{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 0.8251519203186035,
        "class": 0,
        "threshold": 0.9987763166427612
      }
    ],
    "prob": 0.8251519,
    "class": 0,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.8251519,
        "class": 0
      },
      {
        "m": "az/native",
        "prob": 0.017105263,
        "class": 0
      },
      {
        "m": "az/pe",
        "prob": 0.0,
        "class": 0
      }
    ],
    "version": "v17.17",
    "threshold": 0.9987763,
    "analyzed_at": "2026-05-31T07:19:34Z"
  },
  "path": "015c3a3445a04723b76a9f97e0e1039dda7bbd65dead45279d076ff5221a771b.dll",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "Md₂(BiSi)",
        "x": 5,
        "ff": {
          "i": [
            [
              "mscoree",
              "CorDllMain"
            ]
          ],
          "m": {
            "pe": {
              "checksum": 37120.0,
              "checksum_valid": 1.0,
              "resource_count": 1.0,
              "has_version_info": 1.0,
              "computed_checksum": 37120.0,
              "bss_like_section_count": 0.0,
              "section_overflow_count": 0.0,
              "misaligned_section_count": 0.0,
              "base_relocation_block_count": 1.0,
              "base_relocation_entry_count": 1.0
            },
            "file": {
              "size": 20520.0,
              "entropy": 6.54,
              "size_bytes": 20520.0
            },
            "binary": {
              "is_pie": 1.0,
              "has_overlay": 1.0,
              "code_entropy": 5.28,
              "overlay_size": 10280.0,
              "string_count": 367.0,
              "overlay_ratio": 0.5,
              "overlay_entropy": 7.49,
              "entropy_variance": 4.5,
              "avg_string_length": 21.92,
              "max_string_length": 199.0,
              "code_to_data_ratio": 1.0,
              "string_length_stddev": 24.04,
              "largest_section_ratio": 0.37,
              "sentence_string_count": 82.0,
              "sentence_string_ratio": 0.22,
              "high_entropy_string_count": 0.0
            },
            "imports": {
              "count": 1.0
            },
            "sections": {
              "count": 3.0,
              "code_size": 7680.0,
              "entropy_max": 5.28,
              "entropy_mean": 2.74,
              "name_entropy": 3.03,
              "writable_count": 0.0,
              "executable_count": 1.0,
              "nonstandard_count": 0.0,
              "executable_writable_count": 0.0
            },
            "dependencies": {
              "count": 1.0
            }
          },
          "s": [
            [
              77,
              "u8",
              "!This program cannot be run in DOS mode."
            ],
            [
              376,
              "u8",
              ".text"
            ],
            [
              455,
              "u8",
              "@.reloc"
            ],
            [
              592,
              "u8",
              "BSJB"
            ],
            [
              1025,
              "u8",
              "\u003cModule\u003e"
            ],
            [
              1040,
              "u8",
              "System.Runtime"
            ],
            [
              1055,
              "u8",
              "DebuggableAttribute"
            ],
            [
              1075,
              "u8",
              "AssemblyTitleAttribute"
            ],
            [
              1098,
              "u8",
              "AssemblyFileVersionAttribute"
            ],
            [
              1127,
              "u8",
              "AssemblyInformationalVersionAttribute"
            ],
            [
              1165,
              "u8",
              "AssemblyDescriptionAttribute"
            ],
            [
              1194,
              "u8",
              "CompilationRelaxationsAttribute"
            ],
            [
              1226,
              "u8",
              "AssemblyProductAttribute"
            ],
            [
              1251,
              "u8",
              "AssemblyCopyrightAttribute"
            ],
            [
              1278,
              "u8",
              "AssemblyCompanyAttribute"
            ],
            [
              1303,
              "u8",
              "RuntimeCompatibilityAttribute"
            ],
            [
              1333,
              "u8",
              "System.ServiceModel.NetTcp.resources.dll"
            ],
            [
              1374,
              "u8",
              "System.Reflection"
            ],
            [
              1392,
              "u8",
              ".ctor"
            ],
            [
              1398,
              "u8",
              "System.Diagnostics"
            ],
            [
              1417,
              "u8",
              "System.Runtime.CompilerServices"
            ],
            [
              1449,
              "u8",
              "FxResources.System.ServiceModel.NetTcp.SR.pt-BR.resources"
            ],
            [
              1507,
              "u8",
              "System.ServiceModel.NetTcp.resources"
            ],
            [
              1544,
              "u8",
              "DebuggingModes"
            ],
            [
              1632,
              "u8",
              "RSA1"
            ],
            [
              1789,
              "u8",
              "WrapNonExceptionThrows"
            ],
            [
              1825,
              "u8",
              "Microsoft Corporation"
            ],
            [
              1854,
              "u8",
              "Microsoft Corporation. All rights reserved."
