{
  "llm": {
    "conf": 0.80946773,
    "grade": "benign",
    "model": "Qwen/Qwen3.6-27B",
    "review": false,
    "outcome": "benign",
    "interpretation": "Legitimate .NET library assembly"
  },
  "ml": {
    "v": "7",
    "eng": "2.2.0-rc.1",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.18300894,
        "rte": "az",
        "prob": 0.18300894
      }
    ],
    "prob": 0.72781104,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.7278110384941101,
        "type": "nupkg"
      },
      {
        "id": 1,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000010311603546142578,
        "type": "xml"
      },
      {
        "id": 2,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00004094839096069336,
        "type": "xml"
      },
      {
        "id": 3,
        "lvl": -1,
        "conf": 0,
        "prob": 0.7278110384941101,
        "type": "pe"
      },
      {
        "id": 4,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000011205673217773438,
        "type": "markdown"
      },
      {
        "id": 5,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00000961621572059812,
        "type": "xml"
      },
      {
        "id": 6,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00001095732022804441,
        "type": "xml"
      },
      {
        "id": 7,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00001085797975974856,
        "type": "registry"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-06-28T13:04:11Z"
  },
  "path": "Franz.Common.SSO.2.2.9.nupkg",
  "raw": {
    "files": [
      {
        "id": 0,
        "mol": "O(Al)H₂(CmDb)",
        "sha": "13494587daebd072d065a49a7bfab865eab10978ffcc096fb0101d5648df2279",
        "path": "Franz.Common.SSO.2.2.9.nupkg",
        "risk": 4,
        "size": 26199,
        "type": "nupkg",
        "facts": {
          "metrics": {
            "file": {
              "size": 26199.0,
              "entropy": 7.87,
              "size_bytes": 26199.0
            },
            "binary": {
              "overall_entropy": 7.87,
              "peak_region_bytes": 23552.0,
              "peak_region_entropy": 7.8
            },
            "archive": {
              "file_count": 7.0,
              "member_count": 7.0,
              "script_count": 0.0,
              "zip_bomb_ratio": 2.41,
              "directory_count": 0.0,
              "executable_count": 1.0,
              "extra_field_size": 0.0,
              "noise_file_count": 0.0,
              "total_compressed": 25267.0,
              "compression.ratio": 0.62,
              "hidden_file_count": 2.0,
              "total_uncompressed": 40927.0,
              "crc_collision_count": 0.0,
              "entry_comment_count": 0.0,
              "max_filename_length": 81.0,
              "rtlo_filename_count": 0.0,
              "format.regular_count": 7.0,
              "nested_archive_count": 0.0,
              "path_traversal_count": 0.0,
              "symlink_escape_count": 0.0,
              "security.setgid_count": 0.0,
              "security.setuid_count": 0.0,
              "security.sticky_count": 0.0,
              "double_extension_count": 0.0,
              "duplicate_member_count": 0.0,
              "security.symlink_count": 0.0,
              "unicode_filename_count": 0.0,
              "homoglyph_filename_count": 0.0,
              "security.encrypted_count": 0.0,
              "timing.mtime_unique_count": 4.0,
              "timing.mtime_unique_ratio": 0.57,
              "misplaced_executable_count": 1.0,
              "timing.mtime_outlier_count": 3.0,
              "timing.mtime_dominant_count": 4.0,
              "timing.mtime_spread_seconds": 25002.0,
              "timing.sentinel_mtime_count": 0.0,
              "security.world_writable_count": 0.0,
              "timing.mtime_dominant_fraction": 0.57,
              "compression.method_counts.stored": 1.0,
              "compression.method_counts.deflate": 6.0
            }
          }
        },
        "ident": {
          "name": {
            "value": "Franz.Common.SSO",
            "source": "nupkg.title",
            "verified": false
          },
          "urls": [
            {
              "url": "https://github.com/bestacio89/Franz.Common",
              "kind": "repository",
              "source": "nupkg.repository_url"
            }
          ],
          "trust": "unsigned",
          "authors": [
            {
              "name": "Bernardo Estacio Abreu",
              "role": "author",
              "source": "nupkg.authors"
            }
          ],
          "version": {
            "value": "2.2.9",
