{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9998351335525513, "class": 1 } ], "prob": 0.99983513, "class": 1, "models": [ { "m": "az", "prob": 0.9980819, "class": 0 }, { "m": "az/native", "prob": 0.99983513, "class": 0 }, { "m": "az/pe", "prob": 0.99971634, "class": 1 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-10T03:34:56Z" }, "path": "14852", "raw": { "v": "4", "fs": [ { "f": "K(Mc)O₅(C₃As₂Dy₄ErI)H₇(Po₅Cm₂Cr₂Db₂F₃Os₁₀Ti)Md₅(Bi₂PaBkSi)", "k": { "hash.imp": "9e046776b940bab96d48044a457a537c", "pe.checksum": "0x0008cfba", "pe.timestamp": 1436633660, "signing.time": 1436633661, "hash.authenti": "f4ba389e02dfbee752334950de22dbfec8fba5d76545fc754a67e16e1e721bb6", "signing.catalog": "authenticode", "hash.rich_header": "e06ec7adf0996d3ecb77e448bdfa97118e4cc59a032b082ffaf5794f26fdc393", "build.target_arch": "x86", "pe.linker_version": "12.0", "signing.cert.issuer": "VeriSign Class 3 Code Signing 2010 CA", "signing.cert.serial": "71ec58d2c0c7c068666729cac608b70", "pe.resource_types[0]": "RT_STRING", "pe.resource_types[1]": "RT_VERSION", "pe.resource_types[2]": "RT_MANIFEST", "signing.cert.subject": "Lucky Bright", "signing.countersigner": "Thawte Timestamping CA", "pe.rich_header.xor_key": "0x03fd84aa", "pe.data_directories[0].rva": 530640, "pe.data_directories[1].rva": 565248, "pe.data_directories[2].rva": 568832, "pe.data_directories[3].rva": 573440, "pe.data_directories[4].rva": 501944, "pe.data_directories[5].rva": 348160, "signing.validity.not_after": 1466294399, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 300, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 6088, "pe.data_directories[2].name": "certificate", "pe.data_directories[2].size": 7392, "pe.data_directories[3].name": "base_relocation", "pe.data_directories[3].size": 18076, "pe.data_directories[4].name": "load_config", "pe.data_directories[4].size": 64, "pe.data_directories[5].name": "iat", "pe.data_directories[5].size": 1044, "signing.validity.not_before": 1434672000, "pe.version_info.file_version": "1.0.5670.17826", "signing.cert.thumbprint_sha1": "c65307316a44a22ca4a01bd1c877f8db355dbc61", "pe.load_config.security_cookie": "0x47c500", "pe.rich_header_compids[0].count": 40, "pe.rich_header_compids[1].count": 135, "pe.rich_header_compids[2].count": 223, "pe.rich_header_compids[3].count": 7, "pe.rich_header_compids[4].count": 2, "pe.rich_header_compids[5].count": 29, "pe.rich_header_compids[6].count": 266, "pe.rich_header_compids[7].count": 4, "pe.rich_header_compids[8].count": 1, "pe.rich_header_compids[9].count": 1, "pe.version_info.product_version": "1.0.5670.17826", "binary.top_complex_unnamed[0].cc": 384, "binary.top_complex_unnamed[1].cc": 183, "binary.top_complex_unnamed[2].cc": 136, "binary.top_complex_unnamed[3].cc": 133, "binary.top_complex_unnamed[4].cc": 121, "binary.top_complex_unnamed[5].cc": 111, "binary.top_complex_unnamed[6].cc": 94, "binary.top_complex_unnamed[7].cc": 92, "pe.dll_characteristics.nx_compat": true, "pe.manifest.supported_os[0].guid": "{e2011457-1546-43c5-a5fe-008deee3d3f0}", "pe.manifest.supported_os[0].name": "vista", "pe.manifest.supported_os[1].guid": "{35138b9a-5d96-4fbd-8e2d-a2440225f93a}", "pe.manifest.supported_os[1].name": "win7", "pe.manifest.supported_os[2].guid": "{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}", "pe.manifest.supported_os[2].name": "win8", "pe.manifest.supported_os[3].guid": "{1f676c76-80e1-4239-95bb-83d0f6d0da78}", "pe.manifest.supported_os[3].name": "win8.1", "pe.rich_header_compids[0].compid": 14635533, "pe.rich_header_compids[10].count": 1, "pe.rich_header_compids[11].count": 1, "pe.rich_header_compids[1].compid": 14766605, "pe.rich_header_compids[2].compid": 14701069, "pe.rich_header_compids[3].compid": 14766406, "pe.rich_header_compids[4].compid": 8615945, "pe.rich_header_compids[5].compid": 9664521, "pe.rich_header_compids[6].compid": 65536, "pe.rich_header_compids[7].compid": 14776701, "pe.rich_header_compids[8].compid": 14711165, "pe.rich_header_compids[9].compid": 14373389, "binary.top_complex_unnamed[0].bbs": 436, "binary.top_complex_unnamed[1].bbs": 311, "binary.top_complex_unnamed[2].bbs": 228, "binary.top_complex_unnamed[3].bbs": 223, "binary.top_complex_unnamed[4].bbs": 196, "binary.top_complex_unnamed[5].bbs": 190, "binary.top_complex_unnamed[6].bbs": 150, "binary.top_complex_unnamed[7].bbs": 172, "pe.rich_header_compids[10].compid": 9895936, "pe.rich_header_compids[11].compid": 14580093, "pe.rich_header_compids[6].product": "Unknown", "binary.top_complex_unnamed[0].addr": "0x420c81", "binary.top_complex_unnamed[0].size": 5878, "binary.top_complex_unnamed[1].addr": "0x42a89d", "binary.top_complex_unnamed[1].size": 4431, "binary.top_complex_unnamed[2].addr": "0x42e6cd", "binary.top_complex_unnamed[2].size": 3099, "binary.top_complex_unnamed[3].addr": "0x42da67", "binary.top_complex_unnamed[3].size": 3044, "binary.top_complex_unnamed[4].addr": "0x44b2c4", "binary.top_complex_unnamed[4].size": 1912, "binary.top_complex_unnamed[5].addr": "0x44ba6c", "binary.top_complex_unnamed[5].size": 2516, "binary.top_complex_unnamed[6].addr": "0x449db7", "binary.top_complex_unnamed[6].size": 1875, "binary.top_complex_unnamed[7].addr": "0x43fb5c", "binary.top_complex_unnamed[7].size": 1937, "pe.rich_header_compids[10].product": "Unknown", "pe.section_characteristics[0].name": ".text", "pe.section_characteristics[1].name": ".rdata", "pe.section_characteristics[2].name": ".data", "pe.section_characteristics[3].name": ".rsrc", "pe.section_characteristics[4].name": ".reloc", "pe.dll_characteristics.dynamic_base": true, "pe.rich_header.entries[0].use_count": 40, "pe.rich_header.entries[1].use_count": 135, "pe.rich_header.entries[2].use_count": 223, "pe.rich_header.entries[3].use_count": 7, "pe.rich_header.entries[4].use_count": 2, "pe.rich_header.entries[5].use_count": 29, "pe.rich_header.entries[6].use_count": 266, "pe.rich_header.entries[7].use_count": 4, "pe.rich_header.entries[8].use_count": 1, "pe.rich_header.entries[9].use_count": 1, "pe.rich_header.entries[0].product_id": 223, "pe.rich_header.entries[10].use_count": 1, "pe.rich_header.entries[11].use_count": 1, "pe.rich_header.entries[1].product_id": 225, "pe.rich_header.entries[2].product_id": 224, "pe.rich_header.entries[3].product_id": 225, "pe.rich_header.entries[4].product_id": 131, "pe.rich_header.entries[5].product_id": 147, "pe.rich_header.entries[6].product_id": 1, "pe.rich_header.entries[7].product_id": 225, "pe.rich_header.entries[8].product_id": 224, "pe.rich_header.entries[9].product_id": 219, "pe.manifest.requested_execution_level": "requireAdministrator", "pe.rich_header.entries[10].product_id": 151, "pe.rich_header.entries[11].product_id": 222, "pe.rich_header.entries[0].build_number": 21005, "pe.rich_header.entries[0].product_name": "unknown", "pe.rich_header.entries[1].build_number": 21005, "pe.rich_header.entries[1].product_name": "unknown", "pe.rich_header.entries[2].build_number": 21005, "pe.rich_header.entries[2].product_name": "Cvtres_VS2012", "pe.rich_header.entries[3].build_number": 20806, "pe.rich_header.entries[3].product_name": "unknown", "pe.rich_header.entries[4].build_number": 30729, "pe.rich_header.entries[4].product_name": "C_VS2008_LTCG", "pe.rich_header.entries[5].build_number": 30729, "pe.rich_header.entries[5].product_name": "Linker_VS2008_LTCG_RTM", "pe.rich_header.entries[6].product_name": "Imp_VS_v6_or_earlier", "pe.rich_header.entries[7].build_number": 31101, "pe.rich_header.entries[7].product_name": "unknown", "pe.rich_header.entries[8].build_number": 31101, "pe.rich_header.entries[8].product_name": "Cvtres_VS2012", "pe.rich_header.entries[9].build_number": 21005, "pe.rich_header.entries[9].product_name": "C_VS2012", "pe.section_characteristics[0].raw_size": 343552, "pe.section_characteristics[1].raw_size": 188928, "pe.section_characteristics[2].raw_size": 10752, "pe.section_characteristics[3].raw_size": 6144, "pe.section_characteristics[4].raw_size": 18432, "pe.rich_header.entries[10].product_name": "unknown", "pe.rich_header.entries[11].build_number": 31101, "pe.rich_header.entries[11].product_name": "Linker_VS2012_LTCG", "pe.section_characteristics[0].virtual_size": 343068, "pe.section_characteristics[1].virtual_size": 188646, "pe.section_characteristics[2].virtual_size": 21064, "pe.section_characteristics[3].virtual_size": 6088, "pe.section_characteristics[4].virtual_size": 18076, "pe.dll_characteristics.terminal_server_aware": true, "pe.section_characteristics[0].virtual_address": 4096, "pe.section_characteristics[1].virtual_address": 348160, "pe.section_characteristics[2].virtual_address": 540672, "pe.section_characteristics[3].virtual_address": 565248, "pe.section_characteristics[4].virtual_address": 573440, "pe.section_characteristics[0].characteristics_hex": "60000020", "pe.section_characteristics[1].characteristics_hex": "40000040", "pe.section_characteristics[2].characteristics_hex": "c0000040", "pe.section_characteristics[3].characteristics_hex": "40000040", "pe.section_characteristics[4].characteristics_hex": "42000040" }, "x": 366, "id": 0, "is": [ "CreateEventW", "CreateWaitableTimerW", "SetWaitableTimer", "LoadLibraryW", "LoadLibraryExW", "GetModuleFileNameW", "GetModuleHandleW", "CreateProcessW", "GetCommandLineW", "GetWindowsDirectoryW", "DeleteFileW", "CopyFileW", "MoveFileExW", "GetComputerNameW", "GetVersionExW", "CreateToolhelp32Snapshot", "Process32FirstW", "Process32NextW", "GetTickCount", "GetStartupInfoW", "SetLastError", "SetUnhandledExceptionFilter", "UnhandledExceptionFilter", "lstrlenA", "SetEndOfFile", "WaitForSingleObject", "ReleaseMutex", "SetEvent", "LeaveCriticalSection", "EnterCriticalSection", "SetErrorMode", "GetCurrentThreadId", "GetExitCodeProcess", "TerminateProcess", "GetCurrentProcess", "OpenProcess", "LocalFree", "LocalAlloc", "GetProcAddress", "FreeLibrary", "InterlockedCompareExchange", "InterlockedExchange", "InterlockedDecrement", "DeleteCriticalSection", "InitializeCriticalSectionAndSpinCount", "RaiseException", "DecodePointer", "GetFileAttributesW", "CreateFileW", "CreateDirectoryW", "GetCurrentDirectoryW", "LocalFileTimeToFileTime", "SystemTimeToFileTime", "CloseHandle", "SetFileTime", "LockResource", "SetFilePointer", "ReadFile", "CreateMutexW", "WideCharToMultiByte", "MultiByteToWideChar", "FindResourceExW", "FindResourceW", "SizeofResource", "LoadResource", "GetLastError", "GetProcessHeap", "HeapSize", "HeapFree", "HeapReAlloc", "HeapAlloc", "HeapDestroy", "ReadConsoleW", "WriteConsoleW", "SetStdHandle", "UnregisterWaitEx", "QueryDepthSList", "InterlockedFlushSList", "InterlockedPushEntrySList", "InterlockedPopEntrySList", "InitializeSListHead", "GetCPInfo", "ReleaseSemaphore", "DuplicateHandle", "UnregisterWait", "RegisterWaitForSingleObject", "SetThreadAffinityMask", "GetProcessAffinityMask", "GetNumaHighestNodeNumber", "VirtualProtect", "VirtualFree", "VirtualAlloc", "GetModuleHandleA", "FreeLibraryAndExitThread", "GetThreadTimes", "FreeEnvironmentStringsW", "GetEnvironmentStringsW", "GetCurrentProcessId", "QueryPerformanceCounter", "lstrcmpiW", "FileTimeToSystemTime", "GetFileTime", "SetFilePointerEx", "GetFileType", "GetConsoleMode", "GetConsoleCP", "FlushFileBuffers", "GetOEMCP", "GetACP", "IsValidCodePage", "GetCurrentThread", "GetStdHandle", "GetModuleHandleExW", "ExitProcess", "EnumSystemLocalesW", "GetUserDefaultLCID", "IsValidLocale", "GetLocaleInfoW", "LCMapStringW", "Sleep", "WriteFile", "WaitForMultipleObjects", "IsDebuggerPresent", "OutputDebugStringW", "GetSystemTimeAsFileTime", "EncodePointer", "GetStringTypeW", "IsProcessorFeaturePresent", "RtlUnwind", "CreateThread", "ExitThread", "CreateTimerQueue", "WaitForSingleObjectEx", "SignalObjectAndWait", "SwitchToThread", "SetThreadPriority", "GetThreadPriority", "TlsAlloc", "TlsGetValue", "TlsSetValue", "TlsFree", "GetLogicalProcessorInformation", "CreateTimerQueueTimer", "ChangeTimerQueueTimer", "DeleteTimerQueueTimer", "CreateSemaphoreW", "LoadStringW", "MessageBoxW", "CharNextW", "CharUpperW", "PostThreadMessageW", "DispatchMessageW", "TranslateMessage", "GetMessageW", "StartServiceW", "ConvertSidToStringSidW", "CryptDuplicateKey", "CryptDestroyHash", "CryptHashData", "CryptCreateHash", "CryptDecrypt", "CryptEncrypt", "CryptImportKey", "CryptExportKey", "CryptGetHashParam", "CryptDestroyKey", "CryptDeriveKey", "CryptGenKey", "CryptReleaseContext", "CryptAcquireContextW", "StartServiceCtrlDispatcherW", "SetServiceStatus", "RegisterServiceCtrlHandlerW", "QueryServiceStatus", "QueryServiceConfigW", "OpenServiceW", "OpenSCManagerW", "DeleteService", "CreateServiceW", "ControlService", "CloseServiceHandle", "ChangeServiceConfig2W", "RegSetValueExW", "RegQueryValueExW", "RegQueryInfoKeyW", "RegOpenKeyExW", "RegEnumKeyExW", "RegDeleteValueW", "RegDeleteKeyW", "RegCreateKeyExW", "RegCloseKey", "CreateProcessAsUserW", "LookupAccountNameW", "LookupAccountSidW", "IsValidSid", "GetTokenInformation", "OpenProcessToken", "ReportEventW", "RegisterEventSourceW", "DeregisterEventSource", "SHGetFolderPathW", "CoAddRefServerProcess", "CoReleaseServerProcess", "CoInitializeSecurity", "CoSetProxyBlanket", "CoUninitialize", "StringFromCLSID", "CLSIDFromString", "CoTaskMemRealloc", "CoTaskMemFree", "CoCreateInstance", "CoInitializeEx", "CoTaskMemAlloc", "ORDINAL 