            ],
            [
              1904,
              "u8",
              "System.ServiceModel.NetTcp"
            ],
            [
              1953,
              "u8",
              ".8.0.0+852a6098b270771f21d13824877fce59d3279046"
            ],
            [
              2006,
              "u8",
              "Microsoft"
            ],
            [
              2017,
              "u8",
              ".NET Core"
            ],
            [
              2048,
              "u8",
              "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R"
            ],
            [
              2205,
              "u8",
              "PADPADP"
            ],
            [
              2496,
              "wide",
              "ChannelTypeNotSupported"
            ],
            [
              2646,
              "wide",
              "DnsResolveFailedġ"
            ],
            [
              2748,
              "wide",
              "InsufficentMemoryȶ"
            ],
            [
              2842,
              "wide",
              "SFxTimeoutOutOfRange0"
            ],
            [
              2946,
              "wide",
              "SecurityEndpointNotFoundϝ"
            ],
            [
              3046,
              "wide",
              "SocketAbortedReceiveTimedOut"
            ],
            [
              3162,
              "wide",
              "SocketCloseReadReceivedData"
            ],
            [
              3270,
              "wide",
              "SocketConnectionDisposed"
            ],
            [
              3358,
              "wide",
              "TcpConnectErrorWithTimeSpan"
            ],
            [
              3454,
              "wide",
              "TcpConnectingToViaTimedOut"
            ],
            [
              3562,
              "wide",
              "TcpConnectionTimedOut"
            ],
            [
              3660,
              "wide",
              "TcpTransferError"
            ],
            [
              3754,
              "wide",
              "UnableToResolveHost"
            ],
            [
              3860,
              "wide",
              "ValueMustBeNonNegative"
            ],
            [
              3953,
              "u8",
              "Processar a a"
            ],
            [
              3979,
              "u8",
              "NO tipo de canal especificado {0} n"
            ],
            [
              4016,
              "u8",
              "o tem suporte deste gerenciador de canais."
            ],
            [
              4061,
              "u8",
              "ClientCredentialType.None inv"
            ],
            [
              4092,
              "u8",
              "lido para o modo de seguran"
            ],
            [
              4121,
              "u8",
              "a TransportWithMessageCredential. Especifique um tipo de credencial de mensagem ou use um modo de seguran"
            ],
            [
              4228,
              "u8",
              "a diferente."
            ],
            [
              4245,
              "u8",
              "o existem entradas DNS para o host {0}."
            ],
            [
              4287,
              "u8",
              "A prote"
            ],
            [
              4298,
              "u8",
              "o estendida n"
            ],
            [
              4317,
              "u8",
              "suportada nesta plataforma.  Instale o patch apropriado ou altere a ExtendedProtectionPolicy em Binding ou BindingElement para u"
            ],
            [
              4524,
              "u8",
              "ria insuficiente dispon"
            ],
            [
              4549,
              "u8",
              "vel para concluir a opera"
            ],
            [
              4585,
              "u8",
              "o foi poss"
            ],
            [
              4597,
              "u8",
              "vel encontrar IPEndpoints para o host {0}."
            ],
            [
              4640,
              "u8",
              "wO tempo limite deve ser maior ou igual a TimeSpan.Zero. Para desabilitar o tempo limite, especifique TimeSpan.MaxValue."
            ],
            [
              4763,
              "u8",
              "Os tempos limites maiores que Int32.MaxValue TotalMilliseconds (aproximadamente 24 dias) n"
            ],
            [
              4855,
              "u8",
              "o podem ser honrados. Para desabilitar o tempo limite, especifique TimeSpan.MaxValue."
            ],
            [
              4943,
              "u8",
              "O servidor '{0}' retornou uma falha indicando que ele est"
            ],
            [
              5002,
              "u8",
              "desligando. Consulte a exce"
            ],
            [
              5034,
              "u8",
              "o interna para obter os detalhes da falha."
            ],
            [
              5138,
              "u8",
              "muito ocupado para processar a solicita"
            ],
            [
              5182,
              "u8",
              "o. Tente novamente mais tarde. Consulte a exce"
            ],
            [
              5277,
              "u8",
              "O soquete foi anulado porque uma recep"
            ],
            [
              5319,
              "u8",
              "o ass"
            ],
            [
              5326,
              "u8",
              "ncrona do soquete n"
            ],
            [
              5347,
              "u8",
              "o foi conclu"
            ],
            [
              5361,
              "u8",
              "da no tempo limite alocado de {0}. O tempo alocado para essa opera"
            ],
            [
              5431,
              "u8",
              "o pode ter sido uma parte de um tempo limite maior."
            ],
            [
              5485,
              "u8",
              "A conex"
            ],
            [
              5494,
              "u8",
              "o de soquete foi anulada porque um envio ass"
            ],
            [
              5540,
              "u8",
              "ncrono para o soquete n"
            ],
            [
              5579,
              "u8",
              "do no tempo limite alocado de {0}. O tempo alocado para essa opera"
            ],
            [
              5701,
              "u8",
              "]Tentativa de fechamento normal no soquete, mas o outro lado ({0}) ainda est"
            ],
            [
              5779,
              "u8",
              "enviando dados."
            ],
            [
              5798,
              "u8",
              "O ponto de extremidade remoto do soquete ({0}) n"
            ],
            [
              5848,
              "u8",
              "o respondeu a uma solicita"
            ],
            [
              5878,
              "u8",
              "o de fechamento no tempo limite alocado ({1})."
            ],
            [
              5934,
              "u8",
              "vel que o ponto de extremidade remoto n"
            ],
            [
              5975,
              "u8",
              "o esteja chamando Close ap"
            ],
            [
              6003,
              "u8",
              "s receber o sinal EOF (nulo) de Receive. O tempo alocado para essa opera"
            ],
            [
              6131,
              "u8",
              "%A conex"
            ],
            [
              6141,
              "u8",
              "o de soquete foi descartada."
            ],
            [
              6186,
              "u8",
              "vel a conex"
            ],
            [
              6199,
              "u8",
              "o com {0}. C"
            ],
            [
              6213,
              "u8",
              "digo de erro TCP {1}: {2}."
            ],
            [
              6271,
              "u8",
              "o com {0}. A tentativa de conex"
            ],
            [
              6304,
              "u8",
              "o durou pelo per"
            ],
            [
              6322,
              "u8",
              "odo de tempo de {3}. C"
            ],
            [
              6374,
              "u8",
              "_Recursos winsock dispon"
            ],
            [
              6400,
              "u8",
              "veis insuficientes para concluir a inicia"
            ],
            [
              6445,
              "u8",
              "o de conex"
            ],
            [
              6457,
              "u8",
              "o de soquete."
