{ "ml": { "v": "7", "eng": "2.11.0-beta.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.000010897716, "rte": "az", "prob": 0.000010897716 }, { "cls": 0, "raw": 0.0030562382, "rte": "az/nupkg", "prob": 0.0030562382 } ], "prob": 0.00004946192, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.00004946191984345205, "type": "nupkg" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.0000379482917196583, "type": "pe" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.0000426173210144043, "type": "pe" }, { "id": 12, "lvl": -1, "conf": 0, "prob": 0.000040660303056938574, "type": "pe" }, { "id": 14, "lvl": -1, "conf": 0, "prob": 0.000027934709578403272, "type": "pe" }, { "id": 16, "lvl": -1, "conf": 0, "prob": 0.000040660303056938574, "type": "pe" }, { "id": 18, "lvl": -1, "conf": 0, "prob": 0.000027964511900790967, "type": "pe" }, { "id": 21, "lvl": -1, "conf": 0, "prob": 0.000044345855712890625, "type": "pe" }, { "id": 22, "lvl": -1, "conf": 0, "prob": 0.00003958741945098154, "type": "pe" }, { "id": 23, "lvl": -1, "conf": 0, "prob": 0.000044345855712890625, "type": "pe" }, { "id": 24, "lvl": -1, "conf": 0, "prob": 0.00004155437272856943, "type": "pe" }, { "id": 25, "lvl": -1, "conf": 0, "prob": 0.00003958741945098154, "type": "pe" }, { "id": 26, "lvl": -1, "conf": 0, "prob": 0.00004155437272856943, "type": "pe" }, { "id": 27, "lvl": -1, "conf": 0, "prob": 0.00003958741945098154, "type": "pe" }, { "id": 28, "lvl": -1, "conf": 0, "prob": 0.00003958741945098154, "type": "pe" }, { "id": 29, "lvl": -1, "conf": 0, "prob": 0.00003958741945098154, "type": "pe" }, { "id": 30, "lvl": -1, "conf": 0, "prob": 0.000040660303056938574, "type": "pe" }, { "id": 31, "lvl": -1, "conf": 0, "prob": 0.000042180221498711035, "type": "pe" }, { "id": 32, "lvl": -1, "conf": 0, "prob": 0.00004069010537932627, "type": "pe" }, { "id": 33, "lvl": -1, "conf": 0, "prob": 0.000044345855712890625, "type": "pe" }, { "id": 34, "lvl": -1, "conf": 0, "prob": 0.00004069010537932627, "type": "pe" }, { "id": 35, "lvl": -1, "conf": 0, "prob": 0.000044345855712890625, "type": "pe" }, { "id": 36, "lvl": -1, "conf": 0, "prob": 0.000028312206268310547, "type": "pe" }, { "id": 37, "lvl": -1, "conf": 0, "prob": 0.000039637088775634766, "type": "pe" }, { "id": 38, "lvl": -1, "conf": 0, "prob": 0.000044345855712890625, "type": "pe" }, { "id": 39, "lvl": -1, "conf": 0, "prob": 0.00004155437272856943, "type": "pe" }, { "id": 40, "lvl": -1, "conf": 0, "prob": 0.00003733237463166006, "type": "pe" }, { "id": 41, "lvl": -1, "conf": 0, "prob": 0.00002851088902389165, "type": "pe" }, { "id": 42, "lvl": -1, "conf": 0, "prob": 0.00002753734588623047, "type": "pe" }, { "id": 43, "lvl": -1, "conf": 0, "prob": 0.00002828240394592285, "type": "pe" }, { "id": 44, "lvl": -1, "conf": 0, "prob": 0.00004946191984345205, "type": "pe" }, { "id": 45, "lvl": -1, "conf": 0, "prob": 0.000044345855712890625, "type": "pe" }, { "id": 46, "lvl": -1, "conf": 0, "prob": 0.000039637088775634766, "type": "pe" }, { "id": 47, "lvl": -1, "conf": 0, "prob": 0.00002810359001159668, "type": "pe" }, { "id": 48, "lvl": -1, "conf": 0, "prob": 0.00003733237463166006, "type": "pe" }, { "id": 49, "lvl": -1, "conf": 0, "prob": 0.000028312206268310547, "type": "pe" }, { "id": 50, "lvl": -1, "conf": 0, "prob": 0.000026325384169467725, "type": "pe" }, { "id": 51, "lvl": -1, "conf": 0, "prob": 0.00004069010537932627, "type": "pe" }, { "id": 52, "lvl": -1, "conf": 0, "prob": 0.00004201133924652822, "type": "pe" }, { "id": 53, "lvl": -1, "conf": 0, "prob": 0.000026086965590366162, "type": "pe" }, { "id": 54, "lvl": -1, "conf": 0, "prob": 0.000021189451217651367, "type": "pe" }, { "id": 55, "lvl": -1, "conf": 0, "prob": 0.000026752552003017627, "type": "pe" }, { "id": 56, "lvl": -1, "conf": 0, "prob": 0.00002138813397323247, "type": "pe" }, { "id": 57, "lvl": -1, "conf": 0, "prob": 0.00002660354039107915, "type": "pe" }, { "id": 58, "lvl": -1, "conf": 0, "prob": 0.00002138813397323247, "type": "pe" }, { "id": 59, "lvl": -1, "conf": 0, "prob": 0.00002138813397323247, "type": "pe" }, { "id": 60, "lvl": -1, "conf": 0, "prob": 0.000021189451217651367, "type": "pe" }, { "id": 61, "lvl": -1, "conf": 0, "prob": 0.000026752552003017627, "type": "pe" }, { "id": 62, "lvl": -1, "conf": 0, "prob": 0.00002138813397323247, "type": "pe" }, { "id": 63, "lvl": -1, "conf": 0, "prob": 0.00002660354039107915, "type": "pe" }, { "id": 64, "lvl": -1, "conf": 0, "prob": 0.00002138813397323247, "type": "pe" }, { "id": 65, "lvl": -1, "conf": 0, "prob": 0.00002138813397323247, "type": "pe" }, { "id": 66, "lvl": -1, "conf": 0, "prob": 0.000028093656510463916, "type": "pe" }, { "id": 67, "lvl": -1, "conf": 0, "prob": 0.000021189451217651367, "type": "pe" }, { "id": 68, "lvl": -1, "conf": 0, "prob": 0.000026752552003017627, "type": "pe" }, { "id": 69, "lvl": -1, "conf": 0, "prob": 0.00002138813397323247, "type": "pe" }, { "id": 70, "lvl": -1, "conf": 0, "prob": 0.00002660354039107915, "type": "pe" }, { "id": 71, "lvl": -1, "conf": 0, "prob": 0.00002138813397323247, "type": "pe" }, { "id": 72, "lvl": -1, "conf": 0, "prob": 0.00002138813397323247, "type": "pe" }, { "id": 73, "lvl": -1, "conf": 0, "prob": 0.000028093656510463916, "type": "pe" }, { "id": 74, "lvl": -1, "conf": 0, "prob": 0.000021189451217651367, "type": "pe" }, { "id": 75, "lvl": -1, "conf": 0, "prob": 0.000026752552003017627, "type": "pe" }, { "id": 76, "lvl": -1, "conf": 0, "prob": 0.00002138813397323247, "type": "pe" }, { "id": 77, "lvl": -1, "conf": 0, "prob": 0.00002660354039107915, "type": "pe" }, { "id": 78, "lvl": -1, "conf": 0, "prob": 0.00002138813397323247, "type": "pe" }, { "id": 79, "lvl": -1, "conf": 0, "prob": 0.00002138813397323247, "type": "pe" }, { "id": 80, "lvl": -1, "conf": 0, "prob": 0.000028093656510463916, "type": "pe" }, { "id": 81, "lvl": -1, "conf": 0, "prob": 0.000021189451217651367, "type": "pe" }, { "id": 82, "lvl": -1, "conf": 0, "prob": 0.000026752552003017627, "type": "pe" }, { "id": 83, "lvl": -1, "conf": 0, "prob": 0.00002138813397323247, "type": "pe" }, { "id": 84, "lvl": -1, "conf": 0, "prob": 0.00002660354039107915, "type": "pe" }, { "id": 85, "lvl": -1, "conf": 0, "prob": 0.00002138813397323247, "type": "pe" }, { "id": 86, "lvl": -1, "conf": 0, "prob": 0.00002138813397323247, "type": "pe" }, { "id": 87, "lvl": -1, "conf": 0, "prob": 0.000028093656510463916, "type": "pe" }, { "id": 88, "lvl": -1, "conf": 0, "prob": 0.000021189451217651367, "type": "pe" }, { "id": 89, "lvl": -1, "conf": 0, "prob": 0.00002672274968062993, "type": "pe" }, { "id": 90, "lvl": -1, "conf": 0, "prob": 0.00002138813397323247, "type": "pe" }, { "id": 91, "lvl": -1, "conf": 0, "prob": 0.000026524066925048828, "type": "pe" }, { "id": 92, "lvl": -1, "conf": 0, "prob": 0.00002138813397323247, "type": "pe" }, { "id": 93, "lvl": -1, "conf": 0, "prob": 0.00002138813397323247, "type": "pe" }, { "id": 94, "lvl": -1, "conf": 0, "prob": 0.000028093656510463916, "type": "pe" }, { "id": 95, "lvl": -1, "conf": 0, "prob": 0.000021189451217651367, "type": "pe" }, { "id": 96, "lvl": -1, "conf": 0, "prob": 0.000025043884306796826, "type": "pe" }, { "id": 97, "lvl": -1, "conf": 0, "prob": 0.00002138813397323247, "type": "pe" }, { "id": 98, "lvl": -1, "conf": 0, "prob": 0.00002495447733963374, "type": "pe" }, { "id": 99, "lvl": -1, "conf": 0, "prob": 0.00002138813397323247, "type": "pe" }, { "id": 100, "lvl": -1, "conf": 0, "prob": 0.000021010637283325195, "type": "pe" }, { "id": 101, "lvl": -1, "conf": 0, "prob": 0.000028093656510463916, "type": "pe" }, { "id": 104, "lvl": -1, "conf": 0, "prob": 0.000021189451217651367, "type": "pe" }, { "id": 105, "lvl": -1, "conf": 0, "prob": 0.000026752552003017627, "type": "pe" }, { "id": 106, "lvl": -1, "conf": 0, "prob": 0.00002138813397323247, "type": "pe" }, { "id": 107, "lvl": -1, "conf": 0, "prob": 0.00002660354039107915, "type": "pe" }, { "id": 108, "lvl": -1, "conf": 0, "prob": 0.00002138813397323247, "type": "pe" }, { "id": 109, "lvl": -1, "conf": 0, "prob": 0.00002138813397323247, "type": "pe" }, { "id": 110, "lvl": -1, "conf": 0, "prob": 0.000021189451217651367, "type": "pe" }, { "id": 111, "lvl": -1, "conf": 0, "prob": 0.000026752552003017627, "type": "pe" }, { "id": 112, "lvl": -1, "conf": 0, "prob": 0.00002138813397323247, "type": "pe" }, { "id": 113, "lvl": -1, "conf": 0, "prob": 0.00002660354039107915, "type": "pe" }, { "id": 114, "lvl": -1, "conf": 0, "prob": 0.00002138813397323247, "type": "pe" }, { "id": 115, "lvl": -1, "conf": 0, "prob": 0.00002138813397323247, "type": "pe" }, { "id": 116, "lvl": -1, "conf": 0, "prob": 0.000028093656510463916, "type": "pe" }, { "id": 117, "lvl": -1, "conf": 0, "prob": 0.000021189451217651367, "type": "pe" }, { "id": 118, "lvl": -1, "conf": 0, "prob": 0.000027070442229160108, "type": "pe" }, { "id": 119, "lvl": -1, "conf": 0, "prob": 0.00002138813397323247, "type": "pe" }, { "id": 120, "lvl": -1, "conf": 0, "prob": 0.000026752552003017627, "type": "pe" }, { "id": 121, "lvl": -1, "conf": 0, "prob": 0.00002146760562027339, "type": "pe" }, { "id": 122, "lvl": -1, "conf": 0, "prob": 0.00002146760562027339, "type": "pe" }, { "id": 123, "lvl": -1, "conf": 0, "prob": 0.000028093656510463916, "type": "pe" }, { "id": 124, "lvl": -1, "conf": 0, "prob": 0.000028093656510463916, "type": "pe" }, { "id": 125, "lvl": -1, "conf": 0, "prob": 0.000021189451217651367, "type": "pe" }, { "id": 126, "lvl": -1, "conf": 0, "prob": 0.000026752552003017627, "type": "pe" }, { "id": 127, "lvl": -1, "conf": 0, "prob": 0.00002138813397323247, "type": "pe" }, { "id": 128, "lvl": -1, "conf": 0, "prob": 0.00002660354039107915, "type": "pe" }, { "id": 129, "lvl": -1, "conf": 0, "prob": 0.00002138813397323247, "type": "pe" }, { "id": 130, "lvl": -1, "conf": 0, "prob": 0.00002138813397323247, "type": "pe" }, { "id": 131, "lvl": -1, "conf": 0, "prob": 0.000021189451217651367, "type": "pe" }, { "id": 132, "lvl": -1, "conf": 0, "prob": 0.00002477566340530757, "type": "pe" }, { "id": 133, "lvl": -1, "conf": 0, "prob": 0.00002138813397323247, "type": "pe" }, { "id": 134, "lvl": -1, "conf": 0, "prob": 0.000024686256438144483, "type": "pe" }, { "id": 135, "lvl": -1, "conf": 0, "prob": 0.00002138813397323247, "type": "pe" }, { "id": 136, "lvl": -1, "conf": 0, "prob": 0.000020384788513183594, "type": "pe" }, { "id": 137, "lvl": -1, "conf": 0, "prob": 0.000028093656510463916, "type": "pe" }, { "id": 138, "lvl": -1, "conf": 0, "prob": 0.000021189451217651367, "type": "pe" }, { "id": 139, "lvl": -1, "conf": 0, "prob": 0.00002477566340530757, "type": "pe" }, { "id": 140, "lvl": -1, "conf": 0, "prob": 0.00002138813397323247, "type": "pe" }, { "id": 141, "lvl": -1, "conf": 0, "prob": 0.000024686256438144483, "type": "pe" }, { "id": 142, "lvl": -1, "conf": 0, "prob": 0.00002138813397323247, "type": "pe" }, { "id": 143, "lvl": -1, "conf": 0, "prob": 0.000020384788513183594, "type": "pe" }, { "id": 146, "lvl": -1, "conf": 0, "prob": 0.000014513731002807617, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-09-17T13:00:16Z" }, "path": "Assay.linux-x64.0.8.0.nupkg", "raw": { "files": [ { "id": 0, "mol": "Md(Si₂)", "sha": "1cff40620c8331ec0ed785ad73fec2a0ad45c0744e4957b48fe4024047c89976", "path": "Assay.linux-x64.0.8.0.nupkg", "risk": 2, "size": 43921951, "type": "nupkg", "facts": { "metrics": { "file": { "size": 43921951, "entropy": 8 }, "binary": { "peak_region_bytes": 42456064, "peak_region_entropy": 7.86 }, "archive": { "file_count": 152, "member_count": 152, "script_count": 0, "zip_bomb_ratio": 6.72, "compressed_size": 43891731, "directory_count": 0, "executable_count": 129, "extra_field_size": 0, "noise_file_count": 0, "compression.ratio": 0.42, "hidden_file_count": 2, "uncompressed_size": 103993255, "crc_collision_count": 0, "entry_comment_count": 0, "max_filename_length": 91, "rtlo_filename_count": 0, "format.regular_count": 152, "nested_archive_count": 0, "path_traversal_count": 0, "symlink_escape_count": 0, "security.setgid_count": 0, "security.setuid_count": 0, "security.sticky_count": 0, "double_extension_count": 0, "duplicate_member_count": 0, "security.symlink_count": 0, "unicode_filename_count": 0, "homoglyph_filename_count": 0, "security.encrypted_count": 0, "timing.mtime_unique_count": 2, "timing.mtime_unique_ratio": 0.01, "misplaced_executable_count": 129, "timing.mtime_outlier_count": 1, "timing.mtime_dominant_count": 151, "timing.mtime_spread_seconds": 24966, "timing.sentinel_mtime_count": 0, "security.world_writable_count": 0, "timing.mtime_dominant_fraction": 0.99, "compression.method_counts.stored": 1, "compression.method_counts.deflate": 151 } } }, "ident": { "name": { "value": "Assay.linux-x64", "source": "nupkg.title", "verified": false }, "urls": [ { "url": "https://github.com/mhelleborg/assay", "kind": "homepage", "source": "nupkg.project_url" }, { "url": "https://github.com/mhelleborg/assay", "kind": "repository", "source": "nupkg.repository_url" } ], "trust": "unsigned", "authors": [ { "name": "Magne Moss Helleborg", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "0.8.0", "source": "nupkg.version", "verified": false }, "identifier": { "value": "Assay.linux-x64", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "metadata/signed/leaf::microsoft-corporation", "conf": 1.0, "crit": 3, "desc": "Signed