{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 0.8911781907081604,
        "class": 0,
        "threshold": 0.9987763166427612
      }
    ],
    "prob": 0.8911782,
    "class": 0,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.8911782,
        "class": 0
      },
      {
        "m": "az/native",
        "prob": 0.2392638,
        "class": 0
      },
      {
        "m": "az/pe",
        "prob": 0.014666666,
        "class": 0
      }
    ],
    "version": "v17.17",
    "threshold": 0.9987763,
    "analyzed_at": "2026-05-31T11:16:26Z"
  },
  "path": "7377b7a3163111fc84b74fb76f4f674d301bfb8cfd4291242e476ec60f07ed1e.exe",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "O(As)H(Cm)Md",
        "x": 6,
        "ff": {
          "i": [
            [
              "kernel32",
              "DuplicateHandle"
            ],
            [
              "kernel32",
              "WaitForMultipleObjectsEx"
            ],
            [
              "kernel32",
              "CreateEventW"
            ],
            [
              "kernel32",
              "GetCurrentProcessId"
            ],
            [
              "kernel32",
              "OpenProcess"
            ],
            [
              "kernel32",
              "VirtualAlloc"
            ],
            [
              "kernel32",
              "CloseHandle"
            ]
          ],
          "m": {
            "pe": {
              "checksum": 257304.0,
              "checksum_valid": 0.0,
              "computed_checksum": 220118.0,
              "bss_like_section_count": 0.0,
              "section_overflow_count": 0.0,
              "misaligned_section_count": 0.0
            },
            "file": {
              "size": 214528.0,
              "entropy": 6.04,
              "size_bytes": 214528.0
            },
            "binary": {
              "is_pie": 1.0,
              "code_entropy": 5.52,
              "data_entropy": 5.94,
              "string_count": 256.0,
              "entropy_variance": 1.45,
              "avg_string_length": 721.26,
              "max_string_length": 10233.0,
              "code_to_data_ratio": 0.03,
              "string_length_stddev": 1618.66,
              "largest_section_ratio": 0.96,
              "sentence_string_count": 56.0,
              "sentence_string_ratio": 0.22,
              "high_entropy_string_count": 0.0
            },
            "exports": {
              "count": 3.0
            },
            "imports": {
              "count": 7.0
            },
            "sections": {
              "count": 3.0,
              "code_size": 6144.0,
              "entropy_max": 5.94,
              "entropy_mean": 4.89,
              "name_entropy": 2.58,
              "writable_count": 1.0,
              "executable_count": 1.0,
              "nonstandard_count": 0.0,
              "executable_writable_count": 0.0
            },
            "dependencies": {
              "count": 1.0
            }
          },
          "s": [
            [
              77,
              "u8",
              "!This program cannot be run in DOS mode."
            ],
            [
              184,
              "u8",
              "Rich"
            ],
            [
              224,
              "u8",
              "faVc"
            ],
            [
              480,
              "u8",
              ".text"
            ],
            [
              559,
              "u8",
              "@.data"
            ],
            [
              7334,
              "u8",
              "pzGoZf.dll"
            ],
            [
              7345,
              "u8",
              "VvtpZTNdcbXtH"
            ],
            [
              7359,
              "u8",
              "uaygshidjudshygahsijodajsfuasjkfas"
            ],
            [
              7394,
              "u8",
              "yerRiJrSUrZWBGXc"
            ],
            [
              7412,
              "u8",
              "GCTL"
            ],
            [
              7464,
              "u8",
              ".rdata"
            ],
            [
              7480,
              "u8",
              ".edata"
            ],
            [
              7496,
              "u8",
              ".rdata$zzzdbg"
            ],
            [
              7738,
              "u8",
              "CloseHandle"
            ],
            [
              7752,
              "u8",
              "DuplicateHandle"
            ],
            [
              7770,
              "u8",
              "WaitForMultipleObjectsEx"
            ],
            [
              7798,
              "u8",
              "CreateEventW"
            ],
            [
              7814,
              "u8",
              "GetCurrentProcessId"
            ],
            [
              7836,
              "u8",
              "OpenProcess"
            ],
            [
              7850,
              "u8",
              "VirtualAlloc"
            ],
            [
              7864,
              "u8",
              "KERNEL32.dll"
            ],
            [
              29024,
              "u8",
              ":case\"submit\":case\"touchcancel\":case\"touchend\":case\"touchstart\":case\"volumechange\":case\"change\":case\"selectionchange\":case\"textI"
            ],
            [
              34076,
              "u8",
              "82a179500bc4e9b76af627b21b995b8bbd33adc224391f1e7edd0a07f61844464925056111c0e7ac0295595a41a65657584780304d4548db20fa4ecffe6337df"
            ],
            [
              35929,
              "u8",
              "81d85df04607e6c3fb19de54680daa03031ab1f14d3aacaf51f5b77a16494e52af76c4983a0ee0b93129d09b68df9810b75e5748f14f86d96f2f9e45bbecb658"
            ],
            [
              36103,
              "u8",
              "85fc1a252ddec11365b821e20f9dd8be268525f5aaf7b87fec68f7f2878daa29f34da14ba2d99a729341418ecf79f59ae89ab6cdfdb702b9cf634512a911aba9"
            ],
            [
              42993,
              "u8",
              "8a68e53dccec1a085474cc885177608fbf5210a20b2e29be79da3554d4cc4663511aa924367f0496bb6d3b044aa31dd1231989044d7c7e6989bdfaa4b05de5bc"
            ],
            [
              43167,
              "u8",
              "8fa79d4667efe27f8a3b88596e57666f22cdb0dc172f07bee75a1a5e49e6b78146f01a2b79dfa91bfff5c931abd9c0cff96ce32b54ea02e1f4cc6253200de376"
            ],
            [
              45020,
              "u8",
              "80c8606488cc762919b5b31ac3c083b92a645ea5b9802d248d183c7dd1c5a5a0e385f138d2040e368d7ee3cb63133dce0fd505e8d3b003a96581c8f21d4e7687"
            ],
            [
              45194,
              "u8",
              "83b3a31825d38ed550ecd8a1b166b8441d203ed45651bb3a29346b0417b61bd3a1d0ce52edeb5cd0ec66bc47a2c8cd756a5d70bb022e4ffa3f6fec8e37676451"
            ],
            [
              47047,
              "u8",
              "87e559684251d92e175e03353095b6fa5292ea8b3ae83ccf8b9ac2388c91a9f626c188ef17bbbe3e930985bacc8b7b027474d41a587435034211f5df378880cc"
            ],
            [
              48900,
              "unicode-escape",
              "871d6ab6ace45fc38965ecbceaf8218d6dffeb7424dbd50568311af009a05e56a9ff5ef0e1f39690e97fae64d39c231b81fedbf6437219b0298c9b9c36cf59aa"
            ],
            [
              59148,
              "u8",
              "8236eaea827452ec22511ccc49740089bb58a081db526f60f810ec7cdb1ef927d07e14c96dc065c7781d64cc8c42e58a373eeabbcf2695e461fa13d2d13ba147"
            ],
            [
              62854,
              "u8",
              "8204c5c68d13e942579822c5f9b1e7cc5b93c9f133dc3429aecb40323fab59846b71b5ef8f22a2f9d3dc1cd5c1fe338376bcd88aecbf1a0759cdadd2aee5238d"
            ],
            [
              66386,
              "u8",
              "80affa9ec1f82fd957350a9fbb5e88566692008e338b72848d9ae547b05e0f59c9772393f91b7b39af5196fd2ef0118a602f5dfb11300c0b3603fd887d00d10f"
            ],
            [
              66560,
              "u8",
              "8a281116297cde79352c5e022786bf2b743557ffc71d18178149f0adf12fec45ee944a782fbf579decc0ccc2437a684d07f84c72050c4b003785054b52214787"
            ],
            [
              70092,
              "u8",
              "8af1191ca7abb7977b6547c0df8a2853d4bcab5fe655e57dfea4bd6ff27b47e836d036b0e72f2246700b51c8c4961cfc2b457b045605bc7bc02cf38f4819fcb7"
            ],
            [
              70478,
              "xor",
              "f5.77fff5dhzff4u/\"+\u003e}}yya5as/f4u://)29./\u003e"
            ],
            [
              75477,
              "u8",
              "816d6317e5684bb010d3a683c099217ca99dfe0850a6d7f20d06fdac75c762f9f8ae83e02926b6e648e85718da608b38768257d6605e71aec7cb818695612158"
            ],
            [
              75651,
              "u8",
              "80e6024cb8a9c56301dae167c25e76cbce0e765bc077f0719e5f5a67b2954d50e207d4d766bfbe9b89cefb1b6d514a3edad27a13e1499b395f920c906355bb58"
            ],
            [
              77504,
              "u8",
              "85cc296e6119524fd73460c92d7f9b6c03d89c07b5c28ac55fd56d6b20c9a661f255fcc2e0840c21945a222e2bde958ca3ed9efce48a99bbe21a2ed5acd6f5c1"
            ],
            [
              84742,
              "u8",
              "8aaf23e4b47859cb9fb2457f9b38e65b547ef1a6fc58ed652dba87fe733e4d89f220557542a0905c5649d43e97de6d365dea8516bb7d8a8c2ddfddbc4551547c"
            ],
            [
              86769,
              "u8",
              "8e2efbf581de40ed37e8c54b59df78d6d157affa95e3621e272b9d1c3db5ec75ed32422dd598e4a1a938f27f5f8e8e8826f969e500ed74c2a4b5de7bc1adb9c6"
            ],
            [
              88796,
              "u8",
              "8923541cf70f0e2a42b38bbf7374ce0ae96ae62e2b8debcae4759dcfdc2337f6c6ff106c315368000d39d71c6b3a8d2955e313000c57aa65a192174742018aaa"
            ],
            [
              90649,
              "u8",
              "828c1ab0aaea4d57c8e77e2ed3c10f150e2082aa2d6d1b9c9efdd77f754f946ff654db4599150dd0ef06faadea6945ec20b7fa4b2c1218a045d7d3665b717ab5"
            ],
            [
              92502,
              "u8",
              "8ec29d23b7e81d5b0599c0843f16a7459c8e56a9b12034421e3fbf56bc8137c0a35b46b6d87a737fdd01b2de90763624ba01ba2beb7d35bf023d380781c7adf9"
            ],
            [
              94355,
              "unicode-escape",
