{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8251519203186035, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8251519, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8251519, "class": 0 }, { "m": "az/native", "prob": 0.050485436, "class": 0 }, { "m": "az/pe", "prob": 0.044354837, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-30T16:13:38Z" }, "path": "7cb1cce5dc6c041af95951f20a11ee68fa6b657701c41972bcfca6e03f0ec9e4.exe", "raw": { "v": "5", "fs": [ { "f": "H(Po₂)Md(Bi)", "x": 7, "ff": { "i": [ [ "mfc42d", "ORDINAL 2104" ], [ "mfc42d", "ORDINAL 3366" ], [ "mfc42d", "ORDINAL 3826" ], [ "mfc42d", "ORDINAL 4239" ], [ "mfc42d", "ORDINAL 4215" ], [ "mfc42d", "ORDINAL 4408" ], [ "mfc42d", "ORDINAL 2340" ], [ "mfc42d", "ORDINAL 2481" ], [ "mfc42d", "ORDINAL 2584" ], [ "mfc42d", "ORDINAL 3691" ], [ "mfc42d", "ORDINAL 2473" ], [ "mfc42d", "ORDINAL 2585" ], [ "mfc42d", "ORDINAL 2341" ], [ "mfc42d", "ORDINAL 2432" ], [ "mfc42d", "ORDINAL 2339" ], [ "mfc42d", "ORDINAL 3143" ], [ "mfc42d", "ORDINAL 3144" ], [ "mfc42d", "ORDINAL 3142" ], [ "mfc42d", "ORDINAL 2431" ], [ "mfc42d", "ORDINAL 3367" ], [ "mfc42d", "ORDINAL 3784" ], [ "mfc42d", "ORDINAL 3657" ], [ "mfc42d", "ORDINAL 2021" ], [ "mfc42d", "ORDINAL 1285" ], [ "mfc42d", "ORDINAL 4492" ], [ "mfc42d", "ORDINAL 2986" ], [ "mfc42d", "ORDINAL 528" ], [ "mfc42d", "ORDINAL 728" ], [ "mfc42d", "ORDINAL 706" ], [ "mfc42d", "ORDINAL 684" ], [ "mfc42d", "ORDINAL 4792" ], [ "mfc42d", "ORDINAL 2168" ], [ "mfc42d", "ORDINAL 492" ], [ "mfc42d", "ORDINAL 1862" ], [ "mfc42d", "ORDINAL 2052" ], [ "mfc42d", "ORDINAL 574" ], [ "mfc42d", "ORDINAL 654" ], [ "mfc42d", "ORDINAL 4195" ], [ "mfc42d", "ORDINAL 3629" ], [ "mfc42d", "ORDINAL 3948" ], [ "mfc42d", "ORDINAL 4017" ], [ "mfc42d", "ORDINAL 3831" ], [ "mfc42d", "ORDINAL 4753" ], [ "mfc42d", "ORDINAL 3362" ], [ "mfc42d", "ORDINAL 1364" ], [ "mfc42d", "ORDINAL 3651" ], [ "mfc42d", "ORDINAL 4176" ], [ "mfc42d", "ORDINAL 1781" ], [ "mfc42d", "ORDINAL 4118" ], [ "mfc42d", "ORDINAL 5076" ], [ "mfc42d", "ORDINAL 3618" ], [ "mfc42d", "ORDINAL 4208" ], [ "mfc42d", "ORDINAL 2078" ], [ "mfc42d", "ORDINAL 1310" ], [ "mfc42d", "ORDINAL 3069" ], [ "mfc42d", "ORDINAL 3944" ], [ "mfc42d", "ORDINAL 3670" ], [ "mfc42d", "ORDINAL 2076" ], [ "mfc42d", "ORDINAL 1566" ], [ "mfc42d", "ORDINAL 4229" ], [ "mfc42d", "ORDINAL 3002" ], [ "mfc42d", "ORDINAL 4064" ], [ "mfc42d", "ORDINAL 1344" ], [ "mfc42d", "ORDINAL 4191" ], [ "mfc42d", "ORDINAL 1830" ], [ "mfc42d", "ORDINAL 1631" ], [ "mfc42d", "ORDINAL 4205" ], [ "mfc42d", "ORDINAL 3786" ], [ "mfc42d", "ORDINAL 3658" ], [ "mfc42d", "ORDINAL 1952" ], [ "mfc42d", "ORDINAL 1228" ], [ "mfc42d", "ORDINAL 2875" ], [ "mfc42d", "ORDINAL 317" ], [ "mfc42d", "ORDINAL 1857" ], [ "mfc42d", "ORDINAL 3524" ], [ "mfc42d", "ORDINAL 3432" ], [ "mfc42d", "ORDINAL 1087" ], [ "mfc42d", "ORDINAL 429" ], [ "mfc42d", "ORDINAL 1757" ], [ "mfc42d", "ORDINAL 4800" ], [ "mfc42d", "ORDINAL 4676" ], [ "mfc42d", "ORDINAL 880" ], [ "mfc42d", "ORDINAL 1212" ], [ "mfc42d", "ORDINAL 3355" ], [ "mfc42d", "ORDINAL 3447" ], [ "mfc42d", "ORDINAL 3070" ], [ "mfc42d", "ORDINAL 4053" ], [ "mfc42d", "ORDINAL 3960" ], [ "mfc42d", "ORDINAL 646" ], [ "mfc42d", "ORDINAL 1906" ], [ "mfc42d", "ORDINAL 3201" ], [ "mfc42d", "ORDINAL 5072" ], [ "mfc42d", "ORDINAL 2324" ], [ "mfc42d", "ORDINAL 454" ], [ "mfc42d", "ORDINAL 4475" ], [ "mfc42d", "ORDINAL 2993" ], [ "mfc42d", "ORDINAL 413" ], [ "mfc42d", "ORDINAL 3365" ], [ "mfc42d", "ORDINAL 1041" ], [ "mfc42d", "ORDINAL 721" ], [ "mfc42d", "ORDINAL 1446" ], [ "mfc42d", "ORDINAL 411" ], [ "mfc42d", "ORDINAL 730" ], [ "mfc42d", "ORDINAL 1024" ], [ "mfc42d", "ORDINAL 719" ], [ "mfc42d", "ORDINAL 1996" ], [ "mfc42d", "ORDINAL 1264" ], [ "mfc42d", "ORDINAL 410" ], [ "mfc42d", "ORDINAL 643" ], [ "mfc42d", "ORDINAL 1136" ], [ "mfc42d", "ORDINAL 4338" ], [ "mfc42d", "ORDINAL 1066" ], [ "mfc42d", "ORDINAL 2728" ], [ "mfc42d", "ORDINAL 2549" ], [ "mfc42d", "ORDINAL 2361" ], [ "mfc42d", "ORDINAL 644" ], [ "mfc42d", "ORDINAL 1122" ], [ "mfc42d", "ORDINAL 1190" ], [ "mfc42d", "ORDINAL 4227" ], [ "mfc42d", "ORDINAL 2661" ], [ "mfc42d", "ORDINAL 1789" ], [ "mfc42d", "ORDINAL 4130" ], [ "mfc42d", "ORDINAL 1033" ], [ "mfc42d", "ORDINAL 3231" ], [ "mfc42d", "ORDINAL 4415" ], [ "mfc42d", "ORDINAL 1860" ], [ "mfc42d", "ORDINAL 1880" ], [ "mfc42d", "ORDINAL 3702" ], [ "mfc42d", "ORDINAL 5077" ], [ "mfc42d", "ORDINAL 3552" ], [ "mfc42d", "ORDINAL 5078" ], [ "mfc42d", "ORDINAL 3803" ], [ "mfc42d", "ORDINAL 1100" ], [ "msvcrtd", "p__commode" ], [ "msvcrtd", "p__fmode" ], [ "msvcrtd", "set_app_type" ], [ "msvcrtd", "except_handler3" ], [ "msvcrtd", "controlfp" ], [ "msvcrtd", "getmainargs" ], [ "msvcrtd", "acmdln" ], [ "msvcrtd", "exit" ], [ "msvcrtd", "XcptFilter" ], [ "msvcrtd", "adjust_fdiv" ], [ "msvcrtd", "??1type_info@@UAE@XZ" ], [ "msvcrtd", "onexit" ], [ "msvcrtd", "dllonexit" ], [ "msvcrtd", "CrtDbgReport" ], [ "msvcrtd", "strcmp" ], [ "msvcrtd", "memset" ], [ "msvcrtd", "memcpy" ], [ "msvcrtd", "CxxThrowException" ], [ "msvcrtd", "CxxFrameHandler" ], [ "msvcrtd", "chkesp" ], [ "msvcrtd", "setmbcp" ], [ "msvcrtd", "setusermatherr" ], [ "msvcrtd", "exit" ], [ "msvcrtd", "initterm" ], [ "kernel32", "Sleep" ], [ "kernel32", "GetCurrentThread" ], [ "kernel32", "GetProcAddress" ], [ "kernel32", "GetModuleHandleA" ], [ "kernel32", "CloseHandle" ], [ "kernel32", "WriteFile" ], [ "kernel32", "CreateFileA" ], [ "kernel32", "ExitProcess" ], [ "kernel32", "CreateThread" ], [ "kernel32", "ResumeThread" ], [ "kernel32", "GetExitCodeThread" ], [ "kernel32", "GetStartupInfoA" ], [ "kernel32", "SetThreadPriority" ], [ "user32", "GetSystemMetrics" ], [ "shell32", "ShellExecuteA" ], [ "mfco42d", "ORDINAL 798" ] ], "m": { "pe": { "checksum": 0.0, "icon_count": 2.0, "has_overlay": 1.0, "overlay_end": 180312.0, "overlay_size": 88.0, "checksum_valid": 0.0, "overlay_offset": 180224.0, "resource_count": 5.0, "overlay_padding": 88.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 202067.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "base_relocation_block_count": 9.0, "base_relocation_entry_count": 533.0 }, "file": { "size": 180312.0, "entropy": 2.88, "size_bytes": 180312.0 }, "binary": { "is_pie": 0.0, "has_overlay": 1.0, "code_entropy": 1.86, "data_entropy": 3.94, "overlay_size": 88.0, "string_count": 754.0, "overlay_ratio": 0.0, "overlay_entropy": 5.49, "entropy_variance": 0.68, "avg_string_length": 7.96, "max_string_length": 56.0, "code_to_data_ratio": 0.59, "string_length_stddev": 5.9, "largest_section_ratio": 0.52, "sentence_string_count": 2.0, "sentence_string_ratio": 0.0, "high_entropy_string_count": 0.0 }, "imports": { "count": 173.0 }, "sections": { "count": 6.0, "code_size": 94208.0, "entropy_max": 3.98, "entropy_mean": 2.66, "name_entropy": 3.24, "writable_count": 2.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 6.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 224, "u8", "Rich" ], [ 504, "u8", ".text" ], [ 583, "u8", "@.data" ], [ 624, "u8", ".idata" ], [ 664, "u8", ".rsrc" ], [ 703, "u8", "@.reloc" ], [ 4741, "u8", "DSVWQ" ], [ 5386, "u8", "TSVW" ], [ 5653, "u8", "DSVW" ], [ 5980, "stack", "LoadLibraryAKERNEL32.dll" ], [ 6514, "stack", "GetProcessHeapKERNEL32.dll" ], [ 6613, "stack", "HeapReAlloc" ], [ 6682, "stack", "HeapAlloc" ], [ 7036, "stack", "GetProcessHeapKERNEL32.dll" ], [ 7117, "stack", "HeapFree" ], [ 7378, "stack", "VirtualAllocKERNEL32.dll" ], [ 7451, "stack", "GetProcessHeap" ], [ 7550, "stack", "HeapAlloc" ], [ 8604, "stack", "VirtualAllocKERNEL32.dll" ], [ 9186, "stack", "VirtualFreeKERNEL32.dll" ], [ 9255, "stack", "VirtualProtect" ], [ 