            ],
            [
              6482,
              "u8",
              "o via {0} atingiu o tempo limite ap"
            ],
            [
              6519,
              "u8",
              "s {1}. Foram feitas tentativas de conex"
            ],
            [
              6560,
              "u8",
              "o a {2} de {3} endere"
            ],
            [
              6583,
              "u8",
              "os dispon"
            ],
            [
              6594,
              "u8",
              "veis ({4}). Verifique o RemoteAddress do seu canal e verifique se os registros DNS desse ponto de extremidade correspondem a End"
            ],
            [
              6727,
              "u8",
              "os IP v"
            ],
            [
              6736,
              "u8",
              "lidos. O tempo alocado para essa opera"
            ],
            [
              6841,
              "u8",
              "o de soquete foi anulada. Isso pode ter sido causado por um erro de processamento de sua mensagem, por um tempo limite de recep"
            ],
            [
              6972,
              "u8",
              "o excedido pelo host remoto ou por um problema de recurso de rede subjacente. O tempo limite de soquete local era de '{0}'."
            ],
            [
              7098,
              "u8",
              "A transfer"
            ],
            [
              7110,
              "u8",
              "ncia de soquete atingiu o tempo limite ap"
            ],
            [
              7153,
              "u8",
              "s {0}. Voc"
            ],
            [
              7165,
              "u8",
              "excedeu o tempo limite definido na sua associa"
            ],
            [
              7216,
              "u8",
              "o. O tempo alocado para essa opera"
            ],
            [
              7317,
              "u8",
              "o de soquete foi anulada pelo computador local. Isso pode ter sido causado por um canal Abort() ou por um erro de transmiss"
            ],
            [
              7442,
              "u8",
              "o de outro thread usando esse soquete."
            ],
            [
              7481,
              "u8",
              "(Erro TCP ({0}: {1}) ao transmitir dados."
            ],
            [
              7523,
              "u8",
              "5O modo de transfer"
            ],
            [
              7544,
              "u8",
              "ncia {0} n"
            ],
            [
              7556,
              "u8",
              "o tem suporte em {1}."
            ],
            [
              7593,
              "u8",
              "vel resolver nome de host de URI \"{0}\" usando DNS."
            ],
            [
              7650,
              "u8",
              "vel de prote"
            ],
            [
              7666,
              "u8",
              "o '{0}' foi especificado, ainda assim a seguran"
            ],
            [
              7715,
              "u8",
              "a do transporte SSL apenas d"
            ],
            [
              7745,
              "u8",
              "suporte a EncryptAndSign."
            ],
            [
              7772,
              "u8",
              "/O valor deste argumento n"
            ],
            [
              7800,
              "u8",
              "o deve ser negativo."
            ],
            [
              7821,
              "u8",
              "*O valor deste argumento deve ser positivo.nfd"
            ],
            [
              8086,
              "u8",
              "mscoree.dll"
            ],
            [
              8286,
              "wide",
              "VS_VERSION_INFO"
            ],
            [
              8378,
              "wide",
              "VarFileInfo"
            ],
            [
              8410,
              "wide",
              "Translation"
            ],
            [
              8446,
              "wide",
              "StringFileInfo"
            ],
            [
              8506,
              "wide",
              "Comments"
            ],
            [
              8524,
              "wide",
              "System.ServiceModel.NetTcp"
            ],
            [
              8586,
              "wide",
              "CompanyName"
            ],
            [
              8612,
              "wide",
              "Microsoft Corporation"
            ],
            [
              8662,
              "wide",
              "FileDescription"
            ],
            [
              8758,
              "wide",
              "FileVersion"
            ],
            [
              8818,
              "wide",
              "InternalName"
            ],
            [
              8844,
              "wide",
              "System.ServiceModel.NetTcp.resources.dll"
            ],
            [
              8934,
              "wide",
              "LegalCopyright"
            ],
            [
              8964,
              "wide",
              "© Microsoft Corporation. All rights reserved."