by Microsoft Corporation", "from": [ { "file": 54 } ] }, { "id": "metadata/signed/unknown::.net", "conf": 1.0, "crit": 3, "desc": "Authenticode chain CN: .NET", "from": [ { "file": 54 } ] } ] }, { "id": 5, "sha": "502e5c827eb5c22eb813fd884e7af9d32428f6f98cb466ea67a3da5fe3f1c441", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/Assay.Analysis.dll", "size": 2969088, "type": "pe", "depth": 1 }, { "id": 9, "sha": "3f4f45595f9d351a3c96c8329fedbbabc0ffa7f9342d2ad7ab0c84b65d6e0bee", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/Assay.Cli.dll", "risk": 1, "size": 2187264, "type": "pe", "depth": 1 }, { "id": 12, "sha": "348a564dcba41b5f3c7078c20ad922826344f6170d197d24e469a4cead1ec8c9", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/Assay.Core.dll", "size": 1160192, "type": "pe", "depth": 1 }, { "id": 14, "sha": "a24c48bcd6bdba4fb726f2899f12df93e98be590648a073f3c85378b8a8edc8a", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/Assay.Mcp.dll", "size": 258048, "type": "pe", "depth": 1 }, { "id": 16, "sha": "1a92423fe87033a7019f7a53056f74c1da1669f009b185a9509d23bc4684f9c9", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/Assay.Query.dll", "size": 628224, "type": "pe", "depth": 1 }, { "id": 18, "sha": "dd390a96b819025094f99196d8dc4108ba3688162dfe406d866a24c600df21ff", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/Assay.Testing.dll", "size": 74240, "type": "pe", "depth": 1 }, { "id": 21, "sha": "bcca843a18defba33b1955c4b25c6a9415f78cabce9fbcda241b9dfd57574a5e", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/Humanizer.dll", "size": 833024, "type": "pe", "depth": 1 }, { "id": 22, "sha": "bc7ac1881597d56151e47818d04f4e5dde75e4036028d2ca0edba41ffae61415", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/ICSharpCode.Decompiler.dll", "size": 6663680, "type": "pe", "depth": 1 }, { "id": 23, "sha": "7ccd64bc4b57f63ebfaeabc8197785180f352df392ea0afd719789ff5332f005", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/LibGit2Sharp.dll", "size": 1072640, "type": "pe", "depth": 1 }, { "id": 24, "sha": "31bed04db5f7cb4cd9f8821792887615da5bac515c9b55f9aae33fd303bfd220", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/Microsoft.CodeAnalysis.CSharp.Workspaces.dll", "size": 2615808, "type": "pe", "depth": 1 }, { "id": 25, "sha": "0ecabdc554afd3fb201434c72137fffc4c8c64329087ff9350b552f949a227c0", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/Microsoft.CodeAnalysis.CSharp.dll", "size": 19210240, "type": "pe", "depth": 1 }, { "id": 26, "sha": "f841fd8d7cbe12a34020fd7500624c4eada036ffd4bdd41ebfd18b0de23ffa88", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/Microsoft.CodeAnalysis.VisualBasic.Workspaces.dll", "size": 2231296, "type": "pe", "depth": 1 }, { "id": 27, "sha": "74b673300b8854b7261354a4204d46ce7cbd038b7cec5ebc77151f4b68f4df62", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/Microsoft.CodeAnalysis.VisualBasic.dll", "size": 13828096, "type": "pe", "depth": 1 }, { "id": 28, "sha": "91bd91fa2f85ca03ce567a44fb22f6c2ec062c92a5628a7ef0a8252695e2495f", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/Microsoft.CodeAnalysis.Workspaces.dll", "size": 11720704, "type": "pe", "depth": 1 }, { "id": 29, "sha": "e154f1db8159d8418fb90d0a6c1b255543199fafe0321129271c6116f7a80500", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/Microsoft.CodeAnalysis.dll", "size": 8300032, "type": "pe", "depth": 1 }, { "id": 30, "sha": "be37b84bfd08fd1e1b1e119b31210c5b4a73ffe2a79a6e4af306250650ea23d3", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/Microsoft.Data.Sqlite.dll", "size": 445440, "type": "pe", "depth": 1 }, { "id": 31, "sha": "f595f32ebbc4d91d470d3cf5d81a8303c6888b911cdf775fe519f88ae3fb347c", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/Newtonsoft.Json.dll", "size": 1810944, "type": "pe", "depth": 1 }, { "id": 32, "sha": "354148ee6ed10cbff45f1c6bf163391aaa961a0f1c3fcfa17e93b3d2e88761f4", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/NuGet.Common.dll", "size": 231424, "type": "pe", "depth": 1 }, { "id": 33, "sha": "be420eaad9d7174e65c571c75916a89b64663ee1d2c1ead2e38425a7bed226a0", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/NuGet.Configuration.dll", "size": 414720, "type": "pe", "depth": 1 }, { "id": 34, "sha": "c565c89f756ab1932131d5392599e10ae3b3aab0b48a01b568d5230ccf142f77", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/NuGet.DependencyResolver.Core.dll", "size": 218112, "type": "pe", "depth": 1 }, { "id": 35, "sha": "6465b3e3ec54a98a14395f6e5a3829ffee27008c0016ae90a0ae070e99e6f131", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/NuGet.Frameworks.dll", "size": 294912, "type": "pe", "depth": 1 }, { "id": 36, "sha": "d349dfd92f6de170a598d100d7c4f34e84f1898caf6ceedff47ecbd9710fc947", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/NuGet.LibraryModel.dll", "size": 92160, "type": "pe", "depth": 1 }, { "id": 37, "sha": "7fb60cef2410b82fb1b880252efcb5d91eea428186af00ab5f33486084754bb2", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/NuGet.Packaging.dll", "size": 1693184, "type": "pe", "depth": 1 }, { "id": 38, "sha": "ac456d706265ad3dca00ae17f18c69dd19c12052c3140b6e8d2c0e4f7ffcb93a", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/NuGet.ProjectModel.dll", "size": 610816, "type": "pe", "depth": 1 }, { "id": 39, "sha": "b6858fbdf460ea6d58dd285f1d52758f0b7340cffd27c7f5bde6d6b215fbf484", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/NuGet.Protocol.dll", "size": 2067456, "type": "pe", "depth": 1 }, { "id": 40, "sha": "ff1fd1aa3a1b0739718007e114203a4ccbd9478c94eeb0b9b1e535f582cdf272", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/NuGet.Versioning.dll", "size": 116224, "type": "pe", "depth": 1 }, { "id": 41, "sha": "2b7df6db0a31380301436a68e7b36a0ad2341dd26d97c67026b1c65a0dbbae4d", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/SQLitePCLRaw.batteries_v2.dll", "size": 6144, "type": "pe", "depth": 1 }, { "id": 42, "sha": "3b1f6aca2a8e7f79f4710dd667194cb01240bd87b4197c404aaefa32c561af0c", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/SQLitePCLRaw.core.dll", "size": 102400, "type": "pe", "depth": 1 }, { "id": 43, "sha": "72ba094a493697bd1f45907ed252db2d7227042e8f429f88ece8fd90473ec667", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/SQLitePCLRaw.provider.e_sqlite3.dll", "size": 76800, "type": "pe", "depth": 1 }, { "id": 44, "sha": "ff72ca00bdd8fbcc61c9e6d96a06d0bb31bde52f46c9f0647fde53e8cdda2c61", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/Spectre.Console.Ansi.dll", "size": 398336, "type": "pe", "depth": 1 }, { "id": 45, "sha": "95c3f42840c4635e21bebe3d5203e70a07ce908f60fbbd1110eafc31f6772b32", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/Spectre.Console.Cli.dll", "size": 857600, "type": "pe", "depth": 1 }, { "id": 46, "sha": "9667e394364da725bb8691bc42a801aead4443f9e86e27c0df53bded9acc7d64", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/Spectre.Console.dll", "size": 1613312, "type": "pe", "depth": 1 }, { "id": 47, "sha": "3751668b80559d7d14f63c831f26b84e48caf7710097f382eecce987b606dac1", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/System.Composition.AttributedModel.dll", "size": 12800, "type": "pe", "depth": 1 }, { "id": 48, "sha": "0fa4817db4aab54e15047238dc607f6b1e1fd118e0e8c4afb97249f76ce33028", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/System.Composition.Convention.dll", "size": 101376, "type": "pe", "depth": 1 }, { "id": 49, "sha": "8156118fc3241d9c1f0e7f201df388a48f51d68c69535a714e5ddc87e0fa1377", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/System.Composition.Hosting.dll", "size": 104960, "type": "pe", "depth": 1 }, { "id": 50, "sha": "434aa9069015886710817c24ec821cf835d1d4af83259cf36cc89ca0fdf7956d", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/System.Composition.Runtime.dll", "size": 30208, "type": "pe", "depth": 1 }, { "id": 51, "sha": "a5a77829a384b40e1da388c6be52f5838a19bb3b11e38638458d2dcc57c9f547", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/System.Composition.TypedParts.dll", "size": 128512, "type": "pe", "depth": 1 }, { "id": 52, "sha": "9336bb3859fe33b9ca5a37bc34c9cfef69f25cbda9005ba24c07477e9fa599d1", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/System.Security.Cryptography.Pkcs.dll", "size": 603136, "type": "pe", "depth": 1 }, { "id": 53, "sha": "672f3a55eb8a71da2f426310ddd4a6613b43e4a62d8ae994ae5c2feadc575555", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/System.Security.Cryptography.ProtectedData.dll", "size": 32768, "type": "pe", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47aAzQxazCZol@c-7zeS@@e!5l%bME/A00000p^\u003eu:oAtj}Qa]z]00000000", "ln": 0 }, { "b": "3\u0026*nc0ak^b00ic202+?q000000000000000kMy^J00000000000000000000/F0p900000nb@R\u00260SSx7p-]-rkN4h*2(\u003c@900000Kr%@cCNjuI2RVkUFb/MH0000000000000000000000000000000000000000lq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCnnc5X\u003cbyPQ)V\u0026HdbXb(Tgbu5Y8x(mN800000yY\u003c.r1onA4bumUxA0cdv5c8Xgbs+:9l\u0026Wh!Fck\u0026LZYsAnbsli+vGlxd000000SSi32nvdr2($2a0qVZL02tLm0rr913ig5a0rr912(\u003c@92(\u003c@90rr910rr910@@r3000Sj0rr91000i6Hx8z%1{1n}Bo8NC8317C4/\u0026Ed000i6*w\u003c!C1]#BsnDx1}l\u0026Y^V1]@6inDx1}RVoo?1]{jPnDw!\u003e00031000000rrc22([fg0rrYitla{d830\u003ew3ihHPtlbonf-UzU5caY\u003ctlbonk(+9\u00265cbo4tlbonq2\u003c/35car.3JN%xe=VK+:P9{[8VY74e=W9@[C\u003efwd/Y$Ue=WWckMJFqi@\u0026gWe=XlsKPv6mo8$7P1B{EL1POS8000000rr919SQl.ArcyD0000000000000-l3ig5a0000000031005k:007{V00031001tE006!u00031007TL0000006A$]wozZ1j]!JbB97#ge(D?fBzkP607pycB.tt}vR/QwBAzLqvS=^706$WEwO\u003e))C#OH1y?k[OBAh88B-.f{l349UzdmsbmRMWIr+lq)x(v(PBAzLq", "ln": 464 }, { "b": "v@=Hez!s8zlVlHDl2HaED2)Xve\u003c\u0026MJvrcrts8Sa{B8UL$wPGFAwPI^jA:@W4e[w^m08[e:By/qwqE%DRwN/*@z/bLcv@#Tf08[e:By/qwl${7xzF%Prx\u003e8h:q*ACawO\u003c4$B-8qnzdLs!z/6Dcy?mS=wPz%dv}xYYo\u003e!9Tz/Y\u0026eBs]}0wmX5AvqHjgx(+)]q!PPWA4THRxKL}2s8Sa{B8UL$wM08Xz/{8gwPGFlB1RGAB8Mg", "ln": 1304 }, { "b": "04!iKc@1z=A=l2qw]]T)z!9ABzEEvbB7]XFlSmVbA=rTjz/PSmAa9l/A@Vgu!=L)L=DtQ\u00260rr91KPkvYy/tR2By/qwqE%]/B-H#6B1Qv4B8Mhwv}wLHvpS}\u0026efF!Jv@Dy7x\u003c@Ror+lq)x(v(Lg+HEmfFk4gavyo/BAIRnj-j?NBAg/aefE=ivR/:*oj-xFz!\u0026{4jZ{uevkRKLhzEiFg?wv2iu}EFB97#ge(Dn4z/{8gwPGF4B-8qnzdMQRB8Mhwv}wOIBohBx00-G70000008L%Hp^EGC1.VzxHljPUXs\u0026?!WwEPA6N8vB=$$j2Fx^H.L(H^:00000nDw!\u003eDi10ChVJ*Ty5!klL(Q\u003c+Z5!omgd84u0b8vv0ce6U0abZ[0b?\u003cF0bhBJ0a#ps07c:8", "ln": 2144 }, { "b": "000000000000000000000000000000000000000000000000000000000000000000000000000000315c8Xg7YTL^000000000000000000310rr91fAq960000000000000000003100000nb@R\u0026su(\u0026^+ME[C0000000000+MG:500341qVHe8rSCL*qufR}nDqJ^p5[S3nDqG=mGui:00000Y-^*600031ecb[OEi6pb0000000000kl7V-000001onA40SSi2000000000000000l\u0026Wh!0rud2ve$rFmGvc5yYF2DnDrSdw=", "ln": 5072 }, { "b": "00031qVH[tASx!NzuaqHmGvc5yYF2DnDrSdw=M-H000oc00031fAr^bfAr^bfAr{fvGn7Z002W)761vnlJz38z2!IPve$fBC(QOtve$cAwDhYg002Z[x-ISyASy1TA@ZaUw=M]Maoj+ezVB!Tz#:!RASxIFBo31PzVBUP004rBdf6wGmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002Z[x-ISyASy1TA@ZaUw=M]Me=XlszVBqFwDk0@zua8ByYF.XA@Y[OA@W/)lJy3+xAhDvASy4Ue=X@MzVB!TyxezQz#:qDv/Q6uA@Vgu002aY4GDIfmGvc5yYF2DrSDXhASydXx-J5Kzu6Up001\u003eRe=WWcfAr^be=WTbhukufhVL/qfAr%g0052VhVJ\u003cUnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002Z[x-ISyASy1TA@ZaUw=M]Me=XlszVBqFwDk0@zua8ByYF.XA@Y[OA@W/)lJy3+xAhDvASy4Ue=X@MzVB!TyxezQz#:qDv/Q6uA@W/)ASxUJA@ZaUBPuBZv/Q6uA@W/)wb{ACyYBCn004JH", "ln": 5370 }, { "b": "k(+Z3yYCNTASx!Nx8(PBBo3vZaolAZwDl=KwDl-JB]V7Nwb[jZ005q+hVJ\u003cUpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002Z[x-ISyASy1TA@ZaUw=M]Me=XlszVBqFwDk0@zua8ByYF.XA@Y[OA@W/)lJy3+xAhDvASy4Ue=X@MzVB!TyxezQz#:qDv/Q6uA@W/)ASxUJA@ZaUBPuBZv/Q6uA@W/)wb{ACyYBCn0043tdf6wGpYLIozVBqFBPt[KBo25ove$cAwDhYg002Z[x-ISyASy1TA@ZaUw=M]Me=XlszVBqFwDk0@zua8ByYF.XA@Y[OA@W/)lJy3+xAhDvASy4Ue=X@MzVB!TyxezQz#:qDv/Q6uA@Vgu005q+irf6WpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001\u003eRe=WWce=WN9eDvKae=WTbhukAhhVL/qe=W:ed/.p7hums?iriH*wb[v+h#\u003e=nv/Q3tgYPJohukAhgYQ}:v/OE*g5%rmirh2svGp0uwDjT?hVL/qve@m!wDlftf-T9iwb[B^gxolihVJ*T001$U2MK(9k(+%aA@Y+Kz2!2ByYF.XaokBxwDl-JA@Y[OzVBUP001\u003eRe=WWce=WN9e=WN9000000000000000000000000000000", "ln": 5918 }, { "b": "00000000000000000000000000000000000000000000000000000000000005axM3\u0026*nc{+hWF00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", "ln": 6608 }, { "b": "00000000000000000000000000000000000000000000000000000000000000000fEV#400ii4fOg-01{(=lnqu\u003cF0s5X0F*?A*F*?ok0rB[=fBXi)v1}hMwDJ5p0r\u0026DStM$J=1{1\u0026cF\u0026r-i1FwHzoFvm!3m=qY1oB9k0S-/=2)ghdPAH$\u003cFb?nTfBXi)v1}hMwDJ5p0r\u0026DaaCIqS@Thfg0udW3icG84FatKb0F5Mfap\u003e77/$W)oFUmP7]E$\u003e3AXJ7Fta+%00rJrogxmyTTfjO9", "ln": 7116 }, { "b": "Bz(4K5hjN#162Ee69?ADwnMm5whbbV90MHB1pt!So\u003e!9Tz/Y\u0026eBrA}?A=t@qvruj4zzrK[ci:ML1oPqVo\u003e!9Tz/Y\u0026eBrA}?wmV(Zx\u003eIr$zF77*lQq?IfFLpo9V2nvh843Bi59uHi5JS#7y-bTfGgWzf/H%Hh8!X)v\u003e!uB2)HGi1o]Ivrz$Q=fCaG\u003errJNv3rHUSxLzu%Bz(4K5hjN#162Ee69?ADwnMm5whbbV90MHB1pt!So\u003e!9Tz/Y\u0026eBrA}?A=t@qvruj4zzqOO3KcYk1oPq", "ln": 7399 }, { "b": "6?@yLA=l2qw]]d.z/P/nA::67z/do+fFAXkrrJyqdnsI^A=l2qw]]d[z/o.ulUgpWx\u003ez6?vru66l3mo.z/PMlC{1\u003c@f!\u003ev67y-8NfGgWBgb7NCfGAqM4kG*}h.WiDf!+QwiA!a=f:/Vw1{m\u003cd1}}5rq.X}t5E5tq1pbUFs7ce-x(mN9z/dovfB!o?rrJKu2u2a", "ln": 9076 }, { "b": "1{m\u003cd3LKO0q!P(Ry?aU/q=s/cq+/wimLNgXfF#oMeKRPQh.