9950, "u8", "N444" ], [ 10370, "stack", "IsBadReadPtrKERNEL32.dll" ], [ 10461, "stack", "LoadLibraryA" ], [ 11342, "u8", "K444" ], [ 11810, "stack", "FreeLibraryKERNEL32.dll" ], [ 11879, "stack", "VirtualFree" ], [ 11966, "stack", "GetProcessHeap" ], [ 12047, "stack", "HeapFree" ], [ 12613, "u8", "HSVW" ], [ 12837, "u8", "LSVW" ], [ 13374, "u8", "SVWQ" ], [ 13483, "stack", "ShellexAVP.EXE" ], [ 14986, "u8", "LSVWQ" ], [ 16362, "u8", "XSVWQ" ], [ 16383, "u8", "J444" ], [ 16565, "u8", "HSVWQ" ], [ 17690, "u8", "TSVWQ" ], [ 20851, "u8", "QSVW" ], [ 98600, "u8", "thread no %d says %d now" ], [ 98632, "u8", "Open" ], [ 98640, "u8", "tg://setlanguage?lang=classic-zh-cn" ], [ 99460, "u8", "scbThreadCareTaker_IsValid_Failed" ], [ 99538, "u8", "\\code\\ThreadManager.cpp" ], [ 99576, "u8", "ThreadTask::GetThreadTask().IsValid()" ], [ 99660, "u8", "CHandle" ], [ 104006, "u8", "\\code\\testmanagerthread.cpp" ], [ 104076, "u8", "1s7NycbizMzgx8bWzM3UjdDMyq8=" ], [ 104180, "u8", "8NPS1dTHrw==" ], [ 104230, "u8", "8NPS1dTHj+nIy8rNzN/ejwDj4uXk19bOj/DT0tWv" ], [ 104280, "u8", "8NPS1dTHxsmP68rNzN/e4eDjjwXk19bO0dCP8tXUx8bJyMuP7czfrw==" ], [ 109104, "u8", "wPhb" ], [ 109301, "u8", "ooo3t" ], [ 109351, "u8", "rsE{\\AACFG{ah" ], [ 109450, "u8", "hzooo5" ], [ 109519, "u8", "E{\\AACFG{ah" ], [ 109626, "u8", "noo5" ], [ 109772, "u8", "yMlh" ], [ 109799, "u8", "hhloo}5Lnoov" ], [ 110113, "u8", "3xoy" ], [ 110266, "u8", "CCCF" ], [ 110322, "u8", "Hw5lnoo" ], [ 110359, "u8", "}%lnooI}-xmoocU" ], [ 110375, "u8", "f}5xmooFFFPFo" ], [ 110407, "u8", "noFPh" ], [ 110450, "u8", "noGPh" ], [ 110597, "u8", "looo" ], [ 110649, "u8", "joo3x" ], [ 110660, "u8", "hEloo" ], [ 111263, "u8", "gooo" ], [ 111307, "u8", "iooo" ], [ 111320, "u8", "goo3" ], [ 111460, "u8", "ooo3" ], [ 111928, "u8", "GGGC" ], [ 112640, "u8", "Ulnoo" ], [ 112818, "u8", "hanoo3t" ], [ 113028, "u8", "sF.d" ], [ 113415, "u8", "P}5lnooP}5lnoo" ], [ 113537, "u8", "ooow5" ], [ 113710, "u8", "eP}5 mooGPo" ], [ 113746, "u8", "IICF}5TnooCP" ], [ 113856, "u8", "looCc" ], [ 113869, "u8", "looCP" ], [ 113919, "u8", "looPo" ], [ 114067, "u8", "8PCCCCC}5TnooCPCo" ], [ 114531, "u8", "xoo3t" ], [ 114560, "u8", "noo1vg" ], [ 114573, "u8", "IIONK" ], [ 114605, "u8", "mooFPhe" ], [ 114633, "u8", "nooIc" ], [ 114684, "u8", "noo1v" ], [ 114723, "u8", "mooPh" ], [ 114784, "u8", "nooPo" ], [ 114833, "u8", "nooPh" ], [ 114839, "u8", "kooII" ], [ 114846, "u8", "XONK" ], [ 114892, "u8", "looc" ], [ 114972, "u8", "IIN5" ], [ 115290, "u8", ",PFFFFF}5(nooFPFo" ], [ 115433, "u8", "PPPPPPFPw" ], [ 115611, "u8", "jooc" ], [ 115682, "u8", "noov" ], [ 115845, "u8", "xD}5 nooCPv" ], [ 115939, "u8", "mooo" ], [ 115975, "u8", "fPFFo" ], [ 116067, "u8", "giBo" ], [ 116201, "u8", "nooFPo" ], [ 116246, "u8", "mooPo" ], [ 116259, "u8", "oooPo" ], [ 116331, "u8", "nooo" ], [ 116448, "u8", "Zoov" ], [ 116531, "u8", "h4Zoo" ], [ 116811, "u8", "FPPPP" ], [ 117373, "u8", "jooPhpmoo3t" ], [ 117830, "u8", "FFPoA" ], [ 117949, "u8", "oF}5 nooGPy" ], [ 118017, "u8", "xP}5 nooPGo" ], [ 118161, "u8", "fP}5 nooPFo" ], [ 118306, "u8", "TPFFFFF}5 nooFPFo" ], [ 118529, "u8", "kooCc" ], [ 118587, "u8", "kooPTo" ], [ 118602, "u8", "kooo" ], [ 118760, "u8", "xlooc" ], [ 118769, "u8", "}5xnooBP}5xloo" ], [ 118849, "u8", "looII" ], [ 119294, "u8", "iGAFo" ], [ 119697, "u8", "Uxmoo" ], [ 119854, "u8", "lnooO" ], [ 119864, "u8", "mnooP}5dlooPh" ], [ 119951, "u8", "oooGo" ], [ 120026, "u8", "fFGhn" ], [ 120146, "u8", "hllooI" ], [ 120186, "u8", "sCEFG" ], [ 120385, "u8", "noow5" ], [ 120432, "u8", "nooPFh" ], [ 120488, "u8", "Pv5Lmoo" ], [ 120572, "u8", "OGFPh" ], [ 120640, "u8", "PhAgoo3t" ], [ 120652, "u8", "moow5" ], [ 120686, "u8", "ioo3t" ], [ 120782, "u8", "nooPh1" ], [ 120799, "u8", "oooPw" ], [ 120885, "u8", "nooh9cooy5|noohixooP}5\u0026mooPo" ], [ 