            ],
            [
              9062,
              "wide",
              "OriginalFilename"
            ],
            [
              9186,
              "wide",
              "ProductName"
            ],
            [
              9212,
              "wide",
              "Microsoft® .NET Core"
            ],
            [
              9262,
              "wide",
              "ProductVersion"
            ],
            [
              9292,
              "wide",
              "8.0.0+852a6098b270771f21d13824877fce59d3279046"
            ],
            [
              9394,
              "wide",
              "Assembly Version"
            ],
            [
              10306,
              "u8",
              "N0L0"
            ],
            [
              10464,
              "u8",
              "Washington1"
            ],
            [
              10485,
              "u8",
              "Redmond1"
            ],
            [
              10503,
              "u8",
              "Microsoft Corporation1(0\u0026"
            ],
            [
              10535,
              "u8",
              "Microsoft Code Signing PCA 20110"
            ],
            [
              10570,
              "u8",
              "230316184328Z"
            ],
            [
              10585,
              "u8",
              "240314184328Z0t1"
            ],
            [
              10663,
              "u8",
              "Microsoft Corporation1"
            ],
            [
              10695,
              "u8",
              "Microsoft Corporation0"
            ],
            [
              10759,
              "u8",
              "AM78"
            ],
            [
              11107,
              "u8",
              "$Microsoft Ireland Operations Limited1"
            ],
            [
              11155,
              "u8",
              "230012+5005170"
            ],
            [
              11209,
              "u8",
              "M0K0I"
            ],
            [
              11219,
              "u8",
              "Chttp://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0a"
            ],
            [
              11300,
              "u8",
              "U0S0Q"
            ],
            [
              11316,
              "u8",
              "Ehttp://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0"
            ],
            [
              11463,
              "u8",
              "c8LCaIJo"
            ],
            [
              11664,
              "u8",
              "suao"
            ],
            [
              12038,
              "u8",
              "Microsoft Corporation1200"
            ],
            [
              12069,
              "u8",
              ")Microsoft Root Certificate Authority 20110"
            ],
            [
              12115,
              "u8",
              "110708205909Z"
            ],
            [
              12976,
              "u8",
              "S0Q0O"
            ],
            [
              12986,
              "u8",
              "Ihttp://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^"
            ],
            [
              13073,
              "u8",
              "R0P0N"
            ],
            [
              13089,
              "u8",
              "Bhttp://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0"
            ],
            [
              13200,
              "u8",
              "3http://www.microsoft.com/pkiops/docs/primarycps.htm0@"
            ],
            [
              13818,
              "u8",
              "WqVNHE"
            ],
            [
              13961,
              "u8",
              "Microsoft Code Signing PCA 2011"
            ],
            [
              14151,
              "u8",
              "1402"
            ],
            [
              14160,
              "wide",
              "Microsof"
            ],
            [
              14181,
              "u8",
              "http://www.microsoft.com0"
            ],
            [
              14609,
              "u8",
              "L1LU"
            ],
            [
              14749,
              "u8",
              "Microsoft Corporation1%0#"
            ],
            [
              14781,
              "u8",
              "Microsoft America Operations1'0%"
            ],
            [
              14820,
              "u8",
              "nShield TSS ESN:8D00-05E0-D9471%0#"
            ],
            [
              14861,
              "u8",
              "Microsoft Time-Stamp Service"
            ],
            [
              15007,
              "u8",
              "Microsoft Corporation1\u00260$"
            ],
            [
              15039,
              "u8",
              "Microsoft Time-Stamp PCA 20100"
            ],
            [
              15072,
              "u8",
              "230525191205Z"
            ],
            [
              15087,
              "u8",
              "240201191205Z0"
            ],
            [
              15278,
              "u8",
              "Microsoft Time-Stamp Service0"
            ],
            [
              15936,
              "u8",
              "X0V0T"
            ],
            [
              15946,
              "url",
              "Nhttp://www.microsoft.com/pkiops/crl/Microsoft Time-Stamp PCA 2010(1).crl0l"
            ],
            [
              16054,
              "url",
              "Phttp://www.microsoft.com/pkiops/certs/Microsoft Time-Stamp PCA 2010(1).crt0"
            ],
            [
              16473,
              "u8",
              "QKME8"
            ],
            [
              16867,
              "u8",
              ")Microsoft Root Certificate Authority 20100"
            ],
            [
              16913,
              "u8",
              "210930182225Z"
            ],
            [
              17755,
              "u8",
              "3http://www.microsoft.com/pkiops/Docs/Repository.htm0"
            ],
            [
              17926,
              "u8",
              "O0M0K"
            ],
            [
              17936,
              "u8",
              "Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z"
            ],
            [
              18019,
              "u8",
              "N0L0J"
            ],
            [
              18035,
              "u8",
              "\u003ehttp://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0"
            ],
            [
              19053,
              "u8",
              "20231208015157Z"
            ],
            [
              19267,
              "u8",
              "zRhi"
            ],
            [
              19590,
              "u8",
              "Microsoft Time-Stamp PCA 2010"
            ],
            [
              19773,
              "u8",
              "Odh/LGS"
            ],
            [
              20106,
              "u8",
              "XFq6g"
            ],
            [
              20494,
              "u8",
              "B9EG"
            ]
          ],
          "v": {
            "file.stem": "015c3a3445a04723b76a9f97e0e1039dda7bbd65dead45279d076ff5221a771b",
            "pe.imphash": "dae02f32a21e03ce65412f6e56942daa",