              "8a08cd1c22dc4f418e8270b3916d44c135861189f592d50573797abb25fa99124c96893df2896405499ef6319c052d94fefacab641584af07e22b07eb59519aa"
            ],
            [
              96208,
              "u8",
              "88cf3fdda975b24ee8311d1773636b01e3ede6ccff7e874c4a6001f65948a6d11a44b30139f0889bfe042bdaefe4d3ffb20f14641f8a9d7547a43ea427e5ac73"
            ],
            [
              98235,
              "u8",
              "85bb56130a9c35fc0d09985c9032ac5851a6c42be9dbc2e0fab4dd8cae41b3cbc47c62fc055bd0f8d24df6129554af264414221306a95c3b29f60275026739c2"
            ],
            [
              98409,
              "u8",
              "87893f1a9b38b71a7b4fae04304903ac245d990fc6c2679455545efb643fb6661ea0e69d433d272328b5685fcef5192aa9a1dbb06bb85e5bdff11a7f842e3e8f"
            ],
            [
              100262,
              "u8",
              "869a8014ec0ab467e8c9acab4d8ccb06c939aa8529274577ec4211c717ce843e97484763d3af0fef650cade8316c5e047dc6b594d009bb8ae9c090fa6c9263e5"
            ],
            [
              100436,
              "u8",
              "849d39730147f2c00eba19b8233990129081206943ecee3072ef4b6053300060a1a34fda93f7a761db5974ffae9b931707281759ac4d40c9396291facef1a95d"
            ],
            [
              100610,
              "u8",
              "89dfff3cc0c8598a6d2cc5776dd38c6b5f59b9c2606bef52e96fb44a5e6588424150d7c9e3bb69252bd26a9cb482374cc0c0013095b0bbdc811e7f53d1a1c5a3"
            ],
            [
              104490,
              "u8",
              "85b78d910852298a40ab70e40e44b0714a86a1da809266b01a8b00de3bf0b46273e757e53444142aacfcc1ff37718b1822b2bf573f085bccfffc5f21645942ea"
            ],
            [
              108196,
              "u8",
              "8551bd8895c8dc5d0aecd933cd43fe3734f1d2a76f8fec7dddbfc075bca2b52467e663c819025f7e27d28529a6683c126333f5f9ad908ad9c656025fc62993d4"
            ],
            [
              108370,
              "u8",
              "83a80eb6e3371875fe978cd7cb469e265cad99baa90b545895bd600a3eb5ecec69a63f0b1a2e60f662b70184b1bf8ac367cf4f4ba2c792f639d2789f52e48f35"
            ],
            [
              108544,
              "u8",
              "83d4c30b41a3cef1bd4c0828aa3052481a77b9a64554b9b4a0b365634ebff363feec8c882d8c779c645135861fad8064bc0372a9dadf2c58a50912b6cf7e2132"
            ],
            [
              108718,
              "u8",
              "87f85ff2039cc1bcb956a382dcc00970683bca4eb77b01e68aacb2011cea07c9f090ac954d8e879cbdc28c1453cd0dfa5097d5511d330e0a4a286db8e9b06476"
            ],
            [
              108892,
              "u8",
              "8938d75e8fb3da2005059289c56d06e39b805262d86fb68f9c1e8dcb2555df010f1852dfc05f33722cb3ec4d6dca080fd38d80c559ab0645ac228b43bc48e582"
            ],
            [
              109066,
              "u8",
              "8ba450d1d8ff3176564e4cbaec5f7a9cc9effd62e3c1f759bdb485f484c095cf6a23697f5b5912df92a60f7c6b6d40bcaa787489167354859cbf0f88f03b10b8"
            ],
            [
              117809,
              "u8",
              "8b8e04dc35e53f9c106072f1aa6da957525d1753192a0d6f3ad2539acb6e964e6646e669579162d4cc9b387bfea78d1d50641fbc82dcab8fb1ef4a18bf366191"
            ],
            [
              117983,
              "u8",
              "87d4230aa8964fe6a00542ac72bed3fb6dd9311ed1dab522e09d56e2b4f98f746f8ea591154baadad993ec3a82240b89f2952bc7a8b86b238d3b585e9a7d77d1"
            ],
            [
              118157,
              "u8",
              "8a0446ac0f24ffe169b2d54ebb3c577a240d91836bcb8b72549c44fa3a0ff386ae67bfb11295b52c0e8cb6cdafa1d31eb8bee3e993d9b76043ad19827b896e1e"
            ],
            [
              132111,
              "u8",
              "800401fda5de31a369129de96cd228cebab3b8a625865f9e758d35286df74b49fc246632b40b63b99fcea2315480469e62170df711c82152244993894444126e"
            ],
            [
              135817,
              "u8",
              "8fb6b39cb2789410d7239b2481838c692c842e09d20cd325fddb3598c076e7ba24452df6e301a778ec6126bc38ba5336e88e27dfc90b11201eb66a03f0fcf85f"
            ],
            [
              135991,
              "u8",
              "881548fa6dc2ffb65d71c9354975ec16b57209a72344933cb5cd5903824991b87c68c6beae9731eddd72a3a700f6c988edd713bfaf03ff1307bf12bee4f0b42f"
            ],
            [
              137844,
              "u8",
              "8da94a9a2fd2eb0674498e46903e842f25ae36a389cdad8dac4be25dc9b32db4d31ef675973a1b2b4b929feb3b893aec8c21b5befb48fb0a1a75927c348f7fcb"
            ],
            [
              139697,
              "u8",
              "8621f9da89790fed0860daceb8c258df4f000462ca5b497edd96be02881d282bdcef995aeea400ea5a1a31a9df3c069d02a1d24f46abd23ef5a652807705292b"
            ],
            [
              139871,
              "u8",
              "81c3a696821947a06f3ebfe06b0e0d0a5b5242beaa254a224aeb5925e0604503bb47594c92d620cf5c6a8822b298ee25e1046ad7b38dd5914977702442ab29cc"
            ],
            [
              140045,
              "u8",
              "802314624e1709567ab2b932b4751947bd15debed947993b9fbb942f30f6c8674d4a02aaf0adaf42eb9cb45638ac968d9ac4c9034b51f49cc6109c6ac0f23b8d"
            ],
            [
              141898,
              "u8",
              "8cfd907d9179242e0e7cc672b602df9067deb492ae5d4ad13f6563dfcbe5ef317e0ab1c7fe71b7f41db5690fc18ed9e6a7c26528191c3cacb92a13fa11cc57ae"
            ],
            [
              142072,
              "u8",
              "8129e09f819489350ab9e54aa3d13caf262a2188d07fb55731a9b36bb499f415890a7c8aee7fdab0f5c6bd0eb6f972c41f5ab23b0b7c2750a4c0bbc18861522f"
            ],
            [
              143925,
              "u8",
              "826b67e83f1bb973bfe6a2dc8a5872f251e47f265ddb3685e8ee6a23886b79a7532a8a8ae91753fa9391eca3e982001e9fe5dc78e31a7cc7ead719b28c20134d"
            ],
            [
              145778,
              "u8",
              "8ac6e4eada3baab60d5d85a6a2cf51f1e75588db95b954eb2c2ce3badcd043d27fbc622384b6c3d333b642a64ce93c87734e7e8787af8767b46106c7dafd31ed"
            ],
            [
              147631,
              "u8",
              "8628b7e7860c02370f2f59340520f8804b66a868f42340b3d67a4fb092571969d6c6c1ec41708d85402ce9ffede7c7902a74e6f8183f721818ae0b63fa975969"
            ],
            [
              149484,
              "u8",
              "8d5a30a0690c56d463e7bc64db88f190bfccf01f431cbc64ee235d60d9086412690978cdf4b12228ba57ac40279a914e6b4124cd5582c3f79707b18ca2d71231"
            ],
            [
              149658,
              "u8",
              "855d97e4780a3638823c07af305846ad75dfc36a04aabb69678fee49e13cb2189afacc8df4845329c9d85338341c464c2c03f6abd72ebc57378f01c84afffd11"
            ],
            [
              150006,
              "u8",
              "84bc1c122c7d817803657bf77ee077f45939f208dda676667405fd6a8c7ed6c0ffabbe374a859e72801e0495459dc01ffe2d98b08c08645d01f9fee3e44263e3"
            ],
            [
              150180,
              "u8",
              "81e4b39a87818ca7bff560f20864d9ef2f18012a8e3720c32bb5cdc034338db728d150e5126b2cab872a4d4dbdd4c46d2cd439d84a59eef45f7c959475d3396c"
            ],
            [
              150354,
              "u8",
              "8a2c3d3c89a778cb6fb8d0fcbd5d0f6a8f174052c886d90ff58c5825ce1fdda17630513fb149d0bfee3dc89f188e8e7138e1f00246752a1450860df3be1f8f67"
            ],
            [
              150528,
              "u8",
              "811df0843e2c6c9724d902c"
            ],
            [
              150566,
              "u8",
              "8659e49ec2e7d991fc2f4a4777f0698a402b28713b8fcb1e685dcfec2ff3ee814672122631f4c2c33cca05c81a2bff28c7ccedfd4901173bd862715a66ed63c0"
            ],
            [
              154098,
              "u8",
              "8566185a3ad3114c0e6dd8da2c82d875773c7b4d6c39ed8445a74c04473b5c2ddb1eeb0b4a3a953956237867e3abca938650a96389e1b335a29fa3c3ffec04bb"
            ],
            [
              161162,
              "u8",
              "86190ba574a5f1513b88c2da348835296e2759759d81ec664be64da0088e61f0a6477994f82f30a3ab459b5daad31d0ee92990a372ccbf8e2fa46f913e3ea0f4"
            ],
            [
              166547,
              "u8",
              "896acc6f7a7731ef7fc8ae4c8ee49b9d112012ca2966daf0924115c52b3b538f20b1f816c881d525bc452a5c6220e0b47a2a0d1e548165b3a06ea2b52f39d1f4"
            ],
            [
              166721,
              "u8",
              "81bcfad2fc798d28f17b77ed6029b1b4bec8da42ff74371a76504bb5a9a15eedf687c73f23fb965f605cc51f294bc85a80980d634516542ec4c882b6fe04461c"
            ],
            [
              166895,
              "u8",
              "8515ec1b1622147f156fabaaabfd4066886a581b622d225c815c5bc1de52dff5753cbb62a0752f229853c984a18b79858921adf689f64bf88099e634e3e0d54a"
            ],
            [
              167069,
              "u8",
              "8f36cad1e158c313d85f065a64f54163d459ef8e9ccf01a6120ff4d14f695f38597fa99985eca34f4e4fa2755fc288d34c3da4f9d9921c445e984e4a5fdb970d"
            ],
            [
              168987,
              "u8",
              "8fb77cc095ba4c82334bf1ca8be8ffad34b5103be0ecf1e3ec6e76ad24cc1f2d80b502057e9196d7e118ddaac6564264991a0c13f9b6e559539f774787902f5a"
            ],
            [
              177556,
              "u8",
              "89cbc57d166b94a7f50ae6f6f14e811ecb2fb866a7b39e44f7552e79798135b2dc72e5da30e7031534e2000cce885706950193ddfedc4158a341d1b7dbc8e697"
            ],
            [
              179409,
              "u8",
              "8fe3eec8e310bfab9d1b52a2073233b48fae98fb24009ef8616acb6bfd7ce16c7a507d226adbcd59c877c2608c9bed7fa3a61a69108fea472f11051cb659449a"
            ],
            [
              181436,
              "u8",
              "80b9b694025be7b0ccbc6232807120b0c720b220b5b54c6292348aba52fc8ab435bd506b7254ec33b3bd89b4d17fcfb8ad4ff934b03bad274a1fa96655dce69a"
            ],
            [
              181610,
              "u8",
              "8470d678c1f19e7247bbc157f797b4227922decca087d0a4dd3904bc598924d2131f37096d3638d13201eb8ceb0e88d70b413b2d81ea641faef78b37fa391556"
            ],
            [
              181784,
              "u8",
              "8a9440c2dcb03b407aaa4c430f03295d59d159cce68080f7e292a629df0c8ab58a65c6b679da1f219c63cc2b8820201f6519ebdbac0eb5e0958cb8fa96925e64"
            ],
            [
              185316,
              "u8",