120977, "u8", "ooONK" ], [ 121029, "u8", "hXmoo5" ], [ 121113, "u8", "looIP" ], [ 121152, "u8", "PhmkooIP" ], [ 121401, "u8", "loocU" ], [ 121519, "u8", "mooCPh" ], [ 121535, "u8", "mooFPCo" ], [ 121941, "u8", "mooFGPh" ], [ 121958, "u8", "mooFPGo" ], [ 122135, "u8", "v5tmoo" ], [ 122142, "u8", "v5umoo" ], [ 122149, "u8", "v5vmooLv5wmooGv5" ], [ 122208, "u8", "mooLv5" ], [ 122333, "u8", "mooy" ], [ 122338, "u8", "8looy" ], [ 122380, "u8", "CCCCC}5`mooP" ], [ 122421, "u8", "y58looGo" ], [ 122472, "u8", "4loo" ], [ 122491, "u8", "loow54loo" ], [ 122517, "u8", "looy" ], [ 122541, "u8", "loow5" ], [ 122557, "u8", "looy5" ], [ 122581, "u8", "o%8looo" ], [ 122607, "u8", "8loo" ], [ 122646, "u8", "y58loo" ], [ 122893, "u8", "Uxnoo" ], [ 123772, "u8", "xPFAo" ], [ 123806, "u8", "oooONK" ], [ 123846, "u8", "FCG3" ], [ 123865, "u8", "gqnooo" ], [ 124436, "u8", "83xo" ], [ 125861, "u8", "PPPPo" ], [ 126515, "u8", "nooI5" ], [ 126594, "u8", "yMxyM" ], [ 126740, "u8", "kooCPhr" ], [ 126770, "u8", "kooGAo" ], [ 127038, "u8", "xoEh" ], [ 127204, "u8", "PFoEx5" ], [ 127441, "u8", "y5 noo" ], [ 127469, "u8", "o% nooo" ], [ 127642, "u8", "moooE" ], [ 127659, "u8", "nooy" ], [ 127692, "u8", "mooPhJnooCFo" ], [ 127944, "u8", "tnooo%" ], [ 128956, "u8", "ooo5" ], [ 128972, "u8", "hoo3n" ], [ 128987, "u8", "GPChanoo5f" ], [ 129045, "u8", "ONKMr" ], [ 129213, "u8", "Yxloo" ], [ 129264, "u8", "Yuloo" ], [ 129277, "u8", "Y8loo" ], [ 130620, "u8", "oooopN" ], [ 133536, "u8", "GDCA" ], [ 137832, "u8", "CICD" ], [ 139847, "u8", "H9:;\u003c=\u003e?PABCDEFGXIJ" ], [ 140144, "u8", "qgq//c" ], [ 159230, "u8", "\\code\\testmanagerthreadDlg.cpp" ], [ 159394, "u8", "\\code\\ThreadTask.cpp" ], [ 159464, "u8", ".?AVtype_info@@" ], [ 159484, "u8", "appmodul.cpp" ], [ 166148, "u8", "MFC42D.DLL" ], [ 166162, "u8", "_chkesp" ], [ 166172, "u8", "__CxxFrameHandler" ], [ 166192, "u8", "_CxxThrowException" ], [ 166214, "u8", "memcpy" ], [ 166224, "u8", "memset" ], [ 166244, "u8", "_CrtDbgReport" ], [ 166258, "u8", "MSVCRTD.dll" ], [ 166272, "u8", "__dllonexit" ], [ 166286, "u8", "_onexit" ], [ 166296, "u8", "??1type_info@@UAE@XZ" ], [ 166328, "u8", "_XcptFilter" ], [ 166342, "u8", "exit" ], [ 166350, "u8", "_acmdln" ], [ 166360, "u8", "__getmainargs" ], [ 166376, "u8", "_initterm" ], [ 166388, "u8", "__setusermatherr" ], [ 166408, "u8", "_adjust_fdiv" ], [ 166424, "u8", "__p__commode" ], [ 166440, "u8", "__p__fmode" ], [ 166454, "u8", "__set_app_type" ], [ 166472, "u8", "_except_handler3" ], [ 166492, "u8", "_controlfp" ], [ 166506, "u8", "Sleep" ], [ 166514, "u8", "SetThreadPriority" ], [ 166534, "u8", "GetCurrentThread" ], [ 166554, "u8", "GetProcAddress" ], [ 166572, "u8", "GetModuleHandleA" ], [ 166592, "u8", "CloseHandle" ], [ 166606, "u8", "WriteFile" ], [ 166618, "u8", "CreateFileA" ], [ 166632, "u8", "ExitProcess" ], [ 166646, "u8", "CreateThread" ], [ 166662, "u8", "ResumeThread" ], [ 166678, "u8", "GetExitCodeThread" ], [ 166698, "u8", "GetStartupInfoA" ], [ 166714, "u8", "KERNEL32.dll" ], [ 166730, "u8", "GetSystemMetrics" ], [ 166748, "u8", "USER32.dll" ], [ 166762, "u8", "ShellExecuteA" ], [ 166776, "u8", "SHELL32.dll" ], [ 166788, "u8", "MFCO42D.DLL" ], [ 166802, "u8", "_setmbcp" ], [ 169252, "u8", "DDLLDDDL" ], [ 169268, "u8", "LLDDLD" ], [ 169302, "u8", "DDLDLD" ], [ 169316, "u8", "LDDDDDDD" ], [ 170006, "wide", "(C) 2002" ], [ 170224, "wide", "msctls_progress32" ], [ 170260, "wide", "Progress1" ], [ 170344, "wide", "Progress2" ], [ 170462, "wide", "VS_VERSION_INFO" ] ], "v": { "file.stem": "7cb1cce5dc6c041af95951f20a11ee68fa6b657701c41972bcfca6e03f0ec9e4", "pe.imphash": "5d758a6a81b7f7e256b104dd7c0e28c8", "pe.machine": "i386", "pe.rich.key": 320836991, "pe.rich.hash": "d062df1c95da52dd9212392965304aab", "pe.subsystem": "windows_gui", "pe.timestamp": 