            "source": "nupkg.version",
            "verified": false
          },
          "identifier": {
            "value": "Franz.Common.SSO",
            "source": "nupkg.id",
            "verified": false
          }
        },
        "traits": [
          {
            "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal",
            "conf": 0.699999988079071,
            "crit": 1,
            "desc": ".NET code entropy in unpacked range",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "metadata/binary/framework::dotnet-assembly",
            "conf": 1.0,
            "crit": 2,
            "desc": ".NET Assembly (mscoree.dll)",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/data/db/linq::linq-queries",
            "conf": 0.699999988079071,
            "crit": 3,
            "desc": "LINQ query operations",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "metadata/package/versioning::pe-fileversion-field",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "PE FileVersion metadata field",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/server/managed::http-context",
            "conf": 1.0,
            "crit": 3,
            "desc": "Access to ASP.NET HttpContext",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "metadata/package/versioning::pe-productversion-field",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "PE ProductVersion metadata field",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/path/extension::dll-dup",
            "crit": 2,
            "desc": ".dll extension reference",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "metadata/binary/framework::dotnet-metadata",
            "conf": 1.0,
            "crit": 2,
            "desc": ".NET Metadata Root (BSJB)",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "metadata/package/versioning::pe-version-resource",
            "conf": 0.800000011920929,
            "crit": 2,
            "desc": "PE version resource structure",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref",
            "conf": 1.0,
            "crit": 3,
            "desc": "JSON polymorphism runtime marker",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "metadata/binary/framework::clr-runtime-header",
            "conf": 1.0,
            "crit": 2,
            "desc": "PE CLR runtime header present (COM descriptor)"
          }
        ]
      },
      {
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 506.0,
              "entropy": 5.21,
              "size_bytes": 506.0
            },
            "binary": {
              "overall_entropy": 5.21,
              "peak_region_bytes": 506.0,
              "peak_region_entropy": 5.21
            }
          }
        },
        "id": 1,
        "path": "Franz.Common.SSO.2.2.9.nupkg!!_rels/.rels",
        "sha": "c843f834ab76d2191111db6132654935fa8a5230085a6355e2f001a2169b4ad5",
        "size": 506,
        "type": "xml"
      },
      {
        "ctx": [
          {
            "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj]",
            "n": [
              {
                "c": 2,
                "d": "NuGet nuspec manifest file",
                "i": "metadata/build/manifest::nuspec-file",
                "o": 0,
                "z": 23,
                "cf": 0.9800000190734863
              }
            ],
            "ln": 1,
            "addr": 0
          },
          {
            "b": "jAa.syHH\u003c!aB4:tzGv@+xMOuniXJdcv}YB\u003cvrj5rx\u003e8g4B8LVje[n*pfk$ufyHH\u003c\u0026zF7QTfFLvpfF$I3B-RIkv\u003eJ1EwfKh",
            "ln": 2,
            "addr": 42
          },
          {
            "b": "arS^-wPRu\u003evrt{w",
            "ln": 3,
            "addr": 118
          },
          {
            "b": "arR^Hjy-qGD2^RixMMB9z/x#xx\u003eIa3asH.GatLSah6tj%A=brawn-OVB97\u00262x(taWvSD45jtgh.AcVFrxj#xJ",
            "ln": 11,
            "addr": 451
          },
          {
            "b": "arR^HjAL1AB3r6lvqZxllVl*Uz/cW$BzkM9BzkrcawDATx\u003c(a4AV!1-w[$/$qEK3zx()6DavQD+zGGGky-(C^v@=HewPz%dv}xZzflySnB3o",
            "ln": 12,
            "addr": 520
          },
          {
            "b": "arR^HjAt1Lz/YSmz/QaCBA}?pjTaJMBrR\u0026IA+)(.xMOunB2\u003e%cxk8E3BZ=$kz/4dpwPI%4v}/\u003cviwi\u003cxvqZxzlVl*Uz/c:wvSC){v}X1Hzddc@a%pxlzeB0ejT8WqwN]jUfLj=HwN]m8g?6]Fw[kyWwhu82hzM%zgb\u0026SKh-9xLhAh)6ffP",
            "n": [
              {
                "c": 2,
                "d": "NuGet package declares repository",
                "i": "metadata/package/files/nuget::nuspec-repository",
                "o": 611,
                "z": 93,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 13,