277", "ORDINAL 9", "ORDINAL 4", "ORDINAL 6", "ORDINAL 2", "PathAppendW", "PathCombineW", "PathRemoveArgsW", "PathRemoveExtensionW", "PathRemoveFileSpecW", "PathRenameExtensionW", "PathStripPathW", "PathUnquoteSpacesW", "PathFileExistsW", "CryptBinaryToStringA", "CryptStringToBinaryA", "WinHttpQueryHeaders", "WinHttpReceiveResponse", "WinHttpSendRequest", "WinHttpOpen", "WinHttpCloseHandle", "WinHttpConnect", "WinHttpReadData", "WinHttpQueryDataAvailable", "WinHttpOpenRequest", "WinHttpCrackUrl", "GetFileVersionInfoSizeW", "GetFileVersionInfoW", "VerQueryValueW", "CheckSumMappedFile", "GetModuleFileNameExW", "GetTcpTable", "GetUdpTable", "ORDINAL 15" ], "ms": { "pe": { "entry": 152551.0, "signer": "Thawte Timestamping CA, Symantec Time Stamping Services CA - G2, TimeStamp-2048-1, Symantec Time Stamping Services Signer - G4, TimeStamp-2048-2, VeriSign Class 3 Code Signing 2010 CA, Lucky Bright, VeriSign Class 3 Public Primary Certification Authority - G5, VeriSignMPKI-2-8", "machine": 332.0, "checksum": 577466.0, "rsrc_size": 6144.0, "subsystem": 2.0, "timestamp": 1436633660.0, "image_base": 4194304.0, "leaf_issuer": "VeriSign Class 3 Code Signing 2010 CA", "leaf_serial": "71ec58d2c0c7c068666729cac608b70", "has_checksum": true, "has_manifest": true, "rsrc_entropy": 4.42, "signing_time": 1436633661.0, "entry_section": ".text", "has_signature": true, "size_of_image": 593920.0, "checksum_valid": true, "file_alignment": 512.0, "leaf_not_after": 1466294399.0, "primary_signer": "Lucky Bright", "resource_count": 5.0, "resource_types": [ "RT_STRING", "RT_VERSION", "RT_MANIFEST" ], "signature_type": "developer", "characteristics": 258.0, "has_rich_header": true, "leaf_not_before": 1434672000.0, "security_cookie": 4703488.0, "size_of_headers": 1024.0, "cert_chain_depth": 4.0, "export_timestamp": 0.0, "has_version_info": true, "import_dll_count": 14.0, "signature_digest": "f77027d2c35c61f6563575b03fb8177fd35af0a4", "certificate_count": 1.0, "computed_checksum": 577466.0, "section_alignment": 4096.0, "cert_validity_days": 365.0, "resource_timestamp": 0.0, "signature_verified": true, "signer_info_issuer": "VeriSign Class 3 Code Signing 2010 CA", "signer_info_serial": "071ec58d2c0c7c068666729cac608b70", "dll_characteristics": 33088.0, "has_export_timestamp": false, "leaf_thumbprint_sha1": "c65307316a44a22ca4a01bd1c877f8db355dbc61", "linker_major_version": 12.0, "leaf_eku_code_signing": true, "certificate_table_size": 7392.0, "has_resource_timestamp": false, "number_of_rva_and_sizes": 16.0, "leaf_signature_algorithm": "sha1WithRSAEncryption", "signer_info_matches_leaf": true, "signature_digest_algorithm": "sha1", "api_hashing_indicator_count": 1.0 }, "file": { "size": 576224.0 }, "binary": { "code_size": 343552.0, "func_count": 1735.0, "code_entropy": 6.65, "data_entropy": 4.86, "func_density": 5.17, "import_count": 247.0, "string_count": 1307.0, "avg_func_size": 420.5, "has_signature": true, "section_count": 5.0, "avg_complexity": 5.84, "import_density": 0.74, "max_complexity": 384.0, "string_density": 3.9, "overall_entropy": 5.47, "avg_basic_blocks": 9.3, "avg_section_size": 113561.6, "dependency_count": 14.0, "entropy_variance": 0.97, "avg_string_length": 52.64, "complexity_per_kb": 0.02, "max_string_length": 749.0, "wide_string_count": 431.0, "avg_string_entropy": 3.54, "code_to_data_ratio": 1.53, "data_to_file_ratio": 0.02, "rsrc_to_file_ratio": 0.01, "text_to_file_ratio": 0.6, "total_basic_blocks": 16130.0, "func_analysis_depth": 2.0, "string_length_stddev": 87.66, "largest_section_ratio": 0.6, "sentence_string_count": 131.0, "sentence_string_ratio": 0.1, "writable_section_count": 1.0, "behavioral_import_ratio": 0.07, "executable_section_count": 1.0, "high_entropy_string_count": 3.0, "high_complexity_func_count": 16.0, "unnamed_complex_func_count": 16.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 240, "Rich" ], [ 512, ".text" ], [ 591, "@.data" ], [ 632, ".rsrc" ], [ 671, "@.reloc" ], [ 11368, "GWSWV" ], [ 12114, "QWVP" ], [ 15006, "A0V3" ], [ 36775, "G4SW" ], [ 44786, "G49E" ], [ 57315, "SVWP" ], [ 60059, "SVW3" ], [ 61048, "AQPQ" ], [ 63910, "SSSVSP" ], [ 63936, "SSSVS" ], [ 67518, "YYSV" ], [ 74689, "PSVS" ], [ 74773, "PWVS" ], [ 77499, "QRRRP" ], [ 78113, "RSA1" ], [ 78149, "PSSW" ], [ 86272, "QQVW" ], [ 86528, "PQRV" ], [ 89946, "PPSV" ], [ 91713, "48CV" ], [ 91844, "VPVW" ], [ 92194, "6QPQS" ], [ 93067, "RWWWWWW" ], [ 95535, "90tf" ], [ 110414, "5PPE" ], [ 116553, "Z9A8" ], [ 118835, "L18WWS" ], [ 127624, "6PWQ" ], [ 150359, "PRSW" ], [ 152016, "QQSV" ], [ 152692, "YYPW" ], [ 152804, "8RCC" ], [ 152812, "8MOC" ], [ 162693, "WVPS" ], [ 167946, "PSQR" ], [ 170384, "5ntel" ], [ 178067, "SVAW" ], [ 180609, "5PKH" ], [ 181841, "v6j0" ], [ 182026, "PRSQ" ], [ 183123, "PSVW" ], [ 184922, "HHtXHHt" ], [ 186220, "RPWQ" ], [ 192557, "f90t" ], [ 192590, "f97t" ], [ 192635, "QSVW" ], [ 204251, "PWWV" ], [ 209276, "GDQSP" ], [ 209344, "OHPSQ" ], [ 209661, "OHSSVSSW" ], [ 217341, "QQS3" ], [ 220124, "QVW3" ], [ 222124, "QQSVW" ], [ 233208, "NHB3" ], [ 236615, "9E W" ], [ 237686, "f90u" ], [ 237704, "RVSQSWV" ], [ 238850, "UVWS" ], [ 245494, "/PjSW" ], [ 249897, "UQPXY]Y[" ], [ 250473, "PWWWWV" ], [ 250628, "PSSSSV" ], [ 251104, "WVU3" ], [ 271553, "9vdu" ], [ 301858, "Huzj" ], [ 305762, "HAO8" ], [ 312865, "KHVW3" ], [ 322692, "PRQW" ], [ 346284, "bad locale name" ], [ 346308, "generic" ], [ 346316, "unknown error" ], [ 346332, "iostream" ], [ 346344, "iostream stream error" ], [ 346368, "system" ], [ 346384, "ios_base::badbit set" ], [ 346408, "ios_base::failbit set" ], [ 346432, "ios_base::eofbit set" ], [ 346536, "wide", "Ij0/OSQjMSkJJyo6KRw1IiAMCAAILgcwJhA1PiMJBCwZODs7FSYvIzcZNxkwGyAoGgY6ERkWLx4kPRgcHxwCIgEiACkzCy0DNDkDMB8gAj88Fyk5IiIoGzczJTEpJQk1" ], [ 346952, "wide", "ejU5Hx4YKjMVOiUcDAkEChMnAgsHEgciJgAiFiIQFwMXBgIWCDQKJhQpFjoBCTQrLy0bDxYxGT4JPAUzOSYyEiI4CSQbATQeEggUOjUsBjs4ID8fHwE/AAAAVA==" ], [ 347208, "wide", "ey44IRk9CScQMAA/NwYDMTQtPgMHPj4CAwQTOhUxIRYDEwYiFj4PDBUlOSIbAhg0AC8DNRY/ES8dHjYpIQwlABIQIDQWACEQLSYYCwooAhgSJQMCAx0hOhEIBhUSHx0d" ], [ 347584, "wide", "ezEpNCg0AisfPTQgEwcTBxcTKwE5ND0FDDQBBhIWABUcBzIdCTQ8HQgBKSMSMjwoHh0AAD8tLQwMOAIzPz8TOgI6MwYUCBY4KSYdHTErGy41KicSJDIiHzs7OR85KwkN" ], [ 348208, "FHQnMDw+JXEQGQgEYS85Ky8rLyYkZiIhOCFnMTF5MD0lOTUlYTA0aiY4MyovaDU0aik+ZiA2ITAkJ3QvNDgkNH4jOzIZAAA9CggVLykWJiUIIDYeJT8mBRs7DzIcJycA" ], [ 348480, "Bi0/JTEvYTQoOCg4e2sgKTYzL2RwKS0+LjYzczsrdTUjIzEuYTQiOiIpNS4yZjYqMhEnFi4iLAIEACcrDD8iPSU9AxkDHy4gMQI6LhATMx0ABzsCHSQIFxAqGTonKBkd" ], [ 348632, "JyE0JTQuAwkcPgEzDzMkIzYXGxs2KhsuGhgfPTodGhoAFBcSOBY0BgUQCD0PBTcXPC0ENBkbKDkKMSwTNDEXGj46LQUrPTUzESwbBgk3OhsHMi0SPzMGGCQqJB0YEzg6" ], [ 348960, "NDgiNDkaMyM3AzEYBz4TKRAlDzs+LBgaBR0UKj4MHCQAHzIDLgEDMAIdFSYuKRMSIxoXLRg1JT4+GgQ+FjYCJj8GKSMXGwgcFCEVCT8pGTkeHh0mDD4UNjEhJjgpIzU+" ], [ 349264, "IDg9GyUhDx89EjEHNTkdIzI/JxooAAI5IDcONBk8HxUcOAo/GRIxHxISFD4VJzcrAQMXMQUjPT0WMQEsGwEWADs6MQMKKCQuJwI0GAg0BDsjIDgAAzYzNjs6JTgQCSg+" ], [ 349544, "Xw4eASA6LRgUEwodJgQmCgkXBi40Ni0iJjg+ABMREzEwOh86GAIVAhYtCy0MByg+GyQxLjkeGjYWHgUXFiwnJSoHBzIUJDIMDx05OwM2IQ8mIQg9HQ0yKxI7DS09Px0Q" ], [ 349728, "GD0iIjk5JnF9cGBqIC0iLShmJSo6IywgazgiPjY8J3Q/MD0yIBkDIyEQCA8CPDgzLx8kEC0CPxAuIxsDPBc2NQEYBiQMHhMoOw4FMjwlGQsEDAc7ICwuIDIvDx87PSIc" ], [ 349952, "GD0iIjk5JnF9ZmBqLjl2bydhaiE+ZiA2ITAkJ3Q9MDc9MCI2NTg1JAA5IAUSDz8QIj81NjgEGCUuFB8NHz8TAQIBEB4OOQkHJyI0MCIkPT42ChYQPjwgFjEyMyYAPSIY" ], [ 350160, "GD0iIjk5JnF9N2BqLjl2JzgsLyskZiIxJjciIXQ3NDk0FyICEwUiCQ0lMwQfOgMiAgcJIT8fPSEKPAYgHzoQGT4jKyc4IQM7LyYHJBYwCCYBDQA+BCAICz4fHDM5AAAA" ], [ 350296, "GD0iIjk5JnF9ZmBqLjl2bwdhaiE+Zi4mOTQ+czA8NjgwIzEjKD40Aig6LDM3ERcqAQIEHwAsEQY1MhU2Hy0lBQEwOyEVHTYjBy4gKhgyOjEzJSkCGjEhIg03JyQJGzU5" ], [ 350720, "cDg3HRMOFwkeLj8TJgInLhwqPzw4BSEkOxYAFxoxFBYXKT02BwcUCSIQFSceAiktHg8iBwsiPTAtIRsKJzAHNyEOIAQVMiYTEwA3MSwCMCooEgofMSUtNyctOi00NAEi" ], [ 350992, "cDg3FwYaNRk3Jj0jFikwAT0tMAs/ECsEJzExBg0DLDspJDcyNj4+KAshOAATIz0iJyc7IwAbBwQyOhsvLCQXPhQlBD8sJAM7OQQyGA0FPB0GEw0bMxAoPDMxJzYoFhQU" ], [ 351320, "EDkhJSl3JCI5KzcvYTgzOS8jJCs1ZiY6ayYzIT03Mjw6AgQYCxsyIgUgCi8iIhQvATkmDSAeEiIrMjEAEywFIiM6DxQqBwUaGQQ3Bgw0DxE8DwYZKTkfOB00LwYfCRst" ], [ 351496, "FzU1cTUkIjAqL2c5JDojLTQlL2g5KG8nPycuPTMMPzUiITknCgk2LikiAxwyOTMBBBgXKA4BAzMxAjocFBwAOQQ/CQEdAzITGD8bGz0iDBgTAisxOAwlCwQUODU/NhoY" ], [ 351824, "NDA1OCQ+Lj87Jmc5KDN2KzInOCkzMiomOHUiKyQ8NiA0NXAjLnEqKzU5JGsjJjMlJSw1ZjwhOScoNDUtMHQhMDklbyQfAygDLTsfBx8BAhgXLT0xGAEJFCMsLCQiARYZ" ], [ 351968, "MCwhNDMjKD89aiYkLj8+LShmFj1wMiA/LjtnJzt5NzE2OD53NTk/ajQvIiQ4LHouKyQ2ZiAyazRnJjowNjs1NHAkNCMoJSArNS52ODsvOAAWJQE6KiYeOw00OzMZKBM7" ], [ 352360, "FzU1cSU5KDI1LiJqJDg1KSojajs1NzoxJTYicz03dSclIzk5Jmt6LCg/M2syIT0vPjtwIzckLjYzNjB3BTAdNwIPIwYCKAkvNywfCyI2LR05Nh83ADsCGBU7JDMZGgEi" ], [ 352552, "FzU1cSU5KDI1LiJqJDg1KSojajs1NzoxJTYicz03dSclIzk5Jmt6IiIyIC8zKzMrKyRwIiYzIiFnNiwpMDclNDR5FwQgBikvGTsdGgMSOBg1DyoABxMwEgcKIAMkIz4j" ], [ 352888, "EzU4PTUzYSU1aiYmLSQ1KS4jajskNCY6LHUxMjgsMHQzJDYxJCMoHCovLRkTEDsIPDgfFCgTGhkfOTEeITM5ACUuJRILJRcbLD49GisFEyYiAjUlIgAJJDw0HywoISYd" ], [ 353096, "Fjs8PDU5NSJ6JzI5NWslPDs0PmgnLzs8a3oOOS4hIzsQPgcEETsJEjcNBxEDGRQ2Lxo4Nx8zBDQtAhwyADAdKyAGFhAIBBQmBSojIywpOCICHC0yEh4sASw/GxocJjc2" ], [ 353444, "invalid vector\u003cT\u003e subscript" ], [ 353472, "vector\u003cT\u003e too long" ], [ 353492, "string too long" ], [ 353508, "invalid string position" ], [ 353532, "deque\u003cT\u003e too long" ], [ 353552, "bad cast" ], [ 353564, "map/set\u003cT\u003e too long" ], [ 354425, "Qkkbal" ], [ 359760, "OzE0NXAzKDIuIygkIDkvPSoXDQQKLyo5IRkEOjgRBQAJGiEfIgsWHyUjMSE0ARQPDCoEJQcbOwcGAi4KAzgYCCESADwiMiIGJzoHDSsWAxAaDwc8LQYdOQM/ABo+AAAA" ], [ 359896, "JiAjNDE6YTQ0LhMMDAcGAQAqAgkXAwoeGRIoGQ4fHzo+NwgRFhAXCxU9KhogByMVOyMCNCcdODE9HzgWHD8ACBUGBhIRGCwvBR4CGBMkLAoJKSgGJDg0HhsjEgc6OSgG" ], [ 360096, "Mz09NHAyMyM1ODYGIggxHxMwEhsbDCIWHiwfAz8cPwI1NDEgODUgHTMBFjI5JwMzICMUMwMVGzsLAwExEjo1CBkZKDsfHgMTIBM3GS02CDIUAAAARw==" ], [ 360216, "JiAjNDE6YTQoOCg4IxghOTwjCxAAEQINJQIAHQ49Fx4wMzklMgELGiwkJAQCHzsTGBg/PBkcKSQWJjY7Mh40FCkNMhQWHC0IMCkCLR4oIxAaIBs3BzIoEBMuOD88Pz4t" ], [ 360544, "MTUlMHAyMyM1OA8mLQEGHDIUIwQDCz85LBsvEiI1Hxw6PzMnJhIwKzADDR0nMjYKJDIpABg6BxwdAA4hNj8oCCM6CxIIATIMIw4ZDjIvGQ8RJyYiOzwuOAMqNzUeEDQN" ], [ 360768, "PDoiJDYxKDIzLyk+YSYzJTU0Mw4TCCwSBy0GBB0jJQ45KQcfNzITGyg+Kz85JRw0PgQUBwMEDzkzNCcXGDkANgEUDzAgAT8yEAYfHTQhDSkeKyYgCDclPSYgLD09Hx8u" ], [ 361072, "NyE3NzUlYTQoOCg4MDIgJjwVPyApETYOMiQ3NAQBOAELBQIPKQAJLgUuBB4FIhkDATA/CTgVIj8AAAAs" ], [ 361160, "PDoyPj0nICUzKCsvYT0zOikvJSYDNykZMzoAJBg4NjYQPj8UDgU/DSIkEC4OIi8RCyk8PiMOIR49OAM1GiQeHT0uCAMACy4jGDs4GR8nLgYnBAc2CQE9NCAtGhAYICI4" ], [ 361528, "PDonMDw+JXE2IzMvMyo6ZzYjJC8kLm83JDEiMDwvGQwmNyoZOQAPACs7CA4VAAAAEg==" ], [ 361600, "PDonMDw+JXE+IzQ+ICU1LXolJSw1NiIjIhIkGQUMOx0wHzEZKBYLGAEdMRoPET4NJCcgIhcSBg0jIDsNJBErHyAHGCELPgg8KQMVOD0sAiMiDSQWJxkNMQAAAEM=" ], [ 361728, "PDonMDw+JXE4JigpKmsiMSojGCUpCzsdATMlHSAMHx8rPyoiGyY+CzASOQg3IzwiABwyDjoaLx0zGj8eLyUSJhUDAig5Bw0TBCgADxM1BQQjCzsTPDMCADsPETsyODsn" ], [ 361920, "PDonMDw+JXEpPig4JC92KjYpKSNwKio6LCEvICYOBxYoPwMPDRgzPA8YOwESGwMCHCAiKDg+Kg8kFSwVBxwTNxIZAzgWPTYSNxsMPC8CJAEENBwZHhcfGjIQMCMpKBoB" ], [ 362256, "ITs+cT02Lyh6JiIkJj8+aDU0aiw5NTs1JTYicycgODY+PSMeCAASAygFCC83CzAxPyYkKS4VBTk9OSIdIQU5PT4mFgU7AQIuDxsVMBQpPyY7Cj8jDRM9MSAPFyAfIiMP" ], [ 362552, "PDonMDw+JXE4IzNqLS44Ly4uajo1Nio1PzQyIDseHA0ACAgiEQgxEC4mNh0iAzEXPQsAAAAZ" ], [ 362632, "OiI0IyMiIyI5OC4oJC92LCMoKyU5JW82IiFnPzE3MiA5InAjMzQ/Li8+EyQfJiMJBQsjLQ4dBBYoJTk7FBc0KDwHBjsyLioCKj4RET4kDy4GITkTAAAALQ==" ], [ 362760, "PDoyPj0nLTQuL2cuOCU3JTMlaio5Mm84LjsgJzwqdSAjNDUzMCUeBzQTDD4VMCkHIB8/FBsbChYlFxISHQY3JD4RBzQ0HjAuDAQePjE3AjAEAwktAiAsFhg3Hic2Fh0a" ], [ 363048, "OiI0IyMiIyI5OC4oJC92JDMyLzoxKmA4LjsgJzx5ISY0NCgWABc7HyYoKx0TDiIPKBA8CgAiJxA0KT4IGSAnKxsEJRw0CQ8LFj0EHDIPHQ0CNisYPTsdBB4MJQcGOTs9" ], [ 363216, "PDoyPj0nLTQuL2cmKD8zOjsqZSQ1KCggI3UzITE8ERolCzYPBScsCCQdNwMwAywHGBs+IgAlAhwUByc6GCA6MBYSMB8tIyQPKxk/KTkgMwYBEwonHiUQGS0xHg0VPzEA" ], [ 363568, "OiI0IyMiIyI5OC4oJC92LDM1Pik+JSp0PyciNjIrOCcDJzM/OAAZBR8lKyYEDRc8MAsGDT8EDAY/BCA2PB4aFAozOBUCBxImDBksKxscCw8ZKAsEIy03KgIXBjAgPQUw" ], [ 363912, "PDoyPj0nLTQuL2cuKDgiKTQlL2gkNCoxKgUGNxcgJRkEPikSLTovBgwHLQQQLiA3ECcdCw4sBzYLJREaOTc4FRgmEiA1IzMEJTwALRU+EicXHik7GywIPTEKHQcJAwQt" ], [ 364272, "MDkhJSl3JTgpPiYkIi52PCgjL2gnLzs8azkiPTMtPScLATEWOB0IJCUaJBwRHQ4JKQAnMig8LA8BHQAOECQEIxMROQQYPzEdFCQlLhEqPywAAiwyAQMqAQAAADg=" ], [ 364400, "PDonMDw+JXE+IzQ+ICU1LXolJSw1ISMgCS8OJRcNARE+HzIfGRs2AD4bLRwVDBk2PQ0bLQ4MBj4pFSESFywUHxYFLD4iCy4mIwEPHxcTKzo3NR4iChsIAhgIHgc1BgMu" ], [ 364720, "PDonMDw+JXE2IzMvMyo6ZzYjJC8kLm83JDEiOQY+Fz4+Gz89KQIgMAkLFwgGKhEIEC83Igo3JQMmJhMjJyc5IQgDJwcTEistJgQVPQ0LOicSAS47Di8mKywMIDkIMAkZ" ], [ 364904, "IDo6Pz8gL3E5JSo6My4lOzMpJGg9Izs8JDEEMjEuFDowNTgYEjQ3OAwZOyEnHhALKAwZDSMuIAMPHBcKNAYyBgoyBTsOPxUbLRodGygnIgweKBkXIjkEBC0hNBoGCRwd" ], [ 