1687885221, "file.basename": "7cb1cce5dc6c041af95951f20a11ee68fa6b657701c41972bcfca6e03f0ec9e4.exe", "pe.image_base": 4194304, "pe.image_size": 180224, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.version.os": "unknown", "pe.entry_point": 20064, "pe.headers_size": 4096, "pe.version.type": "app", "pe.debug.pdb.age": 1, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.file_alignment": 4096, "pe.image_hash.sha1": "3029e857bb41334a6e8e6dbc63f144705762e070", "pe.version.flags[0]": "debug", "pe.image_hash.sha256": "534c3963aad3f61bc83d6a4da45150e750e5ec7bf6a36b769fa206c2f286e4e6", "pe.image_hash.sha384": "aa62bd1c95c5ec8aa70fe821b39be990d87bc2b8e8caf48e4d05fb669db7a2647a86fb8037dc57e1080e847f45648c2e", "pe.image_hash.sha512": "65af7d9f2438a4e59f4e4101a1c90c6e19a5206cdfd142836fd2299e47184c34c43168a912a680aea023d053571f4d979f9be57b92390d656e5b161fd20efe21", "pe.resource_types[0]": "RT_ICON", "pe.resource_types[1]": "RT_DIALOG", "pe.resource_types[2]": "RT_STRING", "pe.resource_types[3]": "RT_GROUP_ICON", "pe.resource_types[4]": "RT_VERSION", "pe.section_alignment": 4096, "pe.subsystem_version": "4.0", "pe.version.copyright": "版权所有 (C) 2002", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.characteristics_raw": 270, "pe.version.description": "testmanagerthread Microsoft 基础类应用程序", "pe.linker_major_version": 6, "pe.version.file_version": "1, 0, 0, 1", "pe.version.product_name": "testmanagerthread 应用程序", "build.toolchain.compiler": "msvc", "pe.debug.entries[0].type": "codeview", "pe.version.internal_name": "testmanagerthread", "pe.data_directories[0].rva": 163840, "pe.data_directories[1].rva": 167936, "pe.data_directories[2].rva": 176128, "pe.data_directories[3].rva": 98304, "pe.data_directories[4].rva": 165064, "pe.number_of_rva_and_sizes": 16, "pe.version.product_version": "1, 0, 0, 1", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 140, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 4198, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 1140, "pe.data_directories[3].name": "debug", "pe.data_directories[3].size": 28, "pe.data_directories[4].name": "iat", "pe.data_directories[4].size": 1084, "pe.debug.entries[0].type_id": 2, "pe.rich.entries[0].build_id": 93, "pe.rich.entries[1].build_id": 14, "pe.rich.entries[2].build_id": 11, "pe.rich.entries[3].build_id": 10, "pe.rich.entries[4].build_id": 4, "pe.rich.entries[5].build_id": 11, "pe.rich.entries[6].build_id": 4, "pe.rich.entries[7].build_id": 1, "pe.rich.entries[8].build_id": 11, "pe.rich.entries[9].build_id": 6, "pe.rich.entries[0].use_count": 6, "pe.rich.entries[1].use_count": 1, "pe.rich.entries[2].use_count": 1, "pe.rich.entries[3].use_count": 11, "pe.rich.entries[4].use_count": 2, "pe.rich.entries[5].use_count": 3, "pe.rich.entries[6].use_count": 5, "pe.rich.entries[7].use_count": 173, "pe.rich.entries[8].use_count": 5, "pe.rich.entries[9].use_count": 1, "pe.version.original_filename": "testmanagerthread.EXE", "pe.coff.dos_header_pe_pointer": 256, "pe.rich.entries[0].product_id": 4035, "pe.rich.entries[1].product_id": 7299, "pe.rich.entries[2].product_id": 8047, "pe.rich.entries[3].product_id": 8047, "pe.rich.entries[4].product_id": 8047, "pe.rich.entries[5].product_id": 9782, "pe.rich.entries[6].product_id": 9782, "pe.rich.entries[8].product_id": 8168, "pe.rich.entries[9].product_id": 1735, "pe.debug.entries[0].size_bytes": 88, "pe.base_relocations.block_count": 9, "pe.base_relocations.entry_count": 533, "pe.base_relocations.padding_count": 1, "pe.debug.entries[0].timestamp_unix": 1687885221 }, "id": "pe", "sc": [ [ ".text", 4096, 94208, 1.86, "r-x" ], [ ".rdata", 98304, 4096, 2.53, "r--" ], [ ".data", 102400, 61440, 3.98, "rw-" ], [ ".idata", 163840, 4096, 3.45, "rw-" ], [ ".rsrc", 167936, 8192, 1.62, "r--" ], [ ".reloc", 176128, 4096, 2.51, "r--" ] ] }, "id": 0, "sz": 180312, "ts": [ { "c": 0.699999988079071, "d": "GetCurrentThread API call", "e": [ "GetCurrentThread" ], "i": "micro-behaviors/process/info/current::get-current-thread", "l": 2, "el": [ "0x284cc" ] }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2, "el": [ "0x29a96" ] }, { "a": "T1129", "c": 0.949999988079071, "d": "Create thread in current process", "e": [ "CreateThread" ], "i": "micro-behaviors/process/thread/create::create-thread", "l": 2, "el": [ "0x284e8" ] }, { "c": 1.0, "d": "PE has RT_ICON in resources list", "e": [ "[RT_ICON, RT_DIALOG, RT_STRING, RT_GROUP_ICON, RT_VERSION]" ], "i": "metadata/binary/resource::pe-resource-icon-list", "l": 2, "el": [ "value:pe.resource_types" ] }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "1, 0, 0, 1" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.8999999761581421, "d": "Memory copy operation", "e": [ "memcpy" ], "i": "micro-behaviors/mem/c-runtime/functions::memcpy", "l": 2, "el": [ "0x28848" ] }, { "c": 0.8399999737739563, "d": "High PE import count", "e": [ "imports.count = 173.00" ], "i": "metadata/binary/section/metrics::high-import-count-pe", "l": 1 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "c": 0.8500000238418579, "d": "Raise thread execution priority", "e": [ "SetThreadPriority" ], "i": "micro-behaviors/process/thread/priority::set-thread-priority", "l": 3, "el": [ "0x284f8" ] }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2, "el": [ "0x284f4" ] }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "testmanagerthread.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024", "el": [ "0x2c036" ] }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "imports.count = 173.00" ], "i": "metadata/binary/metrics/threshold::many-imports-100", "l": 1 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032", "el": [ "0x299de" ] }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2, "el": [ "0x284c8" ] }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Windows GetProcAddress API string", "e": [ "GetProcAddress" ], "i": "micro-behaviors/dylib/lookup::get-proc-address-text", "l": 2, "el": [ "0x28a9a" ] }, { "c": 0.949999988079071, "d": "PE FileDescription field is populated", "e": [ "testmanagerthread Microsoft 基础类应用程序" ], "i": "metadata/package/versioning::pe-file-description-present", "l": 1, "el": [ "value:pe.version.description" ] }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "imports.count = 173.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "imports.count = 173.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "imports.count = 173.00" ], "i": "metadata/binary/metrics/structural::many-imports", "l": 2 }, { "a": "T1059.001", "c": 0.75, "d": "Execute shell command (ShellExecuteA)", "e": [ "ShellExecuteA" ], "i": "micro-behaviors/process/create/exec::shell-execute-a", "l": 3, "el": [ "0x288a4" ] }, { "c": 0.699999988079071, "d": "CreateThread API name reference", "e": [ "CreateThread" ], "i": "micro-behaviors/process/threading/create::create-thread-text", "l": 2, "el": [ "0x28af6" ] }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2, "el": [ "0x284d4" ] }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "imports.count = 173.00" ], "i": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "l": 1 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2, "el": [ "0x29bea" ] }, { "a": "T1014", "c": 0.9399999976158142, "d": "Regex component marker", "e": [ ".EXE" ], "i": "objectives/evasion/kernel-hide/rootkit::executable-read-patch-markers--rx-7", "l": 1, "el": [ "0x34ab" ] }, { "c": 0.800000011920929, "d": "Very low code entropy, minimal code", "e": [ "binary.code_entropy = 1.86" ], "i": "metadata/binary/resource::low-code-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "Memory fill operation", "e": [ "memset" ], "i": "micro-behaviors/mem/c-runtime/functions::memset", "l": 