAsyncOperation`1\u003cBoolean\u003e", "Windows.Foundation.IAsyncOperation`1\u003cWindows.Foundation.Collections.IVectorView`1\u003cObject\u003e\u003e", "Windows.Foundation.Collections.IIterator`1\u003cObject\u003e", "Windows.Foundation.Collections.IVectorView`1\u003cObject\u003e" ], "i": "objectives/anti-static/obfuscation/encoding/content::encoded-html-tag-fragment", "l": 1, "el": [ "0x16c490", "0x168ad0", "0x16c320", "0x1689a0", "0x16e5b0", "0x16e230", "0x16c380", "0x16c400" ] }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "sections.count = 7.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1562.001", "c": 1.0, "d": "ntdll.dll string reference", "e": [ "ntdll.dll" ], "i": "objectives/evasion/anti-av/platform/defender::ntdll-dll-str", "l": 1, "el": [ "0x166140" ] }, { "a": "T1055", "c": 0.8500000238418579, "d": "Large null run in executable (64+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::large-null-run-text", "l": 1, "el": [ "0x14bcd5" ] }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1, "el": [ "0x165ea8" ] }, { "c": 0.8399999737739563, "d": "Large binary with few DLL dependencies", "e": [ "dependencies.count = 40.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "a": "T1027.007", "c": 1.0, "d": "ntdll.dll as wide string (runtime resolver)", "e": [ "ntdll.dll" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::ntdll-wide-string", "l": 1, "m": "B0032.014", "el": [ "0x166140" ] }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1, "el": [ "0x14bcd5" ] }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "702a41bb6a337f2d7ed036a9697294167abca7da0087431cf9800424bde1a412.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "a": "T1622", "c": 0.8500000238418579, "d": "ProcessDebugPort info class (mov edx, 7)", "e": [ "BA 07 00 00 00" ], "i": "objectives/anti-analysis/debugger-detect/check::nt-process-debug-port-info-class", "l": 1, "m": "B0001", "el": [ "0x85ffd" ] }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2, "el": [ "0x15eda0" ] }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001", "el": [ "0x176968" ] }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "NavigationTransitionInfo", "AutomationElementIdentifiers", "RtlDllShutdownInProgress", "SelectionItemPatternIdentifiers", "RtlDisownModuleHeapAllocation", "ItemsControlAutomationPeer", "ExpandCollapsePatternIdentifiers", "LayoutTransitionElementUtilities", "RaiseFailFastException", "SelectionChangedEventArgs", "ScrollPatternIdentifiers", "FrameworkElementAutomationPeer", "SleepConditionVariableCS", "RtlNtStatusToDosErrorNoTeb", "DoubleAnimationUsingKeyFrames", "ObjectAnimationUsingKeyFrames" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "0x167910", "0x1676f0", "0x166178", "0x1674d0", "0x166198", "0x166460", "0x166ec0", "0x167570", "0x166108", "0x1666a0", "0x1663e0", "0x167060", "0x165ec8", "0x166158", "0x166350", "0x166550" ] }, { "a": "T1036.005", "c": 0.8500000238418579, "d": "PE stem disagrees with embedded PDB stem", "e": [ "file.stem != pe.debug.pdb.stem (\"702a41bb6a337f2d7ed036a9697294167abca7da0087431cf9800424bde1a412\" != \"windows.ui.xaml.phone\")" ], "i": "objectives/evasion/masquerade/debug::pe-stem-differs-from-pdb-stem", "l": 3, "el": [ "value:file.stem" ] }, { "a": "T1027", "c": 0.8500000238418579, "d": "Sparse import table", "e": [ "imports.count = 189.