365184, "PDonMDw+JXEtIykuLjx2OzM8Lw0HJQcyJRADGxc7PxobOyQwLxoMByw5Ey8zIi0fDQkjJBUyPBcjKiUJJSY/CBMbOCI9Mw4GLx49AQ01MD0hEgAtOxY1GwItPg0gHjE1" ], [ 365424, "PDoyPiIlJDIuai8vIC8zOnolIi0zLSAfMg0wORoUGx0hACQwDh4oCwETFCkkAgwpOSc4EA0tDTM2PQQcFx0SKwgQFDUpATcJKCQMLRkROhAANBkbDCw1KTIYJB45GxIm" ], [ 365704, "OzE0NXAzKDIuIygkIDkvHw0VPQcRBRcQOgQhNT0/HRcpJCITNx47EykyOQkXCzsrPyk3IhgyGzs0GCA/MQIYBRwSAzMQMCUkBBgVOC8jLys9MhYbHhQdAQ04AzU4CB01" ], [ 365928, "PDoyPiIlJDIuaiMrNSp2KzIjKSMnKBwTBScOFhI+AyAoJzkeLh0fKQUkIj48AxkyOiYiBDsFPgwsHQcgLCIVMjwdLSQQISQPIhIbDhwiIy8ALD0DMRQyBAIqLAIGByIt" ], [ 366264, "wide", "CXp/DQA0GTAZJy8JEAUiOTIVOxoEIAM1OCcEJyUOBxkQGjojKhQZMjIdGw4/ChIcDAAGMxsgGQAAADM=" ], [ 366432, "wide", "CXp/fjg9ERkIDzA+Kg0OHwkiHgM0FQswIDIGHB0TGBU3PCEYJyEqIz4pNAo1EA8IKSAHDS45GjgAFzMjBAEzFxQCDjQvICIcAgADLDgUAiUyEBcRKhoONRchBC4yJRUN" ], [ 366928, "wide", "enp/fgMTNQU7JTMZLRweIy8IGhIBDhYuGzMKHAIuPCcyJwo1GRoYGyowKiUwLj8pACwJPCIMICAfPhUWOi4BGjEZIwcpMw8/BSQDKjISPj0DJz4XBC0xHx8MAj0FNDo7" ], [ 367280, "wide", "enp/DTEyBiMwLzMtODkGIz0xITIfPCglKD8vFDgpEBMkEBwjBhUfKA4cAjwfBykXARAIIRswGhYrOSEcNhIXMyUSCAsjByYOJBMnIykMBQwbLzglAB4UAx4aBz0hAzwg" ], [ 367720, "AAA4JyQTJDsCKxQOBhoBDgkBLAAlMC0kOiIpBz0PBhMIBT08KBwYJB8cGwg5MC4POgETBw41EzA0FRoyHDgWFBwQERQOLTMoLj0DOhEyOSUzIA4hHyQVEhggMDEbGhEV" ], [ 368016, "wide", "cCd0IhYkCSI2LhEgJyoZBRw0Dy8qDgUzOQAMIjIWDCIpACUUADApPBUdJR8UMTMOITAALSgSGB8TBBsNHjM+NxIdKBI8Jgw/DCMgITQNMA44EgouBxYAAABS" ], [ 368264, "wide", "cCd0InUkDyYLODcBJSACIhECBioeIRwXDwANPRcILCUnABsuJCcyIRATOx8iGAA+DA83EQUtHzwoCw41Fx0cMxYSKzM7PCYnBjIXDw8zJAIaAAAASw==" ], [ 368500, "wide", "Component Categories" ], [ 368544, "wide", "FileType" ], [ 368564, "wide", "Interface" ], [ 368584, "wide", "Hardware" ], [ 368604, "wide", "Mime" ], [ 368624, "wide", "SECURITY" ], [ 368644, "wide", "SYSTEM" ], [ 368660, "wide", "Software" ], [ 368680, "wide", "TypeLib" ], [ 368696, "wide", "CLSID" ], [ 368744, "wide", "ForceRemove" ], [ 368768, "wide", "NoRemove" ], [ 368788, "wide", "Delete" ], [ 368984, "wide", "kernel32.dll" ], [ 369012, "CreateFileTransactedW" ], [ 369036, "wide", "Advapi32.dll" ], [ 369064, "RegOpenKeyTransactedW" ], [ 369088, "RegCreateKeyTransactedW" ], [ 369112, "RegDeleteKeyTransactedW" ], [ 369151, "FRegDeleteKeyExW" ], [ 369304, "wide", "HKCR" ], [ 369316, "wide", "HKCU" ], [ 369328, "wide", "HKLM" ], [ 369348, "wide", "HKPD" ], [ 369384, "wide", "HKEY_CLASSES_ROOT" ], [ 369420, "wide", "HKEY_CURRENT_USER" ], [ 369456, "wide", "HKEY_LOCAL_MACHINE" ], [ 369496, "wide", "HKEY_USERS" ], [ 369520, "wide", "HKEY_PERFORMANCE_DATA" ], [ 369564, "wide", "HKEY_DYN_DATA" ], [ 369592, "wide", "HKEY_CURRENT_CONFIG" ], [ 369716, "wide", "Module" ], [ 369732, "wide", "Module_Raw" ], [ 369756, "wide", "REGISTRY" ], [ 369780, "wide", "APPID" ], [ 369808, "WF4pEDkPFCkLJj8NFQc+IhMJOw8aFzs1Dh0VBjUTEzAXHAY/KhoiLQIOIx8TCjUkMho5AAUNIxAuFRwbJT09JCMzFTYeOyUvDDwXMisnISUHLxUDADQWCxEtFzgrMyYh" ], [ 370056, "cGcVHh0/LQErHzU4GygkHC4ABRghJAYcMRo+CRgWHS4/Hj8fIAEOAT8mCicYLBM+ASEqNxoNER0lPDYvFgQIEzk7NzgTGhA5Kj4kBwMBEDs0JTwhJDE/Ox0aASMHOxci" ], [ 370400, "aD4VKDc+NAMoOTIzNA07IAIFEAQ6NCkcChgVPB0qPjgiGQAAFQkDLS4gAwwFDjIMDg45LBkQDSwxJTYPIhA2Ox86BxgvGQENBzkUBjIpIQoFATsXAyMyCxkvPgwXCzgB" ], [ 370728, "cGYXHDYdCBQ+ICIgDSUcJikwGCkqASM6AhMVAT4yPD0ePwUDFwgAPwgnDioEBxYAIgQBLR09GxEAPxIbJDEaMzMaKCQ0EDMSCC4hPxcwOiQgNA0yHi80JzYjOwIUNykH" ], [ 370904, "eiQECz0dODMJKRcCOS0CJQMuCy40EQcBHj8gERUzAREaGBQGOSgqHhcyNQAHCxgcPS0yDykZDAAsBj0rIhcgPjoEKSQ7JwwbGwYCPSMHDhA/ETknDzAlNw4wMDIINyYi" ], [ 371136, "cGYTODM/CwE0KAMvEw8GIxUrPy4jITc/OR8tPCEKDQUGMjUkABYTGiwzAyg+KTsqOzEaJDo9Mh4oKS08JD0iGjQtDj4cOQoSFjg1PCsfKywWJxYBHiM+GScWHzE7Hjwt" ], [ 371304, "fgEmBTgRJDs3DQQYFDIeMT8WByYfKQI+HRkyKjwKPAAbHj0SBDg1Pw0/DCAkIDsMOxsXIjYeOjsKMAY7PAEIHxc6MAQ/JBIoKyQ8ADMBMi4HLAgXMzo1ACYsLSwQAjUd" ], [ 371464, "wide", "CQclIzk5JhczJiIDLy05FGpyenFgci1kFwU1PDAsNiAHNCIkKD40PjU7JCAsHioBLyomNS45KiAVPx0TIzw5ExQcODwxOjYjIw0mBTUoBh0mJw46OR8yNwMjOiUVASAP" ], [ 372080, "wide", "CQclIzk5JhczJiIDLy05FGp2enhgdn82FwU1PDAsNiAHNCIkKD40Jh8kBigbPxYzLBgBCi4SJiE+HxAoJxgAIykuCyQsPgAEIDofHC0POAkbCxoRKjAdCjcOBzUQGz0F" ], [ 372596, "wide", "CRUjGDERBQQ7CAkPETsAAAAN" ], [ 372648, "wide", "cDB/dDR5ZDV0byMoLBE4JyMhOjkSEhYEAiMIHjg1GT8SBRIOEgE/ORYzKAEXDz8WPzE/Iy06PjYLAjIjFA07GCEwFBYWMgMwOSwZDz0TAgYdCAYOABcKAgUhHwUSPCge" ], [ 373128, "JCdsJR4YKykwEh0YBQgnBiAhPj47EB4BARstIxgsGSwgJyMSKzodDi4yKAwFKzgALQoSMRUAIzoLGxcUPzsaGzs8Fj80OS8sEA4RGhkhAi0ELyw2HxQsPAI8Mh8aOgM/" ], [ 373304, "BRsCBQMCGDYAISADBB8vDBQREw8oPg0lEgwENRgRMCMEOTw/Lh0DGDcbJRovGjYyPDs4ICgWKiQrKjANGhcfJQM7NRARJzISFicQBQkSJycXLBUcPCIqCxctAQc/GyIu" ], [ 373592, "wide", "ITEpJX8nLTAzJD8EEQksJQILIBAjESkQLQ8GFDwcLx4zIToDNz0vGwooIhMUEAATGRwRBRY8BhYJJCM4GhkaGiIDEScbPj0IMQYiECk+BQ4CCAs+GiUBIDgPDQQkISI4" ], [ 374072, "wide", "Fjs/JTU5NXwOMzcveyomODYvKSkkLyA6ZC1qJCMueDI+Iz16NCM2LykpLi8zLBEuEjA/JA0FIiIAPjkMHh4CBik+NiMqDxcBCgEHIgoDPxw5BCMSLwAAACc=" ], [ 374320, "wide", "NDclbHU+SHQpHiE6KxsTPwsMBAwnFg0FMQM2JRwTPS4eNwITCAEfHQE5DholGQ8UJjs3Cj8+KgQDGToIMycBOz4kMxQiBjYlJwc+OxUJPg8VFAciIDosAxMcNBM7Fjo2" ], [ 374952, "wide", "CQ0oKTkmABk4OxAsNwEcAhAUEB4XIDY1OyUUGx0eBD0GJxICNx0OOwgzICkUOD8OIgA7BQMxHQUpORkxGQIiPCQTNiMQKDM5Oz40OA4OOCk8JCoTJyAJGxEhECMoKwMU" ], [ 375360, "wide", "CSUUHTYdKh0wKAo5JQEXLAsIED0INBguAB0yNyQOIB0dEgYUERUMIjMaDQEFOyooLjkHFyIFESUKNhIPPD4eEDQEAgIsLg86KScSMAwuIRA/DRoGBiUPADALBCQmFgEa" ], [ 375872, "wide", "cGRjNX9ycWM+ZWIuYWtzeGgicG1gdCsXASAzETs4ECQfNDsPOAIsKx8ADikQLikqCyo2CxkNIDseOToVATEnHigjADw5PQ0hKCEgIA0DAAAANw==" ], [ 376100, "AgUdCSEUMQEIGDErNSYCAAAADA==" ], [ 376132, "wide", "ASYkNBY8LAM1CCUAAAAH" ], [ 376176, "wide", "EzU9IjUGDz0QPR0lJjkAGDU0MgwCKAkOMSApCjU8OhkjNCY2MSMKLigdEwwyGi88DRgZFQ4GMxwjHDUeHzs1KRgHBRM8CQ4ONA0ULQ4FJh8EKBsGDSUxJi0+NhcUPwky" ], [ 376864, "wide", "cDg1BRo9ET0UIiMoNRwhPAkpAAAADw==" ], [ 376936, "wide", "cDA1OjQ4AisqIwUtJj0zEQgiOz4GEi4SPB0GPgMjLBkZGxE5BysQMjAgDSoaKyMTCR0kFx89GCIMKSM2LxUEEyE5LTYbAxEsEDweHzQHKRIhMQgTKRAOBwANLRwHGR8a" ], [ 377424, "wide", "cCE3NSknCCAjIDcMAzEaEjIqAg4+MSAAOAImMhEuLQMnAQQECh4jCAMPECE1ECAoOwQKJAUlCgYPIgMBBzMGGjIdJBcZLA45DjoyATsVBgQDBSAEESQUGS4SLD0GGwYV" ], [ 377744, "wide", "PjEjPzU7cmN0LismNjs+BQwVDSEHPiMjDiIPAwUvFDckAxQQMBYJDDM4DBwCOw0lHh8KNCU5JxcoGRUQPQMLPgIxEjI5Bjc5KggAAAA+" ], [ 377960, "BCE0IykRND02GjUlIi4lOxMrKy81CC45LgIUAiwBIx0UNSMnBR8KCQ8cFiY+BCgAJTAXEQA9ODk2PiINOxUEHTsyCCEcLzciEQ4XAjkSCzIJIBkiHiMvHSYxBg4fFTUf" ], [ 378248, "wide", "CQgFFgE6GxQbPgM4CAkxGQ8AASoCCCU/HRMtOjYNLBU0EyQxKSEsDQwfOA0dHRUsCSY1Pig+PRsVORgTJjweGQI1GRA4LRUYKS8bDCMBBREGBwcBLj4zEQIaFiMlJCkl" ], [ 378704, "wide", "CTUlHyUDABI2AwMcMjo8IzQlKAYgJQUbISceGzkuLQMfKREDBDo1Hh8fCSEDPy8VAQMZCzkwOQIiBx8eMTcpAzshFhwJDQYdBCAbETUQOjEVFyo3PTwsFiwSJj8JCSYi" ], [ 379332, "HCcGPidhdQEoJSQvMjgjDyoRODgeAAA/JwwIKgAAAA4=" ], [ 379384, "wide", "PjEjPzU7cmMMOSAeOQ8mAhkwIyIHNR8OOh8uNjwgNzgyCz8VOz8SCRYgOQQhDSATBScDKwU1HwUJPi4VFDgzAygGMjUDBzIAECYsLTAjDzkBCTsyOA8ANzsODCIwAAMF" ], [ 380088, "wide", "ET0iITw2OB87JyIoJCUeBxMrEisIPh02Hx4UGBgWPg0nJAgTBDcuLSUNIwEvAhwpCB4JDQkDEREzODM/ExkZNAAHER8fGj8cLSgQJgseMAscAAYODiMfES06JTYeIwMC" ], [ 380376, "wide", "Jzs+JQwEJDIvOC4+OAgzJi4jOHoUMwMwDhI3BxM6PgcjBjckNSI0KQQfKTEPOQkIDgATDw4aAyMtPRYsIjcjMh8DNB4cOCY+BQY7Hww2JQwyNjoABiwXISMxOAMCNhcQ" ], [ 380784, "wide", "BSY+NSU0NQIuKzMvIio6Hh8OCSE4Nzc/PwcKKicXGzEQIgIjKxgAPR4wNiE5JQkgAgUcDz02BSQPByQ3LA0eNx4UFAgRLh0fFgEYMAkHASwbKzkYGTA3KhgXExY5BCEW" ], [ 381144, "wide", "BhEdFBMDYRUzOTcmIDIYKTcjZmgANCAwPjYzACA4ITFxFwIYDHEbJDMjFyIkPSkWOCc0MywgDjMOCzE8Fj8ICSE4LjIrLR4+OS0hASI3LzAzHD4mCS8dOjcaAjYYAjgC" ], [ 381624, "wide", "Jzs+JQwEJDIvOC4+OAgzJi4jODghKDsaITIUKgwUJTo+NSM6DTIYBjAuMB41BgIIPjwENSUZDDMVEhAePxcDCwccIhMYDyEkGDoPPB8DJTEqExgRDhwDMjo0HTsAAABJ" ], [ 381888, "wide", "GjoQMjMyMiIJKSYkLyI4Lx8oKyo8IysYOzEhHjgfOh0mGCI9ID82Hx8CKhIaETkROwIRECw5LzAmCTMBNjwBKDYOJAINMjIOLQIzLSoxDiUTExU4MjAGFjALLBESBgAb" ], [ 382432, "wide", "BSY+NSU0NQQqPigOID8zJC4yHwY4KQIWEjgvBxkQJxgBBiEFEBcPKQweFj0mIh0OLSoqBQESAAAAJw==" ], [ 382600, "wide", "BhEdFBMDYRUzOTcmIDIYKTcjZmgfKA43KDA0IAc6NDo/OD4wBD87KCsvJWd2GCgpLj0zMhokPzoDMiA8dRIDHh13AD8uIxEjMz4lGCgpLj0zMgYcLR8EAD49JyYAHBQG" ], [ 383064, "wide", "C341PxQ2JTUbIR0dIwUwADIBLxEUMhwZAj4mJxA2MT04FRYyNzQsGAgMLyQSGigzGSkIPjcbKgYICgYVMi4/PyYtIxg9JiQALyARES0BKx4iFhczMwczJzo7PwQjJQIQ" ], [ 383488, "wide", "ET0iITw2OB87JyInDwoPPAMnAh05AicnPhMBGzs0MxIzJD8UMyI+HywYJBg9HSkTAyo1ECYGHA0BITg+ITg6JDIvFiAsMikfMCAjKgMgHQ01FScyBjwABR0/ND8nBjwm" ], [ 383992, "wide", "ET0iITw2OB87JyIAFT4QDQgwDBozBBU+OiUPGB0OBzYfKBMWFjcqDBEBBR4mLTQXKy4WDT0SCSc/MDAKBDofKCkkOxI4DS8COAcxKR0jIDs8HCsxJiQKHwUrPA4eMiUl" ], [ 384328, "wide", "BSY+NSU0NQIuKzMvCR4wKRwFAzw2ETkuGxIxHh0gECwFBho9BDUZOjUJFg4EDDMxHgMEAwEEHwIoBDAYAAAAMA==" ], [ 384512, "wide", "CygBNz0nGT0fMC0SIgknHhw8OAUcCwgfLw8PBQI4BBsLFTIRIxMbPxQoCgA5Dj8nLCMDEAYnGTYJEjYoPzcFFRY+IDg+ODYFBC8gPhInABEcKQM/JwM/PTEDLQYVHhYU" ], [ 384992, "wide", "BSY+NSU0NQIuKzMvGyI+Mj8EJz8iJAsFPRY/BBwyGzs0KSgULAYyKSAcECERPiwfJQQIESITGwMfOjcqOwI0OCkfIDg+HQ0LDT4CORI8ODoZACg4EQ0kKT4AAzoiOjM4" ], [ 385472, "wide", "GjoQMjMyMiIJKSYkLyI4Lx8oKyo8IysNKCMfAgUBPT4AAAAJ" ], [ 385576, "wide", "CygCJwovABQuOjUeDjoOJBwzICoGKyUVAR4iJSc2AAAAHA==" ], [ 385680, "wide", "GjoQMjMyMiIJKSYkLyI4Lx8oKyo8IysAGQ0oMRU0Njk3NgoiCScgDxYlExwFPywpDy0HCQkCJjIgMAENJyY4KzMHJCY9AyI7LQcDGggcBQE9HgIjDQ0MGhsROQ0XHDEx" ], [ 386256, "wide", "C3kPKBctMyEpBwA5FA8zDiwnPgIkCjkRLiI2HhkUBDwyHic4Gxw1LDMICiAjLTQ1GwAAAC4=" ], [ 386408, "wide", "BhEdFBMDYXt6DBUFDGsXJi4vGTgpMS4mLgU1PDAsNiAbIBk0FAIvJigGKAEsERUUByYnPjg7IyEFJy0DDyA1ARoDDwU+PhMTDwIVIiAFBgspKxU/PiYdMjc8Az4YEB8P" ], [ 387176, "wide", "C34AICY+LiA5BxcnNAABHx4NPBofPi0QEyc0OjAXEAAEEz08JRsrITIcKgo5OhsFAScUFSMfCBg1MhEDHjEUHTkNEDwNLQ0GDwIRPAMCOCQdEz8iPyAlGTobIAYcFjcD" ], [ 387864, "wide", "ET0iITw2OB87JyINOAE1JxUACDgqCyANLTEFITYvByUnCz8vKRUCGCA4Jg8CEC0MCyQ4Mz4MHg0IIicUNjMnHB4kGDIcGx4tBC8AKhITHh0dHhobLTMyFw40BDA+Fxgz" ], [ 388464, "wide", "ET0iITw2OB87JyIkESghIQAPOR0WMQkOOhIIEQ4MDxgXBCAfNAsjIRAOKzkRJykzHxokAQk2Lxs1KgQANwQ1OQYHNRQQAyk6LT4DGQkfIT0BDBgdBhsMFh4/MRErPjQQ" ], [ 388968, "wide", "BSY+NSU0NQIuKzMvEi4PDDUyJzsbFhYNODAEOwUOPDgSEwo+FTcYKDEwCRE6IwoUPj4FHDgwLBsfGzMbAx8XBCcHFwIiJzcyNwYDJiAMDhgUHAgnLBQAOA0jAD0DAzcA" ], [ 389496, "wide", "Cyg4Ph0iMxYpHz0QBxMGLDgKJwYSLSE7LhkINjkLBQ04IBg6JT4KPR4BODg1EDsKKCcjFDofCT8PORohFCMYJz4+GT09AxMvBBoPAhQwOgMpLwY3PRoSPBMLEBoSBzo4" ], [ 390096, "wide", "BSY+NSU0NQIuKzMvMCQ8AREEDBs+Lg0iEzoCJgQXMRYZMDQGDzgLMA48GQQcBA8+CDIgHwYGDDgwIg09GwwfAygbDzYABCMeBCcXGTkALBEbBTkSATMiHBkhBCULATQn" ], [ 390520, "wide", "GDs1NDw/EjgrOiIOODsXJxk/ABofLwIlHz4DOzUcEB0LHxEnJyAyKCUBAwIiCRIIJCAjKBY1MjgLBS0REz4hCzoSJTsCGTAAGA4ZPxwfIDkdDgsjCRwiJB8RAgAgBiMg" ], [ 390968, "wide", "BhEdFBMDYRw1LiImYQ0EBxdmHSE+dX0LDzw0OBArPCI0CCoQGBo/LQ0JFx04HCkhKwIgFQIBIAMkOTA6EzoLJjc+NB8cJxY7BykVCSsQMzkJLzw3AAw9JCA6ABc7Eyk2" ], [ 391504, "wide", "BxseBQwUCBwMeBcNNz8eOgoCGjofAxkeOS0tERIhLTMAATsuCiUpPgI8IigiLSg8IQopCQUOOCA2IjINOhASISkgBhkZLSQpKjIAOzsFHSwgFx4HHgYSOz47LxoABBo7" ], [ 391848, "wide", "C34aIRsxLzoXDw0OLAoVJxMcDDAcPws8GDkwOAUXEhc8KTYaDyI5CR8eAAoCOQ8jLwsEFRgkPDgLHiIsMiUCPR0dIgUrLBEHMQQ3PCgEPQAzKR4dGSAKMAYhJyYYFCAF" ], [ 392144, "wide", "GDs1NDwVGzcNCzcwMxkFJi4LHjgBPwcgExQ2HwESIA4CGxMFLhsiMyQLEQkGAg8VBgQWNik4OQ0sIj07OjsFMwA8NgESGRE9BgkSHhUOPC4+EAI/HRECHh46IhYDHgcj" ], [ 392584, "wide", "GzU8NBkcCQc+PyQ5Ji8PGTsuDiUVFz4xDTYEPT8+MgY2HToCMDcMHzYwFxEjHTIDEB49Ex4yDgIvGSYPBxwEJQMRBRoUGw4JLj08PRU/OCkbFgwyPSQtPQQQBgIeMiYV" ], [ 393184, "wide", "BhEdFBMDYR87JyJqBxkZBXoRIyZjdBAXJDg3JiA8JwcoIiQyLAEoJSM/Ij84OxEwOAwdIBoOOycDIQw+Fh8bKToeNBUrKB4/KwoYJD0DJBA+CCg2AS0/Ji4OJxMSIjYj" ], [ 393480, "wide", "BxseBQwUCBwMeBAgChsDLBIwLAUpKQ0MExwzPyQQFzoXBSogNTA1KAobBR87ERgpDzwYKyUAKAYqJRc/Fx0bBSgbAAAAOA==" ], [ 393680, "wide", "C34VIB0mAx4+OxAcBSICHDIBGiM2Cig/PTYtJh0/GxMkPhk+GCMROR04FCwzIj88KD0eCQo2Pw0QOicrBDsJHDgyAAAAQA==" ], [ 393880, "wide", "GzU8NBgTDiMZJAI+Az8HARkoPzgmNRY4PyQ2GT8aJD4DExwDEQkPKzMFCR4YAAAAKQ==" ], [ 394024, "ZXphf2B5cTApOSQrNAMHKRQjGyUoLD8EDiUEBTIWGDEmFDQGDSg4DiEPCykOPhAEEBweBQQ2LhoEFz0pOyUWHhkCEh8SOj4wDRgFDjM1Pg4aNT4FDSERGAAAAFE=" ], [ 394152, "wide", "ET0iITw2OB87JyIHGQAcGB0uBg8SCD4aBjIzGSQ9PjAwMz4AAjYpLAIoDAIUBBg8EjwjEBUyMT00MREoLwc4OiYVBx8PPRUcAC4AIDIPAx0hCxwkKDMMKzULEj4pPQc8" ], [ 394720, "wide", "BhEdFBMDYRUzOTcmIDIYKTcjag4CCQJ0HDwpYGYGBi0iJTU6BSMzPCI4YRweDQgDagw5NT84KiwJMjk8dRgYGhV3ZgUbGmodKCVzbxkoJwonICAjOhgVBhMBNhEiExsY" ], [ 395072, "wide", "BxseBQwUCBwMeCI8FiEEETQNAT8/LAAjAgMgBhkJPzAoHzgeLDYrKDUOBAwmOwgXIAM1HAkeJRQsBj0UBBYDNTEAKgkSEz0YND8MAi8HDjk1EiUDOxomAwMVMDgBPx8f" ], [ 395624, "wide", "BhsXBQcWExQGBy4pMyQlJzwyFh85KCs7PCYbECErJzE/JQYyMyIzJSkWADsmaAonPiAjGgk9LzErNiZ3MCw0FTMVBAsdPRIgDCAGHDkjIBkyMTgQGwwNCzIoLxYJFD0A" ] ], "sz": 576224, "ts": [ { "c": 1.0, "d": "Authenticode chain CN: Thawte Timestamping CA", "e": [ "Thawte Timestamping CA" ], "i": "metadata/signed/developer::thawte-timestamping-ca", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: Symantec Time Stamping Services CA - G2", "e": [ "Symantec Time Stamping Services CA - G2" ], "i": "metadata/signed/developer::symantec-time-stamping-services-ca---g2", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: TimeStamp-2048-1", "e": [ "TimeStamp-2048-1" ], "i": "metadata/signed/developer::timestamp-2048-1", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: Symantec Time Stamping Services Signer - G4", "e": [ "Symantec Time Stamping Services Signer - G4" ], "i": "metadata/signed/developer::symantec-time-stamping-services-signer---g4", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: TimeStamp-2048-2", "e": [ "TimeStamp-2048-2" ], "i": "metadata/signed/developer::timestamp-2048-2", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: VeriSign Class 3 Code Signing 2010 CA", "e": [ "VeriSign Class 3 Code Signing 2010 CA" ], "i": "metadata/signed/developer::verisign-class-3-code-signing-2010-ca", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: Lucky Bright", "e": [ "Lucky Bright" ], "i": "metadata/signed/developer::lucky-bright", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: VeriSign Class 3 Public Primary Certification Authority - G5", "e": [ "VeriSign Class 3 Public Primary Certification Authority - G5" ], "i": "metadata/signed/developer::verisign-class-3-public-primary-certification-authority---g5", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: VeriSignMPKI-2-8", "e": [ "VeriSignMPKI-2-8" ], "i": "metadata/signed/developer::verisignmpki-2-8", "l": 2 }, { "c": 1.0, "d": "Signed by Lucky Bright", "e": [ "Lucky Bright" ], "i": "metadata/signed/leaf::lucky-bright", "l": 3 }, { "c": 0.8999999761581421, "d": "Get process exit code", "e": [ "GetExitCodeProcess" ], "i": "micro-behaviors/process/create/spawn::get-exit-code-process", "l": 2 }, { "a": "T1106", "c": 0.699999988079071, "d": "EnumSystemLocales API", "e": [ "EnumSystemLocalesW" ], "i": "objectives/evasion/process/injection/callback::enum-locale-callback", "l": 3, "m": "E1106" }, { "c": 0.8799999952316284, "d": "Import encrypted key material", "e": [ "CryptImportKey" ], "i": "micro-behaviors/crypto/library/provider::crypt-import-key", "l": 3 }, { "c": 0.7799999713897705, "d": "Combine filesystem paths via Shlwapi", "e": [ "PathCombineW" ], "i": "micro-behaviors/fs/path/construct::path-combine", "l": 2 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "47", "49", "46", "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2 }, { "a": "T1027.003", "c": 0.7799999713897705, "d": ".NET resource manager reference", "e": [ ".?AUIResourceManager@Concurrency@@", ".?AVResourceManager@details@Concurrency@@" ], "i": "micro-behaviors/data/embedded/payload/image::dotnet-resource-manager-token", "l": 1, "m": "F0001.006" }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 1307.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 1.0, "d": "PE carries side-by-side assembly manifest", "e": [ "{\"requested_execution_level\":\"requireAdministrator\",\"ui_access\":false,\"supported_os\":[{\"guid\":\"{e2011457-1546-43c5-a5fe-008deee3" ], "i": "metadata/build/manifest::pe-has-manifest", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial resources", "e": [ "binary.rsrc_to_file_ratio = 0.01" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-resources", "l": 1, "m": "E1055.012" }, { "a": "T1071.001", "c": 0.8600000143051147, "d": "UUID formatted route segment", "e": [ "16a6ca3b-7d2d-4120-810d-d477b9a06688", "e2011457-1546-43c5-a5fe-008deee3d3f0" ], "i": "objectives/command-and-control/channel/http/stego::uuid-format-route-segment", "l": 1, "m": "B0030" }, { "a": "T1222.001", "c": 0.949999988079071, "d": "Modify memory page protection", "e": [ "VirtualProtect" ], "i": "micro-behaviors/mem/protect/modify::virtual-protect", "l": 2, "m": "C0021" }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 5.84" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "a": "T1049", "c": 0.8999999761581421, "d": "Enumerate active UDP listeners", "e": [ "GetUdpTable" ], "i": "micro-behaviors/os/network/connections::get-udp-table", "l": 3 }, { "c": 0.8999999761581421, "d": "Decode base64/hex string via CryptoAPI", "e": [ "CryptStringToBinaryA" ], "i": "micro-behaviors/crypto/library/encoding::crypt-string-to-binary", "l": 3 }, { "c": 0.8999999761581421, "d": "Decrypt buffer with CryptoAPI", "e": [ "CryptDecrypt" ], "i": "micro-behaviors/crypto/library/provider::crypt-decrypt", "l": 3 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 247.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 0.4000000059604645, "d": "HKCU registry hive reference", "e": [ "HKCU" ], "i": "micro-behaviors/os/registry/access::hkcu-hive", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1436633660.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8399999737739563, "d": "Initialize COM security context", "e": [ "CoInitializeSecurity" ], "i": "micro-behaviors/os/com/invoke::co-initialize-security", "l": 3 }, { "c": 1.0, "d": "Reference to ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "micro-behaviors/os/module/load::advapi32-dll-reference", "l": 2 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Large PE imports over 120", "e": [ "binary.import_count = 247.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::import-count-over-120", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "c": 0.8999999761581421, "d": "Set file position extended", "e": [ "SetFilePointerEx" ], "i": "micro-behaviors/fs/file/handle::set-file-pointer-ex", "l": 2 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "c": 1.0, "d": "Reference to SHELL32.dll", "e": [ "SHELL32.dll" ], "i": "micro-behaviors/os/module/load::shell32-dll-reference", "l": 2 }, { "c": 0.8999999761581421, "d": "Atomically push entry to thread-safe list", "e": [ "InterlockedPushEntrySList" ], "i": "micro-behaviors/mem/sync/mutex::interlocked-push-entry-slist", "l": 2 }, { "c": 0.75, "d": "CreateTimerQueue import (rare, common padding symbol)", "e": [ "CreateTimerQueue" ], "i": "metadata/binary/anomaly/format::import-padding-timer-queue", "l": 1 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.has_rich_header = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.800000011920929, "d": "ReleaseMutex API call", "e": [ "ReleaseMutex" ], "i": "micro-behaviors/process/sync/mutex::release-mutex", "l": 2, "m": "C0042" }, { "c": 0.8999999761581421, "d": "Atomically pop entry from thread-safe list", "e": [ "InterlockedPopEntrySList" ], "i": "micro-behaviors/mem/sync/mutex::interlocked-pop-entry-slist", "l": 2 }, { "c": 1.0, "d": "Links to ADVAPI32.dll (Service Management)", "e": [ "DeregisterEventSource" ], "i": "micro-behaviors/os/service/host::advapi32-link", "l": 2 }, { "c": 0.800000011920929, "d": "Resolve special folder path via Shell32", "e": [ "SHGetFolderPathW" ], "i": "micro-behaviors/fs/shell-ops::shell-get-folder-path", "l": 2 }, { "c": 0.9200000166893005, "d": "Write Windows event log entry", "e": [ "ReportEventW" ], "i": "micro-behaviors/os/event/log::report-event", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 1735.00" ], "i": "metadata/binary/metrics/threshold::few-functions-3", "l": 1 }, { "a": "T1057", "c": 0.800000011920929, "d": "PSAPI.dll dynamic load string", "e": [ "PSAPI" ], "i": "micro-behaviors/process/enumerate/psapi::psapi-dll-string", "l": 1 }, { "a": "T1071.001", "c": 0.8399999737739563, "d": "WinHTTP receive response text reference", "e": [ "WinHttpReceiveResponse" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-receive-response-text", "l": 1, "m": "C0002" }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "14852" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2 }, { "c": 0.8799999952316284, "d": "Delete registry value", "e": [ "RegDeleteValueW" ], "i": "micro-behaviors/os/registry/manipulate::reg-delete-value", "l": 1 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.800000011920929, "d": "Convert SID to string representation", "e": [ "ConvertSidToStringSidW" ], "i": "micro-behaviors/os/group/lookup::convert-sid-to-string", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "Advapi32.dll", "Dadvapi32.dll", "ADVAPI32.dll" ], "i": "metadata/binary/symbols/imports::imports-advapi32-dll", "l": 1 }, { "c": 1.0, "d": "Reference to USER32.dll", "e": [ "USER32.dll" ], "i": "micro-behaviors/os/module/load::user32-dll-reference", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "binary.import_count = 247.00" ], "i": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "l": 1 }, { "c": 0.8999999761581421, "d": "Exit thread execution", "e": [ "ExitThread" ], "i": "micro-behaviors/process/thread/create::exit-thread", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 5.47" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.4000000059604645, "d": "HKLM registry hive reference", "e": [ "HKLM" ], "i": "micro-behaviors/os/registry/access::hklm-hive", "l": 2 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version_info.company_name' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1 }, { "a": "T1071", "c": 0.8999999761581421, "d": "OLE automation DLL import", "e": [ "OLEAUT32.dll" ], "i": "objectives/command-and-control/backdoor/shell/com::oleaut32-import-reference", "l": 1, "m": "B0025" }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.8999999761581421, "d": "Strip filename from path", "e": [ "PathRemoveFileSpecW" ], "i": "micro-behaviors/fs/path/check::path-remove-file-spec", "l": 2 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/handle::get-file-type", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 247.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "a": "T1071", "c": 1.0, "d": "oleaut32 ordinal 15", "e": [ "ORDINAL 15" ], "i": "objectives/command-and-control/backdoor/shell/com::oleaut-ordinal-15", "l": 1, "m": "B0025" }, { "a": "T1112", "c": 0.8999999761581421, "d": "RegQueryValueEx API", "e": [ "RegQueryValueExW" ], "i": "objectives/anti-static/obfuscation/payload/registry::reg-query-value", "l": 1, "m": "B0032" }, { "a": "T1112", "c": 0.8500000238418579, "d": "Create registry key via WinAPI", "e": [ "RegCreateKeyExW" ], "i": "micro-behaviors/os/registry/access::reg-create-key-ex-w", "l": 2 }, { "a": "T1071.001", "c": 0.8500000238418579, "d": "Read WinHTTP response body", "e": [ "WinHttpReadData" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-read-data", "l": 3, "m": "C0002" }, { "c": 0.8500000238418579, "d": "Post message to thread (Unicode)", "e": [ "PostThreadMessageW" ], "i": "micro-behaviors/os/message/queue::post-thread-message-w", "l": 2 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2 }, { "a": "T1106", "c": 0.949999988079071, "d": "Create process (Unicode)", "e": [ "CreateProcessW" ], "i": "micro-behaviors/process/create/spawn::create-process-w", "l": 3 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Size PE resource payload", "e": [ "SizeofResource" ], "i": "micro-behaviors/data/embedded/payload/resource::sizeof-resource", "l": 2 }, { "c": 0.9800000190734863, "d": "Regex component marker", "e": [ "binary.func_count = 1735.00" ], "i": "micro-behaviors/process/terminate/kill::toolhelp-kill-loop-source-cond-6--inline-3846", "l": 1 }, { "a": "T1486", "c": 0.8999999761581421, "d": "Acquire cryptographic service provider context", "e": [ "CryptAcquireContextW" ], "i": "micro-behaviors/crypto/library/provider::crypt-acquire-context", "l": 3, "m": "C0027" }, { "c": 0.6600000262260437, "d": "Create directories (Windows API Unicode)", "e": [ "CreateDirectoryW" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-w", "l": 2 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-locale-info", "l": 2 }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 9 (htons)", "e": [ "ORDINAL 9" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-9", "l": 1 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "REGISTRY", "OHSSVSSW", "SECURITY" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Locate PE resource entry", "e": [ "FindResourceW" ], "i": "micro-behaviors/data/embedded/payload/resource::find-resource-w", "l": 2 }, { "c": 0.7799999713897705, "d": "Uninitialize COM subsystem", "e": [ "CoUninitialize" ], "i": "micro-behaviors/os/com/invoke::co-uninitialize", "l": 2 }, { "c": 0.8999999761581421, "d": "WinExec hidden-window flag immediate", "e": [ "00 50 45 00", "50 50 45 00" ], "i": "micro-behaviors/process/create/flags::winexec-sw-hide-immediate", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.800000011920929, "d": "Set event object state", "e": [ "SetEvent" ], "i": "micro-behaviors/process/sync/event::set-event", "l": 2, "m": "C0039" }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 247.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Access PE resource data pointer", "e": [ "LockResource" ], "i": "micro-behaviors/data/embedded/payload/resource::lock-resource", "l": 2 }, { "a": "T1543.003", "c": 0.9300000071525574, "d": "Program can open Windows services", "e": [ "OpenServiceW" ], "i": "micro-behaviors/os/service/control::open-service-import", "l": 3 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 247.