            "addr": 607
          },
          {
            "b": "arR^Hjy\u00262xwO#3\u0026zEWx(B3o",
            "n": [
              {
                "c": 2,
                "d": "NuGet package declares dependencies",
                "i": "metadata/package/files/nuget::nuspec-dependencies",
                "o": 754,
                "z": 566,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 14,
            "addr": 750
          },
          {
            "b": "arR^HarS^VA=l8taAR4jxjVfOA:-/@Cw?IqjTa=PBtkE4fD@W",
            "ln": 15,
            "addr": 769
          },
          {
            "b": "arR^HarR^Hjy\u00262xwO#3\u0026zEW@mx\u003efvJmSI{PDm?N6zeBiee\u003e6V1x([R\u0026A:-/@Cw?Iqa%q5uA=U@kzAPg0e\u002624ta%pDwv@co#wJ.k7B.LV5ej1eZy\u003cytrA=SAEffP",
            "ln": 16,
            "addr": 809
          }
        ],
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 1464.0,
              "entropy": 5.1,
              "size_bytes": 1464.0
            },
            "binary": {
              "overall_entropy": 5.1,
              "peak_region_bytes": 1464.0,
              "peak_region_entropy": 5.12
            }
          }
        },
        "id": 2,
        "path": "Franz.Common.SSO.2.2.9.nupkg!!Franz.Common.SSO.nuspec",
        "risk": 1,
        "sha": "03ea155945fc4c985d788e0a8ca2dc5f3b87cc6a7aa867aa5f3e80af99b690e1",
        "size": 1464,
        "traits": [
          {
            "id": "metadata/package/files/nuget::nuspec-dependencies",
            "conf": 0.8999999761581421,
            "crit": 2,
            "desc": "NuGet package declares dependencies",
            "spans": [
              [
                754,
                566
              ]
            ]
          },
          {
            "id": "metadata/build/manifest::nuspec-file",
            "conf": 0.9800000190734863,
            "crit": 2,
            "desc": "NuGet nuspec manifest file",
            "spans": [
              [
                0,
                23
              ]
            ]
          },
          {
            "id": "metadata/package/files/nuget::nuspec-repository",
            "conf": 0.8999999761581421,
            "crit": 2,
            "desc": "NuGet package declares repository",
            "spans": [
              [
                611,
                93
              ]
            ]
          }
        ],
        "type": "xml"
      },
      {
        "ctx": [
          {
            "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J+",
            "n": [
              {
                "c": 3,
                "d": "HTTP fingerprinting evasion campaign",
                "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign",
                "o": 0,
                "z": 34,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 0
          },
          {
            "b": "00000000000000000000IdcC+00000nb@R\u00260SSx7@4m%HA54y[0rr91000000000000",
            "n": [
              {
                "c": 1,
                "d": "PE standard code/data section",
                "i": "metadata/binary/section/names::pe-code-data-standard-section",
                "o": 512,
                "z": 5,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 496
          },
          {
            "b": "015^Of8$$P18\u0026hW017gQlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn",
            "n": [
              {
                "c": 3,
                "d": "Recognized PE anti-analysis marker",
                "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker",
                "o": 4348,
                "z": 4,
                "cf": 1.0
              }
            ],
            "ln": 4332
          },
          {
            "b": "D1gVevqt\u003cQwPRoUvrlh:q*ACawO\u003c4#wN/\u003e6x([RMp\u0026Zn/v}/)\u003cyYD?svqfO1p\u0026Zn/v}/)\u003cyYFA{x(mz",
            "n": [
              {
                "c": 2,
                "d": "System namespace reference",
                "i": "metadata/lang/compiler/managed::system-namespace",
                "o": 11203,
                "z": 15,
                "cf": 0.800000011920929
              }
            ],
            "ln": 11187
          },
          {
            "b": "mSI{PDm?N6zeBiee(LXAe[w^m08[e:By/p?l1BH[y*?3{07ZKtlU{gBz2^mFxk8k-",
            "n": [
              {
                "c": 3,
                "d": "References Windows executable or script",
                "i": "objectives/execution/interpreter/script/shell::windows-executable-ref",
                "o": 11317,
                "z": 4,
                "cf": 0.6000000238418579