=Qjbl!lI1oPqSo\u003e!9Tz/Y\u0026eBrBK%zdLp$Byx39ax8\u0026(C4\u003eC$PN)^MfOfJTfOfDtPAtk@0S\u003c2\u003e0006u2#}.(.=Wk(009610VS)61{(=lnqu\u003cF0rAMi05e^P3OR\u003e\u003e162Ed69qfjf+VkM1{m\u003cd2ONLDvrl9@zFa6fzzqXR4H92n", "ln": 11988 }, { "b": "wnMm5whbbV90MHB1pt!So\u003e!9Tz/Y\u0026eBrA}?A=t@qvruj4zzrE(bNauJ1oPqTo\u003e!9Tz/Y\u0026eBrBK%zdLp$Byx39aw+A\u003eatLS9fFBK:4kG^{i59lAi5APJf\u003ckw5gbZ\u003cwf/7Kzg=NoCs$\u003eJRf:/Vw1{m\u003cd1}}5rq.X}t5E5tq1pbUFs7ce-x(mN9z/dovfB!o?rrJKu2u2bzzeTr5f=\u00261*1{m\u003cd3i", "ln": 12166 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 4608, 5.21, "r-x" ], [ ".rsrc", 5120, 1536, 3.01, "r--" ], [ ".reloc", 6656, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 50124, "timestamp": 2169385378, "image_size": 32768, "headers_size": 512, "checksum_valid": 1, "clr.is_il_only": 1, "file_alignment": 512, "resource_count": 1, "cert_table_size": 10544, "has_version_info": 1, "computed_checksum": 50124, "headers_size_ratio": 0.03, "prose_section_count": 0, "reloc_overhang_bytes": 500, "reloc_overhang_ratio": 0.98, "clr.is_32bit_required": 0, "bss_like_section_count": 0, "clr.is_32bit_preferred": 0, "clr.strong_name_signed": 1, "section_overflow_count": 0, "signature_expired_days": 80.19, "clr.is_native_entrypoint": 0, "clr.strong_name_sig_size": 128, "misaligned_section_count": 0, "version.identity_entropy": 4.22, "clr.managed_resource_count": 1, "base_relocation_block_count": 1, "base_relocation_entry_count": 1, "clr.managed_resource_max_size": 982, "declared_data_directory_count": 7, "version.identity_symbol_ratio": 0.06, "executable_prose_section_count": 0, "clr.managed_resource_max_entropy": 4.86, "directory_section_mismatch_count": 0 }, "file": { "size": 17712, "entropy": 6.65 }, "binary": { "is_pie": 1, "has_overlay": 1, "code_entropy": 5.21, "overlay_size": 10544, "string_count": 135, "overlay_ratio": 0.6, "overlay_entropy": 7.51, "entropy_variance": 4.43, "avg_string_length": 26.29, "max_string_length": 145, "peak_region_bytes": 10544, "code_to_data_ratio": 1, "peak_region_entropy": 7.38, "string_length_stddev": 22.03, "largest_section_ratio": 0.26, "sentence_string_count": 22, "sentence_string_ratio": 0.16, "high_entropy_string_count": 0 }, "imports": { "count": 1 }, "strings": { "truncated": 0, "retained_count": 135, "extracted_count": 135 }, "sections": { "count": 3, "code_size": 4608, "entropy_max": 5.21, "entropy_mean": 2.77, "name_entropy": 3.03, "writable_count": 0, "executable_count": 1, "nonstandard_count": 0, "executable_writable_count": 0 }, "consistency": { "internal_name_original_filename_mismatch": 0 }, "dependencies": { "count": 1 } } }, "id": 54, "ident": { "name": { "value": "Microsoft.CodeAnalysis.CSharp.Workspaces.resources.dll", "source": "pe.version.original_filename", "verified": false }, "title": { "value": "Microsoft.CodeAnalysis.CSharp.Workspaces", "source": "pe.version.description", "verified": false }, "trust": "platform", "signer": { "issuer": "CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US", "source": "pe.signatures[0]", "subject": "CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US", "signed_at": "2026-01-28 19:01:41 UTC", "common_name": ".NET", "organization": "Microsoft Corporation" }, "project": { "value": "Microsoft.CodeAnalysis.CSharp.Workspaces", "source": "pe.version.product_name", "verified": false }, "version": { "value": "5.300.26.7805", "source": "pe.version.file_version", "verified": false }, "unique_ids": { "authenticode_thumbprint_sha256": "01e030ef08f5396f77bf435088ed05c4104038ccb12e7304390a7ee234e58531" }, "organization": { "value": "Microsoft Corporation", "source": "pe.signatures[0]", "verified": true } }, "mol": "K(Te)O₂(Er₂Pr)H(Db)Md₄(Bi₅PaPtSi₄)", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/cs/Microsoft.CodeAnalysis.CSharp.Workspaces.resources.dll", "pid": 0, "risk": 15, "sha": "d7613e5de7c75f57329129e208021b1143a0835826c9751ce6906157ae6e76d9", "size": 17712, "traits": [ { "id": "metadata/signed/unknown::.net", "conf": 1.0, "crit": 3, "desc": "Authenticode chain CN: .NET" }, { "id": "metadata/signed/leaf::microsoft-corporation", "conf": 1.0, "crit": 3, "desc": "Signed by Microsoft Corporation" }, { "id": "metadata/binary/code/entropy::code-entropy-at-most-7-5", "conf": 0.7, "crit": 2, "desc": "Code entropy is 7.5 or lower", "spans": [ [ 512, 4608 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR header (COM descriptor)" }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET metadata root signature (BSJB)", "spans": [ [ 592, 0 ] ] }, { "id": "metadata/binary/layout/overlay::image-under-768kb", "conf": 0.9, "crit": 3, "desc": "PE mapped image under 768 KiB" }, { "id": "metadata/binary/layout/overlay::overlay-over-30pct", "conf": 0.9, "crit": 3, "desc": "PE overlay exceeds thirty percent" }, { "id": "metadata/binary/layout/size::small-pe", "conf": 0.6, "crit": 3, "desc": "Small PE binary (\u003c100KB)" }, { "id": "metadata/binary/resource/identity::pe-description-equals-product-name", "conf": 0.9, "crit": 3, "desc": "PE description duplicates ProductName" }, { "id": "metadata/binary/resource/identity::pe-resource-version-first", "conf": 1.0, "crit": 2, "desc": "PE first resource is RT_VERSION" }, { "id": "metadata/binary/resource/identity::resources-dll-extension", "conf": 0.9, "crit": 3, "desc": ".resources.dll satellite assembly" }, { "id": "metadata/binary/symbols/imports::single-import-raw", "conf": 0.7, "crit": 2, "desc": "PE import table has exactly one entry" }, { "id": "metadata/binary/vendor::is-microsoft-named", "conf": 0.8, "crit": 3, "desc": "File name contains Microsoft" }, { "id": "metadata/binary/vendor::microsoft-corp-marker-cert", "conf": 0.9, "crit": 3, "desc": "Microsoft certificate-chain identity marker" }, { "id": "metadata/binary/vendor::microsoft-corp-marker-rsrc", "conf": 0.9, "crit": 3, "desc": "Microsoft vendor marker in resource section", "spans": [ [ 5460, 21 ] ] }, { "id": "metadata/binary/vendor::microsoft-prefixed-company", "conf": 0.9, "crit": 3, "desc": "PE company name identifies Microsoft", "spans": [ [ 5460, 21 ] ] }, { "id": "metadata/build/reproducible::pe-reproducible-build", "conf": 1.0, "crit": 2, "desc": "Built with /Brepro (deterministic)" }, { "id": "metadata/file/magic/identity::pe-dos-stub", "conf": 1.0, "crit": 2, "desc": "PE/DOS MZ header at file start", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/lang/compiler/managed::mscorlib", "conf": 0.9, "crit": 3, "desc": "mscorlib reference", "spans": [ [ 2208, 128 ] ] }, { "id": "metadata/lang/compiler/managed::reflection-namespace", "conf": 0.7, "crit": 2, "desc": ".NET System.Reflection namespace reference", "spans": [ [ 1357, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 78, 0 ] ] }, { "id": "metadata/package/versioning/scheme::pe-companyname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes CompanyName", "spans": [ [ 5434, 11 ] ] }, { "id": "metadata/package/versioning/scheme::pe-filedescription-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes FileDescription", "spans": [ [ 5510, 15 ] ] }, { "id": "metadata/package/versioning/scheme::pe-fileversion-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes FileVersion", "spans": [ [ 5634, 11 ] ] }, { "id": "metadata/package/versioning/scheme::pe-internalname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes InternalName", "spans": [ [ 5694, 12 ] ] }, { "id": "metadata/package/versioning/scheme::pe-productversion-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes ProductVersion", "spans": [ [ 6234, 14 ] ] }, { "id": "metadata/package/versioning/scheme::pe-version-file-version-value", "conf": 0.9, "crit": 3, "desc": "PE version resource carries a file version", "spans": [ [ 5660, 13 ] ] }, { "id": "metadata/package/versioning/scheme::pe-version-product-name-value", "conf": 0.9, "crit": 3, "desc": "PE version resource names a product", "spans": [ [ 6144, 40 ] ] }, { "id": "metadata/package/versioning/scheme::pe-version-resource", "conf": 0.8, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 5214, 0 ] ] }, { "id": "metadata/package/versioning/scheme::version-info-file-version-present", "conf": 0.95, "crit": 3, "desc": "PE FileVersion value is present", "spans": [ [ 5660, 13 ] ] }, { "id": "metadata/signed/certificate/identity::pe-cert-shallow-chain", "conf": 1.0, "crit": 3, "desc": "Cert chain has only 2 entries" }, { "id": "metadata/signed/certificate/identity::pe-signature-verified", "conf": 1.0, "crit": 2, "desc": "PE Authenticode integrity check reports intact" }, { "id": "metadata/signed/certificate/identity::pe-signature-verified-kv", "conf": 1.0, "crit": 2, "desc": "PE Authenticode signer cryptography verifies" }, { "id": "metadata/signed/trust-level::dotnet-strong-name-signed", "conf": 0.95, "crit": 3, "desc": "Managed assembly is strong-name signed" }, { "id": "micro-behaviors/data/embedded/certificate::microsoft-code-signing-pca", "conf": 0.95, "crit": 2, "desc": "Microsoft code-signing certificate chain", "spans": [ [ 7463, 0 ] ] }, { "id": "micro-behaviors/data/embedded/certificate::microsoft-timestamp-chain", "conf": 0.95, "crit": 2, "desc": "Microsoft timestamp certificate chain", "spans": [ [ 12036, 0 ] ] }, { "id": "micro-behaviors/data/embedded/payload/resource::dotnet-resource-reader", "atk": "T1027.009", "conf": 0.86, "crit": 3, "desc": "References the .NET ResourceReader type", "spans": [ [ 2208, 128 ] ] }, { "id": "objectives/evasion/masquerade/binary::overlay-pkcs7-signeddata-oid", "atk": "T1036.001", "conf": 0.9, "crit": 3, "desc": "PKCS7 SignedData OID in overlay", "spans": [ [ 7180, 32 ] ] }, { "id": "objectives/evasion/masquerade/version-resource/contradiction::microsoft-company-versioninfo-kv", "atk": "T1036.005", "conf": 0.95, "crit": 3, "desc": "Microsoft company version identity", "spans": [ [ 5460, 21 ] ] }, { "id": "well-known/tool/development/toolchain/roslyn::roslyn-runtime-assembly", "conf": 0.96, "crit": 3, "desc": "Roslyn CodeAnalysis runtime assembly" }, { "id": "metadata/binary/layout/overlay::overlay-at-least-half", "conf": 0.9, "crit": 3, "desc": "Binary overlay is at least 50 percent" }, { "id": "metadata/binary/provenance/build::pe-far-future-timestamp", "conf": 0.95, "crit": 3, "desc": "PE COFF timestamp encodes a future date" }, { "id": "metadata/binary/symbols/imports::single-import-count", "conf": 0.7, "crit": 3, "desc": "PE with single import" }, { "id": "metadata/binary/vendor::microsoft-corp-versioninfo", "conf": 0.9, "crit": 2, "desc": "Claims Microsoft in version resource", "spans": [ [ 5460, 0 ] ] }, { "id": "metadata/package/versioning/scheme::pe-productname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes ProductName", "spans": [ [ 6118, 11 ] ] }, { "id": "micro-behaviors/crypto/certificate/usage::certificate-ref", "conf": 0.5, "crit": 2, "desc": "References certificate terminology", "spans": [ [ 9124, 0 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET managed assembly", "uses": [ 3, 4 ], "spans": [ [ 592, 0 ] ] }, { "id": "metadata/binary/vendor::microsoft-corp-marker", "conf": 0.9, "crit": 3, "desc": "Parsed Microsoft vendor claim", "uses": [ 13, 15 ], "spans": [ [ 5460, 21 ] ] }, { "id": "metadata/package/versioning/scheme::version-resource-metadata", "conf": 0.9, "crit": 2, "desc": "PE version resource metadata", "uses": [ 23, 25, 28 ], "spans": [ [ 6234, 0 ] ] }, { "id": "metadata/signed/platform::microsoft-signature-verified", "conf": 1.0, "crit": 2, "desc": "Microsoft certificate chain has verified Authenticode signature", "uses": [ 13, 32, 34, 35 ], "spans": [ [ 12036, 0 ] ] }, { "id": "metadata/signed/trust-level::signer-evidence-present", "conf": 1.0, "crit": 3, "desc": "Platform or developer signing evidence", "uses": [ 31, 32 ] }, { "id": "micro-behaviors/data/embedded/payload/resource::dotnet-embedded-resource-read-any", "atk": "T1027.009", "conf": 0.86, "crit": 3, "desc": ".NET resource-reading API references", "uses": [ 36 ], "spans": [ [ 2208, 128 ] ] }, { "id": "metadata/binary/symbols/imports::managed-resource-bootstrap-import", "conf": 0.95, "crit": 1, "desc": ".resources.dll with CLR bootstrap-only import", "uses": [ 10, 11, 46 ], "spans": [ [ 592, 0 ] ] }, { "id": "metadata/signed/platform::microsoft", "conf": 0.98, "crit": 2, "desc": "Microsoft-signed Windows binary", "uses": [ 1, 49 ], "spans": [ [ 12036, 0 ] ] }, { "id": "metadata/binary/resource/identity::managed-resource-stub", "conf": 0.95, "crit": 1, "desc": ".NET .resources.dll bootstrap stub", "uses": [ 10, 46, 52 ], "spans": [ [ 592, 0 ] ] }, { "id": "metadata/binary/vendor::common-fp-context", "conf": 0.9, "crit": 2, "desc": "Common Windows binary compatibility context", "uses": [ 53 ], "spans": [ [ 12036, 0 ] ] }, { "id": "metadata/binary/vendor::benign-token-privilege-context", "conf": 0.95, "crit": 2, "desc": "Benign token privilege adjustment context", "uses": [ 55 ], "spans": [ [ 12036, 0 ] ] }, { "id": "objectives/privilege-escalation/token-manipulation::dynamic-token-privilege-recognized-marker", "conf": 0.8, "crit": 3, "desc": "Recognized token privilege marker", "uses": [ 56 ], "spans": [ [ 7463, 31 ], [ 12036, 28 ], [ 12214, 29 ] ] }, { "id": "micro-behaviors/data/embedded/payload/resource::dotnet-managed-resource-access", "atk": "T1027.009", "conf": 0.9, "crit": 3, "desc": ".NET embedded-resource API references", "uses": [ 36 ], "spans": [ [ 2208, 128 ] ] } ], "type": "pe" }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47aAzQxazCZol@c-7zeS@@e!5l%bME/A00000p^\u003eu:oAtj}SuAH$0000000000?