diff --git a/anti-static-analysis/disassembler-evasion.md b/anti-static-analysis/disassembler-evasion.md
index e2546cd..3011eb8 100644
--- a/anti-static-analysis/disassembler-evasion.md
+++ b/anti-static-analysis/disassembler-evasion.md
@@ -25,7 +25,7 @@
| Last Modified |
-6 February 2024 |
+22 August 2024 |
@@ -40,6 +40,7 @@ Anti-disassembly techniques take advantage of weaknesses in either flow-oriented
|**Argument Obfuscation**|B0012.001|Simple number or string arguments to API calls are calculated at runtime, making linear disassembly more difficult.|
|**Conditional Misdirection**|B0012.002|Conditional jumps are sometimes used to confuse disassembly engines, resulting in the wrong instruction boundaries and thus wrong mnemonic and operands; may be identified by instructions *jmp/jcc to a label+#* (e.g., JNE loc_401345fe+2).|
|**Desynchronizing Opaque Predicates**|B0012.006|Opaque predicates inject superfluous branches into the disassembly, resulting in disassembly desynchronization, as well as code bloat. The junk bytes introduced damage the disassembly process when the bytes are treated as code. [[6]](#6) This method is related to Unprotect technique U0201.|
+|**Fake Function**|B0012.007|A fake function call is used to call an address which confuses a disassembler and results in incorrect disassembly. Manually undefining the function call can enable the disassembler to produce the true code.|
|**VBA Stomping**|B0012.005|Typically, VBA source code is compiled into p-code, which is stored with compressed sourced code in the OLE file with VBA macros. VBA Stomping - when the VBA source code is removed and only the p-code remains - makes analysis much harder. See [[4]](#4) for an analysis of a VBA-Stomped malicious VBA Office document. See [[5]](#5) for information on Evil Clippy, a tool that creates malicious MS Office documents.|
|**Value Dependent Jumps**|B0012.003|Explicit use of computed values for control flow, often in the same basic block or function.|
diff --git a/micro-behaviors/communication/interprocess-communication.md b/micro-behaviors/communication/interprocess-communication.md
index ff69b09..807bff0 100644
--- a/micro-behaviors/communication/interprocess-communication.md
+++ b/micro-behaviors/communication/interprocess-communication.md
@@ -61,7 +61,7 @@ The Interprocess Communication micro-behavior focuses on interprocess communicat
|Tool: CAPE|Class|Mapping|APIs|
|---|---|---|---|
-|[ipc_namedpipe](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ipc_namedpipe.py)|IPC_NamedPipe|Interprocess Communication (C0003), Interprocess Communication::Create Pipe (C0003.001)|NtReadFile, NtCreateNamedPipeFile, NtWriteFile|
+|[ipc_namedpipe](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ipc_namedpipe.py)|IPC_NamedPipe|Interprocess Communication::Create Pipe (C0003.001)|NtReadFile, NtCreateNamedPipeFile, NtWriteFile|
### C0003.002 Snippet
diff --git a/micro-behaviors/communication/wininet.md b/micro-behaviors/communication/wininet.md
index 3002780..2462669 100644
--- a/micro-behaviors/communication/wininet.md
+++ b/micro-behaviors/communication/wininet.md
@@ -46,7 +46,8 @@ The methods below are those of most interest in malware analysis. Details can be
|Tool: CAPE|Class|Mapping|APIs|
|---|---|---|---|
-|[ransomware_nemty](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/ransomware_nemty.py)|NemtyNetworkActivity|WinINet (C0005), InternetOpen (C0005.002), InternetOpenURL (C0005.003)|InternetOpenA, InternetOpenUrlA|
+|[ransomware_nemty](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/ransomware_nemty.py)|NemtyNetworkActivity|InternetOpen (C0005.002)|InternetOpenA, InternetOpenUrlA|
+|[ransomware_nemty](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/ransomware_nemty.py)|NemtyNetworkActivity|InternetOpenURL (C0005.003)|InternetOpenA, InternetOpenUrlA|
|[powershell_command](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/powershell_command.py)|PowerShellNetworkConnection|WinINet (C0005)|InternetCrackUrlW, InternetCrackUrlA|
### C0005.001 Snippet
diff --git a/micro-behaviors/cryptography/decrypt-data.md b/micro-behaviors/cryptography/decrypt-data.md
index 96a9b8b..43a4998 100644
--- a/micro-behaviors/cryptography/decrypt-data.md
+++ b/micro-behaviors/cryptography/decrypt-data.md
@@ -54,7 +54,7 @@ Malware may decrypt data.