              }
            ],
            "ln": 11301
          },
          {
            "b": "zE^r@v%HT-ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9mbwPz%dv}w2Cy\u00260V)BzkVh07?6KvqGT*pJf(=ve",
            "n": [
              {
                "c": 2,
                "d": "Benign high-entropy PE context",
                "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context",
                "o": 11722,
                "z": 17,
                "cf": 0.949999988079071
              }
            ],
            "ln": 11706
          },
          {
            "b": "z/bLNwPQv=v}xR3x(v\u003e?q*ACawO\u003c50wQ5qHn][]*06$daq!ZbZy?mZbzua9:z#-QDv@=Hez!s8zl340uwPQpTA+c\u003c]BAzE4q*ACawO\u003c4[x(m[\u003cm}DNHA+P2Zq+{kgz*2\u00269wPv=xq!o#)x\u003e7ZJA=la",
            "n": [
              {
                "c": 3,
                "d": "LINQ query operations",
                "i": "micro-behaviors/data/db/linq::linq-queries",
                "o": 11858,
                "z": 11,
                "cf": 0.699999988079071
              },
              {
                "c": 3,
                "d": "JSON polymorphism runtime marker",
                "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref",
                "o": 11798,
                "z": 16,
                "cf": 1.0
              }
            ],
            "ln": 11782
          },
          {
            "b": "Ds.9%oMaMjA=M8s06$danow@)lVl\u003c:wQ5q.v}f7\u003eB8M70nKWJtzdN-@Bz(g1pHX6Iv@$dSB.$W",
            "n": [
              {
                "c": 3,
                "d": "Access to ASP.NET HttpContext",
                "i": "micro-behaviors/communications/http/server/managed::http-context",
                "o": 12376,
                "z": 11,
                "cf": 1.0
              }
            ],
            "ln": 12360
          },
          {
            "b": "0rrv5wO+{^B7CsKe=+@3lVl{?A+Pf1Brz#wdiHx1gbQgvwPzV%A+68hmrrMVv}/\u003c7l1j\u003eCBP",
            "n": [
              {
                "c": 2,
                "d": "Copyright notice",
                "i": "metadata/package/license::copyright-word",
                "o": 16865,
                "z": 9,
                "cf": 0.6000000238418579
              }
            ],
            "ln": 16849
          },
          {
            "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000",
            "n": [
              {
                "c": 1,
                "d": "PE resource section",
                "i": "metadata/binary/section/names::pe-resource-section",
                "o": 17920,
                "z": 5,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 17904
          },
          {
            "b": "0000000000001?UgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrf30SSi",
            "n": [
              {
                "c": 3,
                "d": "Recognized marker for timing checks",
                "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker",
                "o": 18014,
                "z": 15,
                "cf": 0.949999988079071
              }
            ],
            "ln": 17998
          },
          {
            "b": "zVB!Tyxb%!002:]7xsEolJz38z2!IPve$fBC(QOtve$cAwDhYg002s=wDl-Jzua8BASxRIzVy)",
            "n": [
              {
                "c": 2,
                "d": "PE CompanyName metadata field",
                "i": "metadata/package/versioning::pe-companyname-field",
                "o": 18354,
                "z": 11,
                "cf": 0.699999988079071
              }
            ],
            "ln": 18338
          },
          {
            "b": "ASxUJBPqyw002Q\u003e5Dz?imGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002E*ASxIFzua$.e=Xl",
            "n": [
              {
                "c": 2,
                "d": "PE FileDescription metadata field",
                "i": "metadata/package/versioning::pe-filedescription-field",
                "o": 18434,
                "z": 15,
                "cf": 0.699999988079071
              }
            ],
            "ln": 18418
          },
          {
            "b": "qVG.@pxgv{001LI1][V7mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001+Oe=WTbe=W)i002Q\u003e6-XmmnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002E*ASxIFzua$.e=XlszVBRO",
            "n": [
              {
                "c": 3,
                "d": "Dotted-quad PE version metadata marker",
                "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker",
                "o": 18510,
                "z": 11,
                "cf": 0.9399999976158142
              },
              {