#B@z3JR{Y0gTk[00\u0026M800000f1Ik!03zmw0kF", "ln": 0 }, { "b": "3\u0026*nc0n[4Y00ic20hG/0000000000000000kMy^J000000000000000000005v@5C00000nb@R\u00260SSx7p-]-ru\u003ccJg2(\u003c@900000UQ6nHKDP\u003eGk!d70Fb/MH0000000000000000000000000000000000000000lq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCnfAzdNbyPQ)Ob\u0026P\u0026}#D=$bu5Y8x(mN800000M\u0026^r*1onA4bumUxOc5-\u003e5c8Xgbs+:9l\u0026Wh!ToeC5V\u0026Hdbbsli+vGlxd000000SSi32nvdr2($2a0qVZL02tLm0rr913ig5a0rr912(\u003c@92(\u003c@90rr910rr910rr91000Sj0rr91000i6Hx82?1{1n}x-Ozr830Xr4/\u003e}%000i6*w\u003czr1]#Bsj]\u003e\u0026/l\u0026YyK1]@6ij]\u003e\u0026/RVn)Y1]{jPj]\u003eS-00031000000rrc22()^50rrYipYQ+2830Fl3ihHPpYRacf-U2J5caY\u003cpYRack(:ZZ5cbo4pYRacq2\u003cz[5car.3JN%xe=VK+:P9{[8VY74e=W9@[C\u003efwd/Y$Ue=WWckMJFqi@\u0026gWe=XlsKPv6mo8$7P1B{EL1POS8000000rr919SR2$w=Sks0000000000000-l3ig5a0000000031006n80000006A$]wozZ1j]!JbB97#ge(D?fBzkP607pycB.tt}vR/QwBAzLqvS=^706$WEwO\u003e))C#OH1y?k[OBAh88B-.f{l349UzdmsbmRMWIr+lq)x(v(PBAzLqvS=^706$WEwO\u003e))C$z)=z/PY6BzkVh", "ln": 464 }, { "b": "BAzLqvS=^708mfqA=l2qw]]T)z!9ABzEEvbB7]XFlSmVbA=rTKwPI^jA:@W4e[w^m08[e:By/qwqE%DRwN/*@z/bLcv@#Tf08[e:By/qwl${7xzF%Prx\u003e8h:q*ACawO\u003c4$B-8qnzdLs!z/6Dcy?mS=wPz%dv}xYYo\u003e!9Tz/Y\u0026eBs]}0wmX5AvqHjgx(+)]q!PPWA4VfxB8Mhwv}xYYo\u003e!9Tz/Y\u0026eBs]}0wmX5AvqHjgx(+)", "ln": 1269 }, { "b": "n3fWuea{^=1ZO8k0rrx9000009SVlw08%1ns8}.*ph+2sCW\u003er7BzkVhra{q\u003cCxi=\u003c0rrf3000008ux*Mo\u003e!9Tz/Y\u0026eBrA}?A=t@qvruj4zu6U)0rs:?Sus]Hv@=Hez!s8llVm0:z/Podx(v(wavf*WaAzgexMOqrA+fr6A=#28e=U\u003e:0rrM^e\u0026bgne\u00262sqh-JGG002d.05#?*gCgvkga\u003esufGg%zh7Hytw\u0026Tshgb}a2whDq8fF)iFi5iGOiauGhh-AZ8iaVLNhE[T2g=Cyma]}V:o\u003e!9Tz/Y\u0026eBs]}0wmX5AvqHjgx(+)]q!PPWz#Y(}LlI3j+j04B0001Y0001nq*ACawO\u003c4$wPI^jA:@W4e(Dn4z/{8gwM08FwmY^jaz(gfz/PVdvK@T5wPz\u003caz/dY{e?![ie?!?0lV)i!B-I4RzE)%jA:-=naw^h\u0026y?WxLwQdl[yH}xDvMckOhdFH4f/.3DwIu87bu5(eBy/qwqE%]/B-H#6B1QvkzGGPfwM08Xz/{8gwM9eZ0SSi2lKA![00000p^EGCk$1MGR2#noOhbQPVoiVsX\u003edB-6MX^RTAo0CI[\u003c\u003c(B)TYiHWP+.STjm24IBtv0A\u003e0gkaEgf[s$K/f\u003e(j=Qkatw.iPV:\u003e^b(0pYVh#DQipT\u003e0:][^s3TM3Xi\u003e9W!bhzLlMYO{7SgyN)8J7+XhW\u003eLwC{E3VgNo2=iiVcaOWV-mfDh[ze=@\u003c[BC$nbE%2wcEV[.8E83+%c]OnjOv+)PClv{\u003ejusJFJn*=.ubqIq%rwkM3iR0@)#K\u0026$^yeGD2UK+qUf@!M)]pYKV:4+6eQ8SIb4)6S3K:r}Riui%psmPAZhvUSvLM?c(7{\u0026bTPR?)n8Hhtq(?5GlF%k{g#=bR$lRv)C\u0026Yk46isEQXb(\u003czG^fMZSZL9KpHcXy3aV2jEvm)db%7.u2H-L]$]ycQrIGcQrIHcQrIIcQrIMcQrJZK\u003c5U3M?lbTsn4G=-qblTD(!e230-wo}^+Nep?\u003e(JFOH6Xy\u0026kbyEu6iB2-%}+vdGiCKW1^3lpD!W21TUnQF3Ih:6sJ@A+HvrXP%8^0f\u0026zfH]VC-zO7/Gf6n5]a[QY^0q?XTwD!4\u0026Tu..xI+YjR:/{-qJ(^laRpgwjpXG-etl*eFfd-9Y:UO}K?/K\u003eC@h2w/3Bt.yznRtG[Z\u0026+HT\u003eX]}bRa[\u003eA4NaEkq[J", "ln": 1713 }, { "b": "0a=dK08rJj0cwib0bITK0b?\u003cY0a=dv0c]*\u00260aXH#qufO{uJrv(Bo3y.ASx!NvGpJJBo2\u003eLA@Y8rwDlYIBPuaQASxUJpYK]7ASxUJzua+UxAhPzA@Y[ODh}HRwb]p6ve$cAvGo{sve@Z@CMqW.ASxUJA@ZmYx-J5KzucET002LU08-!{0abZ(0cFo-0b?\u003cl0ce6T0b}{H0ce6Y0c[Mi0at\u003eB0b.^P0cwic0a=dd0a=dx08-/d0cwi-0ce6S0bhBJ0a#r1", "ln": 29300 }, { "b": "zua+UM})XZ9Z{6b08-/7073V]0aV730b.^E0a=dP089w-08\u0026)ApxgwCmf3i=qug57li7A]wb]g3zuahEwDl@PwDl-Jp5[Y5z2!bEk(=0bBo3sYbtXvui7i*B08-/7073V]0aV730b.^I0a=dJ0bhBP0at\u003eB0aM1u07D%e0b?\u003cO08-/d0aM1E0ce6I0e%.O047bmqufO{uJry)ve%*rnDrSdx-JkPk(+x{v/Q6uA@ZmYzVB!TXLJnaejxLp08-/7073V]00", "ln": 35864 }, { "b": "B98ChyJKEiTU6StDOx\u003c\u003cygOI@vSMTivqx$5.(UEjvqGG$ygOJavSL$%Zgzi1P=!I3zE)l=B98ChyJKEiT./h5D2N)GDOG}30w)8KB98ChyJKEiTSR%AEir\u003e\u003eEirz", "ln": 196394 }, { "b": "zddg%TSRXbwOMb2Y=.ojwn(m7aA!(HD2N)GDOQ12aAR4c-Lb[aygOJ9wOL:!aAkq/wPhZ0Bs)Pfrc-B9AbPo7.(W*{N@lcyxM22p.[y80DuyuFwOL:!aA..yJCiF", "ln": 198571 }, { "b": "x\u003c\u003e*(DC=B#z/P$yz^)D)yJKXIaAhmoz!3X!azU/hT\u0026ciqCeHp)zY\u003caqz*2LiBzbxfaz$+1zY\u0026H$B7DFqazU[kB98CByJKGnBS+yoB97\u0026dv}u^2wNYN2yANPnNzVdFBAILvCeHp@BS+QiygRg5BS+yox(\u003e%dj9@VfiV{.exlw65zGE1fBAh88B-.:G", "ln": 203579 }, { "b": "P(+i[-JHymd\u003cemyeIe8ZB-UE5aA7!fz*642wmoN5wmow[SCM=2BA}?FaAg+fvqPN$A=\u0026HxwNYN2DlvazN}MZ.zfo{qTSR8\u003cY(UxnwoI)qwP2A0e=!jpD2K)Bvrb=", "ln": 215410 }, { "b": "A:ZN3P-EJ0B.\u003eOhzF%Rtw[=c[ayPdgvpJ!UB8#58y?j.pDOx\u003c}az\u003eXixM4A7CwhejaARpdaz2!pwN/*[wft@cxkRd1B-I4OayMylByxo9v\u003c2S1BzbP6aA}KwxDQ.aB7]J8y?j-dvrb^[wPRH7aA7\u003cmBA}?pasy5#vpSeKy\u003cw@#vqXhOf)#kkayPd#aAz4nB-IvxBA}?paszH\u003eEj3SFj9@Vfaz]2\u0026avy6-y?m9#x(v(QB.LV5wPy7UBAh88B-.gCayP7$aJq7jP\u003e55UY=.AxA3fauC58jM0C\u003e/OY(ELcazU[iwOU^!", "ln": 230395 }, { "b": "z/Z2maAhvtaAkq/x(!xsAck{kTZ/nJaA7.7wOVykazLt2aA?NfB98qrB98aEaAR4cazz%jzE^s6wPw]ufNULOMh%*5zY\u003c2rNzVdFBAILvCeHp4z^)D)yJK?AC5gN", "ln": 240666 }, { "b": "z/)guwOMzaTZ+]+B8UY2x\u003ez6?yS0b70Ar8xAk!l.T.Ru\u003eBS+jayIWB1vpJ\u003c\u003ew]zYvaA.:tzF7Hyw[=H3wft=3vS9xcAV/mhygH(#AbP)rZqE6{aA\u003eV8v}u^2wYqwaygQ{!zxK4DA4Re[r+iy{By/i8.(mF}vpTy\u0026BhKY\u003cNq0^YwO]z\u0026-Lb[av-b\u003e", "ln": 282478 }, { "b": "xNa78TSRK)yHIKmaz$QgAbS.fvpTq1vq-#RaAIanByxu7zO@O0zE)o}ay]hbwOVy4C3#IoB7]J8aAhvtax9MbBy/qwoLFx:kljIQA=k*kN@iaZBS+ZyDuiIdBS=2+EirAsygH(#Ak!kRwmoN5ygg)@aA?UvN}/{o.(U50wNYN2z!9S(Dt^$nzO%dgAa9=}zdN*fe=*\u003ehpq-=KwP/hyfNU6YwP2z/aA!(CvScpfaz+Rj.(j=1BAg/cC{43AwPCV", "ln": 306045 }, { "b": "ygRg5aAR)FBS+\u003cCx\u003eeuj.(W#}.\u003ezf-aAhmoz!3X!aAI*CByxA9aAR)FwP8feC5I89dj$TBp\u0026ZF@z]GC4aBt!\u003cazLEgvrlZiv}Y[3zF)v]az\u003eXiz!9ocazV7gA(jN[C5?23.(U5df)$O}zE))a.V", "ln": 323314 }, { "b": "x\u003eRBdzH0\u0026z3n3dlB97@ex\u003c$o%D[wRDarR^HarR^HarR^HarR!4wP89{vs06hwGU(0aAITkzE^f@wnYq!azU\u003eexM56iBS-8HB7ocey?WuhwnD6h4gjXdBZ/AqB97#gC4CYnx(v(IjACQ+x(mMEarR^HarR!bA(r@WygOJhwPA9haAIWmB9R?G.(mG}aARKnz//[uB7GAmvrMj1.(TvPeO]cgiY}1*y?j-9x(!wWarR^HarR^HarR^HarT\u0026@wmYH$wGUI(y@J9=TSR3", "ln": 347537 }, { "b": "nKrB!CeI1lvr%5jvqPE:vf4xBz!9*9A=lbfzO@B@yghBlyJ1ylSuuv}A^zpT0s:xfEirYAA^zptDOG{HksovdD2^RixMLvBlN:cLx\u003e8g4B8LVjavy6/AbP=9BzkVhe*ailP\u003ed.EzEBVbA(jO]vix-sxMvKcwO${e0s:9=B-q5jvixz#Bz\u003eW\u003c2%r6sB8#5kxfDt2jz]pTy^4\u003efjA1XEAV/nqP)y[3Urz$rpJf(=vpJ\u003c\u003eDt{\u003cbB8LJ4y*!D9-HgpVwYfNtzO@O0DC=B$z^)R4T.S5i0yQ\u003cywQm[", "ln": 354068 }, { "b": "B7GAmvrMj1.(WAZe*9+$wnU/#Dlv6y-LckdB9bs4efFXoyANXfaARJAzn\u0026Y$ZgwBdBI\u003c!]efFXsefI{CwGU]4yHIKiygRG#az$Qgzf6i9A+]D0az$+1zY?#7B97#ge(D?fBzkP6e[w^mefGmIay]UlBS+.zUx\u003e97Y\u003c\u003eZ#znSF%BsXLLvq%hN.(WY\u003cvpQH1-HgA.AbPJmB9eQDAclkzx(\u003eFdCeP\u003c)C4CYuwGSQ2mn$y0A:-/@Cw?IqaA?sby?j-gwNYj60z=LhNpP]twObT]z*2Mb.[vgmD2K)vwGUI{w[=d3C42paY=.GfaA\u003eT", "ln": 393066 }, { "b": "000000000000000000000000000000000000000000000000000000000000000000000000000000315c8Xg7YTL^000000000000000000310rr91fAq960000000000000000003100000nb@R\u0026sILavyY\u003c.r0000000000yY(M{00341qVHe8rSCL*qufR}nDqJ^p5[S3nDqG=mGui:00000Y-^*600031ecb[OEi6pb0000000000kl7V-000001onA40SSi2000000000000000l\u0026Wh!0rud2ve$rFmGvc5yYF2DnDrSdw=", "ln": 433616 }, { "b": "00031qVH[tASx!NzuaqHmGvc5yYF2DnDrSdw=M-H005@100031fAr^bfAr^bfAr{fvGn7Z002W)761vnlJz38z2!IPve$fBC(QOtve$cAwDhYg002Z[x-ISyASy1TA@ZaUw=M]Maoj+ezVB!Tz#:!RASxIFBo31PzVBUP003Kf9SMivmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002Z[x-ISyASy1TA@ZaUw=M]Me=XlszVBqFwDk0@zua8ByYF.XA@Y[OA@W/)lJy3+xAhDvASy4U002aY4GDIfmGvc5yYF2DrSDXhASydXx-J5Kzu6Up001\u003eRe=WWcfAr^be=WTbhukufhVL/qfAr%g004lzec2XJnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002Z[x-ISyASy1TA@ZaUw=M]Me=XlszVBqFwDk0@zua8ByYF.XA@Y[OA@W/)lJy3+xAhDvASy4Ue=Y[(wDl=KzVB[WASxOHwDl=Ke=YzZyYFnK004JHe=U[LoAnS7x8(uuyYD*5zVB.RC(R\u003c+x-I=CxAibO005$#aokaox-ISyASy1TA@ZaUw=M]Maoj+ezVB!Tz#:!RASxIFBo31PzVBUPe=W0]k(+Z3yYCNTASx!Nx8(PBBo3vZaolAZwDl=KwDl-JB]V7Nwb[jZ004JHec2XJpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002Z[x-ISyASy1TA@ZaUw=M]Me=XlszVBqFwDk0@zua8ByYF.XA@Y[OA@W/)lJy3+xAhDvASy4Ue=Y[(wDl=KzVB[WASxOHwDl=Ke=YzZyYFnK003m79SMivpYLIozVBqFBPt[KBo25ove$cAwDhYg002Z[x-ISyASy1TA@ZaUw=M]Me=XlszVBqFwDk0@zua8ByYF.XA@Y[OA@W/)lJy3+xAhDvASy4U005q+irf6WpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001\u003eRe=WWce=WN9eDvKae=WTbhukAhhVL/qe=W:ed/.p7hums?iriH*wb[v+h#\u003e=nv/Q3tgYPJohukAhgYQ}:v/OE*g5%rmirh2svGp0uwDjT?hVL/qve@m!wDlftf-T9iwb[B^gxolihVJ*T001$U2MK(9k(+%aA@Y+Kz2!2ByYF.XaokBxwDl-JA@Y[OzVBUP001\u003eRe=WWce=WN9e=WN9000000000000000000000000000000", "ln": 433914 }, { "b": "0000000000000000000000000000000000000000000000000000000000000i=Uc3\u0026*ncfGGgl00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", "ln": 435152 }, { "b": "000000000000000000000000000000000000000000000000000000000000000002Q]-N00ii4fOg.J1{(=lnqu\u003cF0s5X0F**1uF*/\u003c+0rB[=fBXi)v1}hMwDJ5p0r\u0026DStM$J=1{1\u0026cF\u0026r-i1FwHzoFvm!3m=qY1oB9k0S-/=2)ghdPAH$\u003cFb?nTfBXi)v1}hMwDJ5p0r\u0026Daayn.6jcF5D\u0026FR?LPg*I.Asg=K:!aknMpQ6vIjhFuK!vpn\u003cUhn\u003cv\u003e-Gqop#v*0rJrogxmyTTADn@", "ln": 435660 }, { "b": "ELzi:2)HGi1o]Ivrz$Q=fCaG\u003errJNv3rHUSxLzu%Bz(4K5hjN#162Ee69?ADwnMm5whbbV90MHB1pt!So\u003e!9Tz/Y\u0026eBrA}?A=t@qvruj4zzrK[ci:ML1oPqVo\u003e!9Tz/Y\u0026eBrA}?wmV(Zx\u003eIr$zF77*lQq?IfFLpo9V2nvh843Bi59uHi5JZ17y-bTfGgWzf/H%Hh91?]v\u003e!uB2)HGi1o]Ivrz$Q=fCaG\u003errJNv3rHUSxLzu%Bz(4K5hjN#162Ee69?ADwnMm5whbbV90MHB1pt!So\u003e!9Tz/Y\u0026eBrA}?A=t@qvruj4zzqOO3KcYk1oPque(1\u0026mfOft1fBXi)dUZGG{ydc70r\u0026D9F=Q]jfOfs.0!HD70k0{#f8l%?tPmv4JA).SRwStY}SQhr91BV\u003ea%dv!{Xf\u003cVD)ng[h%3uAlKmN=vs%cKQ{-b:Qn1AX-CPG)^TUA(-s!kwq1)ujS]EJ-Ip?", "ln": 435911 }, { "b": "H+Pn\u003e2)HGi1o]Ivrz$Q=fCaG\u003errJNv3rHUSxLzu%Bz(4K5hjN#162Ee69?ADwnMm5whbbV90MHB1pt!So\u003e!9Tz/Y\u0026eBrA}?A=t@qvruj4zzr[2fA}RV1oPq^o\u003e!9Tz/Y\u0026eBrBF1z/^9?wPz)bw[+:-By=NXB-.qnA+PSvatLS9f!:T+4kxN\u003eh.WiDfF$\u003cAiA^jdgbZ*BfGp*xfGy*Es$\u003eyW3OR\u003e\u003e162Ed69qfjf+VkM1{m\u003cd2ONLDvrl9@zFa6fzzqXR4H92n1p2OBqE]", "ln": 437542 }, { "b": "+p%wU2)HGi1o]Ivrz$Q=fCaG\u003errJNv3rHUSxLzu%Bz(4K5hjN#162Ee69?ADwnMm5whbbV90MHB1pt!So\u003e!9Tz/Y\u0026eBrA}?A=t@qvruj4zzrB\u003ebl!lI1pC\u003e.o\u003e!9Tz/Y\u0026eBrA\u003e^wPzG{viwu+wPzj3x(v)gf^!U31{m\u003cd3LKO0q!P(Ry?aU/q=s/cq+/wyfFCmlfF#oMeKRPQh.=Qjbl!lI1oPqSo\u003e!9Tz/Y\u0026eBrBK%zdLp$Byx39ax8\u0026(C4\u003eC$PN)^vfOfJLfOfDlPAtk@0S\u003c2\u003e00067jAUE(m2f4^009610Tgm!1{(=lnqu\u003cF0rAMi05e^P3OR\u003e\u003e162Ed69qfjf+VkM1{m\u003cd2ONLDvrl9@zFa6fzzqXR4H92n", "ln": 440381 }, { "b": "wnMm5whbbV90MHB1pt!So\u003e!9Tz/Y\u0026eBrA}?A=t@qvruj4zzrE(bNauJ1oPqTo\u003e!9Tz/Y\u0026eBrBK%zdLp$Byx39aw+A\u003eatLS9fFBK:4kG^{f/7Hriw-GFiA^jdgbZ*ygbpNAg+{)Fs$\u003eJJf:/Vw1{m\u003cd1}}5rq.X}t5E5tq1pbUFs7ce-x(mN9z/dovfB!o?rrJKu2u2bzzeTr5f=\u00261*1{m\u003cd3i", "ln": 440687 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 433152, 5.31, "r-x" ], [ ".rsrc", 433664, 1536, 2.85, "r--" ], [ ".reloc", 435200, 512, 0.1, "r--" ] ], "metrics": { "pe": { "checksum": 476795, "timestamp": 3122864553, "image_size": 458752, "headers_size": 512, "checksum_valid": 1, "clr.is_il_only": 1, "file_alignment": 512, "resource_count": 1, "cert_table_size": 10504, "has_version_info": 1, "computed_checksum": 476795, "headers_size_ratio": 0, "prose_section_count": 0, "reloc_overhang_bytes": 500, "reloc_overhang_ratio": 0.98, "clr.is_32bit_required": 0, "bss_like_section_count": 0, "clr.is_32bit_preferred": 0, "clr.strong_name_signed": 1, "section_overflow_count": 0, "signature_expired_days": 80.61, "clr.is_native_entrypoint": 0, "clr.strong_name_sig_size": 128, "misaligned_section_count": 0, "version.identity_entropy": 4.15, "clr.managed_resource_count": 1, "base_relocation_block_count": 1, "base_relocation_entry_count": 1, "clr.managed_resource_max_size": 430986, "declared_data_directory_count": 7, "version.identity_symbol_ratio": 0.05, "executable_prose_section_count": 0, "clr.managed_resource_max_entropy": 5.31, "directory_section_mismatch_count": 0 }, "file": { "size": 446216, "entropy": 5.4 }, "binary": { "is_pie": 1, "has_overlay": 1, "code_entropy": 5.31, "overlay_size": 10504, "string_count": 8469, "overlay_ratio": 0.02, "overlay_entropy": 7.51, "entropy_variance": 4.53, "avg_string_length": 18.63, "max_string_length": 161, "peak_region_bytes": 18184, "code_to_data_ratio": 1, "peak_region_entropy": 7.63, "string_length_stddev": 12.23, "largest_section_ratio": 0.97, "sentence_string_count": 3268, "sentence_string_ratio": 0.39, "high_entropy_string_count": 0 }, "imports": { "count": 1 }, "strings": { "truncated": 0, "retained_count": 8469, "extracted_count": 8469 }, "sections": { "count": 3, "code_size": 433152, "entropy_max": 5.31, "entropy_mean": 2.75, "name_entropy": 3.03, "writable_count": 0, "executable_count": 1, "nonstandard_count": 0, "executable_writable_count": 0 }, "consistency": { "internal_name_original_filename_mismatch": 0 }, "dependencies": { "count": 1 } } }, "id": 55, "ident": { "name": { "value": "Microsoft.CodeAnalysis.CSharp.resources.dll", "source": "pe.version.original_filename", "verified": false }, "title": { "value": "Microsoft.CodeAnalysis.CSharp", "source": "pe.version.description", "verified": false }, "trust": "platform", "signer": { "issuer": "CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US", "source": "pe.signatures[0]", "subject": "CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US", "signed_at": "2026-01-28 