|Name|Date|Method|Description|
|---|---|---|---|
|[**BlackEnergy**](../../xample-malware/blackenergy.md)|2007|--|BlackEnergy encrypts or decrypts via WinCrypt. [[1]](#1)|
-|[**Kovter**](../../xample-malware/kovter.md)|2016|--|Encrypt or decrypt via WinCrypt (This capa rule had 1 match) [[1]](#1)|
+|[**Kovter**](../../xample-malware/kovter.md)|2016|--|Encrypt or decrypt via WinCrypt [[1]](#1)|
## Detection
diff --git a/micro-behaviors/cryptography/generate-pseudorandom-sequence.md b/micro-behaviors/cryptography/generate-pseudorandom-sequence.md
index b24d675..877fe26 100644
--- a/micro-behaviors/cryptography/generate-pseudorandom-sequence.md
+++ b/micro-behaviors/cryptography/generate-pseudorandom-sequence.md
@@ -44,7 +44,7 @@ The Generate Pseudo-random Sequence micro-behavior can be used for a number of p
|Name|Date|Method|Description|
|---|---|---|---|
|[**BlackEnergy**](../../xample-malware/blackenergy.md)|2007|C0021.003|BlackEnergy generates random numbers via WinAPI. [[1]](#1)|
-|[**Locky Bart**](../../xample-malware/locky-bart.md)|2017|C0021.003|Generate random numbers via WinAPI (This capa rule had 1 match) [[1]](#1)|
+|[**Locky Bart**](../../xample-malware/locky-bart.md)|2017|C0021.003|Generate random numbers via WinAPI [[1]](#1)|
## Detection
diff --git a/micro-behaviors/data/compression-library.md b/micro-behaviors/data/compression-library.md
index d5c557e..0a47eff 100644
--- a/micro-behaviors/data/compression-library.md
+++ b/micro-behaviors/data/compression-library.md
@@ -35,7 +35,7 @@ Malware may utilize a compression library.
|Name|Date|Method|Description|
|---|---|---|---|
|[**Dark Comet**](../../xample-malware/dark-comet.md)|2008|--|DarkComet linked against ZLIB. [[1]](#1)|
-|[**Hupigon**](../../xample-malware/hupigon.md)|2013|--|Linked against ZLIB (This capa rule had 1 match) [[1]](#1)|
+|[**Hupigon**](../../xample-malware/hupigon.md)|2013|--|Linked against ZLIB [[1]](#1)|
## Detection
diff --git a/micro-behaviors/file-system/create-file.md b/micro-behaviors/file-system/create-file.md
index baab59d..be40f9f 100644
--- a/micro-behaviors/file-system/create-file.md
+++ b/micro-behaviors/file-system/create-file.md
@@ -69,9 +69,9 @@ Malware creates a file.
|[office_exploit](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/office_exploit.py)|OfficePostScript|Create File (C0016)|NtWriteFile|
|[rat_nanocore](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/rat_nanocore.py)|NanocoreRAT|Create File (C0016)|CryptHashData|
|[infostealer_qulab](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/infostealer_qulab.py)|QulabFiles|Create File (C0016)|--|
-|[ransomware_files](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/ransomware_files.py)|RansomwareFiles|Create File (C0016), Create File::Create Ransomware File (C0016.002)|--|
+|[ransomware_files](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/ransomware_files.py)|RansomwareFiles|Create File::Create Ransomware File (C0016.002)|--|
|[rat_dcrat](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/rat_dcrat.py)|DCRatFiles|Create File (C0016)|--|
-|[office_rtf](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/office_rtf.py)|RTFEmbeddedOfficeFile|Create File (C0016), Create File::Create Office Document (C0016.001)|--|
+|[office_rtf](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/office_rtf.py)|RTFEmbeddedOfficeFile|Create File::Create Office Document (C0016.001)|--|
|[stack_pivot](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/stack_pivot.py)|StackPivotFileCreated|Create File (C0016)|NtCreateFile|
|[infostealer_masslogger](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/infostealer_masslogger.py)|MassLoggerFiles|Create File (C0016)|--|
|[stealth_file](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/stealth_file.py)|StealthFile|Create File (C0016)|NtCreateFile, NtDuplicateObject, NtOpenFile, NtClose, NtSetInformationFile|
\ No newline at end of file
diff --git a/micro-behaviors/file-system/delete-directory.md b/micro-behaviors/file-system/delete-directory.md
index 64d9a3b..7422540 100644
--- a/micro-behaviors/file-system/delete-directory.md
+++ b/micro-behaviors/file-system/delete-directory.md
@@ -35,8 +35,8 @@ Malware deletes a directory.
|Name|Date|Method|Description|
|---|---|---|---|
|[**Gamut**](../../xample-malware/gamut.md)|2014|--|Gamut deletes directories. [[1]](#1)|
-|[**Hupigon**](../../xample-malware/hupigon.md)|2013|--|Delete directory (This capa rule had 1 match) [[1]](#1)|
-|[**Kovter**](../../xample-malware/kovter.md)|2016|--|Delete directory (This capa rule had 4 matches) [[1]](#1)|
+|[**Hupigon**](../../xample-malware/hupigon.md)|2013|--|Delete directory [[1]](#1)|
+|[**Kovter**](../../xample-malware/kovter.md)|2016|--|Delete directory [[1]](#1)|
## Detection
diff --git a/micro-behaviors/operating-system/registry.md b/micro-behaviors/operating-system/registry.md
index 096e83a..a6f09f3 100644
--- a/micro-behaviors/operating-system/registry.md
+++ b/micro-behaviors/operating-system/registry.md
@@ -101,61 +101,62 @@ Malware modifies the registry.