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-import-count", "l": 1, "m": "B0032" }, { "a": "T1140", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "BitmapCacheTestMode", "EnableBitmapCache" ], "i": "objectives/command-and-control/dropper/staging/encrypted::staged-payload-file-name--rx-2", "l": 1, "m": "B0023", "el": [ "0x16ba08", "0x16b960" ] }, { "c": 0.8999999761581421, "d": "Claims Microsoft Corp in version resource", "e": [ "Microsoft Corporation", "Microsoft Corporation." ], "i": "metadata/binary/vendor::microsoft-corp-versioninfo", "l": 1, "el": [ "0x1873e8", "0x187558" ] }, { "a": "T1027", "d": "Binary is 1MB or larger", "e": [ "702a41bb6a337f2d7ed036a9697294167abca7da0087431cf9800424bde1a412.exe" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::file-size-1m-plus", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Browser process termination API", "e": [ "TerminateProcess" ], "i": "objectives/collection/stealer/browser::windows-browser-terminate-api", "l": 1, "el": [ "0x15edf0" ] }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.83" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.9700000286102295, "d": "Regex component marker", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-anti-analysis-data-loader-cond-4--inline-29205", "l": 1, "m": "B0032", "el": [ "0x15ec88" ] }, { "c": 0.949999988079071, "d": "links api-ms-win-core-interlocked-l1-1-0 (InitializeSListHead)", "e": [ "api-ms-win-core-interlocked-l1-1-0" ], "i": "metadata/dylib::api-ms-win-core-interlocked-l1-1-0", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links api-ms-win-core-util-l1-1-0 (EncodePointer, DecodePointer)", "e": [ "api-ms-win-core-util-l1-1-0" ], "i": "metadata/dylib::api-ms-win-core-util-l1-1-0", "l": 2, "el": [ "2 symbols" ] }, { "c": 0.949999988079071, "d": "links api-ms-win-core-winrt-error-l1-1-1 (IsErrorPropagationEnabled, RoClearError, RoGetMatchingRestrictedErrorInfo, RoReportFailedDelegate)", "e": [ "api-ms-win-core-winrt-error-l1-1-1" ], "i": "metadata/dylib::api-ms-win-core-winrt-error-l1-1-1", "l": 2, "el": [ "4 symbols" ] }, { "c": 0.949999988079071, "d": "links api-ms-win-core-sysinfo-l1-1-0 (GetSystemTimeAsFileTime)", "e": [ "api-ms-win-core-sysinfo-l1-1-0" ], "i": "metadata/dylib::api-ms-win-core-sysinfo-l1-1-0", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links api-ms-win-core-winrt-errorprivate-l1-1-0 (RoFailFastWithErrorContextInternal2)", "e": [ "api-ms-win-core-winrt-errorprivate-l1-1-0" ], "i": "metadata/dylib::api-ms-win-core-winrt-errorprivate-l1-1-0", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links api-ms-win-core-profile-l1-1-0 (QueryPerformanceCounter, QueryPerformanceFrequency)", "e": [ "api-ms-win-core-profile-l1-1-0" ], "i": "metadata/dylib::api-ms-win-core-profile-l1-1-0", "l": 2, "el": [ "2 symbols" ] }, { "c": 0.949999988079071, "d": "links api-ms-win-crt-string-l1-1-0 (memset)", "e": [ "api-ms-win-crt-string-l1-1-0" ], "i": "metadata/dylib::api-ms-win-crt-string-l1-1-0", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links api-ms-win-core-synch-l1-2-0 (InitOnceExecuteOnce)", "e": [ "api-ms-win-core-synch-l1-2-0" ], "i": "metadata/dylib::api-ms-win-core-synch-l1-2-0", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links api-ms-win-eventing-classicprovider-l1-1-0 (TraceEvent)", "e": [ "api-ms-win-eventing-classicprovider-l1-1-0" ], "i": "metadata/dylib::api-ms-win-eventing-classicprovider-l1-1-0", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links api-ms-win-core-libraryloader-l1-2-1 (LoadLibraryW)", "e": [ "api-ms-win-core-libraryloader-l1-2-1" ], "i": "metadata/dylib::api-ms-win-core-libraryloader-l1-2-1", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links api-ms-win-core-debug-l1-1-0 (OutputDebugStringW, DebugBreak, IsDebuggerPresent)", "e": [ "api-ms-win-core-debug-l1-1-0" ], "i": "metadata/dylib::api-ms-win-core-debug-l1-1-0", "l": 2, "el": [ "3 symbols" ] }, { "c": 0.949999988079071, "d": "links api-ms-win-core-com-l1-1-0 (CoTaskMemAlloc, StringFromGUID2, CoTaskMemFree, CoCreateInstance, CoCreateFreeThreadedMarshaler, ... +1 more)", "e": [ "api-ms-win-core-com-l1-1-0" ], "i": "metadata/dylib::api-ms-win-core-com-l1-1-0", "l": 2, "el": [ "6 symbols" ] }, { "c": 0.949999988079071, "d": "links api-ms-win-eventing-provider-l1-1-0 (EventSetInformation, EventRegister, EventUnregister, EventWriteTransfer)", "e": [ "api-ms-win-eventing-provider-l1-1-0" ], "i": "metadata/dylib::api-ms-win-eventing-provider-l1-1-0", "l": 2, "el": [ "4 symbols" ] }, { "c": 0.949999988079071, "d": "links api-ms-win-core-libraryloader-l1-2-0 (GetModuleFileNameA, FindResourceExW, GetModuleHandleW, LoadResource, DisableThreadLibraryCalls, ... +5 more)", "e": [ "api-ms-win-core-libraryloader-l1-2-0" ], "i": "metadata/dylib::api-ms-win-core-libraryloader-l1-2-0", "l": 2, "el": [ "10 symbols" ] }, { "c": 0.949999988079071, "d": "links api-ms-win-core-delayload-l1-1-0 (DelayLoadFailureHook)", "e": [ "api-ms-win-core-delayload-l1-1-0" ], "i": "metadata/dylib::api-ms-win-core-delayload-l1-1-0", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links ext-ms-win-xaml-pal-l1-1-0 (XamlBehaviorEnabled, CreatePhoneAppBarProxy)", "e": [ "ext-ms-win-xaml-pal-l1-1-0" ], "i": "metadata/dylib::ext-ms-win-xaml-pal-l1-1-0", "l": 2, "el": [ "2 symbols" ] }, { "c": 0.949999988079071, "d": "links api-ms-win-core-quirks-l1-1-0 (QuirkIsEnabled)", "e": [ "api-ms-win-core-quirks-l1-1-0" ], "i": "metadata/dylib::api-ms-win-core-quirks-l1-1-0", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links msvcp_win (??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ, ??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ, ?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z, ??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ, ?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ, ... +30 more)", "e": [ "msvcp_win" ], "i": "metadata/dylib::msvcp_win", "l": 2, "el": [ "35 symbols" ] }, { "c": 0.949999988079071, "d": "links api-ms-win-core-errorhandling-l1-1-3 (TerminateProcessOnMemoryExhaustion)", "e": [ "api-ms-win-core-errorhandling-l1-1-3" ], "i": "metadata/dylib::api-ms-win-core-errorhandling-l1-1-3", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links api-ms-win-rtcore-ntuser-private-l1-1-7 (IsOneCoreTransformMode)", "e": [ "api-ms-win-rtcore-ntuser-private-l1-1-7" ], "i": "metadata/dylib::api-ms-win-rtcore-ntuser-private-l1-1-7", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links api-ms-win-core-featurestaging-l1-1-0 (UnsubscribeFeatureStateChangeNotification, SubscribeFeatureStateChangeNotification, RecordFeatureUsage, GetFeatureEnabledState)", "e": [ "api-ms-win-core-featurestaging-l1-1-0" ], "i": "metadata/dylib::api-ms-win-core-featurestaging-l1-1-0", "l": 2, "el": [ "4 symbols" ] }, { "c": 0.949999988079071, "d": "links api-ms-win-core-synch-l1-1-0 (InitializeSRWLock, AcquireSRWLockShared, InitializeCriticalSectionEx, ReleaseSRWLockShared, ReleaseSemaphore, ... +15 more)", "e": [ "api-ms-win-core-synch-l1-1-0" ], "i": "metadata/dylib::api-ms-win-core-synch-l1-1-0", "l": 2, "el": [ "20 symbols" ] }, { "c": 0.949999988079071, "d": "links api-ms-win-core-winrt-error-l1-1-0 (RoOriginateErrorW, SetRestrictedErrorInfo, RoOriginateError, RoTransformError)", "e": [ "api-ms-win-core-winrt-error-l1-1-0" ], "i": "metadata/dylib::api-ms-win-core-winrt-error-l1-1-0", "l": 2, "el": [ "4 symbols" ] }, { "c": 0.949999988079071, "d": "links api-ms-win-core-winrt-string-l1-1-0 (WindowsConcatString, WindowsCreateStringReference, WindowsDeleteString, WindowsCreateString, WindowsGetStringRawBuffer, ... +4 more)", "e": [ "api-ms-win-core-winrt-string-l1-1-0" ], "i": "metadata/dylib::api-ms-win-core-winrt-string-l1-1-0", "l": 2, "el": [ "9 symbols" ] }, { "c": 0.949999988079071, "d": "links api-ms-win-core-processthreads-l1-1-1 (IsProcessorFeaturePresent)", "e": [ "api-ms-win-core-processthreads-l1-1-1" ], "i": "metadata/dylib::api-ms-win-core-processthreads-l1-1-1", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links ntdll (RtlCaptureStackBackTrace)", "e": [ "ntdll" ], "i": "metadata/dylib::ntdll", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links api-ms-win-core-registry-l1-1-0 (RegOpenKeyExW, RegQueryValueExW, RegCloseKey, RegGetValueW)", "e": [ "api-ms-win-core-registry-l1-1-0" ], "i": "metadata/dylib::api-ms-win-core-registry-l1-1-0", "l": 2, "el": [ "4 symbols" ] }, { "c": 0.949999988079071, "d": "links bcp47langs (GetApplicationLanguages, LanguageListAsMuiForm)", "e": [ "bcp47langs" ], "i": "metadata/dylib::bcp47langs", "l": 2, "el": [ "2 symbols" ] }, { "c": 0.949999988079071, "d": "links api-ms-win-core-errorhandling-l1-1-0 (GetLastError, RaiseException, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter)", "e": [ "api-ms-win-core-errorhandling-l1-1-0" ], "i": "metadata/dylib::api-ms-win-core-errorhandling-l1-1-0", "l": 2, "el": [ "5 symbols" ] }, { "c": 0.949999988079071, "d": "links combase (ORDINAL 157, ORDINAL 90)", "e": [ "combase" ], "i": "metadata/dylib::combase", "l": 2, "el": [ "2 symbols" ] }, { "c": 0.949999988079071, "d": "links api-ms-win-core-apiquery-l1-1-0 (ApiSetQueryApiSetPresence)", "e": [ "api-ms-win-core-apiquery-l1-1-0" ], "i": "metadata/dylib::api-ms-win-core-apiquery-l1-1-0", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links api-ms-win-core-threadpool-l1-2-0 (SetThreadpoolTimer, WaitForThreadpoolTimerCallbacks, CreateThreadpoolTimer, CloseThreadpoolTimer)", "e": [ "api-ms-win-core-threadpool-l1-2-0" ], "i": "metadata/dylib::api-ms-win-core-threadpool-l1-2-0", "l": 2, "el": [ "4 symbols" ] }, { "c": 0.949999988079071, "d": "links api-ms-win-crt-private-l1-1-0 (o__initialize_narrow_environment, o__initialize_onexit_table, o__invalid_parameter_noinfo, o__invalid_parameter_noinfo_noreturn, o__purecall, ... +25 more)", "e": [ "api-ms-win-crt-private-l1-1-0" ], "i": "metadata/dylib::api-ms-win-crt-private-l1-1-0", "l": 2, "el": [ "30 symbols" ] }, { "c": 0.949999988079071, "d": "links api-ms-win-core-delayload-l1-1-1 (ResolveDelayLoadedAPI)", "e": [ "api-ms-win-core-delayload-l1-1-1" ], "i": "metadata/dylib::api-ms-win-core-delayload-l1-1-1", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links api-ms-win-core-heap-l1-1-0 (HeapAlloc, HeapSize, HeapFree, GetProcessHeap)", "e": [ "api-ms-win-core-heap-l1-1-0" ], "i": "metadata/dylib::api-ms-win-core-heap-l1-1-0", "l": 2, "el": [ "4 symbols" ] }, { "c": 0.949999988079071, "d": "links api-ms-win-core-localization-l1-2-0 (FormatMessageW, SetProcessPreferredUILanguages)", "e": [ "api-ms-win-core-localization-l1-2-0" ], "i": "metadata/dylib::api-ms-win-core-localization-l1-2-0", "l": 2, "el": [ "2 symbols" ] }, { "c": 0.949999988079071, "d": "links api-ms-win-core-handle-l1-1-0 (CloseHandle)", "e": [ "api-ms-win-core-handle-l1-1-0" ], "i": "metadata/dylib::api-ms-win-core-handle-l1-1-0", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links api-ms-win-core-processthreads-l1-1-0 (GetCurrentProcess, TerminateProcess, GetCurrentThreadId, GetCurrentProcessId, TlsFree, ... +2 more)", "e": [ "api-ms-win-core-processthreads-l1-1-0" ], "i": "metadata/dylib::api-ms-win-core-processthreads-l1-1-0", "l": 2, "el": [ "7 symbols" ] }, { "c": 0.949999988079071, "d": "links api-ms-win-crt-runtime-l1-1-0 (initterm, initterm_e, invoke_watson)", "e": [ "api-ms-win-crt-runtime-l1-1-0" ], "i": "metadata/dylib::api-ms-win-crt-runtime-l1-1-0", "l": 2, "el": [ "3 symbols" ] }, { "c": 0.949999988079071, "d": "links api-ms-win-core-rtlsupport-l1-1-0 (RtlLookupFunctionEntry, RtlVirtualUnwind, RtlCaptureContext)", "e": [ "api-ms-win-core-rtlsupport-l1-1-0" ], "i": "metadata/dylib::api-ms-win-core-rtlsupport-l1-1-0", "l": 