              "8c5246d0c82139d45761de4d690cd3de1487b97e617162552a0bfc50ed83a1ed80b6aa33051b20cbfdeb0088cdbddece682bf7fe81b39fd7623a7d50d2995132"
            ],
            [
              187169,
              "u8",
              "81120915b38e8b751c874cb0e399d5a9632bae67fcbb8284902f99771b4f5ad78ea9c786beda4b76868d52c3228ef9f89dead8c24c66b4e695923cab1e532efd"
            ],
            [
              197417,
              "u8",
              "8ea3194c94456072ce924ebeb73ca9bf1c755046b671dba6d1ab39dec47f2f3222b4c12bb684ff0f321b0ef90d6894474042f9ae7ab2ec97e004dca0e9fcd2be"
            ],
            [
              197591,
              "u8",
              "8f66def001a5df3478707f4f3495e478e20d55a2d4723b6e26708e5d757df2879e3286f72e64531cc8db2a620193b8c4f87d6886faa6f000711cf6aa4fb86c1b"
            ],
            [
              201123,
              "u8",
              "8f0612d940293e9765f68a392b7a388a2cc8d163b57c2870e46e780100d72f18815da98a82a974b6d72d79a31547ca99c4132458ddacb1678659c2cf60fef6d3"
            ],
            [
              201297,
              "u8",
              "8b782d881f73f39aa4a9d16ead5aebdf1ce299ea3d3b1efbc11ac2242db740ce092345ca50bddb8870f886079f467f2409756a9095cecb81910cdf63fd74d2a9"
            ],
            [
              203150,
              "u8",
              "8dfb6017964df63379bbd0b229375c2ef3fb812afa5290a479f472cf95964a02d4841bb3047cdf743441f5269aa7e51559ef16b5eae82be9c6c49c168650f07f"
            ],
            [
              206856,
              "u8",
              "8895a2ede7591f1bafc4e1355620aaecb5102b314076733497a7d2ffc0622c08c1131f1867c34224bcbe071a7f3c69761503e9231f6a0b9854929a8075635736"
            ],
            [
              210388,
              "u8",
              "8b2bcf816a32dbc7ef7e6dd6bc00256e2291a57b52974595791bb17873f4e247795b73593b24811b8c65af02537c61e42189991c403d6592c26c3a0c90f2db23"
            ],
            [
              210562,
              "u8",
              "848c4314f01e8bbdb592dedadbc54bf5764a85cf7756bf52d7cea95d6433ad80bce9c9ac021e70eed331fb236a5a825598d7d144c0ed91c2e397c400937de85d"
            ],
            [
              210736,
              "u8",
              "8d2af23abb219747f3f26d1d866cd9767a024549d6dd0d4eceef72f132999b816a10bb31780b65acd31cba54e387a00de090778e6e85fa2fdb994ea6a9096095"
            ],
            [
              210910,
              "u8",
              "8e8f48c6b9b354dc04c449210f6282361a40eb102a3f3858a4f73a9fa9d1e260e923f457e812f383cab7a11437ac164839b0dbfda39094bcb2175f2096f9c7d7"
            ]
          ],
          "v": {
            "file.stem": "7377b7a3163111fc84b74fb76f4f674d301bfb8cfd4291242e476ec60f07ed1e",
            "pe.imphash": "5f3931e8b5b2cabca208c3032e64e333",
            "pe.machine": "x86_64",
            "pe.rich.key": 2531752693,
            "pe.rich.hash": "556039ded2976e74ce800d33b171de2e",
            "pe.subsystem": "windows_cui",
            "pe.timestamp": 1666605414,
            "file.basename": "7377b7a3163111fc84b74fb76f4f674d301bfb8cfd4291242e476ec60f07ed1e.exe",
            "pe.image_base": 6442450944,
            "pe.image_size": 225280,
            "pe.machine_id": 34404,
            "pe.os_version": "6.0",
            "pe.entry_point": 4096,
            "pe.headers_size": 1024,
            "pe.entry_section": ".text",
            "pe.subsystem_raw": 3,
            "pe.file_alignment": 512,
            "pe.image_hash.sha1": "1c7d04bfff64e6bc83a7d8f1b1fecd1a59781822",
            "pe.export_timestamp": 4294967295,
            "pe.image_hash.sha256": "8c26d8b0aaeaf4579bec7908e3fb8685191262d491c00ab53c1e964310fe6c5b",
            "pe.image_hash.sha384": "7625e11413ca737e16f6edb88bf8d0f8a24ba50b9dd7a4229efaccfb81a9595900b86f59638f3d46ee67dbdaf2336082",
            "pe.image_hash.sha512": "416d0db144e5367e20cbd072c8dd63d25bdb583e905829537c73e8219b4ccbad559b0609b2d770fdeef0d9abe3cae1ccd8396e84451c5c0471667a358ffd37a8",
            "pe.section_alignment": 4096,
            "pe.subsystem_version": "6.0",
            "pe.characteristics[0]": "executable_image",
            "pe.characteristics[1]": "large_address_aware",
            "pe.characteristics[2]": "dll",
            "pe.characteristics_raw": 8226,
            "pe.linker_major_version": 7,
            "pe.linker_minor_version": 15,
            "build.toolchain.compiler": "msvc",
            "pe.debug.entries[0].type": "pogo",
            "pe.dll_characteristics[0]": "high_entropy_va",
            "pe.dll_characteristics[1]": "dynamic_base",
            "pe.dll_characteristics[2]": "nx_compat",
            "pe.data_directories[0].rva": 12384,
            "pe.data_directories[1].rva": 12752,
            "pe.data_directories[2].rva": 12352,
            "pe.data_directories[3].rva": 12288,
            "pe.dll_characteristics_raw": 352,
            "pe.number_of_rva_and_sizes": 16,
            "pe.data_directories[0].name": "export",
            "pe.data_directories[0].size": 148,
            "pe.data_directories[1].name": "import",
            "pe.data_directories[1].size": 40,
            "pe.data_directories[2].name": "debug",
            "pe.data_directories[2].size": 28,
            "pe.data_directories[3].name": "iat",
            "pe.data_directories[3].size": 64,
            "pe.debug.entries[0].type_id": 13,
            "pe.rich.entries[0].build_id": 257,
            "pe.rich.entries[1].build_id": 1,
            "pe.rich.entries[2].build_id": 259,
            "pe.rich.entries[3].build_id": 256,
            "pe.rich.entries[4].build_id": 258,
            "pe.rich.entries[0].use_count": 3,
            "pe.rich.entries[1].use_count": 7,
            "pe.rich.entries[2].use_count": 1,
            "pe.rich.entries[3].use_count": 1,
            "pe.rich.entries[4].use_count": 1,
            "pe.coff.dos_header_pe_pointer": 216,
            "pe.rich.entries[0].product_id": 29382,
            "pe.rich.entries[2].product_id": 29382,
            "pe.rich.entries[3].product_id": 29382,
            "pe.rich.entries[4].product_id": 29382,
            "pe.debug.entries[0].size_bytes": 204,
            "pe.debug.entries[0].timestamp_unix": 1666605414
          },
          "x": [
            [
              "VvtpZTNdcbXtH"
            ],
            [
              "uaygshidjudshygahsijodajsfuasjkfas"
            ],
            [
              "yerRiJrSUrZWBGXc"
            ]
          ],
          "id": "pe",
          "sc": [
            [
              ".text",
              1024,
              6144,
              5.52,
              "r-x"
            ],
            [
              ".rdata",
              7168,
              1024,
              3.2,
              "r--"
            ],
            [
              ".data",
              8192,
              206336,
              5.94,
              "rw-"
            ]
          ]
        },
        "id": 0,
        "sz": 214528,
        "ts": [
          {
            "c": 0.8999999761581421,
            "d": "Tiny JavaScript file lines",
            "e": [
              "text.total_lines = 1.00"
            ],
            "i": "metadata/file/text/metrics::tiny-javascript-file-lines",
            "l": 1,
            "el": [
              "embedded@0x851c:unknown"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Very long line",
            "e": [
              "text.max_line_length = 1839.00",
              "text.max_line_length = 1904.00"
            ],
            "i": "metadata/file/text/metrics::single-long-line",
            "l": 1,
            "el": [
              "embedded@0x851c:unknown",
              "embedded@0x28c9d:unknown"
            ]
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Last line is over 1000 chars",
            "e": [
              "text.last_line_length = 1904.00",
              "text.last_line_length = 1839.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000",
            "l": 1,
            "m": "B0032",
            "el": [
              "embedded@0x28c9d:unknown",
              "embedded@0x851c:unknown"
            ]
          },
          {
            "c": 0.9700000286102295,
            "d": "Validation vocabulary string",
            "e": [
              "string"
            ],
            "i": "metadata/file/text/format::vocab-string",
            "l": 1,
            "el": [
              "embedded@0x851c:unknown"
            ]
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Exactly one line exceeds 1000 chars",
            "e": [
              "text.lines_over_1000 = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier",
            "l": 1,
            "m": "B0032",
            "el": [
              "embedded@0x851c:unknown"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "File is a one-liner",
            "e": [
              "text.total_lines = 1.00"
            ],
            "i": "metadata/file/text/metrics::file-one-liner",
            "l": 1,
            "el": [
              "embedded@0x851c:unknown"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Nested loops with multiple charAt calls",
            "e": [
              "for(;e\u0026\u0026e.firstChild;)e=e.firstChild;return e}function _r(e,t){var n,r=br(e);e=0;for(;r;){"
            ],
            "i": "micro-behaviors/data/encode/permutation/loop::js-permutation-loop",
            "l": 2,
            "el": [
              "embedded@0x851c:unknown"
            ]
          },
          {
            "a": "T1071.001",
            "c": 0.8600000143051147,
            "d": "Click analytics event token",
            "e": [
              "click"
            ],
            "i": "micro-behaviors/communications/http/services/analytics::click-event-token",
            "l": 1,
            "m": "C0002",
            "el": [
              "embedded@0x851c:unknown"
            ]
          },
          {
            "a": "T1005",
            "c": 0.30000001192092896,
            "d": "Boolean-true return fragment",
            "e": [
              "return!0"
            ],
            "i": "objectives/credential-access/financial/credit-card::card-filter-return-true",
            "l": 1,
            "m": "B0030",
            "el": [
              "embedded@0x851c:unknown"
            ]
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Many single-char params",