18:59:12 UTC", "common_name": ".NET", "organization": "Microsoft Corporation" }, "project": { "value": "Microsoft.CodeAnalysis.CSharp", "source": "pe.version.product_name", "verified": false }, "version": { "value": "5.300.26.7805", "source": "pe.version.file_version", "verified": false }, "unique_ids": { "authenticode_thumbprint_sha256": "51282e7ce7c8cd8d908b1c2e1a7b54f7ced3e54c4c1b3d6d3747181a322051d3" }, "organization": { "value": "Microsoft Corporation", "source": "pe.signatures[0]", "verified": true } }, "mol": "K(Te)O₂(Er₂Pr)H₂(Db₂F)Md₄(Bi₅PaPtSi₄)", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/cs/Microsoft.CodeAnalysis.CSharp.resources.dll", "pid": 0, "risk": 17, "sha": "96841406a8fffdc7e4f82048939eb5193d0e53454119368a4e8266bdddfedea3", "size": 446216, "traits": [ { "id": "metadata/signed/unknown::.net", "conf": 1.0, "crit": 3, "desc": "Authenticode chain CN: .NET" }, { "id": "metadata/signed/leaf::microsoft-corporation", "conf": 1.0, "crit": 3, "desc": "Signed by Microsoft Corporation" }, { "id": "metadata/binary/code/entropy::code-entropy-at-most-7-5", "conf": 0.7, "crit": 2, "desc": "Code entropy is 7.5 or lower", "spans": [ [ 512, 433152 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR header (COM descriptor)" }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET metadata root signature (BSJB)", "spans": [ [ 592, 0 ] ] }, { "id": "metadata/binary/layout/overlay::image-under-768kb", "conf": 0.9, "crit": 3, "desc": "PE mapped image under 768 KiB" }, { "id": "metadata/binary/resource/identity::clr-resource-large", "conf": 0.6, "crit": 3, "desc": "Large CLR managed resource present", "spans": [ [ 1972, 430986 ] ] }, { "id": "metadata/binary/resource/identity::pe-description-equals-product-name", "conf": 0.9, "crit": 3, "desc": "PE description duplicates ProductName" }, { "id": "metadata/binary/resource/identity::resources-dll-extension", "conf": 0.9, "crit": 3, "desc": ".resources.dll satellite assembly" }, { "id": "metadata/binary/symbols/imports::single-import-raw", "conf": 0.7, "crit": 2, "desc": "PE import table has exactly one entry" }, { "id": "metadata/binary/vendor::is-microsoft-named", "conf": 0.8, "crit": 3, "desc": "File name contains Microsoft" }, { "id": "metadata/binary/vendor::microsoft-corp-marker-cert", "conf": 0.9, "crit": 3, "desc": "Microsoft certificate-chain identity marker" }, { "id": "metadata/binary/vendor::microsoft-corp-marker-rsrc", "conf": 0.9, "crit": 3, "desc": "Microsoft vendor marker in resource section", "spans": [ [ 434004, 21 ] ] }, { "id": "metadata/binary/vendor::microsoft-prefixed-company", "conf": 0.9, "crit": 3, "desc": "PE company name identifies Microsoft", "spans": [ [ 434004, 21 ] ] }, { "id": "metadata/build/reproducible::pe-reproducible-build", "conf": 1.0, "crit": 2, "desc": "Built with /Brepro (deterministic)" }, { "id": "metadata/file/magic/identity::pe-dos-stub", "conf": 1.0, "crit": 2, "desc": "PE/DOS MZ header at file start", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/lang/compiler/managed::mscorlib", "conf": 0.9, "crit": 3, "desc": "mscorlib reference", "spans": [ [ 1984, 128 ], [ 347601, 23 ], [ 393130, 59 ] ] }, { "id": "metadata/lang/compiler/managed::reflection-namespace", "conf": 0.7, "crit": 2, "desc": ".NET System.Reflection namespace reference", "spans": [ [ 1322, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 230448, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 230540, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 282526, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 230443, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 78, 0 ] ] }, { "id": "metadata/lang/natural::polish-common-word-ale", "conf": 1.0, "crit": 1, "desc": "Polish common word ale", "spans": [ [ 196426, 0 ] ] }, { "id": "metadata/lang/natural::polish-common-word-jak", "conf": 1.0, "crit": 1, "desc": "Polish common word jak", "spans": [ [ 240698, 0 ] ] }, { "id": "metadata/lang/natural::polish-common-word-tak", "conf": 1.0, "crit": 1, "desc": "Polish common word tak", "spans": [ [ 198603, 0 ] ] }, { "id": "metadata/package/versioning/scheme::pe-companyname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes CompanyName", "spans": [ [ 433978, 11 ] ] }, { "id": "metadata/package/versioning/scheme::pe-filedescription-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes FileDescription", "spans": [ [ 434054, 15 ] ] }, { "id": "metadata/package/versioning/scheme::pe-fileversion-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes FileVersion", "spans": [ [ 434154, 11 ] ] }, { "id": "metadata/package/versioning/scheme::pe-internalname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes InternalName", "spans": [ [ 434214, 12 ] ] }, { "id": "metadata/package/versioning/scheme::pe-productversion-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes ProductVersion", "spans": [ [ 434682, 14 ] ] }, { "id": "metadata/package/versioning/scheme::pe-version-file-version-value", "conf": 0.9, "crit": 3, "desc": "PE version resource carries a file version", "spans": [ [ 434180, 13 ] ] }, { "id": "metadata/package/versioning/scheme::pe-version-product-name-value", "conf": 0.9, "crit": 3, "desc": "PE version resource names a product", "spans": [ [ 434616, 29 ] ] }, { "id": "metadata/package/versioning/scheme::pe-version-resource", "conf": 0.8, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 433758, 0 ] ] }, { "id": "metadata/package/versioning/scheme::version-info-file-version-present", "conf": 0.95, "crit": 3, "desc": "PE FileVersion value is present", "spans": [ [ 434180, 13 ] ] }, { "id": "metadata/signed/certificate/identity::pe-cert-shallow-chain", "conf": 1.0, "crit": 3, "desc": "Cert chain has only 2 entries" }, { "id": "metadata/signed/certificate/identity::pe-signature-verified", "conf": 1.0, "crit": 2, "desc": "PE Authenticode integrity check reports intact" }, { "id": "metadata/signed/certificate/identity::pe-signature-verified-kv", "conf": 1.0, "crit": 2, "desc": "PE Authenticode signer cryptography verifies" }, { "id": "metadata/signed/trust-level::dotnet-strong-name-signed", "conf": 0.95, "crit": 3, "desc": "Managed assembly is strong-name signed" }, { "id": "micro-behaviors/data/db/linq::lambda-expression", "conf": 0.6, "crit": 3, "desc": "LambdaExpression class", "spans": [ [ 29364, 16 ] ] }, { "id": "micro-behaviors/data/embedded/certificate::microsoft-code-signing-pca", "conf": 0.95, "crit": 2, "desc": "Microsoft code-signing certificate chain", "spans": [ [ 436007, 0 ] ] }, { "id": "micro-behaviors/data/embedded/certificate::microsoft-timestamp-chain", "conf": 0.95, "crit": 2, "desc": "Microsoft timestamp certificate chain", "spans": [ [ 440557, 0 ] ] }, { "id": "micro-behaviors/data/embedded/payload/resource::dotnet-resource-reader", "atk": "T1027.009", "conf": 0.86, "crit": 3, "desc": "References the .NET ResourceReader type", "spans": [ [ 1984, 128 ] ] }, { "id": "micro-behaviors/fs/path/extension::utf16-exe-suffix-token", "conf": 0.84, "crit": 3, "desc": "UTF-16 exe filename suffix token", "spans": [ [ 35928, 17 ] ] }, { "id": "objectives/evasion/masquerade/binary::dense-microsoft-cert-text", "atk": "T1036", "mbc": "OB0006", "conf": 0.9, "crit": 3, "desc": "Dense Microsoft certificate text", "spans": [ [ 1777, 21 ], [ 1806, 43 ], [ 354132, 39 ], [ 434364, 46 ], [ 435975, 25 ], [ 436135, 22 ], [ 437606, 25 ], [ 440445, 25 ] ] }, { "id": "objectives/evasion/masquerade/binary::overlay-pkcs7-signeddata-oid", "atk": "T1036.001", "conf": 0.9, "crit": 3, "desc": "PKCS7 SignedData OID in overlay", "spans": [ [ 435724, 32 ] ] }, { "id": "objectives/evasion/masquerade/version-resource/contradiction::microsoft-company-versioninfo-kv", "atk": "T1036.005", "conf": 0.95, "crit": 3, "desc": "Microsoft company version identity", "spans": [ [ 434004, 21 ] ] }, { "id": "well-known/tool/development/toolchain/roslyn::roslyn-runtime-assembly", "conf": 0.96, "crit": 3, "desc": "Roslyn CodeAnalysis runtime assembly" }, { "id": "metadata/binary/provenance/build::pe-far-future-timestamp", "conf": 0.95, "crit": 3, "desc": "PE COFF timestamp encodes a future date" }, { "id": "metadata/binary/symbols/imports::single-import-count", "conf": 0.7, "crit": 3, "desc": "PE with single import" }, { "id": "metadata/binary/vendor::microsoft-corp-versioninfo", "conf": 0.9, "crit": 2, "desc": "Claims Microsoft in version resource", "spans": [ [ 434004, 0 ] ] }, { "id": "metadata/package/versioning/scheme::pe-productname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes ProductName", "spans": [ [ 434590, 11 ] ] }, { "id": "micro-behaviors/crypto/certificate/usage::certificate-ref", "conf": 0.5, "crit": 2, "desc": "References certificate terminology", "spans": [ [ 437653, 0 ] ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.7, "crit": 3, "desc": "References the .NET System.Linq namespace", "spans": [ [ 306109, 11 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET managed assembly", "uses": [ 3, 4 ], "spans": [ [ 592, 0 ] ] }, { "id": "metadata/binary/vendor::microsoft-corp-marker", "conf": 0.9, "crit": 3, "desc": "Parsed Microsoft vendor claim", "uses": [ 11, 13 ], "spans": [ [ 434004, 21 ] ] }, { "id": "metadata/signed/platform::microsoft-signature-verified", "conf": 1.0, "crit": 2, "desc": "Microsoft certificate chain has verified Authenticode signature", "uses": [ 11, 37, 40, 41 ], "spans": [ [ 440557, 0 ] ] }, { "id": "metadata/signed/trust-level::signer-evidence-present", "conf": 1.0, "crit": 3, "desc": "Platform or developer signing evidence", "uses": [ 36, 37 ] }, { "id": "metadata/binary/symbols/imports::managed-resource-bootstrap-import", "conf": 0.95, "crit": 1, "desc": ".resources.dll with CLR bootstrap-only import", "uses": [ 8, 9, 54 ], "spans": [ [ 592, 0 ] ] }, { "id": "metadata/signed/platform::microsoft", "conf": 0.98, "crit": 2, "desc": "Microsoft-signed Windows binary", "uses": [ 1, 56 ], "spans": [ [ 440557, 0 ] ] }, { "id": "metadata/binary/resource/identity::managed-resource-stub", "conf": 0.95, "crit": 1, "desc": ".NET .resources.dll bootstrap stub", "uses": [ 8, 54, 58 ], "spans": [ [ 592, 0 ] ] }, { "id": "metadata/binary/vendor::common-fp-context", "conf": 0.9, "crit": 2, "desc": "Common Windows binary compatibility context", "uses": [ 59 ], "spans": [ [ 440557, 0 ] ] }, { "id": "metadata/binary/vendor::benign-token-privilege-context", "conf": 0.95, "crit": 2, "desc": "Benign token privilege adjustment context", "uses": [ 61 ], "spans": [ [ 440557, 0 ] ] }, { "id": "objectives/privilege-escalation/token-manipulation::dynamic-token-privilege-recognized-marker", "conf": 0.8, "crit": 3, "desc": "Recognized token privilege marker", "uses": [ 62 ], "spans": [ [ 436007, 31 ], [ 440557, 28 ], [ 440735, 29 ] ] }, { "id": "micro-behaviors/data/embedded/payload/resource::dotnet-managed-resource-access", "atk": "T1027.009", "conf": 0.9, "crit": 3, "desc": ".NET embedded-resource API references", "uses": [ 42 ], "spans": [ [ 1984, 128 ] ] } ], "type": "pe" }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47aAzQxazCZol@c-7zeS@@e!5l%bME/A00000p^\u003eu:oAtj}VwLu?00000000", "ln": 0 }, { "b": "3\u0026*nc0dU4H00ic205%@U000000000000000kMy^J00000000000000000000(}EDW00000nb@R\u00260SSx7p-]-r90Mxy2(\u003c@900000y:GbZUQftI98czkFb/MH0000000000000000000000000000000000000000lq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCnnc5X\u003cbyPQ)V\u0026HdbKobyZbu5Y8x(mN800000l\u003c9F\u00261onA4bumUxncw[)5c8Xgbs+:9l\u0026Wh!soFQ7.#P\u0026rbsli+vGlxd000000SSi32nvdr2($2a0qVZL02tLm0rr913ig5a0rr912(\u003c@92(\u003c@90rr910rr910@@r3000Sj0rr91000i6Hx8P21{1n}C(X9H831mH4/?7X000i6*w\u003c$H1]#Bsp5$L0l\u0026Y%.1]@6ip5$L0RVoD)1]{jPp5$s{00031000000rrc22([ul0rrYiu\u0026ZDi8314B3ihHPu\u0026Z/sf-UOZ5caY\u003cu\u0026Z/sk(+o[5cbo4u\u0026Z/sq2\u003c#85car.3JN%xe=VK+:P9{[8VY74e=W9@[C\u003efwd/Y$Ue=WWckMJFqi@\u0026gWe=XlsKPv6mo8$7P1B{EL1POS8000000rr919SOXiB].{I0000000000000-l3ig5a0000000031005z/002ng00031000Vl008^u00031007\u003cR0000006A$]wozZ1j]!JbB97#ge(D?fBzkP607pycB.tt}vR/QwBAzLqvS=^706$WEwO\u003e))C#OH1y?k[OBAh88B-.f{l349UzdmsbmRMWIr+lq)x(v(PBAzLq", "ln": 464 }, { "b": "w]]T)z!9ABzEEvbB7]XFr+VR$vqFnsB7]bps8Sa{B8UL$wPGFAwPI^jA:@W4e[w^m08[e:By/qwqE%DRwN/*@z/bLcv@#Tf08[e:By/qwl${7xzF%Prx\u003e8h:q*ACawO\u003c4$B-8qnzdLs!z/6Dcy?mS=wPz%dv}xYYo\u003e!9Tz/Y\u0026eBs]}0wmX5AvqHjgx(+[cx(!A9y^IMKx\u003e5+@lrw8CyJBD6v}wLHB8Mhwv}xZlv@\u003cnywPI+", "ln": 1309 }, { "b": "eLP}?A=l2qw]]T)z!9ABzEEvbB7]XFr+VR$vqFnsB7]bps8Sa{B8UL$wPE?Ki3!L8=DtQ\u00260rr91KPkvYy/tR2By/qwqE%]/B-H#6B1Qv4B8Mhwv}wLHvpS}\u0026efF!Jv@Dy7x\u003c@Ror+lq)x(v(Lg+HEmfFk4gavyo/BAIRnj-j?NBAg/aefE=ivR/:*oj-xFz!