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 1.0, "d": "Suspicious combination of imported APIs", "e": [ "pe.api_hashing_indicator_count = 1.00" ], "i": "metadata/binary/metrics/anomaly::suspicious-import-combo-marker", "l": 1 }, { "c": 0.8999999761581421, "d": "Local memory allocation", "e": [ "LocalAlloc" ], "i": "micro-behaviors/mem/alloc/heap::local-alloc", "l": 2 }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "binary.section_count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "c": 0.800000011920929, "d": "Resolve account name to SID", "e": [ "LookupAccountNameW" ], "i": "micro-behaviors/os/user/lookup::lookup-account-name", "l": 2 }, { "c": 0.8199999928474426, "d": "Set COM proxy security", "e": [ "CoSetProxyBlanket" ], "i": "micro-behaviors/os/com/invoke::co-set-proxy-blanket", "l": 2 }, { "c": 0.8999999761581421, "d": "Convert SYSTEMTIME to FILETIME", "e": [ "SystemTimeToFileTime" ], "i": "micro-behaviors/time/query::systemtime-to-filetime", "l": 2 }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/handle::set-std-handle", "l": 2 }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "1.0.5670.17826" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1 }, { "c": 0.8799999952316284, "d": "Register Windows event source", "e": [ "RegisterEventSourceW" ], "i": "micro-behaviors/os/event/log::register-event-source", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 247.00" ], "i": "metadata/binary/metrics/structural::many-imports", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2 }, { "c": 0.8999999761581421, "d": "Local memory deallocation", "e": [ "LocalFree" ], "i": "micro-behaviors/mem/alloc/heap::local-free", "l": 2 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 593920.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 16130.00" ], "i": "metadata/binary/metrics/structural::dense-basic-blocks", "l": 1 }, { "a": "T1027,T1112,T1059.001", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "RegSetValueExW" ], "i": "objectives/command-and-control/dropper/staging/embedded::registry-powershell-byte-payload--rx-4", "l": 1 }, { "a": "T1543.003", "c": 0.949999988079071, "d": "Program can create Windows services", "e": [ "CreateServiceW" ], "i": "micro-behaviors/os/service/control::create-service-import", "l": 3 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryW" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.8799999952316284, "d": "Resolve CLSID from string", "e": [ "CLSIDFromString" ], "i": "micro-behaviors/os/com/invoke::clsid-from-string", "l": 2 }, { "c": 1.0, "d": "MoveFileExW import", "e": [ "MoveFileExW" ], "i": "objectives/command-and-control/dropper/staging/resource::move-file-ex-w-import", "l": 1 }, { "c": 0.9200000166893005, "d": "Registry write API text references", "e": [ "RegSetValueExW" ], "i": "objectives/command-and-control/dropper/staging/resource::registry-write-text", "l": 1 }, { "c": 0.8199999928474426, "d": "GetWindowsDirectory API string", "e": [ "GetWindowsDirectoryW" ], "i": "micro-behaviors/os/sysinfo/directories::get-windows-directory-string", "l": 2 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "c": 0.800000011920929, "d": "SaveToFile string fragment (eToF)", "e": [ "LocalFileTimeToFileTime", "SystemTimeToFileTime" ], "i": "objectives/execution/interpreter/script/wsh-fragments::save-to-file-fragment-etof", "l": 1 }, { "d": "Lowercase alphanumeric character set (digits first)", "e": [ "0123456789abcdefghijklmnopqrstuvwxyz" ], "i": "micro-behaviors/data/encode/charset::lowercase-digits-alphabet", "l": 1 }, { "c": 0.8999999761581421, "d": "Create semaphore object", "e": [ "CreateSemaphoreW" ], "i": "micro-behaviors/process/sync/semaphore::create-semaphore", "l": 2, "m": "C0042" }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 247.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Atomically flush thread-safe list", "e": [ "InterlockedFlushSList" ], "i": "micro-behaviors/mem/sync/mutex::interlocked-flush-slist", "l": 2 }, { "c": 0.8500000238418579, "d": "Wait on multiple object handles", "e": [ "WaitForMultipleObjects" ], "i": "micro-behaviors/process/sync/semaphore::wait-for-multiple-objects", "l": 2, "m": "C0042" }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineW" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "a": "T1071.001", "c": 0.8399999737739563, "d": "Parse URL with WinHTTP helper", "e": [ "WinHttpCrackUrl" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-crack-url", "l": 3, "m": "C0002" }, { "c": 0.6600000262260437, "d": "Delete files (Windows API)", "e": [ "DeleteFileW" ], "i": "micro-behaviors/fs/file/delete::deletefile-w", "l": 3 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "GetEnvironmentStringsW", "LCMapStringW", "OutputDebugStringW", "StringFileInfo", "CryptStringToBinaryA", "CryptBinaryToStringA", "LoadStringW", "CompareStringEx", "invalid string position", "LCMapStringEx", "StringFromCLSID", "ConvertSidToStringSidW", "CLSIDFromString", "GetStringTypeW", "FreeEnvironmentStringsW", "string too long" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "d": "overflow keyword", "e": [ "_DebugMallocator\u003cT\u003e::allocate() - Integer overflow." ], "i": "micro-behaviors/data/text/keywords/lexicon::overflow", "l": 1 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.800000011920929, "d": "Manifest requires administrator privileges", "e": [ "\u003crequestedExecutionLevel level=\"requireAdministrator" ], "i": "micro-behaviors/os/privilege/manifest::require-administrator", "l": 3 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "a": "T1027.007", "c": 1.0, "d": "PE has an Authenticode signature", "e": [ "binary.has_signature = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-is-authenticode-signed", "l": 2, "m": "B0032" }, { "c": 0.8500000238418579, "d": "PE checksum field not set", "e": [ "pe.has_checksum = 1.00" ], "i": "metadata/binary/layout::pe-checksum-absent", "l": 1 }, { "c": 0.8500000238418579, "d": "Get message (Unicode)", "e": [ "GetMessageW" ], "i": "micro-behaviors/os/message/queue::get-message-w", "l": 2 }, { "c": 0.8999999761581421, "d": "CreateMutex API call", "e": [ "CreateMutexW" ], "i": "micro-behaviors/process/sync/mutex::create-mutex", "l": 2, "m": "C0042" }, { "c": 0.800000011920929, "d": "Create COM object instance", "e": [ "CoCreateInstance" ], "i": "micro-behaviors/os/com/invoke::co-create-instance", "l": 2 }, { "a": "T1106", "c": 0.8999999761581421, "d": "FFI GetProcAddress API name", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::ffi-getprocaddress-api", "l": 1 }, { "c": 0.699999988079071, "d": "Move to next character", "e": [ "CharNextW" ], "i": "micro-behaviors/ui/window/manage/control::char-next", "l": 2 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "a": "T1082", "c": 0.8500000238418579, "d": "Query user locale identifier", "e": [ "GetUserDefaultLCID" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-user-default-lcid", "l": 2 }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 6.65" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "Initialize WinHTTP session", "e": [ "WinHttpOpen" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-open", "l": 3, "m": "C0002" }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 247.00" ], "i": "metadata/binary/metrics/threshold::many-imports-100", "l": 1 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/handle::set-file-pointer", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.699999988079071, "d": "GetCurrentThread API call", "e": [ "GetCurrentThread" ], "i": "micro-behaviors/process/info/current::get-current-thread", "l": 2 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/handle::get-std-handle", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.func_count = 1735.00" ], "i": "metadata/binary/metrics/structural::many-functions", "l": 2 }, { "c": 0.8999999761581421, "d": "CreateTimerQueueTimer symbol", "e": [ "CreateTimerQueueTimer" ], "i": "micro-behaviors/time/schedule/callback/create::create-timer-queue-timer-sym", "l": 2 }, { "c": 0.8999999761581421, "d": "Move or rename file with options", "e": [ "MoveFileExW" ], "i": "micro-behaviors/fs/file/move::move-file-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize thread-safe list header", "e": [ "InitializeSListHead" ], "i": "micro-behaviors/mem/sync/mutex::initialize-slist-head", "l": 2 }, { "c": 0.6000000238418579, "d": "References to worker pools", "e": [ "Threadpool" ], "i": "micro-behaviors/process/create/workers::worker-pool", "l": 2 }, { "c": 0.8500000238418579, "d": "Query file attributes or existence", "e": [ "GetFileAttributesW" ], "i": "micro-behaviors/fs/path/check::get-file-attributes", "l": 2 }, { "a": "T1071.001", "c": 0.8399999737739563, "d": "WinHTTP send request text reference", "e": [ "WinHttpSendRequest" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-send-request-text", "l": 1, "m": "C0002" }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "WinHttpQueryHeaders" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-6", "l": 1 }, { "d": "COMPUTERNAME environment variable", "e": [ "GetComputerNameW" ], "i": "micro-behaviors/os/env/vars/system-info::computername-var", "l": 2 }, { "c": 0.8199999928474426, "d": "Get extended module handle", "e": [ "GetModuleHandleExW" ], "i": "micro-behaviors/os/module/load::get-module-handle-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "Check processor features (potential VM detection)", "e": [ "IsProcessorFeaturePresent" ], "i": "objectives/anti-analysis/vm-detect/processor-features::is-processor-feature-present", "l": 1, "m": "B0009" }, { "c": 0.6000000238418579, "d": "SOCKS5 UDP ASSOCIATE request opcode", "e": [ "05 03 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-udp-associate-byte", "l": 1 }, { "a": "T1543.003", "c": 0.9300000071525574, "d": "Program can start Windows services", "e": [ "StartServiceW" ], "i": "micro-behaviors/os/service/control::start-service-import", "l": 3 }, { "c": 0.699999988079071, "d": "Dispatch window message", "e": [ "DispatchMessageW" ], "i": "micro-behaviors/ui/window/manage/control::dispatch-message", "l": 2 }, { "a": "T1071.001", "c": 0.8799999952316284, "d": "Query WinHTTP response headers", "e": [ "WinHttpQueryHeaders" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-query-headers", "l": 3, "m": "C0002" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol", "e": [ "RegOpenKeyExW" ], "i": "micro-behaviors/os/registry/access::reg-open-key-ex-w-symbol", "l": 2 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial data section", "e": [ "binary.data_to_file_ratio = 0.02" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-data", "l": 1, "m": "E1055.012" }, { "c": 0.7799999713897705, "d": "Append child path via Shlwapi", "e": [ "PathAppendW" ], "i": "micro-behaviors/fs/path/construct::path-append", "l": 2 }, { "c": 0.75, "d": "Open process access token", "e": [ "OpenProcessToken" ], "i": "micro-behaviors/os/privilege/token::open-process-token", "l": 2 }, { "c": 0.8500000238418579, "d": "Read current working directory", "e": [ "GetCurrentDirectoryW" ], "i": "micro-behaviors/fs/traversal/drives::get-current-directory", "l": 2 }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 4 (connect)", "e": [ "ORDINAL 4" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-4", "l": 1 }, { "a": "T1082", "c": 0.8399999737739563, "d": "Enumerate installed system locales", "e": [ "EnumSystemLocalesEx", "EnumSystemLocalesW" ], "i": "micro-behaviors/os/sysinfo/platform/locale::enum-system-locales", "l": 2 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "c": 1.0, "d": "requestedExecutionLevel is requireAdministrator", "e": [ "requireAdministrator" ], "i": "metadata/build/manifest::pe-requires-admin", "l": 3 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "a": "T1049", "c": 0.8999999761581421, "d": "Enumerate active TCP connections", "e": [ "GetTcpTable" ], "i": "micro-behaviors/os/network/connections::get-tcp-table", "l": 3 }, { "c": 0.699999988079071, "d": "Encoded HTML tag fragment", "e": [ "\u003cprogram name unknown\u003e" ], "i": "objectives/anti-static/obfuscation/encoding/content::encoded-html-tag-fragment", "l": 1 }, { "c": 0.8600000143051147, "d": "Query locale information", "e": [ "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-locale-info-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 0.8999999761581421, "d": "Encode binary to base64/hex via CryptoAPI", "e": [ "CryptBinaryToStringA" ], "i": "micro-behaviors/crypto/library/encoding::crypt-binary-to-string", "l": 3 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query computer/host name", "e": [ "GetComputerNameW" ], "i": "micro-behaviors/os/sysinfo/hostname::get-computer-name", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.8500000238418579, "d": "Query window station object info", "e": [ "GetUserObjectInformationW" ], "i": "micro-behaviors/ui/window/station::get-user-object-information", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Load PE resource payload", "e": [ "LoadResource" ], "i": "micro-behaviors/data/embedded/payload/resource::load-resource", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "c": 0.8500000238418579, "d": "DarkGate C2 record with embedded key anchor", "e": [ "8bunz8" ], "i": "well-known/malware/trojan/darkgate::c2-record-key-anchor", "l": 1 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/handle::get-console-mode", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Check file existence via SHLWAPI", "e": [ "PathFileExistsW" ], "i": "micro-behaviors/fs/path/check::path-file-exists", "l": 2 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "a": "T1071", "c": 1.0, "d": "oleaut32 ordinal 2", "e": [ "ORDINAL 2" ], "i": "objectives/command-and-control/backdoor/shell/com::oleaut-ordinal-2", "l": 1, "m": "B0025" }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 1307.