2, "el": [ "0x28844" ] }, { "c": 1.0, "d": "Reference to SHELL32.dll", "e": [ "SHELL32.dll" ], "i": "micro-behaviors/os/module/load::shell32-dll-reference", "l": 2, "el": [ "0x28b78" ] }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2, "el": [ "0x284e0" ] }, { "c": 0.8999999761581421, "d": "String comparison", "e": [ "strcmp" ], "i": "micro-behaviors/data/string/library::strcmp", "l": 2, "el": [ "0x28840" ] }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2, "el": [ "0x28ac0" ] }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".EXE" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047", "el": [ "0x34ab" ] }, { "c": 1.0, "d": "Reference to USER32.dll", "e": [ "USER32.dll" ], "i": "micro-behaviors/os/module/load::user32-dll-reference", "l": 2, "el": [ "0x28b5c" ] }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2, "el": [ "0x284e4" ] }, { "c": 0.800000011920929, "d": "Low-entropy rdata section", "e": [ ".rdata (entropy: 2.53)" ], "i": "metadata/binary/section/metrics::low-entropy-rdata-section", "l": 1 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "imports.count = 173.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2, "el": [ "0x29a76" ] }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "7cb1cce5dc6c041af95951f20a11ee68fa6b657701c41972bcfca6e03f0ec9e4.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "imports.count = 173.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 0.800000011920929, "d": "SetThreadPriority API string", "e": [ "SetThreadPriority" ], "i": "micro-behaviors/process/thread/priority::set-thread-priority-text", "l": 2, "el": [ "0x28a72" ] }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0x175c" ] }, { "c": 0.699999988079071, "d": "Query system metrics", "e": [ "GetSystemMetrics" ], "i": "micro-behaviors/ui/controls/widget::get-system-metrics", "l": 2, "el": [ "0x288d4" ] }, { "c": 1.0, "d": "PE has RT_GROUP_ICON in resources list", "e": [ "[RT_ICON, RT_DIALOG, RT_STRING, RT_GROUP_ICON, RT_VERSION]" ], "i": "metadata/binary/resource::pe-resource-group-icon-list", "l": 2, "el": [ "value:pe.resource_types" ] }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write/direct::write-file", "l": 2, "el": [ "0x284dc" ] }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc", ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2, "el": [ "0x29c3e" ] }, { "c": 0.949999988079071, "d": "PE ProductName field is populated", "e": [ "testmanagerthread 应用程序" ], "i": "metadata/package/versioning::pe-product-name-present", "l": 1, "el": [ "value:pe.version.product_name" ] }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "imports.count = 173.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 754.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.949999988079071, "d": "PE LegalCopyright field is populated", "e": [ "版权所有 (C) 2002" ], "i": "metadata/package/versioning::pe-legal-copyright-present", "l": 1, "el": [ "value:pe.version.copyright" ] }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2, "el": [ "0x29b3e" ] }, { "c": 0.800000011920929, "d": "Inline PE header walk sequence", "e": [ "42" ], "i": "micro-behaviors/data/embedded/payload/header::inline-pe-header-walk", "l": 1, "el": [ "0x1f2f" ] }, { "c": 1.0, "d": "PE has RT_DIALOG in resources list", "e": [ "[RT_ICON, RT_DIALOG, RT_STRING, RT_GROUP_ICON, RT_VERSION]" ], "i": "metadata/binary/resource::pe-resource-dialog-list", "l": 1, "el": [ "value:pe.resource_types" ] }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x29a3a" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".data", ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "7cb1cce5dc6c041af95951f20a11ee68fa6b657701c41972bcfca6e03f0ec9e4.