            "pe.machine": "i386",
            "pe.subsystem": "windows_cui",
            "pe.timestamp": 3208071132,
            "file.basename": "015c3a3445a04723b76a9f97e0e1039dda7bbd65dead45279d076ff5221a771b.dll",
            "pe.image_base": 268435456,
            "pe.image_size": 32768,
            "pe.machine_id": 332,
            "pe.os_version": "4.0",
            "pe.version.os": "unknown",
            "pe.entry_point": 15782,
            "pe.headers_size": 512,
            "pe.version.type": "dll",
            "pe.entry_section": ".text",
            "pe.subsystem_raw": 3,
            "pe.clr.is_il_only": 1,
            "pe.file_alignment": 512,
            "pe.cert_table_size": 10280,
            "pe.image_hash.sha1": "83532de38d70459f925c742f4a11ec8b610eb1c8",
            "pe.version.company": "Microsoft Corporation",
            "pe.version.comments": "System.ServiceModel.NetTcp",
            "pe.image_hash.sha256": "f56336e7c5568ec5ea01f0501c2f4df5177f4e3d7ee2753c7efb13122dc3bfcc",
            "pe.image_hash.sha384": "7d026d52ba2b11d9722715229eefccaf52c5367d4e8529afa0b36d69c5b70ce588aba72b7d82f484154eb96e2215a310",
            "pe.image_hash.sha512": "9f7ab129be068da5766ec9eaefbf26b943be7e108eece102103acc57687270b5866cbc0c61059988b4240ed70bfaf27e7d9737a7f25d4ece12a1bff4463324e3",
            "pe.resource_types[0]": "RT_VERSION",
            "pe.section_alignment": 8192,
            "pe.subsystem_version": "4.0",
            "pe.version.copyright": "© Microsoft Corporation. All rights reserved.",
            "pe.characteristics[0]": "executable_image",
            "pe.characteristics[1]": "large_address_aware",
            "pe.characteristics[2]": "dll",
            "pe.characteristics_raw": 8226,
            "pe.clr.runtime_version": "2.5",
            "pe.version.description": "System.ServiceModel.NetTcp",
            "pe.linker_major_version": 48,
            "pe.signatures[0].issuer": "CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US",
            "pe.signatures[0].serial": "330000034d4e91a61a28b0788f00000000034d",
            "pe.version.file_version": "8.0.23.60704",
            "pe.version.product_name": "Microsoft® .NET Core",
            "pe.debug.entries[0].type": "repro",
            "pe.signatures[0].subject": "CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US",
            "pe.version.internal_name": "System.ServiceModel.NetTcp.resources.dll",
            "pe.dll_characteristics[0]": "dynamic_base",
            "pe.dll_characteristics[1]": "nx_compat",
            "pe.dll_characteristics[2]": "no_seh",
            "pe.dll_characteristics[3]": "terminal_server_aware",
            "pe.signatures[0].verified": true,
            "pe.data_directories[0].rva": 15700,
            "pe.data_directories[1].rva": 16384,
            "pe.data_directories[2].rva": 10240,
            "pe.data_directories[3].rva": 24576,
            "pe.data_directories[4].rva": 15672,
            "pe.data_directories[5].rva": 8192,
            "pe.data_directories[6].rva": 8200,
            "pe.dll_characteristics_raw": 34112,
            "pe.number_of_rva_and_sizes": 16,
            "pe.signatures[0].not_after": "2024-03-14T18:43:28Z",
            "pe.version.product_version": "8.0.0+852a6098b270771f21d13824877fce59d3279046",
            "pe.data_directories[0].name": "import",
            "pe.data_directories[0].size": 79,
            "pe.data_directories[1].name": "resource",
            "pe.data_directories[1].size": 1256,
            "pe.data_directories[2].name": "certificate",
            "pe.data_directories[2].size": 10280,
            "pe.data_directories[3].name": "base_relocation",
            "pe.data_directories[3].size": 12,
            "pe.data_directories[4].name": "debug",
            "pe.data_directories[4].size": 28,
            "pe.data_directories[5].name": "iat",
            "pe.data_directories[5].size": 8,
            "pe.data_directories[6].name": "clr_runtime_header",
            "pe.data_directories[6].size": 72,
            "pe.debug.entries[0].type_id": 16,
            "pe.signatures[0].not_before": "2023-03-16T18:43:28Z",
            "pe.version.original_filename": "System.ServiceModel.NetTcp.resources.dll",
            "pe.coff.dos_header_pe_pointer": 128,
            "pe.base_relocations.block_count": 1,
            "pe.base_relocations.entry_count": 1,
            "pe.signatures[0].thumbprint_sha1": "6e78b3dce2998f6c2457c3e54da90a01034916ae",
            "pe.base_relocations.padding_count": 1,
            "pe.signatures[0].cert_chain_depth": 2,
            "pe.signatures[0].digest_algorithm": "sha256",
            "pe.signatures[0].eku_code_signing": true,
            "pe.signatures[0].signature_digest": "f56336e7c5568ec5ea01f0501c2f4df5177f4e3d7ee2753c7efb13122dc3bfcc",
            "pe.signatures[0].thumbprint_sha256": "508a1972c41862b59411c96a388cbf58f303d96e0e57eb0f96e64cd9e0114542",
            "pe.signatures[0].signature_algorithm": "sha256WithRSAEncryption",
            "pe.signatures[0].signature_digest_algorithm": "sha256"
          },
          "id": "pe",
          "sc": [
            [
              ".text",
              512,
              7680,
              5.28,
              "r-x"
            ],
            [
              ".rsrc",
              8192,
              1536,
              2.88,
              "r--"
            ],
            [
              ".reloc",
              9728,
              512,
              0.08,
              "r--"
            ]
          ]
        },
        "id": 0,
        "sz": 20520,
        "ts": [
          {
            "c": 1.0,
            "d": ".NET assembly detected via BSJB CLR metadata signature",
            "e": [
              "BSJB at offset 0x250"
            ],
            "i": "metadata/dotnet/bsjb-signature",
            "l": 2,
            "el": [
              "0x250"
            ]
          },
          {
            "c": 1.0,
            "d": "Authenticode chain CN: Microsoft Corporation",
            "e": [
              "Microsoft Corporation"
            ],
            "i": "metadata/signed/unknown::microsoft-corporation",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Signed by Microsoft Corporation",
            "e": [
              "Microsoft Corporation"
            ],
            "i": "metadata/signed/leaf::microsoft-corporation",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "References System.ServiceModel namespace",
            "e": [
              "System.ServiceModel.NetTcp.resources",
              "FxResources.System.ServiceModel.NetTcp.SR.pt-BR.resources",
              "System.ServiceModel.NetTcp.resources.dll",
              "System.ServiceModel.NetTcp"
            ],
            "i": "micro-behaviors/communications/ipc/wcf::dotnet-system-servicemodel",
            "l": 1,
            "el": [
              "0x5e3",
              "0x5a9",
              "0x535",
              "0x770"
            ]
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "015c3a3445a04723b76a9f97e0e1039dda7bbd65dead45279d076ff5221a771b.dll"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "PE LegalCopyright field is populated",
            "e": [
              "© Microsoft Corporation. All rights reserved."