            "e": [
              "functions.single_char_params = 18.00",
              "functions.single_char_params = 13.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/functions::single-char-params",
            "l": 1,
            "m": "B0032",
            "el": [
              "embedded@0x851c:unknown",
              "embedded@0x28c9d:unknown"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "Sequential source identifier names",
            "e": [
              "identifiers.sequential_names = 31.00",
              "identifiers.sequential_names = 17.00",
              "identifiers.sequential_names = 7.00"
            ],
            "i": "metadata/file/text/profile::sequential-identifiers",
            "l": 2,
            "el": [
              "embedded@0x28c9d:unknown",
              "embedded@0x21a74:unknown",
              "embedded@0x851c:unknown"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "Short sidecar-sized source",
            "e": [
              "text.total_lines = 1.00"
            ],
            "i": "metadata/package/config::short-sidecar-file",
            "l": 1,
            "el": [
              "embedded@0x851c:unknown"
            ]
          },
          {
            "a": "T1552.001, T1041",
            "c": 0.4000000059604645,
            "d": "\"search\" verb inside a string literal",
            "e": [
              "search"
            ],
            "i": "objectives/supply-chain/recon-exfil/ai-cli::prompt-search-word",
            "l": 1,
            "m": "E1552",
            "el": [
              "embedded@0x851c:0x6fe"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "Very short file (under 12 lines)",
            "e": [
              "text.total_lines = 1.00"
            ],
            "i": "metadata/file/text/metrics::file-under-12-lines",
            "l": 1,
            "el": [
              "embedded@0x851c:unknown"
            ]
          },
          {
            "c": 0.30000001192092896,
            "d": "for loop (content)",
            "e": [
              ";for("
            ],
            "i": "micro-behaviors/data/control-flow/analysis::for-loop-content",
            "l": 2,
            "el": [
              "embedded@0x851c:unknown"
            ]
          },
          {
            "c": 1.0,
            "d": "JavaScript length property",
            "e": [
              "length"
            ],
            "i": "metadata/lang/scripted::length-prop",
            "l": 1,
            "el": [
              "embedded@0x851c:unknown"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Regex component marker",
            "e": [
              "location.href"
            ],
            "i": "micro-behaviors/communications/http/url/path::browser-location-host-ref--rx-1",
            "l": 1,
            "el": [
              "embedded@0x851c:unknown"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "innerHTML/location.href rewrite (page blocker shape)",
            "e": [
              "location.href"
            ],
            "i": "objectives/supply-chain/hidden-payload/extensions/browser::extension-page-block",
            "l": 1,
            "el": [
              "embedded@0x851c:unknown"
            ]
          },
          {
            "c": 0.30000001192092896,
            "d": "for loop (AST)",
            "e": [
              "for(;e\u0026\u0026e.firstChild;)e=e.firstChild;",
              "for(r=0;r\u003cn.length;r++){var o=n[r];if(!f.call(t,o)||!yr(e[o],t[o]))return!1}",
              "for(;r;){if(r.nextSibling){r=r.nextSibling;break e}r=r.parentNode}",
              "for(;r;){if(3===r.nodeType){n=e+r.textContent.length;if(e\u003c=t\u0026\u0026n\u003e=t)return{node:r,offset:t-e};e=n}e:{...",
              "for(var e=window,t=J();t instanceof e.HTMLIFrameElement;){try{var n=\"string\"==typeof t.contentWindow..."
            ],
            "i": "micro-behaviors/data/control-flow/analysis::for-loop-ast",
            "l": 2,
            "el": [
              "embedded@0x851c:1:1027",
              "embedded@0x851c:1:927",
              "embedded@0x851c:1:1208",
              "embedded@0x851c:1:1108",
              "embedded@0x851c:1:1504"
            ]
          },
          {
            "c": 0.9700000286102295,
            "d": "Validation vocabulary object",
            "e": [
              "Object"
            ],
            "i": "metadata/file/text/format::vocab-object",
            "l": 1,
            "el": [
              "embedded@0x851c:unknown"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "JavaScript file under 5KB",
            "e": [
              "7377b7a3163111fc84b74fb76f4f674d301bfb8cfd4291242e476ec60f07ed1e.exe##plain@0x28c9d",
              "7377b7a3163111fc84b74fb76f4f674d301bfb8cfd4291242e476ec60f07ed1e.exe##plain@0x21a74",
              "7377b7a3163111fc84b74fb76f4f674d301bfb8cfd4291242e476ec60f07ed1e.exe##plain@0x851c"
            ],
            "i": "metadata/file/text/metrics::javascript-small-file-5k",
            "l": 1,
            "el": [
              "embedded@0x28c9d:unknown",
              "embedded@0x21a74:unknown",
              "embedded@0x851c:unknown"
            ]
          },
          {
            "c": 0.8500000238418579,
            "d": "High function density",
            "e": [
              "functions.density_per_100_lines = 2000.00",
              "functions.density_per_100_lines = 1200.00",
              "functions.density_per_100_lines = 700.00"
            ],
            "i": "metadata/file/text/metrics::high-function-density",
            "l": 2,
            "el": [
              "embedded@0x28c9d:unknown",
              "embedded@0x851c:unknown",
              "embedded@0x21a74:unknown"
            ]
          },
          {
            "c": 1.0,
            "d": "javascript code embedded in string",
            "e": [
              "82a179500bc4e9b76af627b21b995b8bbd33adc224391f1e7edd0a07f61844464925056111c0e7ac0295595a41a65657584780304d4548db20fa4ecffe6337df",
              "8da94a9a2fd2eb0674498e46903e842f25ae36a389cdad8dac4be25dc9b32db4d31ef675973a1b2b4b929feb3b893aec8c21b5befb48fb0a1a75927c348f7fcb",
              "8f36cad1e158c313d85f065a64f54163d459ef8e9ccf01a6120ff4d14f695f38597fa99985eca34f4e4fa2755fc288d34c3da4f9d9921c445e984e4a5fdb970d"
            ],
            "i": "metadata/lang/embedded::javascript",
            "l": 2,
            "el": [
              "embedded@0x851c:0x851c",
              "embedded@0x21a74:0x21a74",
              "embedded@0x28c9d:0x28c9d"
            ]
          },
          {
            "a": "T1071.001",
            "d": "httpRequest function reference",
            "e": [
              "httpRequest"
            ],
            "i": "micro-behaviors/communications/http/request/client::http-request-func",
            "l": 3,
            "m": "C0002",
            "el": [
              "embedded@0x21a74:unknown"
            ]
          },
          {
            "c": 0.6000000238418579,
            "d": "__esModule property",
            "e": [
              "__esModule"
            ],
            "i": "metadata/package/tooling::esmodule-export",
            "l": 1,
            "el": [
              "embedded@0x21a74:0x176"
            ]
          },
          {
            "c": 1.0,
            "d": "Plain JavaScript identifier assignment",
            "e": [
              "services=v;",
              "withStaticAppInfo=s;"
            ],
            "i": "metadata/lang/scripted::plain-js-identifier-assignment",
            "l": 1,
            "el": [
              "embedded@0x28c9d:unknown",
              "embedded@0x21a74:unknown"
            ]
          },
          {
            "c": 0.6000000238418579,
            "d": "Object.defineProperty call marker",
            "e": [
              "Object.defineProperty"
            ],
            "i": "metadata/lang/javascript-features::object-define-property",
            "l": 2,
            "el": [
              "embedded@0x21a74:0x15e"
            ]
          },
          {
            "c": 0.6000000238418579,
            "d": "use strict directive string",
            "e": [
              "use strict"
            ],
            "i": "metadata/package/tooling::use-strict-quote",
            "l": 1,
            "el": [
              "embedded@0x21a74:0x145"
            ]
          },
          {
            "c": 0.8500000238418579,
            "d": "JavaScript transpiler or minifier markers",
            "e": [
              "use strict",
              "__esModule"
            ],
            "i": "metadata/package/quality::terser-output",
            "l": 2,
            "el": [
              "embedded@0x21a74:0x145",
              "embedded@0x21a74:0x176"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "HTTP/HTTPS client request capability",
            "e": [
              "httpRequest",
              "\"method\""
            ],
            "i": "micro-behaviors/crypto/symmetric/aes/runtime-library::http-client-comp",
            "l": 1,
            "el": [
              "embedded@0x21a74:unknown",
              "embedded@0x28c9d:unknown"
            ]
          },
          {
            "c": 0.4000000059604645,
            "d": "\"hostname\" word — composite-only fragment",
            "e": [
              "hostname"
            ],
            "i": "objectives/discovery/system/profile::host-profile-hostname-field",
            "l": 1,
            "el": [
              "embedded@0x28c9d:unknown"
            ]
          },
          {
            "a": "T1027",
            "c": 0.9300000071525574,
            "d": "Regex component marker",
            "e": [
              ").join"
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-split-then-decode--rx-3",
            "l": 1,
            "m": "B0032",
            "el": [
              "embedded@0x28c9d:unknown"
            ]
          },
          {
            "c": 0.30000001192092896,
            "d": "HTTP configuration field (method)",
            "e": [
              "\"method\""
            ],
            "i": "micro-behaviors/communications/http/request/client::http-config-method",
            "l": 2,
            "el": [
              "embedded@0x28c9d:unknown"
            ]