|---|---|---|---|
|[darkcomet_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/darkcomet_regkeys.py)|DarkCometRegkeys|Registry (C0036)|--|
|[ransomware_revil_regkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_revil_regkey.py)|RevilRegkey|Registry (C0036)|--|
-|[browser_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_security.py)|BrowserSecurity| Registry (C0036), Registry::Set Registry Value (C0036.001)|--|
+|[browser_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_security.py)|BrowserSecurity|Registry::Set Registry Value (C0036.001)|--|
|[disables_notificationcenter](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_notificationcenter.py)|DisablesNotificationCenter|Registry (C0036)|--|
|[removes_networking_icon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/removes_networking_icon.py)|RemovesNetworkingIcon|Registry (C0036)|--|
|[tampers_powershell_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/tampers_powershell_logging.py)|TampersPowerShellLogging|Registry (C0036)|--|
|[disables_power_options](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_power_options.py)|DisablesPowerOptions|Registry (C0036)|--|
-|[browser_startpage](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_startpage.py)|browser_startpage|Registry (C0036), Registry::Set Registry Value (C0036.001)|--|
+|[browser_startpage](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_startpage.py)|browser_startpage|Registry::Set Registry Value (C0036.001)|--|
|[disables_restore_default_state](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_restore_default_state.py)|DisablesRestoreDefaultState|Registry (C0036)|--|
-|[antivm_generic_cpu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_cpu.py)|AntiVMCPU|Registry (C0036), Registry::Query Registry Key (C0036.005)| RegQueryValueExW, RegQueryValueExA, NtQueryValueKey|
+|[antivm_generic_cpu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_cpu.py)|AntiVMCPU|Registry::Query Registry Key (C0036.005)| RegQueryValueExW, RegQueryValueExA, NtQueryValueKey|
|[prevents_safeboot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/prevents_safeboot.py)|prevents_safeboot|Registry (C0036)|--|
|[disables_smartscreen](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_smartscreen.py)|DisablesSmartScreen|Registry (C0036)|--|
|[disables_context_menus](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_context_menus.py)|DisablesContextMenus|Registry (C0036)|--|
-|[antivm_generic_bios](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_bios.py)|AntiVMBios|Registry (C0036), Registry::Query Registry Key (C0036.005)|--|
+|[antivm_generic_bios](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_bios.py)|AntiVMBios|Registry::Query Registry Key (C0036.005)|--|
|[disables_run_command](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_run_command.py)|DisableRunCommand|Registry (C0036)|--|
|[persistence_ifeo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_ifeo.py)|PersistenceIFEO|Registry (C0036)|--|
|[persistence_ifeo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_ifeo.py)|PersistenceSilentProcessExit|Registry (C0036)|--|
-|[antivm_vbox_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vbox_keys.py)|VBoxDetectKeys|Registry (C0036), Registry::Query Registry Key (C0036.005)|--|
+|[antivm_vbox_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vbox_keys.py)|VBoxDetectKeys|Registry::Query Registry Key (C0036.005)|--|
|[packer_armadillo_regkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/packer_armadillo_regkey.py)|ArmadilloRegKey|Registry (C0036)|--|
|[disables_backups](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_backups.py)|DisablesBackups|Registry (C0036)|--|
-|[antianalysis_detectreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antianalysis_detectreg.py)|AntiAnalysisDetectReg|Registry (C0036), Registry::Open Registry Key (C0036.003)|--|
+|[antianalysis_detectreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antianalysis_detectreg.py)|AntiAnalysisDetectReg|Registry::Open Registry Key (C0036.003)|--|
|[creates_largekey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/creates_largekey.py)|CreatesLargeKey|Registry (C0036)|RegSetValueExA, RegSetValueExW, NtSetValueKey|
|[removes_username_startmenu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/removes_username_startmenu.py)|RemovesUsernameStartMenu|Registry (C0036)|--|
|[stealth_hiddenreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_hiddenreg.py)|StealthHiddenReg|Registry (C0036)|--|
|[disables_startmenu_search](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_startmenu_search.py)|DisablesStartMenuSearch|Registry (C0036)|--|
-|[antivm_hyperv_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_hyperv_keys.py)|HyperVDetectKeys|Registry (C0036), Registry::Query Registry Key (C0036.005)|--|
+|[antivm_hyperv_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_hyperv_keys.py)|HyperVDetectKeys|Registry::Query Registry Key (C0036.005)|--|
|[creates_nullvalue](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/creates_nullvalue.py)|CreatesNullValue|Registry (C0036)|NtCreateKey, NtSetValueKey|
-|[antivm_generic_scsi](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_scsi.py)|AntiVMSCSI|Registry (C0036), Registry::Query Registry Key (C0036.005)|RegOpenKeyExW, RegQueryValueExA, RegQueryValueExW, RegOpenKeyExA|