            ],
            "i": "metadata/package/versioning::pe-legal-copyright-present",
            "l": 1,
            "el": [
              "value:pe.version.copyright"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "Reflection method namespace token",
            "e": [
              "System.Reflection"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/invoke::namespace-import",
            "l": 1,
            "el": [
              "0x55e"
            ]
          },
          {
            "c": 1.0,
            "d": ".NET Metadata Root (BSJB)",
            "e": [
              "BSJB"
            ],
            "i": "metadata/binary/framework::dotnet-metadata",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "PE FileDescription field is populated",
            "e": [
              "System.ServiceModel.NetTcp"
            ],
            "i": "metadata/package/versioning::pe-file-description-present",
            "l": 1,
            "el": [
              "value:pe.version.description"
            ]
          },
          {
            "a": "T1036.005",
            "c": 0.8999999761581421,
            "d": "Microsoft Corporation company in version info",
            "e": [
              "Microsoft Corporation"
            ],
            "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-microsoft-company",
            "l": 1,
            "m": "F0004",
            "el": [
              "value:pe.version.company"
            ]
          },
          {
            "a": "T1036.005",
            "c": 0.949999988079071,
            "d": "Microsoft company version identity",
            "e": [
              "Microsoft Corporation"
            ],
            "i": "objectives/evasion/masquerade/version-resource/contradiction::microsoft-company-versioninfo-kv",
            "l": 1,
            "el": [
              "value:pe.version.company"
            ]
          },
          {
            "d": ".dll extension reference",
            "e": [
              ".dll"
            ],
            "i": "micro-behaviors/fs/path/extension::dll-dup",
            "l": 2,
            "el": [
              "0x535"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE has few sections",
            "e": [
              "sections.count = 3.00"
            ],
            "i": "metadata/binary/layout::legacy-few-sections",
            "l": 2
          },
          {
            "a": "T1036",
            "c": 0.8999999761581421,
            "d": "Dense Microsoft certificate text",
            "e": [
              "Microsoft Corporation1",
              "© Microsoft Corporation. All rights reserved.",
              "Microsoft Corporation1%0#",
              "Microsoft Corporation1\u00260$",
              "Microsoft Corporation. All rights reserved.",
              "Microsoft Corporation",
              "Microsoft Corporation0",
              "Microsoft Corporation1(0\u0026",
              "Microsoft Corporation1200"
            ],
            "i": "objectives/evasion/masquerade/binary::dense-microsoft-cert-text",
            "l": 1,
            "m": "OB0006",
            "el": [
              "0x29a7",
              "0x2304",
              "0x399d",
              "0x3a9f",
              "0x73e",
              "0x721",
              "0x29c7",
              "0x2907",
              "0x2f06"
            ]
          },
          {
            "c": 0.9700000286102295,
            "d": "Microsoft ImageHlp company metadata",
            "e": [
              "Microsoft Corporation"
            ],
            "i": "well-known/lib/microsoft-imagehlp::imagehlp-company",
            "l": 2,
            "el": [
              "value:pe.version.company"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "PE ProductName field is populated",
            "e": [
              "Microsoft® .NET Core"
            ],
            "i": "metadata/package/versioning::pe-product-name-present",
            "l": 1,
            "el": [
              "value:pe.version.product_name"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "mscorlib reference",
            "e": [
              "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R"
            ],
            "i": "metadata/lang/compiler/managed::mscorlib",
            "l": 2,
            "el": [
              "0x800"
            ]
          },
          {
            "c": 1.0,
            "d": "PE first resource is RT_VERSION",
            "e": [
              "RT_VERSION"
            ],
            "i": "metadata/binary/resource::pe-resource-version-first",
            "l": 2,
            "el": [
              "value:pe.resource_types[0]"
            ]
          },
          {
            "a": "T1027",
            "c": 0.9900000095367432,
            "d": "PE version resource text",
            "e": [
              "VS_VERSION_INFO"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info",
            "l": 1,
            "m": "B0032",
            "el": [
              "0x205e"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE has many readable strings",
            "e": [
              "binary.string_count = 367.00"
            ],
            "i": "metadata/binary/layout::many-readable-strings",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "PE CompanyName metadata field",
            "e": [
              "CompanyName"
            ],
            "i": "metadata/package/versioning::pe-companyname-field",
            "l": 2,
            "el": [
              "0x218a"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard code/data section",
            "e": [
              ".text"
            ],
            "i": "metadata/binary/section/names::pe-code-data-standard-section",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Binary has many sentence-like strings",
            "e": [
              "binary.sentence_string_ratio = 0.22"
            ],
            "i": "metadata/binary/metrics/threshold::rich-sentence-strings-20pct",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE import table has exactly one entry",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "metadata/binary/symbols/imports::single-import-raw",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has 4 or fewer sections",
            "e": [
              "sections.count = 3.00"
            ],
            "i": "objectives/command-and-control/infrastructure/config::max-sections-4",
            "l": 1
          },
          {
            "d": "certificate string reference",
            "e": [
              "Certificate"
            ],
            "i": "micro-behaviors/crypto/certificate/usage::certificate-ref",
            "l": 2,
            "el": [
              "0x2f25"
            ]
          },
          {
            "c": 0.8500000238418579,
            "d": "DLL filename extension present",
            "e": [
              "015c3a3445a04723b76a9f97e0e1039dda7bbd65dead45279d076ff5221a771b.dll"
            ],
            "i": "objectives/evasion/masquerade/dll/name::dll-basename",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "NO_SEH (SafeSEH not used)",