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "a": "T1055", "c": 0.800000011920929, "d": "Dense INT3 breakpoint instructions", "e": [ "CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC" ], "i": "objectives/anti-static/obfuscation/binary-structure::int3-padding-text", "l": 1, "el": [ "0x1127" ] }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "sections.count = 6.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load/runtime::load-library-a-string-no-import", "l": 1, "el": [ "0x28dd" ] }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 5.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "a": "T1055", "c": 0.8999999761581421, "d": "ResumeThread API reference", "e": [ "ResumeThread" ], "i": "micro-behaviors/process/inject/runtime/call::resume-thread-dup", "l": 2, "el": [ "0x28b06" ] }, { "a": "T1222.001", "c": 0.8999999761581421, "d": "Hidden VirtualProtect string reference", "e": [ "VirtualProtect" ], "i": "micro-behaviors/mem/protect/modify::virtual-protect-text-pe", "l": 1, "el": [ "0x2427" ] }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2, "el": [ "0x28ada" ] }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "7cb1cce5dc6c041af95951f20a11ee68fa6b657701c41972bcfca6e03f0ec9e4.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1, "el": [ "0x75a0" ] }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2, "el": [ "0x284d0" ] }, { "a": "T1055", "c": 0.8500000238418579, "d": "Large null run in executable (64+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::large-null-run-text", "l": 1, "el": [ "0x75a0" ] }, { "c": 0.949999988079071, "d": "links kernel32 (Sleep, GetCurrentThread, GetProcAddress, GetModuleHandleA, CloseHandle, ... +8 more)", "e": [ "kernel32" ], "i": "metadata/dylib::kernel32", "l": 2, "el": [ "13 symbols" ] }, { "c": 0.949999988079071, "d": "links shell32 (ShellExecuteA)", "e": [ "shell32" ], "i": "metadata/dylib::shell32", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links mfco42d (ORDINAL 798)", "e": [ "mfco42d" ], "i": "metadata/dylib::mfco42d", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links mfc42d (ORDINAL 2104, ORDINAL 3366, ORDINAL 3826, ORDINAL 4239, ORDINAL 4215, ... +128 more)", "e": [ "mfc42d" ], "i": "metadata/dylib::mfc42d", "l": 2, "el": [ "133 symbols" ] }, { "c": 0.949999988079071, "d": "links msvcrtd (p__commode, p__fmode, set_app_type, except_handler3, controlfp, ... +19 more)", "e": [ "msvcrtd" ], "i": "metadata/dylib::msvcrtd", "l": 2, "el": [ "24 symbols" ] }, { "c": 0.949999988079071, "d": "links user32 (GetSystemMetrics)", "e": [ "user32" ], "i": "metadata/dylib::user32", "l": 2, "el": [ "1 symbols" ] }, { "a": "T1027", "c": 0.8500000238418579, "d": "Suspicious executable section padding", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::suspicious-padding", "l": 2, "el": [ "0x75a0" ] }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetModuleHandleA", "GetProcAddress" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2, "el": [ "0x284d4", "0x284d0" ] }, { "c": 0.8500000238418579, "d": "PE with version resource and broad imports", "e": [ "版权所有 (C) 2002", "imports.count = 173.00", "testmanagerthread 应用程序", "testmanagerthread Microsoft 基础类应用程序" ], "i": "metadata/binary/layout::import-rich-versioned-pe", "l": 2, "el": [ "value:pe.version.copyright", "", "value:pe.version.product_name", "value:pe.version.description" ] }, { "a": "T1027", "c": 0.8999999761581421, "d": "Packed binary process execution", "e": [ "imports.count = 173.00", "ShellExecuteA" ], "i": "objectives/anti-static/obfuscation/eval/loader::packed-binary-process-execution", "l": 2, "m": "B0032", "el": [ "", "0x288a4" ] } ], "sha": "7cb1cce5dc6c041af95951f20a11ee68fa6b657701c41972bcfca6e03f0ec9e4", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2023-06/7cb1cce5dc6c041af95951f20a11ee68fa6b657701c41972bcfca6e03f0ec9e4.exe", "type": "pe" } ], "tv": "ca5ef" } }