          },
          {
            "c": 1.0,
            "d": "Symbol constructor usage marker",
            "e": [
              "Symbol"
            ],
            "i": "metadata/lang/javascript-features::has-symbols-base",
            "l": 2,
            "el": [
              "embedded@0x28c9d:0x26b"
            ]
          },
          {
            "c": 0.550000011920929,
            "d": "Array element swap pattern",
            "e": [
              "let r=n;void 0===r[C]\u0026\u0026(r=(0,u.set)(C,n.query||\"\")(r));const[o,i,a]="
            ],
            "i": "objectives/anti-static/obfuscation/string/encoding::js-array-swap",
            "l": 1,
            "m": "B0032",
            "el": [
              "embedded@0x28c9d:unknown"
            ]
          },
          {
            "c": 1.0,
            "d": "\"Environment\" keyword",
            "e": [
              "environment"
            ],
            "i": "micro-behaviors/data/text/keywords/env::environment-keyword",
            "l": 1,
            "el": [
              "embedded@0x28c9d:unknown"
            ]
          },
          {
            "c": 0.9700000286102295,
            "d": "Validation vocabulary boolean",
            "e": [
              "Boolean"
            ],
            "i": "metadata/file/text/format::vocab-boolean",
            "l": 1,
            "el": [
              "embedded@0x28c9d:unknown"
            ]
          },
          {
            "a": "T1027",
            "c": 0.9300000071525574,
            "d": "Regex component marker",
            "e": [
              ").join"
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-decode-then-reverse-split--rx-8",
            "l": 1,
            "m": "B0032",
            "el": [
              "embedded@0x28c9d:unknown"
            ]
          },
          {
            "c": 0.8399999737739563,
            "d": "Regex component marker",
            "e": [
              "join("
            ],
            "i": "micro-behaviors/fs/file/read::require-cwd-package-json--rx-4",
            "l": 1,
            "el": [
              "embedded@0x28c9d:unknown"
            ]
          },
          {
            "a": "T1027",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              ").join"
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-then-eval--rx-12",
            "l": 1,
            "m": "B0032",
            "el": [
              "embedded@0x28c9d:unknown"
            ]
          },
          {
            "a": "T1539",
            "c": 0.75,
            "d": "Reads browser cookies via document.cookie",
            "e": [
              "document.cookie"
            ],
            "i": "micro-behaviors/communications/http/cookies::document-cookie-read",
            "l": 3,
            "m": "C0002",
            "el": [
              "embedded@0x28c9d:unknown"
            ]
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Many one-line source function definitions",
            "e": [
              "functions.one_liners = 20.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/functions::many-one-liner-functions",
            "l": 2,
            "m": "B0032",
            "el": [
              "embedded@0x28c9d:unknown"
            ]
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "Excessive single-character variable names (\u003e30%)",
            "e": [
              "identifiers.single_char_ratio = 0.44"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::excessive-single-char-vars",
            "l": 2,
            "m": "B0032",
            "el": [
              "embedded@0x28c9d:unknown"
            ]
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "7377b7a3163111fc84b74fb76f4f674d301bfb8cfd4291242e476ec60f07ed1e.exe"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "d": ".dll extension reference",
            "e": [
              ".dll"
            ],
            "i": "micro-behaviors/fs/path/extension::dll-dup",
            "l": 2,
            "el": [
              "0x1ca6"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE has few sections",
            "e": [
              "sections.count = 3.00"
            ],
            "i": "metadata/binary/layout::legacy-few-sections",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "flex word",
            "e": [
              "flex"
            ],
            "i": "objectives/impact/infect/lexicon::flex-word",
            "l": 1,
            "el": [
              "0xbf04"
            ]
          },
          {
            "c": 0.6000000238418579,
            "d": "Interceptor class reference",
            "e": [
              "….jsonResponse=t.responseInterceptor=t.onResponseError=t.onR…",
              "…(e(n)):e(n)));t.responseInterceptor=H;const B=e=\u003ee\u0026\u0026e.heade…"
            ],
            "i": "micro-behaviors/process/hook/interception::interceptor-class",
            "l": 1,
            "el": [
              "0x21a74",
              "0x259f2"
            ]
          },
          {
            "a": "T1552.001",
            "c": 0.30000001192092896,
            "d": "\"password\" keyword",
            "e": [
              "password"
            ],
            "i": "objectives/supply-chain/credential-theft/registry::settings-password-keyword",
            "l": 1,
            "el": [
              "0xb7c7"
            ]
          },
          {
            "c": 0.30000001192092896,
            "d": "HTTP configuration field (headers)",
            "e": [
              "\"headers\""
            ],
            "i": "micro-behaviors/communications/http/request/client::http-config-headers",
            "l": 2,
            "el": [
              "0x2db21"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE file uses .exe extension",
            "e": [
              "7377b7a3163111fc84b74fb76f4f674d301bfb8cfd4291242e476ec60f07ed1e.exe"
            ],
            "i": "metadata/binary/framework::exe-extension",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE has many readable strings",
            "e": [
              "binary.string_count = 256.00"
            ],
            "i": "metadata/binary/layout::many-readable-strings",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 1.0,
            "d": "Binary has normal code entropy (\u003e5.5)",
            "e": [
              "binary.code_entropy = 5.52"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1115",
            "c": 0.7599999904632568,
            "d": "Go binary clipboard string fragment",
            "e": [
              "…?e.clipboardData:window.clipboardData}})),Rn=mn(q({},bn,…",
              "…Data:function(e){return\"clipboardData\"in e?e.clipboardDa…",
              "…rn\"clipboardData\"in e?e.clipboardData:window.clipboardDa…",
              "…ent:0})),Pn=mn(q({},bn,{clipboardData:function(e){return…"
            ],
            "i": "micro-behaviors/os/clipboard/access::go-clipboard-fragment",
            "l": 1,
            "el": [
              "0x10400",
              "0x10400",
              "0x10400",
              "0x10400"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard code/data section",
            "e": [
              ".data",
              ".text"
            ],
            "i": "metadata/binary/section/names::pe-code-data-standard-section",
            "l": 1
          },
          {
            "c": 0.6000000238418579,
            "d": "payload keyword",
            "e": [
              "payload"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::payload",
            "l": 1,
            "el": [
              "0xbf04"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "Hex-encoded data at file end",
            "e": [
              "8d2af23abb219747f3f26d1d866cd9767a024549d6dd0d4eceef72f132999b816a10bb31780b65acd31cba54e387a00de090778e6e85fa2fdb994ea6a9096095"
            ],
            "i": "objectives/anti-static/polyglot/format::appended-hex-blob",
            "l": 3,
            "el": [
              "0x33730"
            ]
          },
          {
            "c": 1.0,
            "d": "High-entropy ASLR (64-bit)",
            "e": [
              "[high_entropy_va, dynamic_base, nx_compat]"
            ],
            "i": "metadata/hardening/mitigation::pe-high-entropy-va",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "Duplicate object handle",
            "e": [
              "DuplicateHandle"
            ],
            "i": "micro-behaviors/communications/ipc/pipe::duplicate-handle",
            "l": 2,
            "el": [
              "0x3000"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "Binary has many sentence-like strings",
            "e": [
              "binary.sentence_string_ratio = 0.22"
            ],
            "i": "metadata/binary/metrics/threshold::rich-sentence-strings-20pct",
            "l": 1
          },
          {
            "c": 0.8500000238418579,
            "d": "Create named event object",
            "e": [
              "CreateEventW"
            ],
            "i": "micro-behaviors/process/sync/event::create-event",
            "l": 2,
            "m": "C0039",
            "el": [
              "0x3010"
            ]
          },
          {
            "a": "T1567",
            "c": 1.0,
            "d": "Regex component marker",
            "e": [
              "8e8f48c6b9b354dc04c449210f6282361a40eb102a3f3858a4f73a9fa9d1e260e923f457e812f383cab7a11437ac164839b0dbfda39094bcb2175f2096f9c7d7",
              "89cbc57d166b94a7f50ae6f6f14e811ecb2fb866a7b39e44f7552e79798135b2dc72e5da30e7031534e2000cce885706950193ddfedc4158a341d1b7dbc8e697"
            ],
            "i": "objectives/exfiltration/cloud/sync-tool::bulk-sensitive-server-data-path--rx-8",
            "l": 1,
            "el": [
              "0x337de",
              "0x2b594"
            ]
          },
          {
            "c": 1.0,
            "d": "Binary has 4 or fewer sections",
            "e": [
              "sections.count = 3.00"
            ],
            "i": "objectives/command-and-control/infrastructure/config::max-sections-4",
            "l": 1
          },
          {
            "a": "T1071.001",
            "c": 0.699999988079071,
            "d": "Network URL with domain name (binary)",
            "e": [
