{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 0.8087313175201416,
        "class": 0,
        "threshold": 0.9989520311355591
      }
    ],
    "prob": 0.8087313,
    "class": 0,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.8087313,
        "class": 0
      },
      {
        "m": "az/native",
        "prob": 0.04310345,
        "class": 0
      },
      {
        "m": "az/pe",
        "prob": 0.0,
        "class": 0
      }
    ],
    "version": "v17.17",
    "threshold": 0.99895203,
    "analyzed_at": "2026-05-30T00:34:12Z"
  },
  "path": "d7c234e4663d1afe2f9ac871ed2e989832226359bb3f1d97fc96b2ffbdba0d9d.exe",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "Md₂(BiSi)",
        "x": 5,
        "ff": {
          "i": [
            [
              "mscoree",
              "CorExeMain"
            ]
          ],
          "m": {
            "pe": {
              "checksum": 0.0,
              "has_overlay": 1.0,
              "overlay_end": 102016.0,
              "overlay_size": 3712.0,
              "checksum_valid": 0.0,
              "overlay_offset": 98304.0,
              "resource_count": 1.0,
              "overlay_padding": 10560.0,
              "has_version_info": 1.0,
              "checksum_stripped": 1.0,
              "computed_checksum": 136888.0,
              "bss_like_section_count": 0.0,
              "section_overflow_count": 0.0,
              "misaligned_section_count": 0.0,
              "base_relocation_block_count": 1.0,
              "base_relocation_entry_count": 1.0
            },
            "file": {
              "size": 119008.0,
              "entropy": 6.14,
              "size_bytes": 119008.0
            },
            "binary": {
              "is_pie": 1.0,
              "has_overlay": 1.0,
              "code_entropy": 5.65,
              "overlay_size": 20704.0,
              "string_count": 2911.0,
              "overlay_ratio": 0.17,
              "overlay_entropy": 7.85,
              "entropy_variance": 5.13,
              "avg_string_length": 15.43,
              "max_string_length": 200.0,
              "code_to_data_ratio": 1.0,
              "string_length_stddev": 10.69,
              "largest_section_ratio": 0.81,
              "sentence_string_count": 19.0,
              "sentence_string_ratio": 0.01,
              "high_entropy_string_count": 0.0
            },
            "imports": {
              "count": 1.0
            },
            "sections": {
              "count": 3.0,
              "code_size": 96256.0,
              "entropy_max": 5.65,
              "entropy_mean": 2.83,
              "name_entropy": 3.03,
              "writable_count": 0.0,
              "executable_count": 1.0,
              "nonstandard_count": 0.0,
              "executable_writable_count": 0.0
            },
            "dependencies": {
              "count": 1.0
            }
          },
          "s": [
            [
              77,
              "u8",
              "!This program cannot be run in DOS mode."
            ],
            [
              376,
              "u8",
              ".text"
            ],
            [
              455,
              "u8",
              "@.reloc"
            ],
            [
              29520,
              "u8",
              "lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R"
            ],
            [
              29677,
              "u8",
              "hSystem.Drawing.Bitmap, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"
            ],
            [
              29846,
              "u8",
              "QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"
            ],
            [
              29934,
              "u8",
              "System.Drawing.Bitmap"
            ],
            [
              29960,
              "u8",
              "Data"
            ],
            [
              29996,
              "u8",
              "IHDR"
            ],
            [
              30173,
              "u8",
              "rr6rrL"
            ],
            [
              31446,
              "u8",
              "0E6xrE"
            ],
            [
              33068,
              "u8",
              "lI n"
            ],
            [
              33572,
              "u8",
              "cu8s"
            ],
            [
              35899,
              "u8",
              "Y9mpq"
            ],
            [
              38655,
              "u8",
              "AZJQ5"
            ],
            [
              38822,
              "u8",
              "WIRV6KI"
            ],
            [
              39632,
              "u8",
              "Pjwk"
            ],
            [
              40158,
              "u8",
              "zKpt"
            ],
            [
              41271,
              "u8",
              "WYA79"
            ],
            [
              41882,
              "u8",
              "AVVR"
            ],
            [
              43109,
              "u8",
              "H_G5"
            ],
            [
              43437,
              "u8",
              "joRj"
            ],
            [
              43680,
              "u8",
              "wc9i"
            ],
            [
              50704,
              "u8",
              "FITR"
            ],
            [
              51093,
              "u8",
              "IEND"
            ],
            [
              51104,
              "u8",
              "BSJB"
            ],
            [
              53325,
              "u8",
              "\u003cModule\u003e"
            ],
            [
              53340,
              "u8",
              "MusicExpressMain"
            ],
            [
              53357,
              "u8",
              "MusicExpress"
            ],
            [
              53370,
              "u8",
              "MusicReader"
            ],
            [
              53382,
              "u8",
              "Program"
            ],
            [
              53390,
              "u8",
              "System.Windows.Forms"
            ],
            [
              53411,
              "u8",
              "Form"
            ],
            [
              53416,
              "u8",
              "mscorlib"
            ],
            [
              53425,
              "u8",
              "System"
            ],
            [
              53432,
              "u8",
              "Object"
            ],
            [
              53439,
              "u8",
              "TextBox"
            ],
            [
              53447,
              "u8",
              "textBox1"
            ],
            [
              53456,
              "u8",
              "RichTextBox"
            ],
            [
              53468,
              "u8",
              "richTextBox1"
            ],
            [
              53481,
              "u8",
              "textBox2"
            ],
            [
              53490,
              "u8",
              "textBox3"
            ],
            [
              53499,
              "u8",
              "Button"
            ],
            [
              53506,
              "u8",
              "button1"
            ],
            [
              53514,
              "u8",
              "button2"
            ],
            [
              53522,
              "u8",
              "button3"
            ],
            [