            "e": [
              "[dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-no-seh",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE InternalName metadata field",
            "e": [
              "InternalName"
            ],
            "i": "metadata/package/versioning::pe-internalname-field",
            "l": 2,
            "el": [
              "0x2272"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "PE version info numeric fields present",
            "e": [
              "8.0.23.60704"
            ],
            "i": "metadata/binary/anomaly/format::version-info-file-version-present",
            "l": 1,
            "el": [
              "value:pe.version.file_version"
            ]
          },
          {
            "c": 1.0,
            "d": "PE Authenticode signature verified metadata",
            "e": [
              "true"
            ],
            "i": "metadata/signed/certificate::pe-signature-verified-kv",
            "l": 2,
            "el": [
              "value:pe.signatures[0].verified"
            ]
          },
          {
            "a": "T1620",
            "c": 0.949999988079071,
            "d": "mscoree DLL string reference",
            "e": [
              "mscoree.dll"
            ],
            "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere",
            "l": 1,
            "m": "B0032",
            "el": [
              "0x1f96"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE OriginalFilename metadata field",
            "e": [
              "OriginalFilename"
            ],
            "i": "metadata/package/versioning::pe-originalfilename-field",
            "l": 2,
            "el": [
              "0x2366"
            ]
          },
          {
            "c": 0.6499999761581421,
            "d": ".NET Diagnostics namespace token",
            "e": [
              "System.Diagnostics"
            ],
            "i": "micro-behaviors/process/create/spawn::diagnostics-namespace-token-dotnet",
            "l": 1,
            "el": [
              "0x576"
            ]
          },
          {
            "c": 0.8199999928474426,
            "d": "Encoded Microsoft OCSP URL",
            "e": [
              "Nhttp://www.microsoft.com/pkiops/crl/Microsoft Time-Stamp PCA 2010(1).crl0l",
              "Phttp://www.microsoft.com/pkiops/certs/Microsoft Time-Stamp PCA 2010(1).crt0"
            ],
            "i": "objectives/anti-static/obfuscation/encoding/content::encoded-ms-ocsp-url",
            "l": 1,
            "el": [
              "0x3e4a",
              "0x3eb6"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "Microsoft timestamp certificate chain",
            "e": [
              "Microsoft Time-Stamp Service",
              "Microsoft Time-Stamp PCA 2010"
            ],
            "i": "micro-behaviors/data/embedded/certificate::microsoft-timestamp-chain",
            "l": 2,
            "el": [
              "0x3a0d",
              "0x3abf"
            ]
          },
          {
            "c": 1.0,
            "d": "Issued by a Microsoft Code Signing PCA",
            "e": [
              "CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US"
            ],
            "i": "metadata/signed/certificate::pe-cert-issuer-microsoft-pca",
            "l": 2,
            "el": [
              "value:pe.signatures[0].issuer"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "Microsoft code-signing certificate chain",
            "e": [
              "Microsoft Code Signing PCA 2011"
            ],
            "i": "micro-behaviors/data/embedded/certificate::microsoft-code-signing-pca",
            "l": 2,
            "el": [
              "0x2927"
            ]
          },
          {
            "c": 1.0,
            "d": "PE binary has trailing overlay data",
            "e": [
              "binary.has_overlay = 1.00"
            ],
            "i": "metadata/binary/layout::has-overlay",
            "l": 3
          },
          {
            "a": "T1562.001",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "ValueMustBeNonNegative",
              "o podem ser honrados. Para desabilitar o tempo limite, especifique TimeSpan.MaxValue.",
              "wO tempo limite deve ser maior ou igual a TimeSpan.Zero. Para desabilitar o tempo limite, especifique TimeSpan.MaxValue.",
              "Os tempos limites maiores que Int32.MaxValue TotalMilliseconds (aproximadamente 24 dias) n"
            ],
            "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3",
            "l": 1,
            "m": "B0047",
            "el": [
              "0xf14",
              "0x12f7",
              "0x1220",
              "0x129b"
            ]
          },
          {
            "c": 1.0,
            "d": "DEP / NX enabled (NX_COMPAT)",
            "e": [
              "[dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-dep",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE .reloc section presence",
            "e": [
              ".reloc"
            ],
            "i": "metadata/binary/section/names::reloc-section-presence",
            "l": 2
          },
          {
            "a": "T1027.009",
            "c": 0.8600000143051147,
            "d": ".NET ResourceReader payload access",
            "e": [
              "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.…"
            ],
            "i": "micro-behaviors/data/embedded/payload/resource::dotnet-resource-reader",
            "l": 1,
            "el": [
              "0x800"
            ]
          },
          {
            "c": 1.0,
            "d": "ASLR enabled (DYNAMIC_BASE)",
            "e": [
              "[dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-aslr",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Regex component marker",
            "e": [
              "binary.overlay_ratio = 0.50"
            ],
            "i": "objectives/anti-static/obfuscation/control-flow/logic::bloated-low-density-malware-cond-5--inline-32080",
            "l": 1
          },
          {
            "c": 0.9599999785423279,
            "d": "Microsoft company metadata",
            "e": [
              "Microsoft Corporation"
            ],
            "i": "well-known/app/drivers::microsoft-company",
            "l": 2,
            "el": [
              "value:pe.version.company"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE ProductName metadata field",
            "e": [
              "ProductName"
            ],
            "i": "metadata/package/versioning::pe-productname-field",
            "l": 2,
            "el": [
              "0x23e2"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE resource section",
            "e": [
              ".rsrc"
            ],
            "i": "metadata/binary/section/names::pe-resource-section",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard runtime section",
            "e": [
              ".reloc"
            ],