              "https://reactjs.org/",
              "http://fb.me/"
            ],
            "i": "objectives/command-and-control/infrastructure/domain/heuristic::http-url-binary",
            "l": 1,
            "m": "C0002",
            "el": [
              "0x17093",
              "0x2db21"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "CompanyName field absent from PE version info",
            "e": [
              "field 'pe.version.company' does not exist"
            ],
            "i": "metadata/binary/anomaly/format::version-info-company-name-absent",
            "l": 1,
            "el": [
              "value:pe.version.company"
            ]
          },
          {
            "a": "T1587.001",
            "c": 0.8999999761581421,
            "d": "Allocate virtual memory",
            "e": [
              "VirtualAlloc"
            ],
            "i": "micro-behaviors/mem/protect/modify::virtual-alloc",
            "l": 2,
            "el": [
              "0x3028"
            ]
          },
          {
            "a": "T1555",
            "c": 0.4000000059604645,
            "d": "browser wallet context",
            "e": [
              "browser-extension"
            ],
            "i": "objectives/credential-access/wallet/mnemonic::browser-word",
            "l": 1,
            "m": "B0028",
            "el": [
              "0xbf04"
            ]
          },
          {
            "c": 1.0,
            "d": "OpenProcess/NtOpenProcess symbol",
            "e": [
              "OpenProcess"
            ],
            "i": "objectives/evasion/fileless/memory::open-process-sym",
            "l": 1,
            "el": [
              "0x3020"
            ]
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Code section dominates file layout",
            "e": [
              "binary.largest_section_ratio = 0.96"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.6000000238418579,
            "d": "Clipboard keyword",
            "e": [
              "…?e.clipboardData:window.clipboardData}})),Rn=mn(q({},bn,{…",
              "…ent:0})),Pn=mn(q({},bn,{clipboardData:function(e){return\"…",
              "…rn\"clipboardData\"in e?e.clipboardData:window.clipboardDat…",
              "…Data:function(e){return\"clipboardData\"in e?e.clipboardDat…"
            ],
            "i": "micro-behaviors/data/text/keywords/clipboard::clipboard-token",
            "l": 1,
            "el": [
              "0x10400",
              "0x10400",
              "0x10400",
              "0x10400"
            ]
          },
          {
            "c": 0.6000000238418579,
            "d": "typeof( call reference",
            "e": [
              "…,i,a){return\"function\"==typeof(e=e.stateNode).shouldCom…",
              "…moizedState;\"function\"==typeof(i=t.getDerivedStateFromP…",
              "…if(null==(d=\"function\"==typeof(h=m.payload)?h.call(p,f,…",
              "…){case 1:if(\"function\"==typeof(h=m.payload)){f=h.call(p…"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/invoke::typeof-call",
            "l": 1,
            "el": [
              "0x2941b",
              "0x8d07",
              "0xbf04",
              "0xbf04"
            ]
          },
          {
            "c": 0.30000001192092896,
            "d": "secret keyword",
            "e": [
              "…,n){\"use strict\";var r=\"SECRET_DO_NOT_PASS_THIS_OR_YOU…"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::secret",
            "l": 1,
            "el": [
              "0x2db21"
            ]
          },
          {
            "a": "T1106",
            "c": 0.949999988079071,
            "d": "Open process handle",
            "e": [
              "OpenProcess"
            ],
            "i": "micro-behaviors/process/create/spawn::open-process",
            "l": 2,
            "el": [
              "0x3020"
            ]
          },
          {
            "c": 0.30000001192092896,
            "d": "HTTP configuration field (body)",
            "e": [
              "\"body\""
            ],
            "i": "micro-behaviors/communications/http/request/client::http-config-body",
            "l": 2,
            "el": [
              "0x2db21"
            ]
          },
          {
            "c": 0.20000000298023224,
            "d": "rust binary fs module vocabulary",
            "e": [
              "services"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::rust-bin-fs-vocab",
            "l": 1,
            "el": [
              "0x21a74"
            ]
          },
          {
            "a": "T1106",
            "c": 0.8999999761581421,
            "d": "Open process handle",
            "e": [
              "OpenProcess"
            ],
            "i": "micro-behaviors/process/create/spawn::open-process-string",
            "l": 2,
            "el": [
              "0x1e9c"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "Low-entropy rdata section",
            "e": [
              ".rdata (entropy: 3.20)"
            ],
            "i": "metadata/binary/section/metrics::low-entropy-rdata-section",
            "l": 1
          },
          {
            "a": "T1562.001",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "85fc1a252ddec11365b821e20f9dd8be268525f5aaf7b87fec68f7f2878daa29f34da14ba2d99a729341418ecf79f59ae89ab6cdfdb702b9cf634512a911aba9",
              "871d6ab6ace45fc38965ecbceaf8218d6dffeb7424dbd50568311af009a05e56a9ff5ef0e1f39690e97fae64d39c231b81fedbf6437219b0298c9b9c36cf59aa",
              "83b3a31825d38ed550ecd8a1b166b8441d203ed45651bb3a29346b0417b61bd3a1d0ce52edeb5cd0ec66bc47a2c8cd756a5d70bb022e4ffa3f6fec8e37676451",
              "8a0446ac0f24ffe169b2d54ebb3c577a240d91836bcb8b72549c44fa3a0ff386ae67bfb11295b52c0e8cb6cdafa1d31eb8bee3e993d9b76043ad19827b896e1e",
              "8ba450d1d8ff3176564e4cbaec5f7a9cc9effd62e3c1f759bdb485f484c095cf6a23697f5b5912df92a60f7c6b6d40bcaa787489167354859cbf0f88f03b10b8",
              "8a281116297cde79352c5e022786bf2b743557ffc71d18178149f0adf12fec45ee944a782fbf579decc0ccc2437a684d07f84c72050c4b003785054b52214787",
              "8fa79d4667efe27f8a3b88596e57666f22cdb0dc172f07bee75a1a5e49e6b78146f01a2b79dfa91bfff5c931abd9c0cff96ce32b54ea02e1f4cc6253200de376",
              ":case\"submit\":case\"touchcancel\":case\"touchend\":case\"touchstart\":case\"volumechange\":case\"change\":case\"selectionchange\":case\"textI",
              "8628b7e7860c02370f2f59340520f8804b66a868f42340b3d67a4fb092571969d6c6c1ec41708d85402ce9ffede7c7902a74e6f8183f721818ae0b63fa975969",
              "8204c5c68d13e942579822c5f9b1e7cc5b93c9f133dc3429aecb40323fab59846b71b5ef8f22a2f9d3dc1cd5c1fe338376bcd88aecbf1a0759cdadd2aee5238d",
              "8923541cf70f0e2a42b38bbf7374ce0ae96ae62e2b8debcae4759dcfdc2337f6c6ff106c315368000d39d71c6b3a8d2955e313000c57aa65a192174742018aaa",
              "828c1ab0aaea4d57c8e77e2ed3c10f150e2082aa2d6d1b9c9efdd77f754f946ff654db4599150dd0ef06faadea6945ec20b7fa4b2c1218a045d7d3665b717ab5",
              "82a179500bc4e9b76af627b21b995b8bbd33adc224391f1e7edd0a07f61844464925056111c0e7ac0295595a41a65657584780304d4548db20fa4ecffe6337df",
              "87e559684251d92e175e03353095b6fa5292ea8b3ae83ccf8b9ac2388c91a9f626c188ef17bbbe3e930985bacc8b7b027474d41a587435034211f5df378880cc",
              "87893f1a9b38b71a7b4fae04304903ac245d990fc6c2679455545efb643fb6661ea0e69d433d272328b5685fcef5192aa9a1dbb06bb85e5bdff11a7f842e3e8f",
              "8da94a9a2fd2eb0674498e46903e842f25ae36a389cdad8dac4be25dc9b32db4d31ef675973a1b2b4b929feb3b893aec8c21b5befb48fb0a1a75927c348f7fcb"
            ],
            "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3",
            "l": 1,
            "m": "B0047",
            "el": [
              "0x8d07",
              "0xbf04",
              "0xb08a",
              "0x1cd8d",
              "0x1aa0a",
              "0x10400",
              "0xa89f",
              "0x7160",
              "0x240af",
              "0xf586",
              "0x15adc",
              "0x16219",
              "0x851c",
              "0xb7c7",
              "0x18069",
              "0x21a74"
            ]
          },
          {
            "c": 1.0,
            "d": "DEP / NX enabled (NX_COMPAT)",
            "e": [
              "[high_entropy_va, dynamic_base, nx_compat]"
            ],
            "i": "metadata/hardening/mitigation::pe-dep",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "c": 1.0,
            "d": "ASLR enabled (DYNAMIC_BASE)",
            "e": [
              "[high_entropy_va, dynamic_base, nx_compat]"
            ],
            "i": "metadata/hardening/mitigation::pe-aslr",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "Regex component marker",
            "e": [
              "81120915b38e8b751c874cb0e399d5a9632bae67fcbb8284902f99771b4f5ad78ea9c786beda4b76868d52c3228ef9f89dead8c24c66b4e695923cab1e532efd",
              "8659e49ec2e7d991fc2f4a4777f0698a402b28713b8fcb1e685dcfec2ff3ee814672122631f4c2c33cca05c81a2bff28c7ccedfd4901173bd862715a66ed63c0"
            ],
            "i": "micro-behaviors/communications/http/client/managed::webclient--rx-2",
            "l": 1,
            "el": [
              "0x2db21",
              "0x24c26"
            ]
          },
          {
            "c": 0.8500000238418579,
            "d": "Wait on multiple handles extended",
            "e": [
              "WaitForMultipleObjectsEx"
            ],
            "i": "micro-behaviors/process/sync/semaphore::wait-for-multiple-objects-ex",
            "l": 2,
            "m": "C0042",
            "el": [
              "0x3008"
            ]
          },
          {
            "d": "overflow keyword",
            "e": [
              "…t)\u0026\u0026(n=null!==ui?{id:si,overflow:li}:null,e.memoizedStat…"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::overflow",
            "l": 1,
            "el": [
              "0x2db21"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Close handle",
            "e": [
              "CloseHandle"
            ],
            "i": "micro-behaviors/process/create/spawn::close-handle-dup",
            "l": 2,
            "el": [
              "0x1e3a"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard runtime section",