+|[antivm_generic_scsi](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_scsi.py)|AntiVMSCSI|Registry::Query Registry Key (C0036.005)|RegOpenKeyExW, RegQueryValueExA, RegQueryValueExW, RegOpenKeyExA|
|[disables_appv_virtualization](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_appv_virtualization.py)|DisablesAppVirtualiztion|Registry (C0036)|--|
-|[antivm_xen_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_xen_keys.py)|XenDetectKeys|Registry (C0036), Registry::Query Registry Key (C0036.005)|--|
-|[antivm_parallels_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_parallels_keys.py)|ParallelsDetectKeys|Registry (C0036), Registry::Query Registry Key (C0036.005)|--|
-|[antivm_generic_diskreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_diskreg.py)|AntiVMDiskReg|Registry (C0036), Registry::Query Registry Key (C0036.005)|--|
-|[antivm_vpc_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vpc_keys.py)|AntiVMDiskReg|Registry (C0036), Registry::Query Registry Key (C0036.005)|--|
+|[antivm_xen_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_xen_keys.py)|XenDetectKeys|Registry::Query Registry Key (C0036.005)|--|
+|[antivm_parallels_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_parallels_keys.py)|ParallelsDetectKeys|Registry::Query Registry Key (C0036.005)|--|
+|[antivm_generic_diskreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_diskreg.py)|AntiVMDiskReg|Registry::Query Registry Key (C0036.005)|--|
+|[antivm_vpc_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vpc_keys.py)|AntiVMDiskReg|Registry::Query Registry Key (C0036.005)|--|
|[disables_folder_options](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_folder_options.py)|DisableFolderOptions|Registry (C0036)|--|
|[office_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/office_security.py)|OfficeSecurity|Registry (C0036)|--|
|[antivm_bochs_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_bochs_keys.py)|BochsDetectKeys|Registry::Query Registry Key (C0036.005)|--|
|[tampers_etw](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/tampers_etw.py)|TampersETW|Registry (C0036)|--|
|[disables_event_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_event_logging.py)|DisablesEventLogging|Registry (C0036)|--|
-|[antivm_generic_system](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_system.py)|AntiVMSystem|Registry (C0036), Registry::Query Registry Key (C0036.005)|--
-|[browser_addon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_addon.py)|BrowserAddon|Registry (C0036),Registry::Set Registry Value (C0036.001)|--|
+|[antivm_generic_system](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_system.py)|AntiVMSystem|Registry::Query Registry Key (C0036.005)|--|
+|[browser_addon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_addon.py)|BrowserAddon|Registry::Set Registry Value (C0036.001)|--|
|[removes_startmenu_defaults](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/removes_startmenu_defaults.py)|RemovesStartMenuDefaults|Registry (C0036)|--|
|[disables_uac](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_uac.py)|DisablesUAC|Registry (C0036)|--|
|[disables_wer](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_wer.py)|DisablesWER|Registry (C0036)|--|
-|[antivm_generic_services](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_services.py)|AntiVMServices|Registry (C0036), Registry::Query Registry Key (C0036.005), Registry::Query Registry Value (C0036.006)|RegOpenKeyExW, RegEnumKeyExW, RegEnumKeyExA, RegOpenKeyExA|
-|[antiav_detectreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiav_detectreg.py)|AntiAVDetectReg|Registry (C0036), Registry::Query Registry Key (C0036.005)|--|
-|[antivm_vmware_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vmware_keys.py)|VMwareDetectKeys|Registry (C0036), Registry::Query Registry Key (C0036.005)|--|
+|[antivm_generic_services](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_services.py)|AntiVMServices|Registry::Query Registry Key (C0036.005)|RegOpenKeyExW, RegEnumKeyExW, RegEnumKeyExA, RegOpenKeyExA|
+|[antivm_generic_services](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_services.py)|AntiVMServices|Registry::Query Registry Value (C0036.006)|RegOpenKeyExW, RegEnumKeyExW, RegEnumKeyExA, RegOpenKeyExA|
+|[antiav_detectreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiav_detectreg.py)|AntiAVDetectReg|Registry::Query Registry Key (C0036.005)|--|
+|[antivm_vmware_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vmware_keys.py)|VMwareDetectKeys|Registry::Query Registry Key (C0036.005)|--|
|[disables_windowsupdate](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_windowsupdate.py)|DisablesWindowsUpdate|Registry (C0036)|--|
|[recon_programs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/recon_programs.py)|InstalledApps|Registry (C0036)|RegQueryValueExA, RegQueryValueExW|
-|[antiav_srp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiav_srp.py)|AntiAVSRP|Registry (C0036), Registry::Set Registry Value (C0036.001)|--|
+|[antiav_srp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiav_srp.py)|AntiAVSRP|Registry::Set Registry Value (C0036.001)|--|