            "i": "metadata/binary/section/names::pe-runtime-standard-section",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Regex component marker",
            "e": [
              "StringFileInfo"
            ],
            "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7",
            "l": 1,
            "el": [
              "0x20fe"
            ]
          },
          {
            "a": "T1053.005",
            "c": 0.8999999761581421,
            "d": "Regex component marker",
            "e": [
              "SocketConnectionDisposed",
              "TcpConnectingToViaTimedOut",
              "TcpConnectErrorWithTimeSpan",
              "TcpConnectionTimedOut"
            ],
            "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1",
            "l": 1,
            "m": "F0012",
            "el": [
              "0xcc6",
              "0xd7e",
              "0xd1e",
              "0xdea"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE has under ten imports",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Microsoft vendor marker in resource section",
            "e": [
              "Microsoft Corporation"
            ],
            "i": "metadata/binary/vendor::microsoft-corp-marker-rsrc",
            "l": 1,
            "el": [
              "0x21a4"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Microsoft vendor marker in certificate data",
            "e": [
              "Microsoft Corporation"
            ],
            "i": "metadata/binary/vendor::microsoft-corp-marker-cert",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE with six or fewer imports",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "metadata/binary/symbols/imports::pe-imports-max-six",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "PE checksum matches computed value",
            "e": [
              "pe.checksum_valid = 1.00"
            ],
            "i": "metadata/binary/layout::pe-checksum-valid",
            "l": 1
          },
          {
            "c": 0.9399999976158142,
            "d": "PE overlay exceeds thirty-five percent",
            "e": [
              "binary.overlay_ratio = 0.50"
            ],
            "i": "metadata/binary/layout::overlay-over-35pct",
            "l": 3
          },
          {
            "c": 0.8500000238418579,
            "d": "IPv4-like .NET assembly version",
            "e": [
              "Version=4.0.0.0"
            ],
            "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version",
            "l": 2,
            "el": [
              "0x800"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE FileDescription metadata field",
            "e": [
              "FileDescription"
            ],
            "i": "metadata/package/versioning::pe-filedescription-field",
            "l": 2,
            "el": [
              "0x21d6"
            ]
          },
          {
            "a": "T1027",
            "c": 0.8399999737739563,
            "d": "VB6 PE with three sections",
            "e": [
              "sections.count = 3.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)",
            "e": [
              "pe.resource_count = 1.00"
            ],
            "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources",
            "l": 1
          },
          {
            "a": "T1105",
            "c": 0.800000011920929,
            "d": "Compact PE import table",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table",
            "l": 1,
            "m": "E1105"
          },
          {
            "c": 1.0,
            "d": ".NET BSJB metadata marker",
            "e": [
              "BSJB"
            ],
            "i": "metadata/binary/framework::bsjb-marker",
            "l": 1
          },
          {
            "a": "T1055",
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571",
            "l": 1,
            "m": "C0041"
          },
          {
            "c": 0.9200000166893005,
            "d": "Overlay exceeds one-third",
            "e": [
              "binary.overlay_ratio = 0.50"
            ],
            "i": "metadata/binary/layout::overlay-dominates-third",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 0.8600000143051147,
            "d": "Long mixed-case identifiers cluster",
            "e": [
              "CompilationRelaxationsAttribute",
              "AssemblyCopyrightAttribute",
              "TcpConnectingToViaTimedOut",
              "AssemblyTitleAttribute",
              "DebuggableAttribute",
              "AssemblyDescriptionAttribute",
              "AssemblyProductAttribute",
              "AssemblyInformationalVersionAttribute",
              "SocketAbortedReceiveTimedOut",
              "TcpConnectErrorWithTimeSpan",
              "AssemblyCompanyAttribute",
              "RuntimeCompatibilityAttribute",
              "ChannelTypeNotSupported",
              "SocketCloseReadReceivedData",
              "ValueMustBeNonNegative",
              "AssemblyFileVersionAttribute"
            ],
            "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers",
            "l": 1,
            "m": "B0032",
            "el": [
              "0x4aa",
              "0x4e3",
              "0xd7e",
              "0x433",
              "0x41f",
              "0x48d",
              "0x4ca",
              "0x467",
              "0xbe6",
              "0xd1e",
              "0x4fe",
              "0x517",
              "0x9c0",
              "0xc5a",
              "0xf14",
              "0x44a"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Claims Microsoft Corp in version resource",
            "e": [
              "Microsoft Corporation",
              "Microsoft Corporation."
            ],
            "i": "metadata/binary/vendor::microsoft-corp-versioninfo",
            "l": 1,
            "el": [
              "0x21a4",
              "0x2304"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "links mscoree (CorDllMain)",
            "e": [
              "mscoree"
            ],
            "i": "metadata/dylib::mscoree",
            "l": 2,
            "el": [
              "1 symbols"
            ]
          },
          {
            "c": 1.0,
            "d": "Microsoft certificate chain markers",
            "e": [
              "Microsoft Time-Stamp Service",
              "Microsoft Code Signing PCA 2011",
              "Microsoft Time-Stamp PCA 2010",
              "Microsoft Corporation",
              "Microsoft Corporation"
            ],
            "i": "metadata/signed/platform::microsoft-certificate-chain",
            "l": 1,
            "el": [
              "0x3a0d",
              "0x2927",
              "0x3abf",
              "0x21a4",
              ""
            ]
          }
        ],
        "sha": "015c3a3445a04723b76a9f97e0e1039dda7bbd65dead45279d076ff5221a771b",
        "path": "015c3a3445a04723b76a9f97e0e1039dda7bbd65dead45279d076ff5221a771b.dll",
        "type": "pe"
      }
    ],
    "tv": "52045"
  }
}