\u0026{4jZ{uevkRKLhzEiFg?wv2iu}EFB97#ge(Dn4z/{8gwPGF4B-8qnzdMQRB8Mhwv}wOIBohBx05jDN0000008L%Hp^EGCD(w/hhsr!.8vGz{mmUaGC5Y*bmenBblR8r$@d]%csa-9f5ZPEEhXs=\u003e{t6JiUjd+cDS\u003e)NUd\u0026(IMPZ[}8\u003co)N:Xl^qfe#X\u0026A9f)v2mRsopgNPb\u0026Vrsx", "ln": 2108 }, { "b": "000000000000000000000000000000000000000000000000000000000000000000000000000000315c8Xg7YTL^000000000000000000310rr91fAq960000000000000000003100000nb@R\u0026syqae(\u0026Wp*0000000000(\u0026YcB00341qVHe8rSCL*qufR}nDqJ^p5[S3nDqG=mGui:00000Y-^*600031ecb[OEi6pb0000000000kl7V-000001onA40SSi2000000000000000l\u0026Wh!0rud2ve$rFmGvc5yYF2DnDrSdw=", "ln": 12752 }, { "b": "00031qVH[tASx!NzuaqHmGvc5yYF2DnDrSdw=M-H001zI00031fAr^bfAr^bfAr{fvGn7Z002W)761vnlJz38z2!IPve$fBC(QOtve$cAwDhYg002Z[x-ISyASy1TA@ZaUw=M]Maoj+ezVB!Tz#:!RASxIFBo31PzVBUP004VLe=U[LmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002Z[x-ISyASy1TA@ZaUw=M]Me=XlszVBqFwDk0@zua8ByYF.XA@Y[OA@W/)rSD?lA@Zs.ve$9zli7A]A@Y[Ov/OaYr@^dsASx\u003ePA@ZdVve%^qwDl=K002aY4GDIfmGvc5yYF2DrSDXhASydXx-J5Kzu6Up001\u003eRe=WWcfAr^be=WTbhukufhVL/qfAr%g005w^jobxZnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002Z[x-ISyASy1TA@ZaUw=M]Me=XlszVBqFwDk0@zua8ByYF.XA@Y[OA@W/)rSD?lA@Zs.ve$9zli7A]A@Y[Ov/OaYr@^dsASx\u003ePA@ZdVve%^qwDl=Ke=Y[(wDl=KzVB[WASxOHwDl=Ke=YzZ", "ln": 13050 }, { "b": "k(+Z3yYCNTASx!Nx8(PBBo3vZaolAZwDl=KwDl-JB]V7Nwb[jZ005U(jobxZpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002Z[x-ISyASy1TA@ZaUw=M]Me=XlszVBqFwDk0@zua8ByYF.XA@Y[OA@W/)rSD?lA@Zs.ve$9zli7A]A@Y[Ov/OaYr@^dsASx\u003ePA@ZdVve%^qwDl=Ke=Y[(wDl=KzVB[WASxOHwDl=Ke=YzZyYFnK004xDe=U[LpYLIozVBqFBPt[KBo25ove$cAwDhYg002Z[x-ISyASy1TA@ZaUw=M]Me=XlszVBqFwDk0@zua8ByYF.XA@Y[OA@W/)rSD?lA@Zs.ve$9zli7A]A@Y[Ov/OaYr@^dsASx\u003ePA@ZdVve%^qwDl=K005q+irf6WpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001\u003eRe=WWce=WN9eDvKae=WTbhukAhhVL/qe=W:ed/.p7hums?iriH*wb[v+h#\u003e=nv/Q3tgYPJohukAhgYQ}:v/OE*g5%rmirh2svGp0uwDjT?hVL/qve@m!wDlftf-T9iwb[B^gxolihVJ*T001$U2MK(9k(+%aA@Y+Kz2!2ByYF.XaokBxwDl-JA@Y[OzVBUP001\u003eRe=WWce=WN9e=WN9000000000000000000000000000000", "ln": 13614 }, { "b": "00000000000000000000000000000000000000000000000000000000000006*I:3\u0026*nc3{BT\u003e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", "ln": 14288 }, { "b": "Bz(4K5hjN#162Ee69?ADwnMm5whbbV90MHB1pt!So\u003e!9Tz/Y\u0026eBrA}?A=t@qvruj4zzrK[ci:ML1oPqVo\u003e!9Tz/Y\u0026eBrA}?wmV(Zx\u003eIr$zF77*lQq?IfFLpo9V2nvh843Bi59uHi5JS#7y-bTfGgWzf/H%Hh8!X)v\u003e!uB2)HGi1o]Ivrz$Q=fCaG\u003errJNv3rHUSxLzu%Bz(4K5hjN#162Ee69?ADwnMm5whbbV90MHB1pt!So\u003e!9Tz/Y\u0026eBrA}?A=t@qvruj4zzqOO3KcYk1oPq", "ln": 15079 }, { "b": "4f^a*HdE6[4flFg1POTR0GNjmF=Q-gF=QA5Q=q-H79[Bg{j$f{?o$ddcQF/4^j0Nw{dfxoaQ?GC^tcJ4@Ik?5iRNYyaS[llqcMf+R1GqW]88e4Us!Al}Vpp0+nW\u003c%NBpj8S1lM*?O}/uJYiwvh6l\u003egzUswmRPm}ArSIrUH#+\u0026fblUT*oj8]+Npd1nl-)SIh=/45mHtotaZ{h2^$W?e]13QcwwJaK[y!kXQI%Es+krAZm)OAdq[I\u003e.HQafSVM\u0026:RLR27\u0026-rC$GO@VElu-^Y/wq$azJDH(Qu31j59qh-{\u0026\u003e:tl+ChS**q3n^[o)b[OgjCiKnY/ixA\u003c.6sfQSolLA\u003c(b)8pLM}0JEb:Nn\u0026Ljtkj{uycyJu6[qxVEh=?UtMrgMneTS#{*5fFQODP:{8ON#\u0026g]:Y[R+8JCfUF0il\u0026rM?\u00260u%N-E3O1GL()H*S4(R6115zAdOgnv(kUt5IP\u003ey]oy93iq6q=l*m+1aML!SyWhsuL5m5PS1FmV41C!EdF9gsRR6!y5=0S@D60I+kEF?R=SELq\u0026F163u/1q\u0026*d1{#\u003c+0r-BPh+TFT1{=Z-0r\u0026Si0%pj$1{m\u003cC4G)KI6TWYgMa:L{gM\u003cC\u0026K5fA\u003cg\u003c:gtz.Lb{163uN1wHNyQ!9mgf!C7f1{m\u003cd3LK^Wx\u003e8g4B8LVjaw3P+y*?i(awV@/A::67z/fRsoLFuTBy!#q7bcBb162Ec6aD=Rg+{*xd(x1sfGy*v9%I*E9u$X7fCYfMnn.#1pZbs1SUWPMbdho^+5)=JfJnkUruid:o!Yi]nUwODmtsfyBAzE.fe4J[Cp)-Dv@=Hez!s8zv@DiqAbffa", "ln": 15312 }, { "b": "6?@yLA=l2qw]]d.z/P/nA::67z/do+fFAXkrrJyqdnsI^A=l2qw]]d[z/o.ulUgpWx\u003ez6?vru66l3mo.z/PMlC{1\u003c@f!\u003ev67y-8NfGgWBgb7NCfGAqM4kG*}h.WiDf!+QwiA!a=f:/Vw1{m\u003cd1}}5rq.X}t5E5tq1pbUFs7ce-x(mN9z/dovfB!o?rrJKu2u2a", "ln": 16756 }, { "b": "1{m\u003cd3LKO0q!P(Ry?aU/q=s/cq+/wimLNgXfF#oMeKRPQh.=Qjbl!lI1oPqSo\u003e!9Tz/Y\u0026eBrBK%zdLp$Byx39ax8\u0026(C4\u003eC$PN)^MfOfJTfOfDtPAtk@0S\u003c2\u003e0006u2#}.(.=Wk(009610VS)61{(=lnqu\u003cF0rAMi05e^P3OR\u003e\u003e162Ed69qfjf+VkM1{m\u003cd2ONLDvrl9@zFa6fzzqXR4H92n", "ln": 19668 }, { "b": "wnMm5whbbV90MHB1pt!So\u003e!9Tz/Y\u0026eBrA}?A=t@qvruj4zzrE(bNauJ1oPqTo\u003e!9Tz/Y\u0026eBrBK%zdLp$Byx39aw+A\u003eatLS9fFBK:4kG^{i59lAi5APJf\u003ckw5gbZ\u003cwf/7Kzg=NoCs$\u003eJRf:/Vw1{m\u003cd1}}5rq.X}t5E5tq1pbUFs7ce-x(mN9z/dovfB!o?rrJKu2u2bzzeTr5f=\u00261*1{m\u003cd3i", "ln": 19846 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 12288, 4.86, "r-x" ], [ ".rsrc", 12800, 1536, 3.08, "r--" ], [ ".reloc", 14336, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 70963, "timestamp": 3181480626, "image_size": 40960, "headers_size": 512, "checksum_valid": 1, "clr.is_il_only": 1, "file_alignment": 512, "resource_count": 1, "cert_table_size": 10544, "has_version_info": 1, "computed_checksum": 70963, "headers_size_ratio": 0.02, "prose_section_count": 0, "reloc_overhang_bytes": 500, "reloc_overhang_ratio": 0.98, "clr.is_32bit_required": 0, "bss_like_section_count": 0, "clr.is_32bit_preferred": 0, "clr.strong_name_signed": 1, "section_overflow_count": 0, "signature_expired_days": 72.81, "clr.is_native_entrypoint": 0, "clr.strong_name_sig_size": 128, "misaligned_section_count": 0, "version.identity_entropy": 4.21, "clr.managed_resource_count": 1, "base_relocation_block_count": 1, "base_relocation_entry_count": 1, "clr.managed_resource_max_size": 9528, "declared_data_directory_count": 7, "version.identity_symbol_ratio": 0.05, "executable_prose_section_count": 0, "clr.managed_resource_max_entropy": 4.69, "directory_section_mismatch_count": 0 }, "file": { "size": 25392, "entropy": 6.2 }, "binary": { "is_pie": 1, "has_overlay": 1, "code_entropy": 4.86, "overlay_size": 10544, "string_count": 259, "overlay_ratio": 0.42, "overlay_entropy": 7.51, "entropy_variance": 3.89, "avg_string_length": 26.06, "max_string_length": 215, "peak_region_bytes": 7984, "code_to_data_ratio": 1, "peak_region_entropy": 7.63, "string_length_stddev": 29.52, "largest_section_ratio": 0.48, "sentence_string_count": 65, "sentence_string_ratio": 0.25, "high_entropy_string_count": 0 }, "imports": { "count": 1 }, "sections": { "count": 3, "code_size": 12288, "entropy_max": 4.86, "entropy_mean": 2.67, "name_entropy": 3.03, "writable_count": 0, "executable_count": 1, "nonstandard_count": 0, "executable_writable_count": 0 }, "consistency": { "internal_name_original_filename_mismatch": 0 }, "dependencies": { "count": 1 } } }, "id": 56, "ident": { "name": { "value": "Microsoft.CodeAnalysis.VisualBasic.Workspaces.resources.dll", "source": "pe.version.original_filename", "verified": false }, "title": { "value": "Microsoft.CodeAnalysis.VisualBasic.Workspaces", "source": "pe.version.description", "verified": false }, "trust": "platform", "signer": { "issuer": "CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US", "source": "pe.signatures[0]", "subject": "CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US", "signed_at": "2026-01-28 19:17:35 UTC", "common_name": ".NET", "organization": "Microsoft Corporation" }, "project": { "value": "Microsoft.CodeAnalysis.VisualBasic.Workspaces", "source": "pe.version.product_name", "verified": false }, "version": { "value": "5.300.26.7805", "source": "pe.version.file_version", "verified": false }, "unique_ids": { "authenticode_thumbprint_sha256": "01e030ef08f5396f77bf435088ed05c4104038ccb12e7304390a7ee234e58531" }, "organization": { "value": "Microsoft Corporation", "source": "pe.signatures[0]", "verified": true } }, "mol": "K(Te)O₂(ErPr)H(Db)Md₄(Bi₅PaPtSi₄)", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/cs/Microsoft.CodeAnalysis.VisualBasic.Workspaces.resources.dll", "pid": 0, "risk": 16, "sha": "036d46ddc0baed3df638be1a08a443a0af7f77284002a6b3e298803bb78f5c14", "size": 25392, "traits": [ { "id": "metadata/signed/unknown::.net", "conf": 1.0, "crit": 3, "desc": "Authenticode chain CN: .NET" }, { "id": "metadata/signed/leaf::microsoft-corporation", "conf": 1.0, "crit": 3, "desc": "Signed by Microsoft Corporation" }, { "id": "metadata/binary/code/entropy::code-entropy-at-most-7-5", "conf": 0.7, "crit": 2, "desc": "Code entropy is 7.5 or lower", "spans": [ [ 512, 12288 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR header (COM descriptor)" }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET metadata root signature (BSJB)", "spans": [ [ 592, 0 ] ] }, { "id": "metadata/binary/layout/overlay::image-under-768kb", "conf": 0.9, "crit": 3, "desc": "PE mapped image under 768 KiB" }, { "id": "metadata/binary/layout/overlay::overlay-over-30pct", "conf": 0.9, "crit": 3, "desc": "PE overlay exceeds thirty percent" }, { "id": "metadata/binary/layout/size::small-pe", "conf": 0.6, "crit": 3, "desc": "Small PE binary (\u003c100KB)" }, { "id": "metadata/binary/resource/identity::pe-description-equals-product-name", "conf": 0.9, "crit": 3, "desc": "PE description duplicates ProductName" }, { "id": "metadata/binary/resource/identity::pe-resource-version-first", "conf": 1.0, "crit": 2, "desc": "PE first resource is RT_VERSION" }, { "id": "metadata/binary/resource/identity::resources-dll-extension", "conf": 0.9, "crit": 3, "desc": ".resources.dll satellite assembly" }, { "id": "metadata/binary/section/prose::rich-sentence-strings-20pct", "conf": 0.8, "crit": 2, "desc": "Binary has many sentence-like strings" }, { "id": "metadata/binary/symbols/imports::single-import-raw", "conf": 0.7, "crit": 2, "desc": "PE import table has exactly one entry" }, { "id": "metadata/binary/vendor::is-microsoft-named", "conf": 0.8, "crit": 3, "desc": "File name contains Microsoft" }, { "id": "metadata/binary/vendor::microsoft-corp-marker-cert", "conf": 0.9, "crit": 3, "desc": "Microsoft certificate-chain identity marker" }, { "id": "metadata/binary/vendor::microsoft-corp-marker-rsrc", "conf": 0.9, "crit": 3, "desc": "Microsoft vendor marker in resource section", "spans": [ [ 13140, 21 ] ] }, { "id": "metadata/binary/vendor::microsoft-prefixed-company", "conf": 0.9, "crit": 3, "desc": "PE company name identifies Microsoft", "spans": [ [ 13140, 21 ] ] }, { "id": "metadata/build/reproducible::pe-reproducible-build", "conf": 1.0, "crit": 2, "desc": "Built with /Brepro (deterministic)" }, { "id": "metadata/file/magic/identity::pe-dos-stub", "conf": 1.0, "crit": 2, "desc": "PE/DOS MZ header at file start", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/lang/compiler/managed::mscorlib", "conf": 0.9, "crit": 3, "desc": "mscorlib reference", "spans": [ [ 2172, 128 ] ] }, { "id": "metadata/lang/compiler/managed::reflection-namespace", "conf": 0.7, "crit": 2, "desc": ".NET System.Reflection namespace reference", "spans": [ [ 1362, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 78, 0 ] ] }, { "id": "metadata/package/versioning/scheme::pe-companyname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes CompanyName", "spans": [ [ 13114, 11 ] ] }, { "id": "metadata/package/versioning/scheme::pe-filedescription-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes FileDescription", "spans": [ [ 13190, 15 ] ] }, { "id": "metadata/package/versioning/scheme::pe-fileversion-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes FileVersion", "spans": [ [ 13322, 11 ] ] }, { "id": "metadata/package/versioning/scheme::pe-internalname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes InternalName", "spans": [ [ 13382, 12 ] ] }, { "id": "metadata/package/versioning/scheme::pe-productversion-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes ProductVersion", "spans": [ [ 13946, 14 ] ] }, { "id": "metadata/package/versioning/scheme::pe-version-file-version-value", "conf": 0.9, "crit": 3, "desc": "PE version resource carries a file version", "spans": [ [ 13348, 13 ] ] }, { "id": "metadata/package/versioning/scheme::pe-version-product-name-value", "conf": 0.9, "crit": 3, "desc": "PE version resource names a product", "spans": [ [ 13848, 45 ] ] }, { "id": "metadata/package/versioning/scheme::pe-version-resource", "conf": 0.8, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 12894, 0 ] ] }, { "id": "metadata/package/versioning/scheme::version-info-file-version-present", "conf": 0.95, "crit": 3, "desc": "PE FileVersion value is present", "spans": [ [ 13348, 13 ] ] }, { "id": "metadata/signed/certificate/identity::pe-cert-shallow-chain", "conf": 1.0, "crit": 3, "desc": "Cert chain has only 2 entries" }, { "id": "metadata/signed/certificate/identity::pe-signature-verified", "conf": 1.0, "crit": 2, "desc": "PE Authenticode integrity check reports intact" }, { "id": "metadata/signed/certificate/identity::pe-signature-verified-kv", "conf": 1.0, "crit": 2, "desc": "PE Authenticode signer cryptography verifies" }, { "id": "metadata/signed/trust-level::dotnet-strong-name-signed", "conf": 0.95, "crit": 3, "desc": "Managed assembly is strong-name signed" }, { "id": "micro-behaviors/data/embedded/certificate::microsoft-code-signing-pca", "conf": 0.95, "crit": 2, "desc": "Microsoft code-signing certificate chain", "spans": [ [ 15143, 0 ] ] }, { "id": "micro-behaviors/data/embedded/certificate::microsoft-timestamp-chain", "conf": 0.95, "crit": 2, "desc": "Microsoft timestamp certificate chain", "spans": [ [ 19716, 0 ] ] }, { "id": "micro-behaviors/data/embedded/payload/resource::dotnet-resource-reader", "atk": "T1027.009", "conf": 0.86, "crit": 3, "desc": "References the .NET ResourceReader type", "spans": [ [ 2172, 128 ] ] }, { "id": "objectives/evasion/masquerade/version-resource/contradiction::microsoft-company-versioninfo-kv", "atk": "T1036.005", "conf": 0.95, "crit": 3, "desc": "Microsoft company version identity", "spans": [ [ 13140, 21 ] ] }, { "id": "well-known/tool/development/toolchain/roslyn::roslyn-runtime-assembly", "conf": 0.96, "crit": 3, "desc": "Roslyn CodeAnalysis runtime assembly" }, { "id": "metadata/binary/provenance/build::pe-far-future-timestamp", "conf": 0.95, "crit": 3, "desc": "PE COFF timestamp encodes a