                "c": 2,
                "d": "PE InternalName metadata field",
                "i": "metadata/package/versioning::pe-internalname-field",
                "o": 18554,
                "z": 12,
                "cf": 0.699999988079071
              }
            ],
            "ln": 18494
          },
          {
            "b": "vGpAGwDl\u0026M002)%6-Xmmpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002E*ASxIFzua$.e=Xls",
            "n": [
              {
                "c": 2,
                "d": "PE OriginalFilename metadata field",
                "i": "metadata/package/versioning::pe-originalfilename-field",
                "o": 18750,
                "z": 16,
                "cf": 0.699999988079071
              }
            ],
            "ln": 18734
          },
          {
            "b": "wb{ACyYBCn002s=5Dz?ipYLIozVBqFBPt[KBo25ove$cAwDhYg002E*ASxIFzua$.e=XlszVBR",
            "n": [
              {
                "c": 2,
                "d": "PE ProductName metadata field",
                "i": "metadata/package/versioning::pe-productname-field",
                "o": 18834,
                "z": 11,
                "cf": 0.699999988079071
              }
            ],
            "ln": 18818
          },
          {
            "b": "qVG.@pxgv{004PJf8#1MpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001+Oe=WTbe=W)id/.v9g5}",
            "n": [
              {
                "c": 2,
                "d": "PE version resource metadata",
                "i": "metadata/package/versioning::version-resource-metadata",
                "o": 18902,
                "z": 14,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 18886
          },
          {
            "b": "000000000000000000000ak^b3\u0026*ncTtf+Q000000000000000000000000000000000",
            "n": [
              {
                "c": 2,
                "d": "PE .reloc section presence",
                "i": "metadata/binary/section/names::reloc-section-presence",
                "o": 19456,
                "z": 6,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 19440
          }
        ],
        "depth": 1,
        "facts": {
          "imp": [
            [
              "mscoree",
              "CorDllMain"
            ]
          ],
          "sec": [
            [
              ".text",
              512,
              17408,
              5.72,
              "r-x"
            ],
            [
              ".rsrc",
              17920,
              1536,
              2.72,
              "r--"
            ],
            [
              ".reloc",
              19456,
              512,
              0.08,
              "r--"
            ]
          ],
          "metrics": {
            "pe": {
              "checksum": 0.0,
              "checksum_valid": 0.0,
              "resource_count": 1.0,
              "has_version_info": 1.0,
              "checksum_stripped": 1.0,
              "computed_checksum": 45174.0,
              "reloc_overhang_bytes": 500.0,
              "reloc_overhang_ratio": 0.98,
              "bss_like_section_count": 0.0,
              "section_overflow_count": 0.0,
              "misaligned_section_count": 0.0,
              "version.identity_entropy": 4.22,
              "base_relocation_block_count": 1.0,
              "base_relocation_entry_count": 1.0,
              "version.identity_symbol_ratio": 0.07
            },
            "file": {
              "size": 19968.0,
              "entropy": 5.39,
              "size_bytes": 19968.0
            },
            "binary": {
              "is_pie": 1.0,
              "code_entropy": 5.72,
              "string_count": 302.0,
              "overall_entropy": 5.39,
              "entropy_variance": 5.3,
              "avg_string_length": 19.74,
              "max_string_length": 108.0,
              "peak_region_bytes": 3072.0,
              "code_to_data_ratio": 1.0,
              "peak_region_entropy": 5.67,
              "string_length_stddev": 13.61,
              "largest_section_ratio": 0.87,
              "sentence_string_count": 17.0,
              "sentence_string_ratio": 0.06,
              "high_entropy_string_count": 0.0
            },
            "imports": {
              "count": 1.0
            },
            "sections": {
              "count": 3.0,
              "code_size": 17408.0,
              "entropy_max": 5.72,
              "entropy_mean": 2.84,
              "name_entropy": 3.03,
              "writable_count": 0.0,
              "executable_count": 1.0,
              "nonstandard_count": 0.0,
              "executable_writable_count": 0.0