              53530,
              "u8",
              "button4"
            ],
            [
              53538,
              "u8",
              "button5"
            ],
            [
              53546,
              "u8",
              "button6"
            ],
            [
              53554,
              "u8",
              "button7"
            ],
            [
              53562,
              "u8",
              "button8"
            ],
            [
              53570,
              "u8",
              "button9"
            ],
            [
              53578,
              "u8",
              "button10"
            ],
            [
              53587,
              "u8",
              "button11"
            ],
            [
              53596,
              "u8",
              "button12"
            ],
            [
              53605,
              "u8",
              "button13"
            ],
            [
              53614,
              "u8",
              "button14"
            ],
            [
              53623,
              "u8",
              "button15"
            ],
            [
              53632,
              "u8",
              "button16"
            ],
            [
              53641,
              "u8",
              "button17"
            ],
            [
              53650,
              "u8",
              "button18"
            ],
            [
              53659,
              "u8",
              "button19"
            ],
            [
              53668,
              "u8",
              "button20"
            ],
            [
              53677,
              "u8",
              "button21"
            ],
            [
              53686,
              "u8",
              "button22"
            ],
            [
              53695,
              "u8",
              "button23"
            ],
            [
              53704,
              "u8",
              "button24"
            ],
            [
              53713,
              "u8",
              "button25"
            ],
            [
              53722,
              "u8",
              "button26"
            ],
            [
              53731,
              "u8",
              "button27"
            ],
            [
              53740,
              "u8",
              "button28"
            ],
            [
              53749,
              "u8",
              "button29"
            ],
            [
              53758,
              "u8",
              "button30"
            ],
            [
              53767,
              "u8",
              "button31"
            ],
            [
              53776,
              "u8",
              "button32"
            ],
            [
              53785,
              "u8",
              "button33"
            ],
            [
              53794,
              "u8",
              "button34"
            ],
            [
              53803,
              "u8",
              "button35"
            ],
            [
              53812,
              "u8",
              "button36"
            ],
            [
              53821,
              "u8",
              "button37"
            ],
            [
              53830,
              "u8",
              "button38"
            ],
            [
              53839,
              "u8",
              "textBox4"
            ],
            [
              53848,
              "u8",
              "button39"
            ],
            [
              53857,
              "u8",
              "button40"
            ],
            [
              53866,
              "u8",
              "button41"
            ],
            [
              53875,
              "u8",
              "button42"
            ],
            [
              53884,
              "u8",
              "button43"
            ],
            [
              53893,
              "u8",
              "button44"
            ],
            [
              53902,
              "u8",
              "button45"
            ],
            [
              53911,
              "u8",
              "button46"
            ],
            [
              53920,
              "u8",
              "button47"
            ],
            [
              53929,
              "u8",
              "button48"
            ],
            [
              53938,
              "u8",
              "button49"
            ],
            [
              53947,
              "u8",
              "button50"
            ],
            [
              53956,
              "u8",
              "button51"
            ],
            [
              53965,
              "u8",
              "button52"
            ],
            [
              53974,
              "u8",
              "button53"
            ],
            [
              53983,
              "u8",
              "button54"
            ],
            [
              53992,
              "u8",
              "button55"
            ],
            [
              54001,
              "u8",
              "button56"
            ],
            [
              54010,
              "u8",
              "button57"
            ],
            [
              54019,
              "u8",
              "button58"
            ],
            [
              54028,
              "u8",
              "button59"
            ],
            [
              54037,
              "u8",
              "button60"
            ],
            [
              54046,
              "u8",
              "button61"
            ],
            [
              54055,
              "u8",
              "button62"
            ],
            [
              54064,
              "u8",
              "button63"
            ],
            [
              54073,
              "u8",
              "button64"
            ],
            [
              54082,
              "u8",
              "textBox5"
            ],
            [
              54091,
              "u8",
              "textBox6"
            ],
            [
              54100,
              "u8",
              "textBox7"
            ],
            [
              54109,
              "u8",
              "button65"
            ],
            [
              54118,
              "u8",
              "button66"
            ],
            [
              54127,
              "u8",
              "button67"
            ],
            [
              54136,
              "u8",
              "button68"
            ],
            [
              54145,
              "u8",
              "button69"
            ],
            [
              54154,
              "u8",
              "button70"
            ],
            [
              54163,
              "u8",
              "button71"
            ],
            [
              54172,
              "u8",
              "button72"
            ],
            [
              54181,
              "u8",
              "button73"
            ],
            [
              54190,
              "u8",
              "button74"
            ],
            [
              54199,
              "u8",
              "button75"
            ],
            [
              54208,
              "u8",
              "button76"
            ],
            [
              54217,
              "u8",
              "CheckBox"
            ],
            [
              54226,
              "u8",
              "checkBox1"