future date" }, { "id": "metadata/binary/symbols/imports::single-import-count", "conf": 0.7, "crit": 3, "desc": "PE with single import" }, { "id": "metadata/binary/vendor::microsoft-corp-versioninfo", "conf": 0.9, "crit": 2, "desc": "Claims Microsoft in version resource", "spans": [ [ 13140, 0 ] ] }, { "id": "metadata/package/versioning/scheme::pe-productname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes ProductName", "spans": [ [ 13822, 11 ] ] }, { "id": "micro-behaviors/crypto/certificate/usage::certificate-ref", "conf": 0.5, "crit": 2, "desc": "References certificate terminology", "spans": [ [ 16804, 0 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET managed assembly", "uses": [ 3, 4 ], "spans": [ [ 592, 0 ] ] }, { "id": "metadata/binary/vendor::microsoft-corp-marker", "conf": 0.9, "crit": 3, "desc": "Parsed Microsoft vendor claim", "uses": [ 14, 16 ], "spans": [ [ 13140, 21 ] ] }, { "id": "metadata/signed/platform::microsoft-signature-verified", "conf": 1.0, "crit": 2, "desc": "Microsoft certificate chain has verified Authenticode signature", "uses": [ 14, 33, 35, 36 ], "spans": [ [ 19716, 0 ] ] }, { "id": "metadata/signed/trust-level::signer-evidence-present", "conf": 1.0, "crit": 3, "desc": "Platform or developer signing evidence", "uses": [ 32, 33 ] }, { "id": "metadata/binary/symbols/imports::managed-resource-bootstrap-import", "conf": 0.95, "crit": 1, "desc": ".resources.dll with CLR bootstrap-only import", "uses": [ 10, 12, 45 ], "spans": [ [ 592, 0 ] ] }, { "id": "metadata/signed/platform::microsoft", "conf": 0.98, "crit": 2, "desc": "Microsoft-signed Windows binary", "uses": [ 1, 47 ], "spans": [ [ 19716, 0 ] ] }, { "id": "metadata/binary/resource/identity::managed-resource-stub", "conf": 0.95, "crit": 1, "desc": ".NET .resources.dll bootstrap stub", "uses": [ 10, 45, 49 ], "spans": [ [ 592, 0 ] ] }, { "id": "metadata/binary/vendor::common-fp-context", "conf": 0.9, "crit": 2, "desc": "Common Windows binary compatibility context", "uses": [ 50 ], "spans": [ [ 19716, 0 ] ] }, { "id": "metadata/binary/vendor::benign-token-privilege-context", "conf": 0.95, "crit": 2, "desc": "Benign token privilege adjustment context", "uses": [ 52 ], "spans": [ [ 19716, 0 ] ] }, { "id": "objectives/privilege-escalation/token-manipulation::dynamic-token-privilege-recognized-marker", "conf": 0.8, "crit": 3, "desc": "Recognized token privilege marker", "uses": [ 53 ], "spans": [ [ 15143, 31 ], [ 19716, 28 ], [ 19894, 29 ] ] }, { "id": "micro-behaviors/data/embedded/payload/resource::dotnet-managed-resource-access", "atk": "T1027.009", "conf": 0.9, "crit": 3, "desc": ".NET embedded-resource API references", "uses": [ 37 ], "spans": [ [ 2172, 128 ] ] } ], "type": "pe" }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47aAzQxazCZol@c-7zeS@@e!5l%bME/A00000p^\u003eu:oAtj}0C:N10000000000?#B@z3JR{Y0b8Gn00\u0026M800000(v]Aw03zmw0h6", "ln": 0 }, { "b": "3\u0026*nc0kFZq00ic20b@5v000000000000000kMy^J00000000000000000000+.ul200000nb@R\u00260SSx7p-]-rBoITA2(\u003c@900000-3Cx-ia8\u003c?@dLmNFb/MH0000000000000000000000000000000000000000lq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCnfAzdNbyPQ)Ob\u0026P\u00262M:#abu5Y8x(mN800000QYQO%1onA4bumUxR#)215c8Xgbs+:9l\u0026Wh!Xb#ZhYA50jbsli+vGlxd000000SSi32nvdr2($2a0qVZL02tLm0rr913ig5a0rr912(\u003c@92(\u003c@90rr910rr910rr91000Sj0rr91000i6Hx8h)1{1n}zuf}w830\u003ew4/(t8000i6*w\u003cOw1]#BslJEw\u003el\u0026YNP1]@6ilJEw\u003eRVo6+1]{jPlJEe!00031000000rrc22()%a0rrYirrip7830Uq3ihHPrriThf-UhO5caY\u003crriThk(:)=5cbo4rriThq2\u003cO%5car.3JN%xe=VK+:P9{[8VY74e=W9@[C\u003efwd/Y$Ue=WWckMJFqi@\u0026gWe=XlsKPv6mo8$7P1B{EL1POS8000000rr919SRi3yxj+x0000000000000-l3ig5a0000000031006Ri0000006A$]wozZ1j]!JbB97#ge(D?fBzkP607pycB.tt}vR/QwBAzLqvS=^706$WEwO\u003e))C#OH1y?k[OBAh88B-.f{l349UzdmsbmRMWIr+lq)x(v(PBAzLqvS=^706$WEwO\u003e))C$z)=z/PY6BzkVh", "ln": 464 }, { "b": "B-.f{o\u003e!9Tz/Y\u0026eBs]}0wmX5AvqHjgx(+[cx(!A9y^IMKx\u003e5=owPI^jA:@W4e[w^m08[e:By/qwqE%DRwN/*@z/bLcv@#Tf08[e:By/qwl${7xzF%Prx\u003e8h:q*ACawO\u003c4$B-8qnzdLs!z/6Dcy?mS=wPz%dv}xYYo\u003e!9Tz/Y\u0026eBs]}0wmX5AvqHjgx(+[cx(!A9y^IMKx\u003e5=owPI^jA:@W408mfqA=l2qw]]T)z!9ABzEEt", "ln": 1274 }, { "b": "n3fWuea{^=1ZO8k0rrx9000009SVlw08%1ns8}.*ph+2sCW\u003er7BzkVhra{q\u003cCxi=\u003c0rrf3000008ux*Mo\u003e!9Tz/Y\u0026eBrA}?A=t@qvruj4zu6U)0rs:?Sus]Hv@=Hez!s8llVm0:z/Podx(v(wavf*WaAzgexMOqrA+fr6A=#28e=U\u003e:0rrM^e\u0026bgne\u00262sqh-JGG002d.05#?*gCgvkga\u003esufGg%zh7Hytw\u0026Tshgb}a2whDq8fF)iFi5iGOiauGhh-AZ8iaVLNhE[T2g=CymcJKh\u003eo\u003e!9Tz/Y\u0026eBs]}0wmX5AvqHjgx(+[cx(!A9y^IMKx\u003e4by0000Mu\u003c3FP+j04B0001Y0001nq*ACawO\u003c4$wPI^jA:@W4e(Dn4z/{8gwM08FwmY^jaz(gfz/PVdvK@T5wPz\u003caz/dY{e?![ie?!?0lV)i!B-I4RzE)%jA:-=naw^h\u0026y?WxLwQdl[yH}xDvMckOhdFH4f/.3DwIu87bu5(eBy/qwqE%]/B-H#6B1QvkzGGPfwM08Xz/{8gwM9eZ0SSi23i{Lh00000p^EGCk$1L[mH\u003c$i0VuK!Kf\u003cC\u003cI[\u003c\u003c!g%guq)^bF5e=g6Y88D\u0026fUq}du?+F:@*gbYNCx[++9I[rqbHI8bRsGg/jqJK[rwPjMQkatIHrLl*x=@57mbrF:Ck^b[^?dod3VgLTFpi8N!0#8@caOYiL!\u00264DSs:?bu)QI{eHDfyY?\u003cz$z!$ac=.ub)V.-v\u003e+=#\u003c.@iz3APr%qidaT9giQzEA.%SiXJR[H6l7%4WKLLVuKLLVXUSvK@q:(E2q:(FfvOqF3\u003c7\u003cz#-=W56kZwcLfqskxH0bm:rul)D^\u003c{l02T\u003cGRm[5l)\u003czG=^b\u003e3J\u003c.$F]rcm$6}gPDpJ/6n8qr6b#0Vrh#%Eu6ghbKZJfJxh#Mupx^Ooivad{?tV3ylTR#f6n8Lb[M3u**MeFYmk+OYNL(zYNL)qYNL(2Y)(10Y)(0sLaEReYq7tEMBz?bDaP40!Zfnswcd:W1QHa.?/K\u003eo\u003ezUz*@h2xHs*K8^s*KaIlb!?=cGf}2J24DtCPq+pZBLul\u003eYhXxOP{ed\u0026\u003c1Kf/0QIE:]WT#a+kT8F%8fmv91yrO8xtZq@-{O9p]jT/7UjG3\u003e!UGxEn?MS7r0:Ymk]{Rnwr-m^=vvw=!90emjIV8fRdv40W[UY}HL", "ln": 1725 }, { "b": "0eESQ07olQqufO{uJrK}BPupVv/QPJx-J5Kzu9MmwDl=KBPujTBo1Vdve$fBzuaOPBo1ScwDkp4zuahEwDl@PwDllvf-YI2002hK08-!{0abZ@0a=dF0a=dJ0at\u003ez08JVo0b?\u003cL0a=du0cwij0bRZP0b?\u003cT0cwiZ07u)d0ce6T0ce5}04a/F07GxSqufO{uJrN@wDlPFwDl-Jx-ISyk(+{9x8(#Mpxknjk(=0bBo3sYx-IPxBPuH-wDkTez#:CHv/Qiyw=", "ln": 49113 }, { "b": ".\u003ezf\u003cAV^N?B7DF8.\u003ewh(z/%4k.(X26ygRp3z6i$AzFsjiNilE/NzVdxvs05ss7#+\u0026efFwqwGU(4aA.\u003cBx(}sZazC.cv}/v/x)NW\u003cBz(isUop=yy?mI6Uom:)ygRg5-JH({cvmB{az$+d.(U52y*?B6.\u003ewh-wOV9\u003cA:-D?azU[kB97\u0026dBA]FtbU#vr", "ln": 136900 }, { "b": "C%MK]A+P09By^69h*Wlbaz$+9wmV)3vrlK0C4(4vByw@oayO-8aAI9pAbP]ry\u0026sG9y*!D1z!9:7ByuqfB.\u003e\u003eD0BZseEirooaA.kjP\u003e[T*BrC0mzE)M[wGU-4aA\u00262", "ln": 143686 }, { "b": "aw=#(BZ#R6y?j-0xK+Q}wGVqpvqv01zGGDgAb]Jiz*2MhazLt2zY\u0026.iwnVscBS:X4x\u003e86(wH[%yz/%4kx\u003e?:3azb+lyH.63o\u003e!9Tz/Y\u0026eBs{QdB9g]clsB}Hv\u003eH5*v]\u003eo9p\u0026yb(wftM7ay/7{wPRGax(n37A=u5gBz(thBrCsbyI$ulJL?(ty?Wx[efF[IB\u0026z7eyij2fw{50bv}^5Wx\u003e8g4B8LVje((XcBZY8Mvrlc)e((y%e=/\u0026?z//[uww\u003c%F-g7UZTSR}e-JKu3vS=A%ay/Xjy?Wx{.(j=8.\u003ezl/B8k=oBzh\u003emwQn5kDOx\u003c\u003c\u0026^^jnDOG{\u003evixq@xM22pzG0HZwP2A0z6i.cvS9xn.\u003ey\u003cZvpTn[T./h5D2NtiaBt\u003e(e=^?5z/fSrvqZf}aBt!\u003cao", "ln": 147722 }, { "b": "-Lfl(BrCsbyI$ts.[y80Dm/j?l3dcYvS==nDOx\u003c\u003cwmow[Y=.GfaBmNsz!:il.(mF}B8Mhgz/P$yygOJhazU[kw]8f%BAFZEaz(5oZhv\u003egBI\u003ej6DOG}30xS\u003e\u0026Abo7", "ln": 148894 }, { "b": "w]8f%BAFZEaA?tnNpQbJ.[x[fBA}?pz6iw2w[=d3C42paY\u003e[)naAkq/x\u003egT\u0026.(mF}zeS%cy\u0026{\u003eEf)$UPtphZUA+P09BA]06x\u003e8g4B8LVje((XcBZY8Mvrlc)e\u003c\u003cL]lU{gLB3T[\u0026A+P09By=O6aBt!\u003caz$+9wmV)5z/%4k.(X26Ab]\u003etBAIYySL#N]BJ6V=TZ(Mb0C9SABAh88B-X:2x\u003e8g4B8LVje((XcBZY8Mvrlc)e\u003c\u003cL]lU{gLB3T[\u0026A+P09By=OjwOL:!aAhmw-Lfl(BrCKyzY\u003cevNzVdqBS+-FwmYK)vrb^^.(U4QB-RT@zFiQ4x(\u003e%dFDmb{vrb^[wPR%raw3D)wPzx\u003ev}wkxayMxYC4CMkB4G)+Ab]\u003etvruK7vS==no\u003e!9Tz/Y\u0026eBs{QdB9g]clsB}Hv\u003eHb!z9@bFB8%S?BAh88B-.gqBJ6V=TZ(Y1DOx\u003c\u003czE)X7UF[j]BS+LsT-LXbBy/i8z/)goz!9:7BAGhpjX]J#v@xh-az\u003eXiz!abozE)X7UF[j]BS+ehY(UxuD2[7oC4CMpaA7.7wOVzbUwCz0z!9A}BS:4Eo!DE20vH\u003c=NzVdqBS:y)v@=Hez!s8zr+VR$vqFnsB7]bplVl*ey*?yal3di?x\u003c#jbwGU(4ygH(#AbP)rZqE6{aAhvtaAUO\u003c.(WD(efF.IwPCXZazLEgz^)o/zO@d\u003czE)o}aA7.gvA2@(zEBVgC5z2o-Hd\u0026!vR64!.(mr/aAR)FBUiYpcQz\u0026{x\u003c#jbawDMWA=l2qw]]Uax(!A9y^IMKx\u003e5+.z/4\u003cTvrlGQBAzLqvS=^7az$+9wmV)5z/%4k.(X26Ab]\u003etDOx\u003e0aAhvtBz]djwGU(4znS4\u0026zEEQdvrMj1z/)gkwOV9\u003cA:-D(aw^h\u0026y?Wxi0Gm4bl3dcYvS==no\u003e!9Tz/Y\u0026eBs{QdB9g]clsB}Hv\u003eHb!z9@bFB8%S?BAh88B-.gqzE)M[wGVbmy*?B6x(\u003eFnvixWhNzVdqBS=2+EjMHWA=l5r-Lb[aygRd$TSRy$zGGD8zE)\u0026hDOG{\u003ezE).6TSRd=yIWB1z*2Mb.[vgcvqx^7p\u003c3k-x\u003e5:@XDa6zBAh88B-X:8D2[7sz7X.ezGGPfwIcL(By/GhA8Qs*C4\u003eC$B1P\u003c{B8TYYl3di?x\u003c#jbwGU(4ygH(#AbP)rZqE6{az$QgBJ6V=TZ(L%DOx\u003e0aAhvtBz]djwGUA6A+P09BrBp(v@=Hez!s8zr+VR$vqFnsB7]bplVl*ey*?yal3di?x\u003c#jbwGU\u003ccP=!J7xMvKcwP2z+aztV", "ln": 149065 }, { "b": "ygRp3z6i$AzFsjiNilE/NzVdxvs05sl#KWUl)\u003e*INzVdxvr%4-z/fVhzGPIkmSiq\u0026B7DF8.\u003ewh(z/%4k.(X26ygRp3z6j0AA(jO/v}^68-HjSCyHIKiavZo\u0026e=!G\u003cp@O\u003cuT.Ru\u003eavy6+BzkSnwGU5/x(4u6B7DF8.\u003ewh(z/%4k.(X26ygRp3z6j0", "ln": 152088 }, { "b": "xM50haAR)FBS+Nkzn\u0026Y$ZgwA@.[ydmw5CA+wO\u0026Mkz/0s+zO@O0zdN*cwo/^du)!lZA+P09BrBIcB97#ge(D?fBzkP6e\u003eG@5wPzZdq!o#)x\u003e7Z}e\u003c%I(nO@A+A=:P?BAh88B-.gqzE)M[wGU@gB\u0026z8jT-LX8A=i7t-HjSCyHIKmavG^Jy*?u}e=*CHl3dcYvS==nq*ACawO\u003c4$B-8qnzdLs\u003ezGGDgz/wS^A=#ebwPGE(y?#WWAbP=sl3di?x\u003c#jbwGU(4ygH(#AbP)rZqE6{aAhvtaz\u003eXiz!9#kl1BH%vqYQ(wPxsAqE%Y-C4BiMzE^M{AV/mhvS9w!vqf^]mrSlWBs)P6cQz\u0026{x\u003c#jbax9MbBy/qwqGV(0x(dAlnP5SYA=k[}wPz%dv}xZll#lWhze:AlBu$1\u003cA+P09By=OjwOL:!aAhmw-Lfl(BrCKyzY\u0026[dBz\u003eYjav*0+az$+1zY?$\u0026Bs)PR0vHfPA+P09BrBIcB97#ge(D?fBzkP6e\u003eG@5wPzZdq!o#)x\u003e7Z}e\u003c%I(nO@A+A=:P?BAh88B-.gqzE)M[", "ln": 155315 }, { "b": "wN/R}P=!k:vS9x8By/HgP=!8YaA7.gvA2@(zEBVhaA7.2v@xh-z6i}CAci=lvjau.A+P09BrBIcB97#ge(D?fBzkP6e\u003eG@5wPzZdq!o#)x\u003e7Z}e\u003c%I(nO@A+A=:P?BAh88B-.gqzE)M[wGU@gB\u0026z8jT-LX8A=i7mzGx]dzP4JL.(U4#wPR\u003c3BUiY4cQz\u0026{x\u003c#jbax9MbBy/qwqGV(0x(dAlnP5SYA=k[}wPz%dv}xZll#lWhze:AlBu$1\u003cA+P09By=OjwOL:!aAhmw-Lfl(BrCKyzY\u0026[dBz\u003eYnaAzyDxMvK0.(UJ(K]V{@BAh88B-X:8D2[7sz7X.ezGGPfwIcL(By/GhA8Qs*C4\u003eC$B1P\u003c%y!nF.z/P}=BAzLqvS=^7az$+9wmV)5", "ln": 155790 }, { "b": "B9RUkxMw3ezO@O0zdN*cwo/qnwNYN2x(){b.\u003ezf\u003cA^n^BwOL:!aAhmw-Lfl(BrC1lA+P09BrBIcB97#ge(D?fBzkP6e\u003eG@5wPzZdq!o#)x\u003e7Z}e\u003c%I(nO@A+A=:P?BAh88B-.gE0E3?KA+P09BrBIcB97#ge(D?fBzkP6e\u003c\u003cL]Aa%c1A-lK\u0026C4\u003eC$B1P*#ze:i9wPymKvruTjwM08VB.L(cwi\u003erVA+P09By=OfwGVewxMvKcwO@Sfz/{wqaAhvt", "ln": 156190 }, { "b": "Ds.gvAkOw\u0026z*64iaAkq/.(WY.DlsC3CYWIqzEEuWz/{8gwIa0fcR}WuwOYhSC42hfB7DFk-HjSCyHIJimq=SUmS\u0026PUBzkVhe=!P)okIIF-eOXU.(mG}aAIvqC6a]@zE:\u003eYw/$@kBhLa5Ak!kRwmGq\u003cP)yo(aAkk(A=lcsSut$).(Z\u003epz*63$aAIvqC5FG{w?B9JcS4^I.(WY.Duyu0zE:\u003e:z!a0bwGU\u0026jBhLa5Ak!kRwmGq\u003cP)yo(aAkk(A=lcs", "ln": 159932 }, { "b": "wN]p:.\u003ezx/BrCLuP(L6{.[vgi-HjSCyHIJiq/)55v@#\u003clwIa0acR}WuwOYhSC42hfB7DFk-HjSCyHIJimq=SUq/#L40y!Ck-HjSCyHIKiavQfUax9M6v[Z/JyANFpBhLa5Ak!kRwmGq\u003cP)yo(aAkk(A=lcsY=.pkNzVdxvr%4{D2va=z!0Mn0zK}my@rx[JC\u003c0TSCM=2B8k=rBS:a\u003cwfs\u0026(C{3%DBhLa5Ak!kRwmGq\u003cP)yo(aAkk(A=la", "ln": 160574 }, { "b": "NzVdxvs05ss7(q:wIa0fcR}WuwOYhSC42i9aAI9pyIZ[\u003c-eOXU.(j=1y\u0026sGnavf)Qe==$up@O\u003cuT.Ru\u003eaBt!\u003caA\u00264HZf$L{ygOJbz!@#q0vf3*-eOtz.\u003ezlZy\u0026pCqwGU=8.(Z\u003epz*63$aAIvqC5FG?B1NFecR}WuwOYhSC42hfB7DFuzEEr6jUu:", "ln": 163303 }, { "b": "BA]Ftg/+-fwOV9\u003cA:-D(axRuiay/8gv-bq\u003cC6R6vvpTq1vq-#@ayPwjx\u003c#jbaA?spB7]Mge=^7}aAhvAyJQ+fxNa78TSRy$zEWQd.\u003ewi0zEHFyyHF*@D@TZ{P\u003e[T*BrC]:EirAszn\u0026Y$ZgwB3ze:r5zdNQbz*2MhaA.kjP\u003e[T*BrC]+EirxBwozZhaxJm", "ln": 193847 }, { "b": "awMu:-HjSCyIWA\u0026iV]?HBZ=:FauTRZNzVdxvr$9^e\u003eG@7z!\u0026]jdfjA/wO#QdaA\u003eVoA::npy*?f\u0026wmlP}wN]W%-HjSqwnuab.(mr/aAkq/.(WY.DuyuEB-UE5ay-m4BrC-H", "ln": 223729 }, { "b": "wOU^!aJfmQwP2F\u003caBt!\u003cazLEgDspQbP)yc+.[vgoazLt2.(mA\u0026y?X5nAbQ5pv}^K@lDbs2Ds.0iP=!b?y?mx(wGX{Jy?mI6UomX8BhLa5z^)=@xM565BrCBmzFr}", "ln": 226910 }, { "b": "e)8$be\u003e/$%AuFWjq*ACawO\u003c4!z/PzizE)o}azLRd.\u003ewh]wPI%4C4CNeTSRd=yIWB1B.X*@w5Cz\u003eBA}?Jax9MbBy/qwoLFx:e\u003e6V2zdN-@vR/Qbax9MbBy/qwsz.\u003eboLFx:e)7LUwO(0@BsXLkD2[7sz7X}cy+wy}zGdphpgn0JefE(pB97#ge)8$be\u003e/$%Av$uVBAzLqvS=^7ayMx\u003eD2[7sz7X}cy+wy}zGdphpgn0JB8UL$wIa1t0EDIGazLD", "ln": 240308 }, { "b": "vruBh.[vgmD2K)rB-7#8wDr/Fz!9*9A=lbfzO@B@yghBlyJ1ylSuuv}A^zpT0s:xfEirYAA^zptDOG{HksovdD2^RixMLvBlN:cLx\u003e8g4B8LVjavy6/AbP=9BzkVhe*ailP\u003ed.EzEBVbA(jO]vix-sxMvKcwO${e0wEu?Nq3iHP)1tEaAI9pC5h9oZgzi1Y=.l7yHIJizEBVewPI%4C4CNeTSR%AEj+Kzp@O\u0026pww+9:.\u003ewh]wGU]4yHIJizEBV8z!a0baBt!\u003ce=^p}-HgBJ.\u003ezm\u003eP=!z/aA7=", "ln": 242519 }, { "b": "vqfQ\u003cA+fGbarR^HarR^HarR^]A+eW3wGUz7s7#L.z*cmBvq{g4x\u003e7N[x(v(iBzb98aAzQxB0bgm4gjj2arR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^Hl2Z^gz/fV9x(mH5e!5dtByxi5wPP$Sx(m=#z^)D7arR^HarR^HarR^HarR^HavyfX", "ln": 243433 }, { "b": "iY}1*y?l%\u0026x(!wWarR^HarR^HarR^HqE%DKA+fb#wGU\u00263BywY*Byuq7A=k!qBzbkdB8UY2x\u003ez6\u003cwft-cwozZ1A$5Edy?W^5iY}1*y?l%\u0026x(!wWarR^HarR^HarR^HarR^HavQcRwN({2wPRu\u003evrt{2w].