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/handle::flush-file-buffers", "l": 2 }, { "c": 1.0, "d": "OpenProcess/NtOpenProcess symbol", "e": [ "OpenProcess" ], "i": "objectives/evasion/fileless/memory::open-process-sym", "l": 1 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "Send WinHTTP request to server", "e": [ "WinHttpSendRequest" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-send-request", "l": 3, "m": "C0002" }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 6144.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "a": "T1106", "c": 0.949999988079071, "d": "Open process handle", "e": [ "OpenProcess" ], "i": "micro-behaviors/process/create/spawn::open-process", "l": 2 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime/clr::corexitprocess-string", "l": 3 }, { "a": "T1071.001", "c": 0.8500000238418579, "d": "Query WinHTTP buffered response bytes", "e": [ "WinHttpQueryDataAvailable" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-query-data-available", "l": 3, "m": "C0002" }, { "c": 0.8999999761581421, "d": "Create cryptographic hash object", "e": [ "CryptCreateHash" ], "i": "micro-behaviors/crypto/library/provider::crypt-create-hash", "l": 3 }, { "a": "T1112", "c": 0.8999999761581421, "d": "RegOpenKeyEx API", "e": [ "RegOpenKeyExW" ], "i": "objectives/anti-static/obfuscation/payload/registry::reg-open-key", "l": 1, "m": "B0032" }, { "a": "T1027.009", "c": 0.8500000238418579, "d": "Locate PE resource entry with language", "e": [ "FindResourceExW" ], "i": "micro-behaviors/data/embedded/payload/resource::find-resource-ex-w", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Query registry value via import symbol", "e": [ "RegQueryValueExW" ], "i": "micro-behaviors/os/registry/access::reg-query-value-ex-w-symbol", "l": 2 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "Receive WinHTTP server response", "e": [ "WinHttpReceiveResponse" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-receive-response", "l": 3, "m": "C0002" }, { "c": 0.8999999761581421, "d": "DeleteTimerQueueTimer symbol", "e": [ "DeleteTimerQueueTimer" ], "i": "micro-behaviors/time/schedule/callback/delete::delete-timer-queue-timer-sym", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "a": "T1543.003", "c": 0.949999988079071, "d": "Program opens service control manager", "e": [ "OpenSCManagerW" ], "i": "micro-behaviors/os/service/control::open-sc-manager-import", "l": 3 }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "14852" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8500000238418579, "d": "Modify file creation/access/write times", "e": [ "SetFileTime" ], "i": "micro-behaviors/fs/sync/fsync::set-file-time", "l": 3 }, { "c": 0.8500000238418579, "d": "Create named event object", "e": [ "CreateEventW" ], "i": "micro-behaviors/process/sync/event::create-event", "l": 2, "m": "C0039" }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.func_count = 1735.00" ], "i": "metadata/binary/metrics/threshold::many-functions-50", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc", ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "a": "T1071.001", "c": 0.800000011920929, "d": "Close WinHTTP handle object", "e": [ "WinHttpCloseHandle" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-close-handle", "l": 3, "m": "C0002" }, { "a": "T1027.003", "c": 0.9900000095367432, "d": "PE checksum mismatch", "e": [ "pe.checksum_valid = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/container::pe-checksum-mismatch-png", "l": 1, "m": "F0001.006" }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.8399999737739563, "d": "Enumerate installed locales", "e": [ "EnumSystemLocalesW" ], "i": "micro-behaviors/os/sysinfo/platform/locale::enum-system-locales-import", "l": 2 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "Connect WinHTTP to remote host", "e": [ "WinHttpConnect" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-connect", "l": 3, "m": "C0002" }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "Create WinHTTP HTTP request handle", "e": [ "WinHttpOpenRequest" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-open-request", "l": 3, "m": "C0002" }, { "c": 0.800000011920929, "d": "Duplicate object handle", "e": [ "DuplicateHandle" ], "i": "micro-behaviors/communications/ipc/pipe::duplicate-handle", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "c": 0.8500000238418579, "d": "Raise thread execution priority", "e": [ "SetThreadPriority" ], "i": "micro-behaviors/process/thread/priority::set-thread-priority", "l": 3 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process startup information", "e": [ "GetStartupInfoW" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info", "l": 2 }, { "a": "T1129", "c": 0.949999988079071, "d": "Create thread in current process", "e": [ "CreateThread" ], "i": "micro-behaviors/process/thread/create::create-thread", "l": 2 }, { "c": 0.800000011920929, "d": "Suppress error dialogs", "e": [ "SetErrorMode" ], "i": "micro-behaviors/os/exception/error-handling::set-error-mode", "l": 2 }, { "c": 0.8999999761581421, "d": "Hash data using crypto provider", "e": [ "CryptHashData" ], "i": "micro-behaviors/crypto/library/provider::crypt-hash-data", "l": 3 }, { "a": "T1106", "c": 0.8500000238418579, "d": "CreateProcessW API string", "e": [ "CreateProcessW" ], "i": "micro-behaviors/process/create/spawn::create-process-w-string", "l": 2 }, { "c": 0.800000011920929, "d": "Initialize COM apartment model", "e": [ "CoInitializeEx" ], "i": "micro-behaviors/os/com/invoke::co-initialize-ex", "l": 2 }, { "a": "T1622", "c": 0.8199999928474426, "d": "OutputDebugString anti-debug API", "e": [ "OutputDebugStringW" ], "i": "objectives/anti-analysis/debugger-detect/check::output-debug-string", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "Convert FILETIME to SYSTEMTIME", "e": [ "FileTimeToSystemTime" ], "i": "micro-behaviors/time/query::filetime-to-systemtime", "l": 2 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write/direct::write-file", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Set registry value via WinAPI", "e": [ "RegSetValueExW" ], "i": "micro-behaviors/os/registry/access::reg-set-value-ex-w", "l": 2 }, { "c": 0.8399999737739563, "d": "High PE import count", "e": [ "binary.import_count = 247.00" ], "i": "metadata/binary/section/metrics::high-import-count-pe", "l": 1 }, { "a": "T1055.012", "c": 0.800000011920929, "d": "CreateProcess API string reference", "e": [ "CreateProcessAsUserW", "CreateProcessW" ], "i": "objectives/evasion/process/injection/hollowing::create-process-string", "l": 1, "m": "E1055.012" }, { "c": 0.699999988079071, "d": "Free COM memory allocation", "e": [ "CoTaskMemFree" ], "i": "micro-behaviors/os/com/invoke::co-task-mem-free", "l": 2 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "c": 0.4000000059604645, "d": "Embedded ZIP archive", "e": [ "50 4B 03 04" ], "i": "micro-behaviors/data/embedded/payload/archive::zip-magic", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "GetComputerName API", "e": [ "GetComputerNameW" ], "i": "objectives/anti-static/obfuscation/payload/registry::get-computer-name", "l": 3, "m": "B0032" }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.65)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Get Windows installation directory", "e": [ "GetWindowsDirectoryW" ], "i": "micro-behaviors/os/sysinfo/directories::get-windows-directory", "l": 2 }, { "c": 1.0, "d": "PE Authenticode signature cryptographically valid", "e": [ "pe.signature_verified = 1.00" ], "i": "metadata/signed/certificate::pe-signature-verified", "l": 2 }, { "c": 0.8999999761581421, "d": "PE certificate table entry populated", "e": [ "pe.certificate_table_size = 7392.00" ], "i": "metadata/binary/layout::cert-table-present", "l": 1 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExW" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-version-ex", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 10752)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 1.0, "d": "VirtualProtect symbol", "e": [ "VirtualProtect" ], "i": "objectives/anti-static/obfuscation/reflection/class::virtualprotect-sym", "l": 1 }, { "a": "T1573", "c": 0.800000011920929, "d": "Regex component marker", "e": [ "\u003cVeriSign Class 3 Public Primary Certification Authority - G50", "spanish-dominican republic" ], "i": "micro-behaviors/crypto/asymmetric/kem::encrypted-trailer-terms--rx-4", "l": 1, "m": "C0027" }, { "c": 0.8999999761581421, "d": "Release cryptographic context", "e": [ "CryptReleaseContext" ], "i": "micro-behaviors/crypto/library/provider::crypt-release-context", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.54" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 0.8799999952316284, "d": "ATL module RTTI markers", "e": [ "CAtlException@ATL@@" ], "i": "metadata/binary/framework::atl-module-rtti", "l": 2 }, { "c": 0.8500000238418579, "d": "Release semaphore count", "e": [ "ReleaseSemaphore" ], "i": "micro-behaviors/process/sync/semaphore::release-semaphore", "l": 2, "m": "C0042" }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "CreateThread API name reference", "e": [ "CreateThread" ], "i": "micro-behaviors/process/threading/create::create-thread-text", "l": 2 }, { "c": 0.8999999761581421, "d": "Encrypt buffer with CryptoAPI", "e": [ "CryptEncrypt" ], "i": "micro-behaviors/crypto/library/provider::crypt-encrypt", "l": 3 }, { "a": "T1027.003", "c": 0.9900000095367432, "d": "PE signature is present", "e": [ "pe.has_signature = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/container::pe-has-signature-png", "l": 1, "m": "F0001.006" }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "binary.func_count = 1735.00" ], "i": "objectives/command-and-control/dropper/execution/inject::self-map-extract-execute-cond-4--inline-11988", "l": 1 }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 0.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "a": "T1087", "c": 0.8500000238418579, "d": "Convert SID to string form", "e": [ "ConvertSidToStringSidW" ], "i": "objectives/discovery/account/lookup::sid-string-conversion", "l": 3 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.func_count = 1735.00" ], "i": "metadata/binary/metrics/threshold::high-function-count-200", "l": 2 }, { "a": "T1543.003", "c": 0.8500000238418579, "d": "Create Windows service", "e": [ "CreateServiceW" ], "i": "micro-behaviors/os/service/control::create-service", "l": 3 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low behavioral-import ratio", "e": [ "binary.behavioral_import_ratio = 0.07" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-behavioral-import-ratio", "l": 1, "m": "B0032" }, { "a": "T1027.007", "c": 0.699999988079071, "d": "FNV-1a 32-bit prime constant (0x01000193)", "e": [ "93 01 00 01" ], "i": "objectives/anti-static/obfuscation/imports::fnv1a-prime-32bit-literal", "l": 1, "m": "B0032.014" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Transacted registry open API lookup", "e": [ "RegOpenKeyTransactedW" ], "i": "micro-behaviors/os/registry/access::reg-open-key-transacted-name", "l": 3 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.6000000238418579, "d": "High maximum function complexity", "e": [ "binary.max_complexity = 384.00" ], "i": "metadata/binary/metrics/structural::high-max-complexity", "l": 1 }, { "c": 0.800000011920929, "d": "GUID-formatted mutex name", "e": [ "{16a6ca3b-7d2d-4120-810d-d477b9a06688}" ], "i": "micro-behaviors/process/sync/mutex::guid-mutex", "l": 2, "m": "C0042" }, { "c": 0.8999999761581421, "d": "Binary has many functions", "e": [ "binary.func_count = 1735.00" ], "i": "objectives/anti-static/pack/entropy::large-function-surface", "l": 1 }, { "a": "T1543.003", "c": 0.800000011920929, "d": "Query service configuration", "e": [ "QueryServiceConfigW" ], "i": "micro-behaviors/os/service/control::query-service-config", "l": 3 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "VirtualAlloc API string reference", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc-string", "l": 1 }, { "a": "T1057", "c": 0.8999999761581421, "d": "Create process or module snapshot", "e": [ "CreateToolhelp32Snapshot" ], "i": "micro-behaviors/process/enumerate/snapshot::create-toolhelp32-snapshot", "l": 3, "m": "E1057" }, { "c": 0.7200000286102295, "d": "WSOCK32 Winsock DLL import", "e": [ "WSOCK32.dll" ], "i": "micro-behaviors/communications/socket/init::wsock32-dll-marker", "l": 3 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "a": "T1543.003", "c": 0.8799999952316284, "d": "Report service status updates", "e": [ "SetServiceStatus" ], "i": "micro-behaviors/os/service/control::set-service-status", "l": 3 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Sparse import table", "e": [ "binary.import_count = 247.