            ],
            [
              54236,
              "u8",
              "checkBox2"
            ],
            [
              54246,
              "u8",
              "checkBox3"
            ],
            [
              54256,
              "u8",
              "checkBox4"
            ],
            [
              54266,
              "u8",
              "checkBox5"
            ],
            [
              54276,
              "u8",
              "checkBox6"
            ],
            [
              54286,
              "u8",
              "checkBox7"
            ],
            [
              54296,
              "u8",
              "checkBox8"
            ],
            [
              54306,
              "u8",
              "checkBox9"
            ],
            [
              54316,
              "u8",
              "checkBox10"
            ],
            [
              54327,
              "u8",
              "textBox8"
            ],
            [
              54336,
              "u8",
              "textBox9"
            ],
            [
              54345,
              "u8",
              "textBox10"
            ],
            [
              54355,
              "u8",
              "textBox11"
            ],
            [
              54365,
              "u8",
              "textBox12"
            ],
            [
              54375,
              "u8",
              "textBox13"
            ],
            [
              54385,
              "u8",
              "textBox14"
            ],
            [
              54395,
              "u8",
              "textBox15"
            ],
            [
              54405,
              "u8",
              "textBox16"
            ],
            [
              54415,
              "u8",
              "textBox17"
            ],
            [
              54425,
              "u8",
              "textBox18"
            ],
            [
              54435,
              "u8",
              "textBox19"
            ],
            [
              54445,
              "u8",
              "textBox20"
            ],
            [
              54455,
              "u8",
              "textBox21"
            ],
            [
              54465,
              "u8",
              "textBox22"
            ],
            [
              54475,
              "u8",
              "Label"
            ],
            [
              54481,
              "u8",
              "label1"
            ],
            [
              54488,
              "u8",
              "label2"
            ],
            [
              54495,
              "u8",
              "label3"
            ],
            [
              54502,
              "u8",
              "label4"
            ],
            [
              54509,
              "u8",
              "label5"
            ],
            [
              54516,
              "u8",
              "label6"
            ],
            [
              54523,
              "u8",
              "label7"
            ],
            [
              54530,
              "u8",
              "label8"
            ],
            [
              54537,
              "u8",
              "label9"
            ],
            [
              54544,
              "u8",
              "label10"
            ],
            [
              54552,
              "u8",
              "label11"
            ],
            [
              54560,
              "u8",
              "label12"
            ],
            [
              54568,
              "u8",
              "label13"
            ],
            [
              54576,
              "u8",
              "label14"
            ],
            [
              54584,
              "u8",
              "label15"
            ],
            [
              54592,
              "u8",
              "button77"
            ],
            [
              54601,
              "u8",
              "button78"
            ],
            [
              54610,
              "u8",
              "button79"
            ],
            [
              54619,
              "u8",
              "button80"
            ],
            [
              54628,
              "u8",
              "button81"
            ],
            [
              54637,
              "u8",
              "button82"
            ],
            [
              54646,
              "u8",
              "button83"
            ],
            [
              54655,
              "u8",
              "button84"
            ],
            [
              54664,
              "u8",
              "button85"
            ],
            [
              54673,
              "u8",
              "button86"
            ],
            [
              54682,
              "u8",
              "button87"
            ],
            [
              54691,
              "u8",
              "button88"
            ],
            [
              54700,
              "u8",
              "button89"
            ],
            [
              54709,
              "u8",
              "button90"
            ],
            [
              54718,
              "u8",
              "button91"
            ],
            [
              54727,
              "u8",
              "button92"
            ],
            [
              54736,
              "u8",
              "button93"
            ],
            [
              54745,
              "u8",
              "button94"
            ],
            [
              54754,
              "u8",
              "button95"
            ],
            [
              54763,
              "u8",
              "button96"
            ],
            [
              54772,
              "u8",
              "button97"
            ],
            [
              54781,
              "u8",
              "button98"
            ],
            [
              54790,
              "u8",
              "button99"
            ],
            [
              54799,
              "u8",
              "button100"
            ],
            [
              54809,
              "u8",
              "textBox23"
            ],
            [
              54819,
              "u8",
              "System.ComponentModel"
            ],
            [
              54841,
              "u8",
              "IContainer"
            ],
            [
              54852,
              "u8",
              "components"
            ],
            [
              54863,
              "u8",
              ".ctor"
            ],
            [
              54869,
              "u8",
              "InitializeComponent"
            ],
            [
              54889,
              "u8",
              "init"
            ],
            [
              54894,
              "u8",
              "Browse"
            ],
            [
              54901,
              "u8",
              "GetMusic"
            ],
            [
              54910,
              "u8",
              "Play"
            ],
            [
              54915,
              "u8",
              "EventArgs"
            ],
            [
              54925,
              "u8",
              "MusicExpressMain_Load"
            ],
            [
              54947,
              "u8",
              "get_Path"
            ],
            [
              54956,
              "u8",
              "_getPath"
            ],
            [