            },
            "dependencies": {
              "count": 1.0
            }
          }
        },
        "id": 3,
        "mol": "O(Al)H₂(CmDb)",
        "path": "Franz.Common.SSO.2.2.9.nupkg!!lib/net10.0/Franz.Common.SSO.dll",
        "risk": 4,
        "sha": "9798e1347a247855e03299d9fd07ba74284810aad9eea02634620ce999160328",
        "size": 19968,
        "traits": [
          {
            "id": "micro-behaviors/communications/http/server/managed::http-context",
            "conf": 1.0,
            "crit": 3,
            "desc": "Access to ASP.NET HttpContext",
            "spans": [
              [
                12376,
                11
              ]
            ]
          },
          {
            "id": "metadata/package/versioning::pe-productversion-field",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "PE ProductVersion metadata field",
            "spans": [
              [
                18902,
                14
              ]
            ]
          },
          {
            "id": "micro-behaviors/fs/path/extension::dll-dup",
            "crit": 2,
            "desc": ".dll extension reference",
            "spans": [
              [
                11317,
                4
              ]
            ]
          },
          {
            "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal",
            "conf": 0.699999988079071,
            "crit": 1,
            "desc": ".NET code entropy in unpacked range",
            "spans": [
              [
                0,
                26
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/db/linq::linq-queries",
            "conf": 0.699999988079071,
            "crit": 3,
            "desc": "LINQ query operations",
            "spans": [
              [
                11858,
                11
              ]
            ]
          },
          {
            "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref",
            "conf": 1.0,
            "crit": 3,
            "desc": "JSON polymorphism runtime marker",
            "spans": [
              [
                11798,
                16
              ]
            ]
          },
          {
            "id": "metadata/package/versioning::pe-fileversion-field",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "PE FileVersion metadata field",
            "spans": [
              [
                18510,
                11
              ]
            ]
          },
          {
            "id": "metadata/binary/framework::dotnet-metadata",
            "conf": 1.0,
            "crit": 2,
            "desc": ".NET Metadata Root (BSJB)",
            "spans": [
              [
                4348,
                4
              ]
            ]
          },
          {
            "id": "metadata/package/versioning::pe-version-resource",
            "conf": 0.800000011920929,
            "crit": 2,
            "desc": "PE version resource structure",
            "spans": [
              [
                18014,
                15
              ]
            ]
          },
          {
            "id": "metadata/binary/framework::clr-runtime-header",
            "conf": 1.0,
            "crit": 2,
            "desc": "PE CLR runtime header present (COM descriptor)"
          },
          {
            "id": "metadata/binary/framework::dotnet-assembly",
            "conf": 1.0,
            "crit": 2,
            "desc": ".NET Assembly (mscoree.dll)",
            "spans": [
              [
                4348,
                4
              ]
            ]
          }
        ],
        "type": "pe"
      },
      {
        "ctx": [
          {
            "b": "boOD=mSI{PDm?N6zeBiee(LXAdK\u003e",
            "ln": 3,
            "addr": 8
          },
          {
            "b": "",
            "ln": 4,
            "addr": 31
          },
          {
            "b": "k{f#TvSC)$C{4rBBzbxaaARpdasX\u003cgA:-\u003ciavZxWzdN{fA+^cOaARp9BrCKyz*2\u00269wPF#nBAg@3zer{7wN({8B-qqrA=-Boz/M%IdPp50xkzc4q!Y(ZeL*mbc@T5udjM!\u0026x(k4Vq=28wmn$x%z/Pzivq{g4x\u003e7N[x(v)ge=",
            "n": [
              {
                "c": 2,
                "d": "English language detection",
                "i": "metadata/file/profile/language::lang-english",
                "o": 49,
                "z": 3,
                "cf": 0.800000011920929
              }
            ],
            "ln": 5,
            "addr": 32
          },
          {
            "b": "ra]#!aAg+0yHH\u003c!aA.Now[+*$ay/tcw[+[2A::67z/cXazE:(gwOkZ#BAg/ix(v(iz!pbeB.(elAbo8dq=uEmAb](ux\u003eg^}B0bgmBz\u0026pgaAImmxkzcgay/tcB7]YqwO#PjvScgbB98ChAbYJexcq55v}Yp*x(!bxaA}Hky?j-bz/PY6y?XifzF782y?$k7y*?3{B0bgmBz\u0026pgaA.Now[+*!asX\u003cGmSI{PDp.TUzGGPmC%=H/By/Ysu[9SU",