            "e": [
              ".rdata"
            ],
            "i": "metadata/binary/section/names::pe-runtime-standard-section",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Regex component marker",
            "e": [
              "8fa79d4667efe27f8a3b88596e57666f22cdb0dc172f07bee75a1a5e49e6b78146f01a2b79dfa91bfff5c931abd9c0cff96ce32b54ea02e1f4cc6253200de376",
              "87893f1a9b38b71a7b4fae04304903ac245d990fc6c2679455545efb643fb6661ea0e69d433d272328b5685fcef5192aa9a1dbb06bb85e5bdff11a7f842e3e8f",
              "82a179500bc4e9b76af627b21b995b8bbd33adc224391f1e7edd0a07f61844464925056111c0e7ac0295595a41a65657584780304d4548db20fa4ecffe6337df",
              "85fc1a252ddec11365b821e20f9dd8be268525f5aaf7b87fec68f7f2878daa29f34da14ba2d99a729341418ecf79f59ae89ab6cdfdb702b9cf634512a911aba9",
              "8ba450d1d8ff3176564e4cbaec5f7a9cc9effd62e3c1f759bdb485f484c095cf6a23697f5b5912df92a60f7c6b6d40bcaa787489167354859cbf0f88f03b10b8",
              "8a08cd1c22dc4f418e8270b3916d44c135861189f592d50573797abb25fa99124c96893df2896405499ef6319c052d94fefacab641584af07e22b07eb59519aa",
              "8204c5c68d13e942579822c5f9b1e7cc5b93c9f133dc3429aecb40323fab59846b71b5ef8f22a2f9d3dc1cd5c1fe338376bcd88aecbf1a0759cdadd2aee5238d",
              "871d6ab6ace45fc38965ecbceaf8218d6dffeb7424dbd50568311af009a05e56a9ff5ef0e1f39690e97fae64d39c231b81fedbf6437219b0298c9b9c36cf59aa",
              "828c1ab0aaea4d57c8e77e2ed3c10f150e2082aa2d6d1b9c9efdd77f754f946ff654db4599150dd0ef06faadea6945ec20b7fa4b2c1218a045d7d3665b717ab5",
              "8a0446ac0f24ffe169b2d54ebb3c577a240d91836bcb8b72549c44fa3a0ff386ae67bfb11295b52c0e8cb6cdafa1d31eb8bee3e993d9b76043ad19827b896e1e",
              "8f36cad1e158c313d85f065a64f54163d459ef8e9ccf01a6120ff4d14f695f38597fa99985eca34f4e4fa2755fc288d34c3da4f9d9921c445e984e4a5fdb970d",
              ":case\"submit\":case\"touchcancel\":case\"touchend\":case\"touchstart\":case\"volumechange\":case\"change\":case\"selectionchange\":case\"textI",
              "8923541cf70f0e2a42b38bbf7374ce0ae96ae62e2b8debcae4759dcfdc2337f6c6ff106c315368000d39d71c6b3a8d2955e313000c57aa65a192174742018aaa",
              "8566185a3ad3114c0e6dd8da2c82d875773c7b4d6c39ed8445a74c04473b5c2ddb1eeb0b4a3a953956237867e3abca938650a96389e1b335a29fa3c3ffec04bb",
              "8ac6e4eada3baab60d5d85a6a2cf51f1e75588db95b954eb2c2ce3badcd043d27fbc622384b6c3d333b642a64ce93c87734e7e8787af8767b46106c7dafd31ed",
              "8fb77cc095ba4c82334bf1ca8be8ffad34b5103be0ecf1e3ec6e76ad24cc1f2d80b502057e9196d7e118ddaac6564264991a0c13f9b6e559539f774787902f5a"
            ],
            "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7",
            "l": 1,
            "el": [
              "0xa89f",
              "0x18069",
              "0x851c",
              "0x8d07",
              "0x1aa0a",
              "0x17093",
              "0xf586",
              "0xbf04",
              "0x16219",
              "0x1cd8d",
              "0x28c9d",
              "0x7160",
              "0x15adc",
              "0x259f2",
              "0x23972",
              "0x2941b"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE has under ten imports",
            "e": [
              "imports.count = 7.00"
            ],
            "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10",
            "l": 1
          },
          {
            "a": "T1071.001",
            "c": 0.800000011920929,
            "d": "Auth-like constant assignment",
            "e": [
              "UNAUTHORIZED_MESSAGE="
            ],
            "i": "micro-behaviors/communications/http/headers::auth-like-constant-assignment",
            "l": 1,
            "m": "C0002",
            "el": [
              "0x2db21"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "payload request parameter",
            "e": [
              "payload="
            ],
            "i": "micro-behaviors/communications/http/request/params::payload-param",
            "l": 1,
            "m": "C0002",
            "el": [
              "0x2941b"
            ]
          },
          {
            "a": "T1553.002",
            "c": 0.8500000238418579,
            "d": "PE lacks VS_VERSION_INFO resource",
            "e": [
              "field 'pe.version.file_version' does not exist"
            ],
            "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource",
            "l": 1,
            "el": [
              "value:pe.version.file_version"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "Regex component marker",
            "e": [
              "81120915b38e8b751c874cb0e399d5a9632bae67fcbb8284902f99771b4f5ad78ea9c786beda4b76868d52c3228ef9f89dead8c24c66b4e695923cab1e532efd",
              "8566185a3ad3114c0e6dd8da2c82d875773c7b4d6c39ed8445a74c04473b5c2ddb1eeb0b4a3a953956237867e3abca938650a96389e1b335a29fa3c3ffec04bb"
            ],
            "i": "micro-behaviors/communications/http/client/managed::webclient--rx-6",
            "l": 1,
            "el": [
              "0x2db21",
              "0x259f2"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "Crack and serial lure names set A3",
            "e": [
              "keygen"
            ],
            "i": "micro-behaviors/fs/path/application/p2p::deceptive-lure-names-a3",
            "l": 1,
            "el": [
              "0xbf04"
            ]
          },
          {
            "d": "password keyword",
            "e": [
              "…e37ba2ed6ba84bae9e9be||\"password\"===e.type)||\"textarea\"=…"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::password",
            "l": 1,
            "el": [
              "0xb7c7"
            ]
          },
          {
            "a": "T1027",
            "c": 0.8399999737739563,
            "d": "VB6 PE with three sections",
            "e": [
              "sections.count = 3.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "Get current process ID",
            "e": [
              "GetCurrentProcessId"
            ],
            "i": "micro-behaviors/process/info/thread::get-current-process-id",
            "l": 2,
            "el": [
              "0x3018"
            ]
          },
          {
            "c": 0.4000000059604645,
            "d": "XMLHttpRequest API reference",
            "e": [
              "…t)(\"Request\",e.Request||XMLHttpRequest)(e)):(0,r.set)(\"Request…",
              "…meRequest\u0026\u0026window.iframeXMLHttpRequestPromise;if(!(t||n))retur…",
              "…t)(a)};t.maybeWithIframeXMLHttpRequest=c;const f=e=\u003enew Promis…",
              "…rnalResponse instanceof XMLHttpRequest?(0,o.buildResponse)(e.e…",
              "…(\"Request\",window.iframeXMLHttpRequest)(a)};t.maybeWithIframeX…",
              "…{const n=new(e.Request||XMLHttpRequest);if(e.error){t((0,o.wit…",
              "…t)(\"Request\",e.Request||XMLHttpRequest)(e);const o=Object.assi…",
              "…meRequest\u0026\u0026window.iframeXMLHttpRequest\u0026\u0026window.apiIframe\u0026\u0026wind…",
              "…);return n?window.iframeXMLHttpRequestPromise.then(e=\u003e(0,r.set…",
              "…Called=t.maybeWithIframeXMLHttpRequest=void 0;var r=n(15),o=n(…"
            ],
            "i": "micro-behaviors/communications/http/request/client::xmlhttprequest-word",
            "l": 3,
            "el": [
              "0x2db21",
              "0x2db21",
              "0x2db21",
              "0x2db21",
              "0x2db21",
              "0x2db21",
              "0x2db21",
              "0x2db21",
              "0x2db21",
              "0x2db21"
            ]
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Oversized data section vs code",
            "e": [
              ".rdata+.data = 3375.0% of text (207360 / 6144 bytes)",
              ".data",
              ".rdata"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::oversized-data-section",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027.007",
            "c": 0.800000011920929,
            "d": "DLL name strings without LoadLibrary import",
            "e": [
              "imports.count = 7.00"
            ],
            "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::dll-names-no-loadlibrary",
            "l": 1,
            "m": "B0032.014"
          },
          {
            "a": "T1053.005",
            "c": 0.8799999952316284,
            "d": "Regex component marker",
            "e": [
              "85fc1a252ddec11365b821e20f9dd8be268525f5aaf7b87fec68f7f2878daa29f34da14ba2d99a729341418ecf79f59ae89ab6cdfdb702b9cf634512a911aba9",
              "8659e49ec2e7d991fc2f4a4777f0698a402b28713b8fcb1e685dcfec2ff3ee814672122631f4c2c33cca05c81a2bff28c7ccedfd4901173bd862715a66ed63c0",
              "871d6ab6ace45fc38965ecbceaf8218d6dffeb7424dbd50568311af009a05e56a9ff5ef0e1f39690e97fae64d39c231b81fedbf6437219b0298c9b9c36cf59aa",
              "8e8f48c6b9b354dc04c449210f6282361a40eb102a3f3858a4f73a9fa9d1e260e923f457e812f383cab7a11437ac164839b0dbfda39094bcb2175f2096f9c7d7"
            ],
            "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-5",
            "l": 1,
            "m": "F0012",
            "el": [
              "0x8d07",
              "0x24c26",
              "0xbf04",
              "0x337de"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Very low code-to-data ratio (large PE payload)",
            "e": [
              "binary.code_to_data_ratio = 0.03"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::low-code-to-data-ratio-pe",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8199999928474426,
            "d": "Packed loader largest section ratio above 0.65",
            "e": [
              "binary.largest_section_ratio = 0.96"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1587.001",
            "c": 0.8999999761581421,
            "d": "VirtualAlloc API string reference",
            "e": [
              "VirtualAlloc"
            ],
            "i": "micro-behaviors/mem/protect/modify::virtual-alloc-string",
            "l": 1,
            "el": [
              "0x1eaa"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "Encoded HTML tag fragment",
            "e": [
              "871d6ab6ace45fc38965ecbceaf8218d6dffeb7424dbd50568311af009a05e56a9ff5ef0e1f39690e97fae64d39c231b81fe..."