              54965,
              "u8",
              "Path"
            ],
            [
              54970,
              "u8",
              "Main"
            ],
            [
              54975,
              "u8",
              "System.Reflection"
            ],
            [
              54993,
              "u8",
              "AssemblyFileVersionAttribute"
            ],
            [
              55022,
              "u8",
              "AssemblyVersionAttribute"
            ],
            [
              55047,
              "u8",
              "System.Runtime.InteropServices"
            ],
            [
              55078,
              "u8",
              "GuidAttribute"
            ],
            [
              55092,
              "u8",
              "ComVisibleAttribute"
            ],
            [
              55112,
              "u8",
              "AssemblyCultureAttribute"
            ],
            [
              55137,
              "u8",
              "AssemblyTrademarkAttribute"
            ],
            [
              55164,
              "u8",
              "AssemblyCopyrightAttribute"
            ],
            [
              55191,
              "u8",
              "AssemblyProductAttribute"
            ],
            [
              55216,
              "u8",
              "AssemblyCompanyAttribute"
            ],
            [
              55241,
              "u8",
              "AssemblyConfigurationAttribute"
            ],
            [
              55272,
              "u8",
              "AssemblyDescriptionAttribute"
            ],
            [
              55301,
              "u8",
              "AssemblyTitleAttribute"
            ],
            [
              55324,
              "u8",
              "System.Security.Permissions"
            ],
            [
              55352,
              "u8",
              "SecurityPermissionAttribute"
            ],
            [
              55380,
              "u8",
              "SecurityAction"
            ],
            [
              55395,
              "u8",
              "System.Runtime.CompilerServices"
            ],
            [
              55427,
              "u8",
              "CompilationRelaxationsAttribute"
            ],
            [
              55459,
              "u8",
              "RuntimeCompatibilityAttribute"
            ],
            [
              55491,
              "u8",
              "Control"
            ],
            [
              55499,
              "u8",
              "SuspendLayout"
            ],
            [
              55513,
              "u8",
              "System.Drawing"
            ],
            [
              55528,
              "u8",
              "Point"
            ],
            [
              55534,
              "u8",
              "set_Location"
            ],
            [
              55547,
              "u8",
              "set_Name"
            ],
            [
              55556,
              "u8",
              "Size"
            ],
            [
              55561,
              "u8",
              "set_Size"
            ],
            [
              55570,
              "u8",
              "set_TabIndex"
            ],
            [
              55583,
              "u8",
              "set_Text"
            ],
            [
              55592,
              "u8",
              "TextBoxBase"
            ],
            [
              55604,
              "u8",
              "set_Multiline"
            ],
            [
              55618,
              "u8",
              "ButtonBase"
            ],
            [
              55629,
              "u8",
              "set_UseVisualStyleBackColor"
            ],
            [
              55657,
              "u8",
              "set_AutoSize"
            ],
            [
              55670,
              "u8",
              "RightToLeft"
            ],
            [
              55682,
              "u8",
              "set_RightToLeft"
            ],
            [
              55698,
              "u8",
              "HorizontalAlignment"
            ],
            [
              55718,
              "u8",
              "set_TextAlign"
            ],
            [
              55732,
              "u8",
              "SystemColors"
            ],
            [
              55745,
              "u8",
              "Color"
            ],
            [
              55751,
              "u8",
              "get_ActiveCaptionText"
            ],
            [
              55773,
              "u8",
              "set_BackColor"
            ],
            [
              55787,
              "u8",
              "set_ClientSize"
            ],
            [
              55802,
              "u8",
              "ControlCollection"
            ],
            [
              55820,
              "u8",
              "get_Controls"
            ],
            [
              55837,
              "u8",
              "EventHandler"
            ],
            [
              55859,
              "u8",
              "ResumeLayout"
            ],
            [
              55872,
              "u8",
              "PerformLayout"
            ],
            [
              55886,
              "u8",
              "AppDomain"
            ],
            [
              55896,
              "u8",
              "get_CurrentDomain"
            ]
          ],
          "v": {
            "file.stem": "d7c234e4663d1afe2f9ac871ed2e989832226359bb3f1d97fc96b2ffbdba0d9d",
            "pe.imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
            "pe.machine": "i386",
            "pe.subsystem": "windows_gui",
            "pe.timestamp": 1528736851,
            "file.basename": "d7c234e4663d1afe2f9ac871ed2e989832226359bb3f1d97fc96b2ffbdba0d9d.exe",
            "pe.image_base": 4194304,
            "pe.image_size": 122880,
            "pe.machine_id": 332,
            "pe.os_version": "4.0",
            "pe.version.os": "unknown",
            "pe.entry_point": 104030,
            "pe.headers_size": 512,
            "pe.version.type": "app",
            "pe.entry_section": ".text",
            "pe.subsystem_raw": 2,
            "pe.clr.is_il_only": 1,
            "pe.file_alignment": 512,
            "pe.cert_table_size": 10144,
            "pe.image_hash.sha1": "199ed2bfa0f1752dc08eec42321af2561f2fe1f4",
            "pe.version.company": "chieftain",
            "pe.image_hash.sha256": "94a83d03d5bdeb342befc54fedc57fb8714fa1c94650e27a4f90567cd163b4a2",
            "pe.image_hash.sha384": "b60d84d5e81cbe9d6cddb08adce4dfe05608db785ff7f8704d50315d0deb33d0b02c6a7551755aeea6209c8e5ae3e261",
            "pe.image_hash.sha512": "3758fed11c2bb7c5af545fd1f0e15a0888a90f1c64a766a130b1c7bcaf0d79464ee80343c1eb5e81dc811f8ffb51220c1827d84751b40b39ac1904a8dae76a1d",
            "pe.resource_types[0]": "RT_VERSION",
            "pe.section_alignment": 8192,
            "pe.subsystem_version": "4.0",
            "pe.version.copyright": "aluminium © gluttonous",
            "pe.characteristics[0]": "executable_image",
            "pe.characteristics[1]": "32bit_machine",
            "pe.characteristics_raw": 258,
            "pe.clr.runtime_version": "2.5",
            "pe.version.description": "approximation",
            "pe.linker_major_version": 8,
            "pe.signatures[0].issuer": "CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US",