            "ln": 6,
            "addr": 166
          },
          {
            "b": "",
            "ln": 7,
            "addr": 367
          }
        ],
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 4759.0,
              "entropy": 5.11,
              "size_bytes": 4759.0
            },
            "text": {
              "digit_ratio": 0.01,
              "space_count": 585.0,
              "total_lines": 181.0,
              "char_entropy": 5.11,
              "unique_chars": 84.0,
              "avg_line_length": 25.3,
              "high_byte_ratio": 0.0,
              "max_line_length": 200.0,
              "non_ascii_ratio": 0.0,
              "empty_line_ratio": 0.28,
              "last_line_length": 26.0,
              "whitespace_ratio": 0.16,
              "most_common_ratio": 0.07,
              "line_length_stddev": 29.68,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 1.0,
              "most_common_char_codepoint": 101.0
            },
            "binary": {
              "overall_entropy": 5.11,
              "peak_region_bytes": 4759.0,
              "peak_region_entropy": 5.08
            }
          }
        },
        "id": 4,
        "path": "Franz.Common.SSO.2.2.9.nupkg!!readme.md",
        "risk": 1,
        "sha": "53df2a7c0df8fffbaf27770e30a1774eeb39ca139f879466e1742593d8e6bf03",
        "size": 4759,
        "traits": [
          {
            "id": "metadata/file/profile/language::lang-english",
            "conf": 0.800000011920929,
            "crit": 2,
            "desc": "English language detection",
            "spans": [
              [
                49,
                3
              ]
            ]
          },
          {
            "id": "metadata/file/extension/identity::markdown-file-basename",
            "conf": 1.0,
            "crit": 1,
            "desc": "Markdown document file extension",
            "spans": [
              [
                0,
                9
              ]
            ]
          },
          {
            "id": "metadata/file/extension/identity::doc-or-config-extension",
            "conf": 1.0,
            "crit": 1,
            "desc": "Document or config file extension",
            "spans": [
              [
                0,
                9
              ]
            ]
          }
        ],
        "type": "markdown"
      },
      {
        "ctx": [
          {
            "b": "ju[7cy-)[jA=U@kzAPf#e?!E(wO#0@wnb{]jTb2\u003cw?t$^krYAprc-B]B0bZAy\u0026jqSb4#7uA5]T9B7n({zddGrz/xo9CX}nez/PY6BAo5",
            "n": [
              {
                "c": 1,
                "d": "File uses a document or configuration extension",
                "i": "metadata/file/extension/identity::doc-or-config-extension",
                "o": 0,
                "z": 19,
                "cf": 1.0
              }
            ],
            "ln": 0,
            "col": 1,
            "line": 1
          }
        ],
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 520.0,
              "entropy": 4.81,
              "size_bytes": 520.0
            },
            "binary": {
              "overall_entropy": 4.81,
              "peak_region_bytes": 520.0,
              "peak_region_entropy": 4.81
            }
          }
        },
        "id": 5,
        "path": "Franz.Common.SSO.2.2.9.nupkg!![Content_Types].xml",
        "pid": 0,
        "sha": "1a6670ec6cb20a6520f5d6b9be859fcd7416bef2ba0e8e40bfbf0aaab5409e4f",
        "size": 520,
        "traits": [
          {
            "id": "metadata/file/extension/identity::doc-or-config-extension",
            "conf": 1.0,
            "crit": 1,
            "desc": "File uses a document or configuration extension",
            "spans": [
              [
                0,
                19
              ]
            ]
          }
        ],
        "type": "xml"
      },
      {
        "id": 6,
        "sha": "65f295b9fd3a5810c6e5fe2e163a92a196b57c6d76a367cce81572bfbc693f22",
        "path": "Franz.Common.SSO.2.2.9.nupkg!!package/services/metadata/core-properties/dd5890121d024fa4b66190ba5635edeb.psmdcp",
        "size": 723,
        "type": "xml",
        "depth": 1
      },
      {
        "id": 7,
        "sha": "566e83cbc2f5b3a838b0a3dd8ee07eb2169026deb1eb88c5c475d46946e0803f",
        "path": "Franz.Common.SSO@2.2.9.registry.json",
        "size": 785,
        "type": "registry",
        "depth": 1
      }
    ],
    "omitted_files": 2,
    "v": "8"
  }
}