2, "el": [ "3 symbols" ] }, { "c": 0.949999988079071, "d": "links api-ms-win-core-winrt-l1-1-0 (RoGetActivationFactory, RoActivateInstance)", "e": [ "api-ms-win-core-winrt-l1-1-0" ], "i": "metadata/dylib::api-ms-win-core-winrt-l1-1-0", "l": 2, "el": [ "2 symbols" ] }, { "c": 1.0, "d": "Benign unsigned Microsoft binary with many imports", "e": [ "imports.count = 189.00", "Microsoft Corporation.", "Microsoft Corporation" ], "i": "metadata/binary/vendor::benign-unsigned-microsoft-import-heavy-context", "l": 1, "el": [ "", "0x187558", "0x1873e8" ] }, { "a": "T1027.007", "c": 1.0, "d": "Benign unsigned Microsoft binary with many imports", "e": [ "Microsoft Corporation.", "imports.count = 189.00", "Microsoft Corporation" ], "i": "objectives/anti-static/obfuscation/imports::benign-unsigned-microsoft-import-heavy-context", "l": 1, "m": "B0032.014", "el": [ "0x187558", "", "0x1873e8" ] }, { "c": 1.0, "d": "Modern PE hardening (ASLR + DEP + CFG)", "e": [ "[high_entropy_va, dynamic_base, nx_compat, guard_cf]" ], "i": "metadata/hardening/mitigation::pe-modern-hardening", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleW", "GetModuleHandleExW" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2, "el": [ "0x15eda0", "0x15ed78", "0x15eda8" ] }, { "c": 0.8500000238418579, "d": "PE with version resource and broad imports", "e": [ "Windows UI XAML Phone API", "© Microsoft Corporation. All rights reserved.", "Microsoft® Windows® Operating System", "imports.count = 189.00" ], "i": "metadata/binary/layout::import-rich-versioned-pe", "l": 2, "el": [ "value:pe.version.description", "value:pe.version.copyright", "value:pe.version.product_name", "" ] }, { "a": "T1129", "c": 0.699999988079071, "d": "SRW lock operations", "e": [ "AcquireSRWLockShared", "ReleaseSRWLockShared", "AcquireSRWLockExclusive", "ReleaseSRWLockExclusive" ], "i": "micro-behaviors/process/threading/advanced-sync::srw-lock-ops", "l": 2, "el": [ "0x15eeb0", "0x15eec0", "0x15ef00", "0x15eef0" ] }, { "a": "T1497.003", "c": 0.7799999713897705, "d": "Microsoft export-heavy waitable timer context", "e": [ "Microsoft Corporation", "exports.count = 14.00" ], "i": "objectives/anti-analysis/timing/evasion::waitable-timer-export-heavy-microsoft", "l": 1, "m": "B0003.003", "el": [ "0x1873e8", "" ] }, { "c": 0.800000011920929, "d": "Mutex-based single instance enforcement", "e": [ "GetLastError", "CreateMutexExW" ], "i": "micro-behaviors/process/sync/mutex::mutex-instance-check", "l": 2, "m": "C0042", "el": [ "0x15ecb8", "0x15ef40" ] }, { "c": 0.800000011920929, "d": "Microsoft-rich updater stager context", "e": [ "imports.count = 189.00", "exports.count = 14.00", "Microsoft Corporation" ], "i": "objectives/command-and-control/dropper/staging/stager::microsoft-rich-updater-stager-fp", "l": 1, "el": [ "", "", "0x1873e8" ] }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key open and query chain", "e": [ "RegQueryValueExW", "RegOpenKeyExW" ], "i": "micro-behaviors/os/registry/access::registry-read-api-chain", "l": 2, "el": [ "0x15ee68", "0x15ee60" ] }, { "a": "T1027.009", "c": 0.8999999761581421, "d": "PE resource load and data pointer chain", "e": [ "FindResourceExW", "LockResource", "LoadResource" ], "i": "micro-behaviors/data/embedded/payload/resource::pe-resource-load-lock-chain", "l": 2, "el": [ "0x15ed70", "0x15edb0", "0x15ed80" ] }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "SetUnhandledExceptionFilter", "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 1, "el": [ "0x15ecd8", "0x15ecd0" ] } ], "sha": "702a41bb6a337f2d7ed036a9697294167abca7da0087431cf9800424bde1a412", "path": "702a41bb6a337f2d7ed036a9697294167abca7da0087431cf9800424bde1a412.exe", "type": "pe" } ], "tv": "52045" } }