            "pe.signatures[0].serial": "33000002528b33aaf895f339db000000000252",
            "pe.version.file_version": "1.28.14.52",
            "pe.version.product_name": "frozen",
            "pe.signatures[0].subject": "CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US",
            "pe.version.internal_name": "1.exe",
            "pe.dll_characteristics[0]": "dynamic_base",
            "pe.dll_characteristics[1]": "nx_compat",
            "pe.dll_characteristics[2]": "no_seh",
            "pe.dll_characteristics[3]": "terminal_server_aware",
            "pe.signatures[0].verified": true,
            "pe.data_directories[0].rva": 103944,
            "pe.data_directories[1].rva": 106496,
            "pe.data_directories[2].rva": 102016,
            "pe.data_directories[3].rva": 114688,
            "pe.data_directories[4].rva": 8192,
            "pe.data_directories[5].rva": 8200,
            "pe.dll_characteristics_raw": 34112,
            "pe.number_of_rva_and_sizes": 16,
            "pe.signatures[0].not_after": "2022-09-01T18:32:59Z",
            "pe.version.product_version": "1.28.14.52",
            "pe.data_directories[0].name": "import",
            "pe.data_directories[0].size": 83,
            "pe.data_directories[1].name": "resource",
            "pe.data_directories[1].size": 840,
            "pe.data_directories[2].name": "certificate",
            "pe.data_directories[2].size": 10144,
            "pe.data_directories[3].name": "base_relocation",
            "pe.data_directories[3].size": 12,
            "pe.data_directories[4].name": "iat",
            "pe.data_directories[4].size": 8,
            "pe.data_directories[5].name": "clr_runtime_header",
            "pe.data_directories[5].size": 72,
            "pe.signatures[0].not_before": "2021-09-02T18:32:59Z",
            "pe.version.original_filename": "1.exe",
            "pe.coff.dos_header_pe_pointer": 128,
            "pe.base_relocations.block_count": 1,
            "pe.base_relocations.entry_count": 1,
            "pe.signatures[0].thumbprint_sha1": "8740df4acb749640ad318e4be842f72ec651ad80",
            "pe.base_relocations.padding_count": 1,
            "pe.signatures[0].cert_chain_depth": 2,
            "pe.signatures[0].digest_algorithm": "sha256",
            "pe.signatures[0].eku_code_signing": true,
            "pe.signatures[0].signature_digest": "c8361aec219d230e6aba29521f523e79cac271f3ce45418d80681438dcdbedc0",
            "pe.signatures[0].thumbprint_sha256": "2eb421fbb33bbf9c8f6b58c754b0405f40e02cb6328936aae39db7a24880ea21",
            "pe.signatures[0].signature_algorithm": "sha256WithRSAEncryption",
            "pe.signatures[0].signature_digest_algorithm": "sha256"
          },
          "id": "pe",
          "sc": [
            [
              ".text",
              512,
              96256,
              5.65,
              "r-x"
            ],
            [
              ".rsrc",
              96768,
              1024,
              2.75,
              "r--"
            ],
            [
              ".reloc",
              97792,
              512,
              0.1,
              "r--"
            ]
          ]
        },
        "id": 0,
        "sz": 119008,
        "ts": [
          {
            "c": 1.0,
            "d": ".NET assembly detected via BSJB CLR metadata signature",
            "e": [
              "BSJB at offset 0xc7a0"
            ],
            "i": "metadata/dotnet/bsjb-signature",
            "l": 2,
            "el": [
              "0xc7a0"
            ]
          },
          {
            "c": 1.0,
            "d": "Authenticode chain CN: Microsoft Corporation",
            "e": [
              "Microsoft Corporation"
            ],
            "i": "metadata/signed/unknown::microsoft-corporation",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Signed by Microsoft Corporation",
            "e": [
              "Microsoft Corporation"
            ],
            "i": "metadata/signed/leaf::microsoft-corporation",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "Binary has 1000 or more strings",
            "e": [
              "binary.string_count = 2911.00"
            ],
            "i": "metadata/binary/metrics/threshold::string-count-1000-plus",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "Reflection method namespace token",
            "e": [
              "System.Reflection"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/invoke::namespace-import",
            "l": 1,
            "el": [
              "0xd6bf"
            ]
          },
          {
            "c": 1.0,
            "d": "ASLR enabled (DYNAMIC_BASE)",
            "e": [
              "[dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-aslr",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE FileDescription metadata field",
            "e": [
              "FileDescription"
            ],
            "i": "metadata/package/versioning::pe-filedescription-field",
            "l": 2,
            "el": [
              "0x17b6e"
            ]
          },
          {
            "c": 1.0,
            "d": "PE Authenticode signature verified metadata",
            "e": [
              "true"
            ],
            "i": "metadata/signed/certificate::pe-signature-verified-kv",
            "l": 2,
            "el": [
              "value:pe.signatures[0].verified"
            ]
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "High plaintext string count",
            "e": [
              "binary.string_count = 2911.00"
            ],
            "i": "objectives/anti-static/pack/polymorphic::high-string-count-2000",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE has under ten imports",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "PE version info numeric fields present",
            "e": [
              "1.28.14.52"
            ],
            "i": "metadata/binary/anomaly/format::version-info-file-version-present",
            "l": 1,
            "el": [
              "value:pe.version.file_version"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE import table has exactly one entry",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "metadata/binary/symbols/imports::single-import-raw",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Code section dominates file layout",
            "e": [
              "binary.largest_section_ratio = 0.81"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 1.0,
            "d": "PE binary has trailing overlay data",
            "e": [
              "binary.has_overlay = 1.00"
            ],
            "i": "metadata/binary/layout::has-overlay",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "NO_SEH (SafeSEH not used)",
            "e": [
              "[dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-no-seh",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "c": 0.9200000166893005,
            "d": "PE FileVersion resembles IPv4",
            "e": [
              "1.28.14.52"
            ],
            "i": "metadata/package/versioning::pe-file-version-ipv4-shape",
            "l": 1,
            "el": [
              "value:pe.version.file_version"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PNG image magic in text section",
            "e": [
              "89 50 4E 47 0D 0A 1A 0A"
            ],
            "i": "metadata/binary/resource::png-magic-in-text",
            "l": 1,