|[recon_fingerprint](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/recon_fingerprint.py)|Fingerprint|Registry (C0036)|--|
|[removes_pinned_programs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/removes_pinned_programs.py)|RemovesPinnedPrograms|Registry (C0036)|--|
-|[bypass_firewall](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bypass_firewall.py)|BypassFirewall|Registry (C0036), Registry::Set Registry Value (C0036.001)|--|
-|[antivm_vmware_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vmware_keys.py)|VMwareDetectKeys|Registry (C0036), Registry::Query Registry Key (C0036.005)|--|
-|[antivm_vbox_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vbox_keys.py)|VBoxDetectKeys|Registry (C0036), Registry::Query Registry Key (C0036.005)|--|
+|[bypass_firewall](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bypass_firewall.py)|BypassFirewall|Registry::Set Registry Value (C0036.001)|--|
+|[antivm_vmware_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vmware_keys.py)|VMwareDetectKeys|Registry::Query Registry Key (C0036.005)|--|
+|[antivm_vbox_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vbox_keys.py)|VBoxDetectKeys|Registry::Query Registry Key (C0036.005)|--|
|[disables_smartscreen](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_smartscreen.py)|DisablesSmartScreen|Registry (C0036)|--|
|[recon_fingerprint](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/recon_fingerprint.py)|Fingerprint|Registry (C0036)|--|
-|[browser_proxy](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_proxy.py)|ModifyProxy|Registry (C0036), Registry::Set Registry Value (C0036.001)|--|
+|[browser_proxy](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_proxy.py)|ModifyProxy|Registry::Set Registry Value (C0036.001)|--|
|[stealth_hiddenextension](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_hiddenextension.py)|StealthHiddenExtension|Registry (C0036)|--|
|[rat_blackremote](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_blackremote.py)|BlackRATRegistryKeys|Registry (C0036)| RegSetValueExW, RegQueryValueExW|
|[disables_event_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_event_logging.py)|DisablesEventLogging|Registry (C0036)|--|
@@ -163,14 +164,14 @@ Malware modifies the registry.
|[removes_pinned_programs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/removes_pinned_programs.py)|RemovesPinnedPrograms|Registry (C0036)|--|
|[removes_startmenu_defaults](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/removes_startmenu_defaults.py)|RemovesStartMenuDefaults|Registry (C0036)|--|
|[rat_warzone](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_warzone.py)|WarzoneRATRegkeys|Registry (C0036)|--|
-|[bypass_firewall](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bypass_firewall.py)|BypassFirewall|Registry (C0036), Registry::Set Registry Value (C0036.001)|--|
+|[bypass_firewall](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bypass_firewall.py)|BypassFirewall|Registry::Set Registry Value (C0036.001)|--|
|[stealth_hidenotifications](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_hidenotifications.py)|StealthHideNotifications|Registry (C0036)|--|
|[stealth_hiddenreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_hiddenreg.py)|StealthHiddenReg|Registry (C0036)|--|
|[ransomware_revil_regkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_revil_regkey.py)|RevilRegkey|Registry (C0036)|--|
-|[accesses_netlogon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/accesses_netlogon.py)|AccessesMailslot|Registry (C0036), Registry::Open Registry Key (C0036.003)]|--|
-|[accesses_netlogon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/accesses_netlogon.py)|AccessesNetlogonRegkey|Registry (C0036), Registry::Open Registry Key (C0036.003)]|--|
-|[browser_addon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_addon.py)|BrowserAddon|Registry (C0036), Registry::Set Registry Value (C0036.001)|--|
-|[antivm_generic_scsi](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_scsi.py)|AntiVMSCSI|Registry (C0036), Registry::Query Registry Key (C0036.005)| RegOpenKeyExA, RegOpenKeyExW, RegQueryValueExA, RegQueryValueExW|
+|[accesses_netlogon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/accesses_netlogon.py)|AccessesMailslot|Registry::Open Registry Key (C0036.003)|--|
+|[accesses_netlogon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/accesses_netlogon.py)|AccessesNetlogonRegkey|Registry::Open Registry Key (C0036.003)|--|
+|[browser_addon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_addon.py)|BrowserAddon|Registry::Set Registry Value (C0036.001)|--|
+|[antivm_generic_scsi](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_scsi.py)|AntiVMSCSI|Registry::Query Registry Key (C0036.005)| RegOpenKeyExA, RegOpenKeyExW, RegQueryValueExA, RegQueryValueExW|
|[recon_programs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/recon_programs.py)|InstalledApps|Registry (C0036)| RegQueryValueExA, RegQueryValueExW|
|[disables_windefender](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_windefender.py)|DisablesWindowsDefender|Registry (C0036)|--|
|[disables_windefender](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_windefender.py)|RemovesWindowsDefenderContextMenu|Registry (C0036)|--|
@@ -179,28 +180,27 @@ Malware modifies the registry.