            ],
            "i": "objectives/anti-static/obfuscation/encoding/content::encoded-html-tag-fragment",
            "l": 1,
            "el": [
              "0xbf04"
            ]
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "Data section significantly larger than code",
            "e": [
              ".data",
              ".rdata",
              ".rdata+.data = 3375.0% of text (207360 / 6144 bytes)"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::data-section-dominant",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1105",
            "c": 0.800000011920929,
            "d": "Compact PE import table",
            "e": [
              "imports.count = 7.00"
            ],
            "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table",
            "l": 1,
            "m": "E1105"
          },
          {
            "c": 0.9900000095367432,
            "d": "Exactly seven imports",
            "e": [
              "imports.count = 7.00"
            ],
            "i": "well-known/malware/worm/mydoom::metric-import-count-7",
            "l": 1
          },
          {
            "a": "T1045",
            "c": 0.6000000238418579,
            "d": "Single section dominates file (packer",
            "e": [
              "binary.largest_section_ratio = 0.96"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics/shape::dominant-section",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.6000000238418579,
            "d": "Single section dominates file (packer)",
            "e": [
              "binary.largest_section_ratio = 0.96"
            ],
            "i": "metadata/binary/metrics/structural::dominant-section",
            "l": 3
          },
          {
            "a": "T1055",
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "imports.count = 7.00"
            ],
            "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571",
            "l": 1,
            "m": "C0041"
          },
          {
            "c": 0.949999988079071,
            "d": "Filename has EXE extension",
            "e": [
              "7377b7a3163111fc84b74fb76f4f674d301bfb8cfd4291242e476ec60f07ed1e.exe"
            ],
            "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe",
            "l": 1
          },
          {
            "c": 0.6000000238418579,
            "d": "Very few sections (merged/stripped)",
            "e": [
              "sections.count = 3.00"
            ],
            "i": "metadata/binary/metrics/structural::few-sections",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 0.8600000143051147,
            "d": "Dominant section for VB6 loader profile",
            "e": [
              "binary.largest_section_ratio = 0.96"
            ],
            "i": "objectives/anti-static/obfuscation/payload/string-sparse::dominant-text-layout-vb6",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8600000143051147,
            "d": "Long mixed-case identifiers cluster",
            "e": [
              "WaitForMultipleObjectsEx",
              "AnimationIteration",
              "GetCurrentProcessId",
              "ReactCurrentBatchConfig"
            ],
            "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers",
            "l": 1,
            "m": "B0032",
            "el": [
              "0x1e5a",
              "0x24c26",
              "0x1e86",
              "0x2db21"
            ]
          },
          {
            "a": "T1140",
            "c": 0.8500000238418579,
            "d": "Regex component marker",
            "e": [
              "payload"
            ],
            "i": "objectives/command-and-control/dropper/staging/encrypted::staged-payload-file-name--rx-1",
            "l": 1,
            "m": "B0023",
            "el": [
              "0xbf04"
            ]
          },
          {
            "a": "T1140",
            "c": 0.8500000238418579,
            "d": "Regex component marker",
            "e": [
              "8a0446ac0f24ffe169b2d54ebb3c577a240d91836bcb8b72549c44fa3a0ff386ae67bfb11295b52c0e8cb6cdafa1d31eb8bee3e993d9b76043ad19827b896e1e",
              "8c5246d0c82139d45761de4d690cd3de1487b97e617162552a0bfc50ed83a1ed80b6aa33051b20cbfdeb0088cdbddece682bf7fe81b39fd7623a7d50d2995132",
              "87893f1a9b38b71a7b4fae04304903ac245d990fc6c2679455545efb643fb6661ea0e69d433d272328b5685fcef5192aa9a1dbb06bb85e5bdff11a7f842e3e8f",
              "8f66def001a5df3478707f4f3495e478e20d55a2d4723b6e26708e5d757df2879e3286f72e64531cc8db2a620193b8c4f87d6886faa6f000711cf6aa4fb86c1b",
              "8a9440c2dcb03b407aaa4c430f03295d59d159cce68080f7e292a629df0c8ab58a65c6b679da1f219c63cc2b8820201f6519ebdbac0eb5e0958cb8fa96925e64",
              "83b3a31825d38ed550ecd8a1b166b8441d203ed45651bb3a29346b0417b61bd3a1d0ce52edeb5cd0ec66bc47a2c8cd756a5d70bb022e4ffa3f6fec8e37676451",
              "81120915b38e8b751c874cb0e399d5a9632bae67fcbb8284902f99771b4f5ad78ea9c786beda4b76868d52c3228ef9f89dead8c24c66b4e695923cab1e532efd"
            ],
            "i": "objectives/command-and-control/dropper/staging/encrypted::staged-payload-file-name--rx-2",
            "l": 1,
            "m": "B0023",
            "el": [
              "0x1cd8d",
              "0x2d3e4",
              "0x18069",
              "0x303d7",
              "0x2c618",
              "0xb08a",
              "0x2db21"
            ]
          },
          {
            "c": 0.75,
            "d": "Inline password token in lure",
            "e": [
              "password\"===e.type"
            ],
            "i": "objectives/lateral-movement/social-engineering/lures::inline-password-token",
            "l": 1,
            "el": [
              "0xb7c7"
            ]
          },
          {
            "a": "T1027",
            "c": 0.8500000238418579,
            "d": "Regex component marker",
            "e": [
              ".rdata",
              ".data",
              ".rdata+.data = 3375.0% of text (207360 / 6144 bytes)"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::large-encoded-config-section-cond-1--inline-29175",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "binary.largest_section_ratio = 0.96"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.9599999785423279,
            "d": "Regex component marker",
            "e": [
              ".rdata+.data = 3375.0% of text (207360 / 6144 bytes)",
              ".data",
              ".rdata"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::encrypted-loader-data-geometry-cond-1--inline-29194",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.949999988079071,
            "d": "links kernel32 (DuplicateHandle, WaitForMultipleObjectsEx, CreateEventW, GetCurrentProcessId, OpenProcess, ... +2 more)",
            "e": [
              "kernel32"
            ],
            "i": "metadata/dylib::kernel32",
            "l": 2,
            "el": [
              "7 symbols"
            ]
          },
          {
            "d": "HTTP configuration fields (method/body/headers)",
            "e": [
              "\"headers\"",
              "\"method\"",
              "\"body\""
            ],
            "i": "micro-behaviors/communications/http/request/client::http-config-fields",
            "l": 2,
            "el": [
              "0x2db21",
              "embedded@0x28c9d:unknown",
              "0x2db21"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Decoded unicode-escape content",
            "e": [
              "8a08cd1c22dc4f418e8270b3916d44c135861189 \u003cunicode-escape\u003e",
              "871d6ab6ace45fc38965ecbceaf8218d6dffeb74 \u003cunicode-escape\u003e"
            ],
            "i": "metadata/encoded-payload/unicode-escape",
            "l": 2,
            "el": [
              "offset:94355",
              "offset:48900"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Encoded payload detected: xor",
            "e": [
              "f5.77fff5dhzff4u/\"+\u003e}}yya5as/f4u://)29./ \u003cxor\u003e"
            ],
            "i": "metadata/encoded-payload/xor",
            "l": 3,
            "el": [
              "offset:70478"
            ]
          }
        ],
        "sha": "7377b7a3163111fc84b74fb76f4f674d301bfb8cfd4291242e476ec60f07ed1e",
        "path": "7377b7a3163111fc84b74fb76f4f674d301bfb8cfd4291242e476ec60f07ed1e.exe",
        "type": "pe"
      }
    ],
    "tv": "52045"
  }
}