            "el": [
              "0x7521"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE .reloc section presence",
            "e": [
              ".reloc"
            ],
            "i": "metadata/binary/section/names::reloc-section-presence",
            "l": 2
          },
          {
            "c": 0.6499999761581421,
            "d": "AppDomain class token",
            "e": [
              "AppDomain"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/invoke::appdomain-class-token",
            "l": 1,
            "el": [
              "0xda4e"
            ]
          },
          {
            "c": 1.0,
            "d": ".NET Metadata Root (BSJB)",
            "e": [
              "BSJB"
            ],
            "i": "metadata/binary/framework::dotnet-metadata",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.9900000095367432,
            "d": "PE version resource text",
            "e": [
              "VS_VERSION_INFO"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info",
            "l": 1,
            "m": "B0032",
            "el": [
              "0x17a5e"
            ]
          },
          {
            "a": "T1620",
            "c": 0.949999988079071,
            "d": "mscoree DLL string reference",
            "e": [
              "mscoree.dll"
            ],
            "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere",
            "l": 1,
            "m": "B0032",
            "el": [
              "0x1784e"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "PE FileDescription field is populated",
            "e": [
              "approximation"
            ],
            "i": "metadata/package/versioning::pe-file-description-present",
            "l": 1,
            "el": [
              "value:pe.version.description"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE resource section",
            "e": [
              ".rsrc"
            ],
            "i": "metadata/binary/section/names::pe-resource-section",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Issued by a Microsoft Code Signing PCA",
            "e": [
              "CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US"
            ],
            "i": "metadata/signed/certificate::pe-cert-issuer-microsoft-pca",
            "l": 2,
            "el": [
              "value:pe.signatures[0].issuer"
            ]
          },
          {
            "c": 0.9900000095367432,
            "d": "Exactly three sections",
            "e": [
              "sections.count = 3.00"
            ],
            "i": "well-known/malware/worm/ludbaruma::metric-section-count-3",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE OriginalFilename metadata field",
            "e": [
              "OriginalFilename"
            ],
            "i": "metadata/package/versioning::pe-originalfilename-field",
            "l": 2,
            "el": [
              "0x17c6a"
            ]
          },
          {
            "d": "certificate string reference",
            "e": [
              "Certificate"
            ],
            "i": "micro-behaviors/crypto/certificate/usage::certificate-ref",
            "l": 2,
            "el": [
              "0x195a1"
            ]
          },
          {
            "a": "T1105",
            "c": 0.8999999761581421,
            "d": "Dominant high entropy overlay",
            "e": [
              "binary.overlay_entropy = 7.85"
            ],
            "i": "objectives/command-and-control/dropper/execution/installer::dominant-overlay-high-entropy",
            "l": 1,
            "m": "B0022"
          },
          {
            "c": 0.8199999928474426,
            "d": "Encoded Microsoft OCSP URL",
            "e": [
              "Phttp://www.microsoft.com/pkiops/certs/Microsoft Time-Stamp PCA 2010(1).crt0",
              "Nhttp://www.microsoft.com/pkiops/crl/Microsoft Time-Stamp PCA 2010(1).crl0l"
            ],
            "i": "objectives/anti-static/obfuscation/encoding/content::encoded-ms-ocsp-url",
            "l": 1,
            "el": [
              "0x1a53a",
              "0x1a4ce"
            ]
          },
          {
            "c": 1.0,
            "d": "DEP / NX enabled (NX_COMPAT)",
            "e": [
              "[dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-dep",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Microsoft vendor marker in certificate data",
            "e": [
              "Microsoft Corporation"
            ],
            "i": "metadata/binary/vendor::microsoft-corp-marker-cert",
            "l": 1
          },
          {
            "a": "T1027.009",
            "c": 0.8600000143051147,
            "d": ".NET ResourceReader payload access",
            "e": [
              "lSystem.Resources.ResourceReader, mscorlib, Version=2.0.…"
            ],
            "i": "micro-behaviors/data/embedded/payload/resource::dotnet-resource-reader",
            "l": 1,
            "el": [
              "0x7350"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "System namespace reference",
            "e": [
              "System.Security"
            ],
            "i": "metadata/lang/compiler/managed::system-namespace",
            "l": 2,
            "el": [
              "0xd81c"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE CompanyName metadata field",
            "e": [
              "CompanyName"
            ],
            "i": "metadata/package/versioning::pe-companyname-field",
            "l": 2,
            "el": [
              "0x17b3a"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "Microsoft timestamp certificate chain",
            "e": [
              "Microsoft Time-Stamp PCA 2010",
              "Microsoft Time-Stamp Service"
            ],
            "i": "micro-behaviors/data/embedded/certificate::microsoft-timestamp-chain",
            "l": 2,
            "el": [
              "0x1a140",
              "0x1a08e"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "Microsoft code-signing certificate chain",
            "e": [
              "Microsoft Code Signing PCA 2011"
            ],
            "i": "micro-behaviors/data/embedded/certificate::microsoft-code-signing-pca",
            "l": 2,
            "el": [
              "0x18fa7"
            ]
          },
          {
            "a": "T1027",
            "c": 1.0,
            "d": "Binary has normal code entropy (\u003e5.5)",
            "e": [
              "binary.code_entropy = 5.65"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.800000011920929,
            "d": "Windows Forms UI framework",
            "e": [
              "System.Windows.Forms"
            ],
            "i": "metadata/lang/compiler/managed::winforms-ui",
            "l": 2,
            "el": [
              "0xd08e"
            ]
          },
          {
            "c": 0.9200000166893005,
            "d": "PE ProductVersion resembles IPv4",
            "e": [
              "1.28.14.52"
            ],
            "i": "metadata/package/versioning::pe-product-version-ipv4-shape",
            "l": 1,
            "el": [
              "value:pe.version.product_version"
            ]
          },
          {
            "c": 0.6200000047683716,
            "d": "Assembly Load method token",
            "e": [
              "Load"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/invoke::dotnet-assembly-load-token",
            "l": 1,
            "el": [