|[office_dll_loading](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/office_dll_loading.py)|OfficePerfKey|Registry (C0036)|--|
|[disables_folder_options](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_folder_options.py)|DisableFolderOptions|Registry (C0036)|--|
|[ransomware_radamant](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_radamant.py)|RansomwareRadamant|Registry (C0036)|--|
-|[antiav_bypass](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiav_bypass.py)|ModifiesAttachmentManager|Registry (C0036), Registry::Set Registry Value (C0036.001)|--|
+|[antiav_bypass](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiav_bypass.py)|ModifiesAttachmentManager|Registry::Set Registry Value (C0036.001)|--|
|[rat_spynet](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_spynet.py)|SpynetRat|Registry (C0036)|--|
|[rat_njrat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_njrat_regkeys.py)|NjratRegkeys|Registry (C0036)|--|
|[disables_uac](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_uac.py)|DisablesUAC|Registry (C0036)|--|
|[remcos](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/remcos.py)|RemcosRegkeys|Registry (C0036)|--|
|[disables_power_options](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_power_options.py)|DisablesPowerOptions|Registry (C0036)|--|
-|[browser_bho](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_bho.py)|BrowserHelperObject|Registry (C0036), Registry::Set Registry Value (C0036.001)|--|
+|[browser_bho](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_bho.py)|BrowserHelperObject|Registry::Set Registry Value (C0036.001)|--|
|[disables_windowsupdate](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_windowsupdate.py)|DisablesWindowsUpdate|Registry (C0036)|--|
-|[antivm_vpc_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vpc_keys.py)|VPCDetectKeys|Registry (C0036), Registry::Query Registry Key (C0036.005)|--|
-|[antivm_hyperv_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_hyperv_keys.py)|HyperVDetectKeys|Registry (C0036), Registry::Query Registry Key (C0036.005)|--|
-|[antivm_xen_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_xen_keys.py)|XenDetectKeys|Registry (C0036), Registry::Query Registry Key (C0036.005)|--|
-|[antivm_generic_system](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_system.py)|AntiVMSystem|Registry (C0036), Registry::Query Registry Key (C0036.005)|--|
-|[antiemu_wine](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiemu_wine.py)|WineDetectReg|Registry (C0036), Registry::Query Registry Key (C0036.005)|--|
+|[antivm_vpc_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vpc_keys.py)|VPCDetectKeys|Registry::Query Registry Key (C0036.005)|--|
+|[antivm_hyperv_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_hyperv_keys.py)|HyperVDetectKeys|Registry::Query Registry Key (C0036.005)|--|
+|[antivm_xen_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_xen_keys.py)|XenDetectKeys|Registry::Query Registry Key (C0036.005)|--|
+|[antivm_generic_system](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_system.py)|AntiVMSystem|Registry::Query Registry Key (C0036.005)|--|
+|[antiemu_wine](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiemu_wine.py)|WineDetectReg|Registry::Query Registry Key (C0036.005)|--|
|[virus_neshta](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/virus_neshta.py)|NeshtaRegKeys|Registry (C0036)| RegSetValueExA, RegSetValueExW|
-|[antivm_generic_bios](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_bios.py)|AntiVMBios|Registry (C0036), Registry::Query Registry Key (C0036.005)|--|
+|[antivm_generic_bios](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_bios.py)|AntiVMBios|Registry::Query Registry Key (C0036.005)|--|
|[hides_recyclebin_icon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/hides_recyclebin_icon.py)|HidesRecycleBinIcon|Registry (C0036)|--|
-|[antiav_detectreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiav_detectreg.py)|AntiAVDetectReg|Registry (C0036), Registry::Query Registry Key (C0036.005)|--|
-|[browser_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_security.py)|BrowserSecurity|Registry (C0036), Registry::Set Registry Value (C0036.001)|--|
-|[banker_geodo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/banker_geodo.py)|Geodo|Registry (C0036), Registry::Set Registry Value (C0036.001)|--|
-|[antivm_generic_services](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_services.py)|AntiVMServices|Registry (C0036), Registry::Query Registry Key (C0036.005) Registry::Query Registry Value (C0036.006)| RegOpenKeyExA, RegEnumKeyExA, RegOpenKeyExW, RegEnumKeyExW|
-|[antiav_srp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiav_srp.py)|AntiAVSRP|Registry (C0036), Registry::Set Registry Value (C0036.001)|--|
-|[antivm_parallels_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_parallels_keys.py)|ParallelsDetectKeys|Registry (C0036), Registry::Query Registry Key (C0036.005)|--|
+|[antiav_detectreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiav_detectreg.py)|AntiAVDetectReg|Registry::Query Registry Key (C0036.005)|--|
+|[browser_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_security.py)|BrowserSecurity|Registry::Set Registry Value (C0036.001)|--|
+|[banker_geodo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/banker_geodo.py)|Geodo|Registry::Set Registry Value (C0036.001)|--|
+|[antiav_srp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiav_srp.py)|AntiAVSRP|Registry::Set Registry Value (C0036.001)|--|
+|[antivm_parallels_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_parallels_keys.py)|ParallelsDetectKeys|Registry::Query Registry Key (C0036.005)|--|
|[disables_startmenu_search](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_startmenu_search.py)|DisablesStartMenuSearch|Registry (C0036)|--|
|[office_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/office_security.py)|OfficeSecurity|Registry (C0036)|--|
|[tampers_etw](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/tampers_etw.py)|TampersETW|Registry (C0036)|--|
@@ -211,16 +211,16 @@ Malware modifies the registry.