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-import-count", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection/toolkit::module-stomping-target", "l": 1 }, { "a": "T1543.003", "c": 0.8500000238418579, "d": "Start Windows service", "e": [ "StartServiceW" ], "i": "micro-behaviors/os/service/control::start-service", "l": 3 }, { "a": "T1057", "c": 0.8999999761581421, "d": "Get first process from snapshot", "e": [ "Process32FirstW" ], "i": "micro-behaviors/process/enumerate/snapshot::process32-first", "l": 3 }, { "a": "T1543.003", "c": 0.8500000238418579, "d": "Open existing service handle", "e": [ "OpenServiceW" ], "i": "micro-behaviors/os/service/control::open-service", "l": 1 }, { "c": 0.800000011920929, "d": "Data before JAR/ZIP header", "e": [ "50 4B 03 04" ], "i": "objectives/anti-static/polyglot/format::jar-polyglot-prefix", "l": 1 }, { "a": "T1140", "c": 0.800000011920929, "d": "Large base64 encoded payload", "e": [ "GD0iIjk5JnF9ZmBqLjl2bwdhaiE+Zi4mOTQ+czA8NjgwIzEjKD40Aig6LDM3ERcqAQIEHwAsEQY1MhU2Hy0lBQEwOyEVHTYjBy4gKhgyOjEzJSkCGjEhIg03JyQJGzU5", "PDonMDw+JXEpPig4JC92KjYpKSNwKio6LCEvICYOBxYoPwMPDRgzPA8YOwESGwMCHCAiKDg+Kg8kFSwVBxwTNxIZAzgWPTYSNxsMPC8CJAEENBwZHhcfGjIQMCMpKBoB", "Fjs8PDU5NSJ6JzI5NWslPDs0PmgnLzs8a3oOOS4hIzsQPgcEETsJEjcNBxEDGRQ2Lxo4Nx8zBDQtAhwyADAdKyAGFhAIBBQmBSojIywpOCICHC0yEh4sASw/GxocJjc2", "MCwhNDMjKD89aiYkLj8+LShmFj1wMiA/LjtnJzt5NzE2OD53NTk/ajQvIiQ4LHouKyQ2ZiAyazRnJjowNjs1NHAkNCMoJSArNS52ODsvOAAWJQE6KiYeOw00OzMZKBM7", "Ij0/OSQjMSkJJyo6KRw1IiAMCAAILgcwJhA1PiMJBCwZODs7FSYvIzcZNxkwGyAoGgY6ERkWLx4kPRgcHxwCIgEiACkzCy0DNDkDMB8gAj88Fyk5IiIoGzczJTEpJQk1", "FzU1cSU5KDI1LiJqJDg1KSojajs1NzoxJTYicz03dSclIzk5Jmt6IiIyIC8zKzMrKyRwIiYzIiFnNiwpMDclNDR5FwQgBikvGTsdGgMSOBg1DyoABxMwEgcKIAMkIz4j", "JiAjNDE6YTQoOCg4IxghOTwjCxAAEQINJQIAHQ49Fx4wMzklMgELGiwkJAQCHzsTGBg/PBkcKSQWJjY7Mh40FCkNMhQWHC0IMCkCLR4oIxAaIBs3BzIoEBMuOD88Pz4t", "GD0iIjk5JnF9cGBqIC0iLShmJSo6IywgazgiPjY8J3Q/MD0yIBkDIyEQCA8CPDgzLx8kEC0CPxAuIxsDPBc2NQEYBiQMHhMoOw4FMjwlGQsEDAc7ICwuIDIvDx87PSIc", "GD0iIjk5JnF9ZmBqLjl2bydhaiE+ZiA2ITAkJ3Q9MDc9MCI2NTg1JAA5IAUSDz8QIj81NjgEGCUuFB8NHz8TAQIBEB4OOQkHJyI0MCIkPT42ChYQPjwgFjEyMyYAPSIY", "MTUlMHAyMyM1OA8mLQEGHDIUIwQDCz85LBsvEiI1Hxw6PzMnJhIwKzADDR0nMjYKJDIpABg6BxwdAA4hNj8oCCM6CxIIATIMIw4ZDjIvGQ8RJyYiOzwuOAMqNzUeEDQN", "PDoiJDYxKDIzLyk+YSYzJTU0Mw4TCCwSBy0GBB0jJQ45KQcfNzITGyg+Kz85JRw0PgQUBwMEDzkzNCcXGDkANgEUDzAgAT8yEAYfHTQhDSkeKyYgCDclPSYgLD09Hx8u", "IDg9GyUhDx89EjEHNTkdIzI/JxooAAI5IDcONBk8HxUcOAo/GRIxHxISFD4VJzcrAQMXMQUjPT0WMQEsGwEWADs6MQMKKCQuJwI0GAg0BDsjIDgAAzYzNjs6JTgQCSg+", "cDg3HRMOFwkeLj8TJgInLhwqPzw4BSEkOxYAFxoxFBYXKT02BwcUCSIQFSceAiktHg8iBwsiPTAtIRsKJzAHNyEOIAQVMiYTEwA3MSwCMCooEgofMSUtNyctOi00NAEi", "PDoyPj0nICUzKCsvYT0zOikvJSYDNykZMzoAJBg4NjYQPj8UDgU/DSIkEC4OIi8RCyk8PiMOIR49OAM1GiQeHT0uCAMACy4jGDs4GR8nLgYnBAc2CQE9NCAtGhAYICI4", "ezEpNCg0AisfPTQgEwcTBxcTKwE5ND0FDDQBBhIWABUcBzIdCTQ8HQgBKSMSMjwoHh0AAD8tLQwMOAIzPz8TOgI6MwYUCBY4KSYdHTErGy41KicSJDIiHzs7OR85KwkN", "JyE0JTQuAwkcPgEzDzMkIzYXGxs2KhsuGhgfPTodGhoAFBcSOBY0BgUQCD0PBTcXPC0ENBkbKDkKMSwTNDEXGj46LQUrPTUzESwbBgk3OhsHMi0SPzMGGCQqJB0YEzg6" ], "i": "micro-behaviors/data/encode/payload::large-base64-payload", "l": 3, "m": "C0043" }, { "c": 1.0, "d": "Manifest declares only Vista support", "e": [ "[{\"guid\":\"{e2011457-1546-43c5-a5fe-008deee3d3f0}\",\"name\":\"vista\"}, {\"guid\":\"{35138b9a-5d96-4fbd-8e2d-a2440225f93a}\",\"name\":\"win7" ], "i": "metadata/build/manifest::pe-vista-only-manifest", "l": 3 }, { "a": "T1070.006", "c": 0.7799999713897705, "d": "PE header timestamp after 2030", "e": [ "pe.timestamp = 1436633660.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-post-2030", "l": 1 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.has_export_timestamp = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1070.004", "c": 0.9200000166893005, "d": "Windows RegDeleteValue API reference", "e": [ "RegDeleteValueW" ], "i": "objectives/evasion/self-delete/cleanup/heartbeat::reg-delete-value-wide", "l": 1, "m": "F0007" }, { "c": 0.800000011920929, "d": "Resolve SID to account/group name", "e": [ "LookupAccountSidW" ], "i": "micro-behaviors/os/group/lookup::lookup-account-sid", "l": 3 }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "f8 52 45 00", "d8 51 45 00", "94 51 45 00", "90 51 45 00", "74 51 45 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Transacted registry create API lookup", "e": [ "RegCreateKeyTransactedW" ], "i": "micro-behaviors/os/registry/access::reg-create-key-transacted-name", "l": 3 }, { "a": "T1543.003", "c": 0.8999999761581421, "d": "Start service control dispatcher", "e": [ "StartServiceCtrlDispatcherW" ], "i": "micro-behaviors/os/service/control::start-service-dispatcher", "l": 3 }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "PathRemoveArgsW", "PathRenameExtensionW", "PathUnquoteSpacesW", "PathStripPathW", "SHGetFolderPathW", "PathRemoveFileSpecW", "PathFileExistsW", "PathCombineW", "PathRemoveExtensionW", "PathAppendW" ], "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-5", "l": 1, "m": "F0012" }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicator_count = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "c": 0.949999988079071, "d": "PE checksum mismatch (modified binary)", "e": [ "pe.checksum_valid = 1.00" ], "i": "metadata/binary/layout::pe-checksum-mismatch", "l": 3 }, { "a": "T1543.003", "c": 0.8500000238418579, "d": "Open service control manager", "e": [ "OpenSCManagerW" ], "i": "micro-behaviors/os/service/control::open-sc-manager", "l": 1 }, { "c": 0.949999988079071, "d": "Signed PE checksum mismatch", "e": [ "pe.checksum_valid = 1.00" ], "i": "metadata/binary/layout::signed-pe-checksum-mismatch", "l": 1 }, { "c": 0.8199999928474426, "d": "Opaque token in version resource", "e": [ "BTgkNjk5Aj40PiYjLy4kZj8+LyQbLic5JAchIwQ9PTEgCwEhDRYMCwUGMAEUAzA3CSskJDwmPDwOHgMoIA4jCT4xEAU+PwYtGD4YHDcCJgEbDi4cExETAD4oPywWNwIb" ], "i": "metadata/package/versioning::pe-version-resource-opaque-token", "l": 4 }, { "a": "T1027", "c": 1.0, "d": "Binary has 1000 or more functions", "e": [ "binary.func_count = 1735.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::function-count-1000-plus", "l": 1, "m": "B0032" }, { "a": "T1543.003", "c": 0.8999999761581421, "d": "Register service control handler", "e": [ "RegisterServiceCtrlHandlerW" ], "i": "micro-behaviors/os/service/control::register-service-handler", "l": 3 }, { "a": "T1543.003", "c": 0.8600000143051147, "d": "Send service control code", "e": [ "ControlService" ], "i": "micro-behaviors/os/service/control::control-service", "l": 3 }, { "c": 0.8500000238418579, "d": "Query process CPU affinity", "e": [ "GetProcessAffinityMask" ], "i": "micro-behaviors/process/control/affinity::get-process-affinity-mask", "l": 2 }, { "c": 0.8999999761581421, "d": "Set thread CPU affinity", "e": [ "SetThreadAffinityMask" ], "i": "micro-behaviors/process/control/affinity::set-thread-affinity-mask", "l": 3 }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 1307.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "a": "T1057", "c": 0.8999999761581421, "d": "Enumerate next process in snapshot", "e": [ "Process32NextW" ], "i": "micro-behaviors/process/enumerate/snapshot::process32-next", "l": 3 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Transacted registry delete API lookup", "e": [ "RegDeleteKeyTransactedW" ], "i": "micro-behaviors/os/registry/access::reg-delete-key-transacted-name", "l": 3 }, { "a": "T1543.003", "c": 0.8199999928474426, "d": "Query service runtime status", "e": [ "QueryServiceStatus" ], "i": "micro-behaviors/os/service/control::query-service-status", "l": 3 }, { "a": "T1543.003", "c": 0.8399999737739563, "d": "Delete installed service", "e": [ "DeleteService" ], "i": "micro-behaviors/os/service/control::delete-service", "l": 3 }, { "a": "T1134", "c": 1.0, "d": "CreateProcessAsUser API reference", "e": [ "CreateProcessAsUserW" ], "i": "micro-behaviors/process/create/spawn::create-process-as-user", "l": 4 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 5.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 0.6600000262260437, "d": "Copy files", "e": [ "CopyFileW" ], "i": "micro-behaviors/fs/file/copy::copyfile-w", "l": 3 }, { "a": "T1140", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ ".?AVCacheLocalScheduleGroup@details@Concurrency@@", ".?AVCacheLocalScheduleGroupSegment@details@Concurrency@@", "LocalContextCacheSize" ], "i": "objectives/command-and-control/dropper/staging/encrypted::staged-payload-file-name--rx-2", "l": 1, "m": "B0023" }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "c": 0.8799999952316284, "d": "Configure waitable timer", "e": [ "SetWaitableTimer" ], "i": "micro-behaviors/time/schedule/waitable::set-waitable-timer", "l": 3 }, { "c": 0.8999999761581421, "d": "Derive symmetric key from hash", "e": [ "CryptDeriveKey" ], "i": "micro-behaviors/crypto/library/provider::crypt-derive-key", "l": 3 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "IjwDHCgWLiMjNQsBCjgAAACR", "InitializeCriticalSectionEx", "GetCurrentProcessorNumberEx", "CreateFileTransactedW", "RegCreateKeyTransactedW", "FlushProcessWriteBuffers", "SetThreadStackGuarantee", "RegOpenKeyTransactedW", "GetLogicalProcessorInformationEx", "SetThreadGroupAffinity", "WaitForThreadpoolTimerCallbacks", "GetCurrentProcessorNumber", "GetThreadGroupAffinity", "RegDeleteKeyTransactedW", "NwowGjkRCSEHHBoEAiQXGTYPJjsmFjsAEgAAAJk", "FreeLibraryWhenCallbackReturns" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "XORed Cobalt Strike config marker", "e": [ "EF BE [2] BE B7" ], "i": "well-known/malware/rat/cobalt-strike::xored-config-beef-rdata", "l": 1 }, { "c": 0.800000011920929, "d": "GetTokenInformation API", "e": [ "GetTokenInformation" ], "i": "micro-behaviors/os/privilege/token::get-token-information", "l": 3 }, { "c": 1.0, "d": "Changes service configuration via ADVAPI32", "e": [ "ChangeServiceConfig2W" ], "i": "micro-behaviors/os/service/host::service-config-change", "l": 3 }, { "a": "T1027.002", "c": 0.699999988079071, "d": "High maximum function complexity (obfuscation)", "e": [ "binary.max_complexity = 384.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::high-max-complexity", "l": 3, "m": "B0032" }, { "c": 0.949999988079071, "d": "links CRYPT32.dll (CryptBinaryToStringA, CryptStringToBinaryA)", "e": [ "CRYPT32.dll" ], "i": "metadata/dylib::crypt32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links imagehlp.dll (CheckSumMappedFile)", "e": [ "imagehlp.dll" ], "i": "metadata/dylib::imagehlp/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (StartServiceW, ConvertSidToStringSidW, CryptDuplicateKey, CryptDestroyHash, CryptHashData, ... +41 more)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (LoadStringW, MessageBoxW, CharNextW, CharUpperW, PostThreadMessageW, ... +3 more)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links WINHTTP.dll (WinHttpQueryHeaders, WinHttpReceiveResponse, WinHttpSendRequest, WinHttpOpen, WinHttpCloseHandle, ... +5 more)", "e": [ "WINHTTP.dll" ], "i": "metadata/dylib::winhttp/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links VERSION.dll (GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW)", "e": [ "VERSION.dll" ], "i": "metadata/dylib::version/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links PSAPI.DLL (GetModuleFileNameExW)", "e": [ "PSAPI.DLL" ], "i": "metadata/dylib::psapi/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links WSOCK32.dll (ORDINAL 15)", "e": [ "WSOCK32.dll" ], "i": "metadata/dylib::wsock32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links OLEAUT32.dll (ORDINAL 277, ORDINAL 9, ORDINAL 4, ORDINAL 6, ORDINAL 2)", "e": [ "OLEAUT32.dll" ], "i": "metadata/dylib::oleaut32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links IPHLPAPI.DLL (GetTcpTable, GetUdpTable)", "e": [ "IPHLPAPI.DLL" ], "i": "metadata/dylib::iphlpapi/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHELL32.dll (SHGetFolderPathW)", "e": [ "SHELL32.dll" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHLWAPI.dll (PathAppendW, PathCombineW, PathRemoveArgsW, PathRemoveExtensionW, PathRemoveFileSpecW, ... +4 more)", "e": [ "SHLWAPI.dll" ], "i": "metadata/dylib::shlwapi/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ole32.dll (CoAddRefServerProcess, CoReleaseServerProcess, CoInitializeSecurity, CoSetProxyBlanket, CoUninitialize, ... +7 more)", "e": [ "ole32.dll" ], "i": "metadata/dylib::ole32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (CreateEventW, CreateWaitableTimerW, SetWaitableTimer, LoadLibraryW, LoadLibraryExW, ... +141 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "a": "T1543.003", "c": 0.949999988079071, "d": "Windows service admin import cluster", "e": [ "StartServiceW", "CreateServiceW", "OpenSCManagerW", "OpenServiceW" ], "i": "micro-behaviors/os/service/control::service-admin-import-cluster", "l": 3 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Multiple Win32 locale discovery APIs", "e": [ "EnumSystemLocalesEx", "EnumSystemLocalesW", "GetLocaleInfoW", "GetUserDefaultLCID" ], "i": "micro-behaviors/os/sysinfo/platform/locale::locale-environment-fingerprint", "l": 2 }, { "a": "T1057", "c": 0.8999999761581421, "d": "Toolhelp process enumeration via imports", "e": [ "Process32FirstW", "Process32NextW", "CreateToolhelp32Snapshot" ], "i": "micro-behaviors/process/enumerate/snapshot::toolhelp-process-enumeration-symbol", "l": 3 }, { "a": "T1071.001", "c": 0.9200000166893005, "d": "WinHTTP session with remote connection", "e": [ "WinHttpOpen", "WinHttpConnect", "WinHttpCrackUrl" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-session-connect-flow", "l": 3, "m": "C0002" }, { "c": 0.9800000190734863, "d": "Elex multi-malware bundle loader (Remcos/Stealc/Maze)", "e": [ "GetProcAddress", "IsDebuggerPresent", "binary.max_complexity = 384.00", "mscoree.dll", "GetModuleHandleA" ], "i": "well-known/malware/trojan/elex/bundle-loader::elex-bundle-loader", "l": 5 }, { "c": 0.8999999761581421, "d": "Timer queue create + delete lifecycle", "e": [ "DeleteTimerQueueTimer", "CreateTimerQueueTimer" ], "i": "micro-behaviors/time/schedule/callback/lifecycle::timer-queue-lifecycle", "l": 2 }, { "c": 0.9200000166893005, "d": "Fingerprint host locale configuration", "e": [ "GetUserDefaultLCID", "GetLocaleInfoW", "EnumSystemLocalesW" ], "i": "micro-behaviors/os/sysinfo/platform/locale::locale-fingerprinting-imports", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetModuleHandleW", "GetModuleHandleExW", "GetProcAddress", "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1543.003", "c": 0.9200000166893005, "d": "Service stop or delete chain", "e": [ "QueryServiceStatus", "OpenSCManagerW", "ControlService", "OpenServiceW", "DeleteService" ], "i": "micro-behaviors/os/service/control::service-stop-control", "l": 3 }, { "c": 0.8999999761581421, "d": "COM proxy setup for WMI automation", "e": [ "CoSetProxyBlanket", "CoInitializeEx", "CoInitializeSecurity", "CoCreateInstance" ], "i": "micro-behaviors/os/com/invoke::wmi-com-proxy-setup", "l": 3 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "a": "T1543.003", "c": 0.949999988079071, "d": "Full Windows service dispatch triplet", "e": [ "SetServiceStatus", "RegisterServiceCtrlHandlerW", "StartServiceCtrlDispatcherW" ], "i": "micro-behaviors/os/service/control::service-dispatch-triad", "l": 3 }, { "a": "T1129", "c": 0.9399999976158142, "d": "Self copy append and relaunch", "e": [ "GetTickCount", "SetFilePointer", "GetModuleFileNameW", "CreateFileW", "CreateProcessW", "DeleteFileW", "CopyFileW", "WriteFile" ], "i": "objectives/command-and-control/dropper/execution/loader::self-copy-relaunch-loader", "l": 2, "m": "B0030" }, { "c": 0.8600000143051147, "d": "Query active window station state", "e": [ "GetUserObjectInformationW", "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::window-station-query-chain", "l": 2 }, { "a": "T1543.003", "c": 0.9200000166893005, "d": "Windows service control dispatch", "e": [ "StartServiceCtrlDispatcherW", "StartServiceW", "RegisterServiceCtrlHandlerW", "SetServiceStatus" ], "i": "micro-behaviors/os/service/control::service-control-dispatch", "l": 3 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "WinHTTP request response data flow", "e": [ "WinHttpReadData", "WinHttpQueryHeaders", "WinHttpQueryDataAvailable", "WinHttpSendRequest", "WinHttpOpenRequest", "WinHttpReceiveResponse" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-request-flow", "l": 3, "m": "C0002" }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "pe.has_rich_header = 1.00", "binary.import_count = 247.00" ], "i": "objectives/evasion/process/injection/module-stomping::msvc-crt-full-linkage", "l": 1 }, { "a": "T1129", "c": 0.699999988079071, "d": "Interlocked SList sync", "e": [ "InterlockedFlushSList", "InterlockedPopEntrySList", "InterlockedPushEntrySList", "InitializeSListHead" ], "i": "micro-behaviors/process/threading/advanced-sync::slist-sync-ops", "l": 2 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "DeleteFileW", "GetModuleFileNameW" ], "i": "objectives/evasion/self-delete/file/script::module-path-delete", "l": 2, "m": "F0007" }, { "c": 0.800000011920929, "d": "Mutex-based single instance enforcement", "e": [ "CreateMutexW", "ExitProcess", "GetLastError" ], "i": "micro-behaviors/process/sync/mutex::mutex-instance-check", "l": 2, "m": "C0042" }, { "a": "T1027.009", "c": 0.8999999761581421, "d": "PE resource load and data pointer chain", "e": [ "FindResourceExW", "LoadResource", "FindResourceW", "LockResource" ], "i": "micro-behaviors/data/embedded/payload/resource::pe-resource-load-lock-chain", "l": 2 }, { "c": 0.8500000238418579, "d": "Semaphore coordination with wait logic", "e": [ "CreateSemaphoreW", "ReleaseSemaphore", "WaitForMultipleObjects" ], "i": "micro-behaviors/process/sync/semaphore::coordinated-semaphore-wait", "l": 2, "m": "C0042" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key open and query chain", "e": [ "RegOpenKeyExW", "RegQueryValueExW" ], "i": "micro-behaviors/os/registry/access::registry-read-api-chain", "l": 2 }, { "a": "T1027.009", "c": 0.949999988079071, "d": "Complete PE resource extraction with data access", "e": [ "SizeofResource", "LoadResource", "LockResource", "FindResourceW", "FindResourceExW" ], "i": "micro-behaviors/data/embedded/payload/resource::pe-resource-full-extraction", "l": 3 }, { "a": "T1071.001", "c": 0.9399999976158142, "d": "WinHTTP download session and response flow", "e": [ "WinHttpConnect", "WinHttpCloseHandle", "WinHttpOpen", "WinHttpSendRequest", "WinHttpQueryDataAvailable", "WinHttpOpenRequest", "WinHttpCrackUrl", "WinHttpReceiveResponse", "WinHttpReadData", "WinHttpQueryHeaders" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-downloader-flow", "l": 3, "m": "C0002" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key and value write chain", "e": [ "RegOpenKeyExW", "RegSetValueExW", "RegCreateKeyExW" ], "i": "micro-behaviors/os/registry/access::registry-write-api-chain", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamic Toolhelp enumeration suite", "e": [ "GetProcAddress", "Process32FirstW", "CreateToolhelp32Snapshot", "Process32NextW" ], "i": "micro-behaviors/process/enumerate/snapshot::dynamic-toolhelp-enumerator", "l": 3 }, { "c": 0.8799999952316284, "d": "CryptoAPI key setup from derived or imported material", "e": [ "CryptImportKey", "CryptAcquireContextW", "CryptDeriveKey" ], "i": "micro-behaviors/crypto/library/provider::capi-key-material-setup", "l": 3 }, { "c": 0.8999999761581421, "d": "Query and modify CPU affinity", "e": [ "SetThreadAffinityMask", "GetProcessAffinityMask" ], "i": "micro-behaviors/process/control/affinity::affinity-mask-control", "l": 3 }, { "a": "T1112", "c": 0.9200000166893005, "d": "Registry open create and write APIs", "e": [ "RegSetValueExW", "RegOpenKeyTransactedW", "RegOpenKeyExW", "RegQueryValueExW", "HKCU", "RegCreateKeyTransactedW", "RegDeleteKeyTransactedW", "RegCreateKeyExW", "HKLM" ], "i": "micro-behaviors/os/registry/manipulate::registry-write-api-chain", "l": 3 }, { "a": "T1036", "c": 0.8500000238418579, "d": "PE version info present but string fields stripped", "e": [ "field 'pe.version_info.company_name' does not exist", "1.0.5670.17826" ], "i": "metadata/binary/anomaly/format::version-info-string-table-stripped", "l": 4 }, { "c": 0.8199999928474426, "d": "Hardcoded uppercase mutex name", "e": [ "REGISTRY", "SECURITY", "CreateMutexW", "OHSSVSSW" ], "i": "micro-behaviors/process/sync/mutex::named-uppercase-mutex", "l": 2, "m": "C0042" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Transacted registry API fallback chain", "e": [ "RegDeleteKeyTransactedW", "RegCreateKeyTransactedW", "RegOpenKeyTransactedW" ], "i": "micro-behaviors/os/registry/access::registry-transacted-api-chain", "l": 3 }, { "c": 0.800000011920929, "d": "Process enumeration capability (for targeting)", "e": [ "Process32FirstW", "CreateToolhelp32Snapshot" ], "i": "objectives/impact/degrade/edr/targeting::process-enumeration", "l": 3, "m": "C0003" }, { "a": "B0030", "c": 0.9300000071525574, "d": "GUID mutex with crypto and network", "e": [ "WinHttpReceiveResponse", "LCMapStringEx", "StringFromCLSID", "invalid string position", "CryptStringToBinaryA", "LoadStringW", "CryptBinaryToStringA", "string too long", "OutputDebugStringW", "WinHttpCrackUrl", "CompareStringEx", "CLSIDFromString", "WinHttpReadData", "ConvertSidToStringSidW", "LCMapStringW", "GetStringTypeW" ], "i": "objectives/command-and-control/beacon/mutex::mutex-guid-crypto-http-coordination", "l": 4 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Windows locale fingerprinting imports", "e": [ "EnumSystemLocalesW", "FreeEnvironmentStringsW", "GetLocaleInfoW", "GetUserDefaultLCID", "EnumSystemLocalesEx", "GetEnvironmentStringsW" ], "i": "objectives/discovery/system/locale::windows-locale-fingerprint", "l": 3, "m": "E1082" }, { "a": "T1057", "c": 0.8999999761581421, "d": "ToolHelp snapshot enumeration with process access", "e": [ "OpenProcess", "CreateToolhelp32Snapshot" ], "i": "objectives/discovery/process/targeting::toolhelp-enumeration-with-access", "l": 3, "m": "E1057" }, { "a": "T1140", "c": 0.8500000238418579, "d": "CryptoAPI file decryption loader markers", "e": [ "CreateFileW", "CryptAcquireContextW", "CryptDecrypt", "ReadFile", "VirtualProtect", "CryptImportKey", "CreateThread" ], "i": "objectives/command-and-control/dropper/staging/encrypted::capi-file-payload-decrypt-loader", "l": 4, "m": "B0023" }, { "a": "T1547.001", "c": 0.9200000166893005, "d": "Self-copy into Windows AppData", "e": [ "GetModuleFileNameW", "SHGetFolderPathW", "CopyFileW", "GetTickCount" ], "i": "objectives/persistence/login/self-install/copy::windows-appdata-self-copy", "l": 2 }, { "a": "T1082", "c": 0.9300000071525574, "d": "Profile locale environment and launch context", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "GetLocaleInfoW", "GetCurrentThreadId", "EnumSystemLocalesW", "GetCommandLineW", "GetUserDefaultLCID" ], "i": "objectives/discovery/system/locale::locale-and-environment-profiling-windows-loader", "l": 2, "m": "E1082" }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "SetUnhandledExceptionFilter", "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 }, { "a": "T1049", "c": 0.8500000238418579, "d": "Network connection discovery via API", "e": [ "GetTcpTable", "GetUdpTable" ], "i": "objectives/discovery/network/connections::connection-discovery", "l": 3 }, { "c": 0.9300000071525574, "d": "Windows event log writing", "e": [ "ReportEventW", "RegisterEventSourceW" ], "i": "micro-behaviors/os/event/log::event-log-write", "l": 3 }, { "c": 0.8999999761581421, "d": "CryptoAPI key setup with buffer encryption operations", "e": [ "CryptDeriveKey", "CryptImportKey", "CryptEncrypt", "CryptDecrypt", "CryptAcquireContextW" ], "i": "micro-behaviors/crypto/library/provider::capi-keyed-buffer-crypto-chain", "l": 3 }, { "a": "T1071.001", "c": 0.9399999976158142, "d": "WinHTTP C2 with staged loader host integration profile", "e": [ "WinHttpReceiveResponse", "CryptImportKey", "CryptDeriveKey", "LoadResource", "WinHttpQueryDataAvailable", "WinHttpReadData", "RegCreateKeyExW", "FindResourceExW", "CreateMutexW", "WinHttpSendRequest", "CryptAcquireContextW", "RegSetValueExW", "WinHttpOpenRequest", "SizeofResource", "GetLastError", "CryptDecrypt" ], "i": "objectives/command-and-control/backdoor/loader/stage::winhttp-staged-loader-profile", "l": 4 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Locale and environment profiling cluster", "e": [ "GetEnvironmentStringsW", "GetCommandLineW", "GetLocaleInfoW", "EnumSystemLocalesW", "EnumSystemLocalesEx", "GetSystemTimeAsFileTime", "FreeEnvironmentStringsW", "GetUserDefaultLCID" ], "i": "objectives/discovery/system/locale::locale-and-environment-profiling", "l": 3, "m": "E1082" }, { "c": 0.8999999761581421, "d": "Encoded payload detected: base64", "e": [ "\u003cbinary data\u003e \u003cbase64\u003e" ], "i": "metadata/encoded-payload/base64", "l": 3 } ], "sha": "ae0113c08bcaca0f89146457bc46ef46d64a64bd7cb4ec6cbdcdf45e7bca4f3c", "path": "14852", "type": "pe" } ], "tv": "d376d" } }