              "0xe993"
            ]
          },
          {
            "c": 1.0,
            "d": "Binary has 4 or fewer sections",
            "e": [
              "sections.count = 3.00"
            ],
            "i": "objectives/command-and-control/infrastructure/config::max-sections-4",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "d7c234e4663d1afe2f9ac871ed2e989832226359bb3f1d97fc96b2ffbdba0d9d.exe"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "c": 0.6000000238418579,
            "d": "AppDomain.CurrentDomain accessor",
            "e": [
              "get_CurrentDomain"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/invoke::appdomain-currentdomain",
            "l": 1,
            "el": [
              "0xda58"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE has few sections",
            "e": [
              "sections.count = 3.00"
            ],
            "i": "metadata/binary/layout::legacy-few-sections",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "PE first resource is RT_VERSION",
            "e": [
              "RT_VERSION"
            ],
            "i": "metadata/binary/resource::pe-resource-version-first",
            "l": 2,
            "el": [
              "value:pe.resource_types[0]"
            ]
          },
          {
            "c": 0.75,
            "d": "Runtime interop services",
            "e": [
              "System.Runtime.InteropServices"
            ],
            "i": "metadata/lang/compiler/managed::runtime-interop",
            "l": 2,
            "el": [
              "0xd707"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE with six or fewer imports",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "metadata/binary/symbols/imports::pe-imports-max-six",
            "l": 1
          },
          {
            "a": "T1140",
            "c": 0.8399999737739563,
            "d": "CreateInstance activation token",
            "e": [
              "CreateInstance"
            ],
            "i": "objectives/command-and-control/dropper/staging/embedded::createinstance-token",
            "l": 1,
            "m": "B0030",
            "el": [
              "0xda73"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": ".NET WPF namespace reference",
            "e": [
              "System.Windows"
            ],
            "i": "well-known/game/mod::wpf-namespace-ref",
            "l": 1,
            "el": [
              "0xd08e"
            ]
          },
          {
            "d": ".dll extension reference",
            "e": [
              ".dll"
            ],
            "i": "micro-behaviors/fs/path/extension::dll-dup",
            "l": 2,
            "el": [
              "0x1784e"
            ]
          },
          {
            "c": 0.8199999928474426,
            "d": "Type.InvokeMember reflection token",
            "e": [
              "InvokeMember"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/invoke::invokemember-token",
            "l": 1,
            "el": [
              "0xdacb"
            ]
          },
          {
            "a": "T1027",
            "c": 0.8399999737739563,
            "d": "VB6 PE with three sections",
            "e": [
              "sections.count = 3.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard runtime section",
            "e": [
              ".reloc"
            ],
            "i": "metadata/binary/section/names::pe-runtime-standard-section",
            "l": 1
          },
          {
            "a": "T1041",
            "c": 0.8600000143051147,
            "d": "Notification config wording",
            "e": [
              "sender"
            ],
            "i": "objectives/exfiltration/messaging/webhook::notification-config-word",
            "l": 1,
            "m": "B0030",
            "el": [
              "0xdb0d"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "SOCKS5 client greeting bytes",
            "e": [
              "05 01 00"
            ],
            "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes",
            "l": 1,
            "el": [
              "0x74e8"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE ProductName metadata field",
            "e": [
              "ProductName"
            ],
            "i": "metadata/package/versioning::pe-productname-field",
            "l": 2,
            "el": [
              "0x17c9e"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "PE ProductName field is populated",
            "e": [
              "frozen"
            ],
            "i": "metadata/package/versioning::pe-product-name-present",
            "l": 1,
            "el": [
              "value:pe.version.product_name"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "mscorlib reference",
            "e": [
              "System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934",
              "lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R",
              "mscorlib"
            ],
            "i": "metadata/lang/compiler/managed::mscorlib",
            "l": 2,
            "el": [
              "0x1776d",
              "0x7350",
              "0xd0a8"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE has many readable strings",
            "e": [
              "binary.string_count = 2911.00"
            ],
            "i": "metadata/binary/layout::many-readable-strings",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "PE LegalCopyright field is populated",
            "e": [
              "aluminium © gluttonous"
            ],
            "i": "metadata/package/versioning::pe-legal-copyright-present",
            "l": 1,
            "el": [
              "value:pe.version.copyright"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE InternalName metadata field",
            "e": [
              "InternalName"
            ],
            "i": "metadata/package/versioning::pe-internalname-field",
            "l": 2,
            "el": [
              "0x17bea"
            ]
          },
          {
            "c": 1.0,
            "d": "Binary has 2000+ strings",
            "e": [
              "binary.string_count = 2911.00"
            ],
            "i": "metadata/binary/metrics/threshold::many-strings-2000",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Regex component marker",
            "e": [
              "String",
              "Substring",
              "StringFileInfo"
            ],
            "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7",
            "l": 1,
            "el": [
              "0xdadd",
              "0xdaf4",
              "0x17afe"
            ]
          },
          {
            "a": "T1027.003",
            "c": 0.8199999928474426,
            "d": ".NET Bitmap type reference",
            "e": [
              "System.Drawing.Bitmap"
            ],
            "i": "micro-behaviors/data/embedded/payload/image::dotnet-bitmap-type-token",
            "l": 1,
            "m": "F0001.006",
            "el": [
              "0x74ee"
            ]
          },
          {
            "c": 0.8500000238418579,
            "d": "IPv4-like .NET assembly version",
            "e": [
              "Version=2.0.0.0"
            ],
            "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version",
            "l": 2,
            "el": [
              "0x7350"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard code/data section",