|[disables_backups](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_backups.py)|DisablesBackups|Registry (C0036)|--|
|[disables_appv_virtualization](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_appv_virtualization.py)|DisablesAppVirtualiztion|Registry (C0036)|--|
|[disables_browserwarn](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_browserwarn.py)|DisablesBrowserWarn|Registry (C0036)|--|
-|[creates_largekey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/creates_largekey.py)|CreatesLargeKey|Registry (C0036)| NtSetValueKey, RegSetValueExA RegSetValueExW])|
+|[creates_largekey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/creates_largekey.py)|CreatesLargeKey|Registry (C0036)| NtSetValueKey, RegSetValueExA RegSetValueExW|
|[remote_desktop](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/remote_desktop.py)|RDPTCPKey|Registry (C0036)|--|
|[ransomware_medusalocker](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_medusalocker.py)|MedusaLockerRegkeys|Registry (C0036)|--|
-|[antivm_generic_cpu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_cpu.py)|AntiVMCPU|Registry (C0036), Registry::Query Registry Key (C0036.005)| filter_apinames = set(|
+|[antivm_generic_cpu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_cpu.py)|AntiVMCPU|Registry::Query Registry Key (C0036.005)| filter_apinames = set|
|[disables_app_autotermination](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_app_autotermination.py)|DisablesAutomaticAppTermination|Registry (C0036)|--|
|[disables_restore_default_state](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_restore_default_state.py)|DisablesRestoreDefaultState|Registry (C0036)|--|
|[disables_context_menus](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_context_menus.py)|DisablesContextMenus|Registry (C0036)|--|
|[ransomware_nemty](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_nemty.py)|NemtyRegkeys|Registry (C0036)|--|
|[disables_cpl_display](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_cpl_display.py)|DisablesCPLDisplay|Registry (C0036)|--|
-|[antivm_generic_diskreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_diskreg.py)|AntiVMDiskReg|Registry (C0036), Registry::Query Registry Key (C0036.005)|--|
+|[antivm_generic_diskreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_diskreg.py)|AntiVMDiskReg|Registry::Query Registry Key (C0036.005)|--|
|[modifies_oem](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/modifies_oem.py)|ModifiesOEMInformation|Registry (C0036)|--|
|[forces_mappeddrives_uac](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/forces_mappeddrives_uac.py)|MappedDrivesUAC| Registry (C0036)|--|
|[rat_limerat](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_limerat.py)|LimeRATRegkeys|Registry (C0036)|--|
@@ -228,15 +228,15 @@ Malware modifies the registry.
|[prevents_safeboot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/prevents_safeboot.py)|PreventsSafeboot|Registry (C0036)|--|
|[removes_sec_maintain_icon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/removes_sec_maintain_icon.py)|RemovesSecurityAndMaintenanceIcon|Registry (C0036)|--|
|[creates_nullvalue](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/creates_nullvalue.py)|CreatesNullValue|Registry (C0036)| NtSetValueKey, NtCreateKey|
-|[antianalysis_detectreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antianalysis_detectreg.py)|AntiAnalysisDetectReg|Registry (C0036), Registry::Open Registry Key (C0036.003)]|--|
+|[antianalysis_detectreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antianalysis_detectreg.py)|AntiAnalysisDetectReg|Registry::Open Registry Key (C0036.003)|--|
|[disables_notificationcenter](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_notificationcenter.py)|DisablesNotificationCenter|Registry (C0036)|--|
|[trojan_ursnif](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/trojan_ursnif.py)|UrsnifBehavior|Registry (C0036)|--|
|[packer_armadillo_regkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/packer_armadillo_regkey.py)|ArmadilloRegKey| Registry (C0036)|--|
-|[browser_startpage](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_startpage.py)|browser_startpage|Registry (C0036), Registry::Set Registry Value (C0036.001)|--|
+|[browser_startpage](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_startpage.py)|browser_startpage|Registry::Set Registry Value (C0036.001)|--|
|[tampers_powershell_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/tampers_powershell_logging.py)|TampersPowerShellLogging|Registry (C0036)|--|
|[credential_access](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/credential_access.py)|EnablesWDigest|Registry (C0036)|--|
|[disables_run_command](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_run_command.py)|DisableRunCommand|Registry (C0036)|--|
-|[backdoor_ketrican_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/backdoor_ketrican_regkeys.py)|KetricanRegkeys| Registry (C0036), Registry::Query Registry Key (C0036.005)|--|
+|[backdoor_ketrican_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/backdoor_ketrican_regkeys.py)|KetricanRegkeys| Registry::Query Registry Key (C0036.005)|--|
|[removes_networking_icon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/removes_networking_icon.py)|RemovesNetworkingIcon|Registry (C0036)|--|
|[modifies_certs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/modifies_certs.py)|ModifiesCerts| Registry (C0036)|--|
|[removes_username_startmenu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/removes_username_startmenu.py)|RemovesUsernameStartMenu|Registry (C0036)|--|
diff --git a/micro-behaviors/process/create-process.md b/micro-behaviors/process/create-process.md
index 6a7ba59..efee82b 100644
--- a/micro-behaviors/process/create-process.md
+++ b/micro-behaviors/process/create-process.md
@@ -71,7 +71,7 @@ Malware creates a process.