            "e": [
              ".text"
            ],
            "i": "metadata/binary/section/names::pe-code-data-standard-section",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE file uses .exe extension",
            "e": [
              "d7c234e4663d1afe2f9ac871ed2e989832226359bb3f1d97fc96b2ffbdba0d9d.exe"
            ],
            "i": "metadata/binary/framework::exe-extension",
            "l": 1
          },
          {
            "a": "T1027",
            "d": "Binary has overlay data",
            "e": [
              "binary.has_overlay = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics/shape::has-overlay",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8600000143051147,
            "d": "Long mixed-case identifiers cluster",
            "e": [
              "AssemblyConfigurationAttribute",
              "SecurityPermissionAttribute",
              "AssemblyFileVersionAttribute",
              "AssemblyCultureAttribute",
              "AssemblyCompanyAttribute",
              "AssemblyProductAttribute",
              "AssemblyCopyrightAttribute",
              "AssemblyTrademarkAttribute",
              "CompilationRelaxationsAttribute",
              "RuntimeCompatibilityAttribute",
              "InitializeComponent",
              "AssemblyDescriptionAttribute",
              "AssemblyVersionAttribute",
              "AssemblyTitleAttribute",
              "ComVisibleAttribute",
              "HorizontalAlignment"
            ],
            "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers",
            "l": 1,
            "m": "B0032",
            "el": [
              "0xd7c9",
              "0xd838",
              "0xd6d1",
              "0xd748",
              "0xd7b0",
              "0xd797",
              "0xd77c",
              "0xd761",
              "0xd883",
              "0xd8a3",
              "0xd655",
              "0xd7e8",
              "0xd6ee",
              "0xd805",
              "0xd734",
              "0xd992"
            ]
          },
          {
            "a": "T1055",
            "c": 0.800000011920929,
            "d": "Executable section with very low entropy",
            "e": [
              ".text (size: 96256, perms: r-x)"
            ],
            "i": "objectives/anti-static/obfuscation/binary-structure::low-entropy-executable",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "High string count over 1000",
            "e": [
              "binary.string_count = 2911.00"
            ],
            "i": "metadata/binary/metrics/threshold::high-string-count-1000",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)",
            "e": [
              "pe.resource_count = 1.00"
            ],
            "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8199999928474426,
            "d": "Packed loader largest section ratio above 0.65",
            "e": [
              "binary.largest_section_ratio = 0.81"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.7200000286102295,
            "d": "WinForms Label control token",
            "e": [
              "Label"
            ],
            "i": "micro-behaviors/ui/controls/widget::winforms-label",
            "l": 1,
            "el": [
              "0xd4cb"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "Tiny resource section (no version/icon)",
            "e": [
              ".rsrc (size: 1024)"
            ],
            "i": "metadata/binary/resource::minimal-resources",
            "l": 2
          },
          {
            "c": 1.0,
            "d": ".NET BSJB metadata marker",
            "e": [
              "BSJB"
            ],
            "i": "metadata/binary/framework::bsjb-marker",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "Filename has EXE extension",
            "e": [
              "d7c234e4663d1afe2f9ac871ed2e989832226359bb3f1d97fc96b2ffbdba0d9d.exe"
            ],
            "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe",
            "l": 1
          },
          {
            "a": "T1053.005",
            "c": 0.8799999952316284,
            "d": "Regex component marker",
            "e": [
              "Path",
              "get_Path",
              "_getPath"
            ],
            "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-5",
            "l": 1,
            "m": "F0012",
            "el": [
              "0xd6b5",
              "0xd6a3",
              "0xd6ac"
            ]
          },
          {
            "a": "T1027.009",
            "c": 0.800000011920929,
            "d": "High entropy overlay data",
            "e": [
              "binary.overlay_entropy = 7.85"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics/shape::high-entropy-overlay-raw",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.7200000286102295,
            "d": "WinForms Button control token",
            "e": [
              "Button"
            ],
            "i": "micro-behaviors/ui/controls/widget::winforms-button",
            "l": 1,
            "el": [
              "0xd0fb"
            ]
          },
          {
            "a": "T1055",
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571",
            "l": 1,
            "m": "C0041"
          },
          {
            "a": "T1105",
            "c": 0.800000011920929,
            "d": "Compact PE import table",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table",
            "l": 1,
            "m": "E1105"
          },
          {
            "a": "T1027",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "binary.largest_section_ratio = 0.81"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.949999988079071,
            "d": "links mscoree (CorExeMain)",
            "e": [
              "mscoree"
            ],
            "i": "metadata/dylib::mscoree",
            "l": 2,
            "el": [
              "1 symbols"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "PE version numbers look like IPv4",
            "e": [
              "1.28.14.52"
            ],
            "i": "metadata/package/versioning::version-number-ipv4-metadata",
            "l": 1,
            "el": [
              "value:pe.version.file_version"
            ]
          },
          {
            "a": "T1036.005",
            "c": 0.9399999976158142,
            "d": "Two dotted-quad version strings",
            "e": [
              "1.28.14.52"
            ],
            "i": "objectives/evasion/masquerade/identity/fabricated::dotted-quad-version-pair",
            "l": 1,
            "el": [
              "value:pe.version.file_version"
            ]
          },
          {
            "c": 1.0,
            "d": "Microsoft certificate chain markers",
            "e": [
              "Microsoft Time-Stamp Service",
              "Microsoft Code Signing PCA 2011",
              "Microsoft Time-Stamp PCA 2010",
              "Microsoft Corporation"
            ],
            "i": "metadata/signed/platform::microsoft-certificate-chain",
            "l": 1,
            "el": [
              "0x1a08e",
              "0x18fa7",
              "0x1a140",
              ""
            ]
          }
        ],
        "sha": "d7c234e4663d1afe2f9ac871ed2e989832226359bb3f1d97fc96b2ffbdba0d9d",
        "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2024-06/d7c234e4663d1afe2f9ac871ed2e989832226359bb3f1d97fc96b2ffbdba0d9d.exe",
        "type": "pe"
      }
    ],
    "tv": "ca5ef"
  }
}