|---|---|---|---|
|[stealth_system_procname](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_system_procname.py)|StealthSystemProcName|Create Process (C0017)|ShellExecuteExW, CreateProcessInternalW|
|[stack_pivot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stack_pivot.py)|StackPivotProcessCreate|Create Process (C0017)|CreateProcessInternalW, NtCreateUserProcess|
-|[wmi](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/wmi.py)|WMICreateProcess|Create Process (C0017), Create Process:Create Process via WMI (C0017.002)| CreateProcessInternalW, NtCreateUserProcess|
+|[wmi](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/wmi.py)|WMICreateProcess|Create Process:Create Process via WMI (C0017.002)| CreateProcessInternalW, NtCreateUserProcess|
|[script_downloader](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/script_downloader.py)|ScriptCreatedProcess|Create Process (C0017)|CreateProcessInternalW, NtCreateUserProcess|
### C0049 Snippet
diff --git a/xample-malware/dnschanger.md b/xample-malware/dnschanger.md
index 88c9bd8..d546203 100644
--- a/xample-malware/dnschanger.md
+++ b/xample-malware/dnschanger.md
@@ -37,13 +37,6 @@ DNSChanger is used to change DNS settings to generate fraudulent advertising rev
|[Defense Evasion::File and Directory Permissions Modification (T1222)](https://attack.mitre.org/techniques/T1222)|DNSChanger sets file attributes. [[2]](#2)|
|[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|DNSChanger accesses PE headers. [[2]](#2)|
-## ATT&CK Techniques
-
-|Name|Use|
-|---|---|
-|[Defense Evasion::File and Directory Permissions Modification (T1222)](https://attack.mitre.org/techniques/T1222)|Set file attributes (This capa rule had 1 match) [[2]](#2)|
-|[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|Access PE header (This capa rule had 3 matches) [[2]](#2)|
-
## Enhanced ATT&CK Techniques
|Name|Use|
diff --git a/xample-malware/emotet.md b/xample-malware/emotet.md
index 01a6149..c0f1b51 100644
--- a/xample-malware/emotet.md
+++ b/xample-malware/emotet.md
@@ -45,13 +45,6 @@ Emotet is a banking trojan. [[1]](#1)
|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|To start itself at system boot, Emotet adds the downloaded payload to the registry to maintain persistence. [[1]](#1)|
|[Impact::Clipboard Modification (E1510)](../impact/clipboard-modification.md)|Emotet writes clipboard data. [[6]](#6)|
-|Name|Use|
-|---|---|
-|[Anti-Static Analysis::Software Packing::Custom Compression (F0001.005)](../anti-static-analysis/software-packing.md)|Emotet uses custom packers which first decrypt the loaders and the loaders decrypt and load emotet's main payloads [[2]](#2)|
-|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Collects information related to os, processes, and sometimes mail client information and sends it to c2 [[2]](#2)|
-|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|To start itself at system boot, emotet adds the downloaded payload to the registry to maintain persistence [[1]](#1)|
-|[Impact::Clipboard Modification (E1510)](../impact/clipboard-modification.md)|Write clipboard data (this capa rule had 1 match) [[6]](#6)|
-
## MBC Behaviors
|Name|Use|
diff --git a/xample-malware/gamut.md b/xample-malware/gamut.md
index c66c08e..0cbcdad 100644
--- a/xample-malware/gamut.md
+++ b/xample-malware/gamut.md
@@ -62,7 +62,7 @@ Gamut is a spamming botnet.
|[Impact::Spamming (B0039)](../impact/spamming.md)|If port 25 is open, the bot uses a spam template and email list to send spam. [[1]](#1)|
|[Data::Checksum::CRC32 (C0032.001)](../micro-behaviors/data/checksum.md)|Gamut hashes data with CRC32. [[3]](#3)|
|[Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|Gamut encodes data using XOR. [[3]](#3)|
-|[Discovery::Code Discovery::Enumerate PE Sections (B0046.001)](../discovery/code-discovery.md)|Enumerate PE sections (This capa rule had 1 match) [[3]](#3)|
+|[Discovery::Code Discovery::Enumerate PE Sections (B0046.001)](../discovery/code-discovery.md)|Gemut enumerates PE sections. [[3]](#3)|
|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|Gamut contains an embedded PE file. [[3]](#3)|
|[File System::Create Directory (C0046)](../micro-behaviors/file-system/create-directory.md)|Gamut creates directories. [[3]](#3)|
|[File System::Delete Directory (C0048)](../micro-behaviors/file-system/delete-directory.md)|Gamut deletes directories. [[3]](#3)|