*baARpdaAIHkv}/K?wN(]$zGGDgz/uc", "ln": 243907 }, { "b": "arR^HnP53OB.25avqG:5w[=6)B0bgmaARpday/LmA+fcgay]hbwN/?2A^n93arR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarU9gwft@ovQ%g[wN/?2A+P9aayO+\u0026z/Px5zF78lzY\u003cdnwEO$?arR^HarR^HarR^HarR^HarR^HarR^HarR^", "ln": 244147 }, { "b": "iY}1*y?l%\u0026x(!wWarR^HarR^HarR^Hax0u1aARpdayPd@y\u003cytrA=SvnA=k!qBzbxfayPtjwO\u003e))C)$96arR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HasHf4z/P}xw]zZbiV{1.dgDRovpS[.BzkVhvqGK\u0026y?kT\u0026w[=6)az++kBuQ/\u0026arR^H", "ln": 244470 }, { "b": "BrC7iwmVhSarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarUrdzE)\u0026%BzkVhayYFnaz\u003eLjayX[8B-Rb8ayYQsvqYH\u0026D3T4xB0b7kAV/swz!a02x(mL)3lQDlarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR!rA=M8sB0bywaA}mmzFr$", "ln": 244661 }, { "b": "z8@^\u003ey?W^5A+fqv4gjX8z*b]kgCS/QzFrY]B95JEarR^HarR^HarR^HarR^Hra]?=wmYvYB.(dxzddr@w[u49aAIjmB.\u003eOhzF%RtvR3V[zdm6!wmYoX3lQDlarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR!vzxK4mwGU?#zFrY]B95KCwN//", "ln": 245113 }, { "b": "q/u/0v}u^0x(mYex(mK3aARJAwO\u003e)/wftP7Bz\u0026o#l{-Hn3jNs+arR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^Hat1Z8qC{p*qY[w3l)bL%qCG!Um]HJZ4gjX8z*bSgzxH5AarR^HarR^HarR^HarR^HarR^HarR^Hl${ZJvR/P#vqG:5CvtH", "ln": 246920 }, { "b": "arR^HarR^HarR!9BZ=E/vqfQiaw3U$v{%l$vqH16ayX[8viv{NvrlGjBzb984gjj2arR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^Hx(mP}A+PSpazbUjz6h=5B97#ge(#+8wn=Wke\u003ef=1zf4s0z/PXE4gjj2arR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^Hc@T!$A=-Boz/PXQat4BV4gjX7z!a0bwNPU3wO\u003e))D2v5cwJz}{BAh8kxfD", "ln": 251751 }, { "b": "vqY$3Byxo5azbLjwOC^{ayPtjwO\u003e))C)$96arR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HayO+\u0026wPI{bvRGT)BA]0uA=M8sB0bWvBz8!vxKM09vrlH3zdmsbaARpdC{3Q9zdK\u00264A=k!E4gjXdwnuc)Bz9Y$Aa9\u003c4j%g%\u003carR^HarR^HarTG?", "ln": 252997 }, { "b": "000000000000000000000000000000000000000000000000000000000000000000000000000000315c8Xg7YTL^000000000000000000310rr91fAq960000000000000000003100000nb@R\u0026sFb=%Oce/(0000000000OcgUG00341qVHe8rSCL*qufR}nDqJ^p5[S3nDqG=mGui:00000Y-^*600031ecb[OEi6pb0000000000kl7V-000001onA40SSi2000000000000000l\u0026Wh!0rud2ve$rFmGvc5yYF2DnDrSdw=", "ln": 289232 }, { "b": "00031qVH[tASx!NzuaqHmGvc5yYF2DnDrSdw=M-H007TN00031fAr^bfAr^bfAr{fvGn7Z002W)761vnlJz38z2!IPve$fBC(QOtve$cAwDhYg002Z[x-ISyASy1TA@ZaUw=M]Maoj+ezVB!Tz#:!RASxIFBo31PzVBUP003)pbld-AmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002Z[x-ISyASy1TA@ZaUw=M]Me=XlszVBqFwDk0@zua8ByYF.XA@Y[OA@W/)rSD?lA@Zs.ve$9zli7A]A@Y[Ov/MGe002aY4GDIfmGvc5yYF2DrSDXhASydXx-J5Kzu6Up001\u003eRe=WWcfAr^be=WTbhukufhVL/qfAr%g004PJf-RjOnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002Z[x-ISyASy1TA@ZaUw=M]Me=XlszVBqFwDk0@zua8ByYF.XA@Y[OA@W/)rSD?lA@Zs.ve$9zli7A]A@Y[Ov/OaYASxUJA@ZaUBPuBZv/Q6uA@W/)wb{ACyYBCn004JHe=U[LoAnS7x8(uuyYD*5zVB.RC(R\u003c+x-I=CxAibO005$#aokaox-ISyASy1TA@ZaUw=M]Maoj+ezVB!Tz#:!RASxIFBo31PzVBUPe=W0]k(+Z3yYCNTASx!Nx8(PBBo3vZaolAZwDl=KwDl-JB]V7Nwb[jZ004(Rf-RjOpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002Z[x-ISyASy1TA@ZaUw=M]Me=XlszVBqFwDk0@zua8ByYF.XA@Y[OA@W/)rSD?lA@Zs.ve$9zli7A]A@Y[Ov/OaYASxUJA@ZaUBPuBZv/Q6uA@W/)wb{ACyYBCn003Qhbld-ApYLIozVBqFBPt[KBo25ove$cAwDhYg002Z[x-ISyASy1TA@ZaUw=M]Me=XlszVBqFwDk0@zua8ByYF.XA@Y[OA@W/)rSD?lA@Zs.ve$9zli7A]A@Y[Ov/MGe005q+irf6WpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001\u003eRe=WWce=WN9eDvKae=WTbhukAhhVL/qe=W:ed/.p7hums?iriH*wb[v+h#\u003e=nv/Q3tgYPJohukAhgYQ}:v/OE*g5%rmirh2svGp0uwDjT?hVL/qve@m!wDlftf-T9iwb[B^gxolihVJ*T001$U2MK(9k(+%aA@Y+Kz2!2ByYF.XaokBxwDl-JA@Y[OzVBUP001\u003eRe=WWce=WN9e=WN9000000000000000000000000000000", "ln": 289530 }, { "b": "0000000000000000000000000000000000000000000000000000000000000dUgL3\u0026*nc(]1?z00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", "ln": 290768 }, { "b": "ELzi:2)HGi1o]Ivrz$Q=fCaG\u003errJNv3rHUSxLzu%Bz(4K5hjN#162Ee69?ADwnMm5whbbV90MHB1pt!So\u003e!9Tz/Y\u0026eBrA}?A=t@qvruj4zzrK[ci:ML1oPqVo\u003e!9Tz/Y\u0026eBrA}?wmV(Zx\u003eIr$zF77*lQq?IfFLpo9V2nvh843Bi59uHi5JZ17y-bTfGgWzf/H%Hh91?]v\u003e!uB2)HGi1o]Ivrz$Q=fCaG\u003errJNv3rHUSxLzu%Bz(4K5hjN#162Ee69?ADwnMm5whbbV90MHB1pt!So\u003e!9Tz/Y\u0026eBrA}?A=t@qvruj4zzqOO3KcYk1oPque(1\u0026mfOft1fBXi)dUZGG{ydc70r\u0026D9F=Q]jfOfs.0!HD70k0{#f8l%?tPmv4JA).SRwStY}SQhr91BV\u003ea%dv!{Xf\u003cVD)ng[h%3uAlKmN=vs%cKQ{-b:Qn1AX-CPG)^TUA(-s!kwq1)ujS]EJ-Ip?", "ln": 291527 }, { "b": "H+Pn\u003e2)HGi1o]Ivrz$Q=fCaG\u003errJNv3rHUSxLzu%Bz(4K5hjN#162Ee69?ADwnMm5whbbV90MHB1pt!So\u003e!9Tz/Y\u0026eBrA}?A=t@qvruj4zzr[2fA}RV1oPq^o\u003e!9Tz/Y\u0026eBrBF1z/^9?wPz)bw[+:-By=NXB-.qnA+PSvatLS9f!:T+4kxN\u003eh.WiDfF$\u003cAiA^jdgbZ*BfGp*xfGy*Es$\u003eyW3OR\u003e\u003e162Ed69qfjf+VkM1{m\u003cd2ONLDvrl9@zFa6fzzqXR4H92n1p2OBqE]", "ln": 293158 }, { "b": "+p%wU2)HGi1o]Ivrz$Q=fCaG\u003errJNv3rHUSxLzu%Bz(4K5hjN#162Ee69?ADwnMm5whbbV90MHB1pt!So\u003e!9Tz/Y\u0026eBrA}?A=t@qvruj4zzrB\u003ebl!lI1pC\u003e.o\u003e!9Tz/Y\u0026eBrA\u003e^wPzG{viwu+wPzj3x(v)gf^!U31{m\u003cd3LKO0q!P(Ry?aU/q=s/cq+/wlgb7ylfF#oMeKRPQh.=Qjbl!lI1oPqSo\u003e!9Tz/Y\u0026eBrBK%zdLp$Byx39ax8\u0026(C4\u003eC$PN)^yfOfJLfOfDlPAtk@0S\u003c2\u003e0006b2Nxq-t-v/B009610TQK\u00261{(=lnqu\u003cF0rAMi05e^P3OR\u003e\u003e162Ed69qfjf+VkM1{m\u003cd2ONLDvrl9@zFa6fzzqXR4H92n", "ln": 295997 }, { "b": "wnMm5whbbV90MHB1pt!So\u003e!9Tz/Y\u0026eBrA}?A=t@qvruj4zzrE(bNauJ1oPqTo\u003e!9Tz/Y\u0026eBrBK%zdLp$Byx39aw+A\u003eatLS9fFBK:4kG^{f/7Hriw-GGhcH!9gbZ*ygbpNAg+{{Cs$\u003eJJf:/Vw1{m\u003cd1}}5rq.X}t5E5tq1pbUFs7ce-x(mN9z/dovfB!o?rrJKu2u2bzzeTr5f=\u00261*1{m\u003cd3i", "ln": 296303 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 288768, 5.35, "r-x" ], [ ".rsrc", 289280, 1536, 2.92, "r--" ], [ ".reloc", 290816, 512, 0.1, "r--" ] ], "metrics": { "pe": { "checksum": 349529, "timestamp": 3023399681, "image_size": 319488, "headers_size": 512, "checksum_valid": 1, "clr.is_il_only": 1, "file_alignment": 512, "resource_count": 1, "cert_table_size": 10512, "has_version_info": 1, "computed_checksum": 349529, "headers_size_ratio": 0, "prose_section_count": 0, "reloc_overhang_bytes": 500, "reloc_overhang_ratio": 0.98, "clr.is_32bit_required": 0, "bss_like_section_count": 0, "clr.is_32bit_preferred": 0, "clr.strong_name_signed": 1, "section_overflow_count": 0, "signature_expired_days": 72.81, "clr.is_native_entrypoint": 0, "clr.strong_name_sig_size": 128, "misaligned_section_count": 0, "version.identity_entropy": 4.12, "clr.managed_resource_count": 1, "base_relocation_block_count": 1, "base_relocation_entry_count": 1, "clr.managed_resource_max_size": 286768, "declared_data_directory_count": 7, "version.identity_symbol_ratio": 0.04, "executable_prose_section_count": 0, "clr.managed_resource_max_entropy": 5.35, "directory_section_mismatch_count": 0 }, "file": { "size": 301840, "entropy": 5.48 }, "binary": { "is_pie": 1, "has_overlay": 1, "code_entropy": 5.35, "overlay_size": 10512, "string_count": 5673, "overlay_ratio": 0.03, "overlay_entropy": 7.52, "entropy_variance": 4.6, "avg_string_length": 19.52, "max_string_length": 145, "peak_region_bytes": 15120, "code_to_data_ratio": 1, "peak_region_entropy": 7.59, "string_length_stddev": 13.19, "largest_section_ratio": 0.96, "sentence_string_count": 2411, "sentence_string_ratio": 0.42, "high_entropy_string_count": 0 }, "imports": { "count": 1 }, "sections": { "count": 3, "code_size": 288768, "entropy_max": 5.35, "entropy_mean": 2.79, "name_entropy": 3.03, "writable_count": 0, "executable_count": 1, "nonstandard_count": 0, "executable_writable_count": 0 }, "consistency": { "internal_name_original_filename_mismatch": 0 }, "dependencies": { "count": 1 } } }, "id": 57, "ident": { "name": { "value": "Microsoft.CodeAnalysis.VisualBasic.resources.dll", "source": "pe.version.original_filename", "verified": false }, "title": { "value": "Microsoft.CodeAnalysis.VisualBasic", "source": "pe.version.description", "verified": false }, "trust": "platform", "signer": { "issuer": "CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US", "source": "pe.signatures[0]", "subject": "CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US", "signed_at": "2026-01-28 19:15:16 UTC", "common_name": ".NET", "organization": "Microsoft Corporation" }, "project": { "value": "Microsoft.CodeAnalysis.VisualBasic", "source": "pe.version.product_name", "verified": false }, "version": { "value": "5.300.26.7805", "source": "pe.version.file_version", "verified": false }, "unique_ids": { "authenticode_thumbprint_sha256": "51282e7ce7c8cd8d908b1c2e1a7b54f7ced3e54c4c1b3d6d3747181a322051d3" }, "organization": { "value": "Microsoft Corporation", "source": "pe.signatures[0]", "verified": true } }, "mol": "K₂(LiTe)O₃(AsEr₂Pr)H₂(Db₂F)Md₄(Bi₅PaPtSi₄)", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/cs/Microsoft.CodeAnalysis.VisualBasic.resources.dll", "pid": 0, "risk": 19, "sha": "28c3f5b0e41bda66e2229d111873693670d3fc533792d133ca8b9beb96072ab4", "size": 301840, "traits": [ { "id": "metadata/signed/unknown::.net", "conf": 1.0, "crit": 3, "desc": "Authenticode chain CN: .NET" }, { "id": "metadata/signed/leaf::microsoft-corporation", "conf": 1.0, "crit": 3, "desc": "Signed by Microsoft Corporation" }, { "id": "metadata/binary/code/entropy::code-entropy-at-most-7-5", "conf": 0.7, "crit": 2, "desc": "Code entropy is 7.5 or lower", "spans": [ [ 512, 288768 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR header (COM descriptor)" }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET metadata root signature (BSJB)", "spans": [ [ 592, 0 ] ] }, { "id": "metadata/binary/layout/overlay::image-under-768kb", "conf": 0.9, "crit": 3, "desc": "PE mapped image under 768 KiB" }, { "id": "metadata/binary/resource/identity::clr-resource-large", "conf": 0.6, "crit": 3, "desc": "Large CLR managed resource present", "spans": [ [ 1992, 286768 ] ] }, { "id": "metadata/binary/resource/identity::pe-description-equals-product-name", "conf": 0.9, "crit": 3, "desc": "PE description duplicates ProductName" }, { "id": "metadata/binary/resource/identity::pe-resource-version-first", "conf": 1.0, "crit": 2, "desc": "PE first resource is RT_VERSION" }, { "id": "metadata/binary/resource/identity::resources-dll-extension", "conf": 0.9, "crit": 3, "desc": ".resources.dll satellite assembly" }, { "id": "metadata/binary/section/prose::rich-sentence-strings-20pct", "conf": 0.8, "crit": 2, "desc": "Binary has many sentence-like strings" }, { "id": "metadata/binary/symbols/imports::single-import-raw", "conf": 0.7, "crit": 2, "desc": "PE import table has exactly one entry" }, { "id": "metadata/binary/vendor::is-microsoft-named", "conf": 0.8, "crit": 3, "desc": "File name contains Microsoft" }, { "id": "metadata/binary/vendor::microsoft-corp-marker-cert", "conf": 0.9, "crit": 3, "desc": "Microsoft certificate-chain identity marker" }, { "id": "metadata/binary/vendor::microsoft-corp-marker-rsrc", "conf": 0.9, "crit": 3, "desc": "Microsoft vendor marker in resource section", "spans": [ [ 289620, 21 ] ] }, { "id": "metadata/binary/vendor::microsoft-prefixed-company", "conf": 0.9, "crit": 3, "desc": "PE company name identifies Microsoft", "spans": [ [ 289620, 21 ] ] }, { "id": "metadata/build/reproducible::pe-reproducible-build", "conf": 1.0, "crit": 2, "desc": "Built with /Brepro (deterministic)" }, { "id": "metadata/file/magic/identity::pe-dos-stub", "conf": 1.0, "crit": 2, "desc": "PE/DOS MZ header at file start", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/lang/compiler/managed::mscorlib", "conf": 0.9, "crit": 3, "desc": "mscorlib reference", "spans": [ [ 2004, 128 ] ] }, { "id": "metadata/lang/compiler/managed::reflection-namespace", "conf": 0.7, "crit": 2, "desc": ".NET System.Reflection namespace reference", "spans": [ [ 1327, 0 ] ] }, { "id": "metadata/lang/compiler/managed::visual-basic-runtime", "conf": 0.85, "crit": 3, "desc": "Visual Basic runtime reference", "spans": [ [ 147786, 74 ], [ 147877, 38 ], [ 149129, 66 ], [ 149222, 59 ], [ 149327, 87 ], [ 149528, 52 ], [ 149656, 59 ], [ 149776, 68 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 243955, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 246968, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "spans": [ [ 243481, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 152136, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 253045, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 78, 0 ] ] }, { "id": "metadata/lang/natural::polish-common-word-ale", "conf": 1.0, "crit": 1, "desc": "Polish common word ale", "spans": [ [ 136954, 0 ] ] }, { "id": "metadata/lang/natural::polish-common-word-jak", "conf": 1.0, "crit": 1, "desc": "Polish common word jak", "spans": [ [ 226942, 0 ] ] }, { "id": "metadata/lang/natural::polish-common-word-tak", "conf": 1.0, "crit": 1, "desc": "Polish common word tak", "spans": [ [ 143718, 0 ] ] }, { "id": "metadata/package/versioning/scheme::pe-companyname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes CompanyName", "spans": [ [ 289594, 11 ] ] }, { "id": "metadata/package/versioning/scheme::pe-filedescription-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes FileDescription", "spans": [ [ 289670, 15 ] ] }, { "id": "metadata/package/versioning/scheme::pe-fileversion-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes FileVersion", "spans": [ [ 289782, 11 ] ] }, { "id": "metadata/package/versioning/scheme::pe-internalname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes InternalName", "spans": [ [ 289842, 12 ] ] }, { "id": "metadata/package/versioning/scheme::pe-productversion-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes ProductVersion", "spans": [ [ 290346, 14 ] ] }, { "id": "metadata/package/versioning/scheme::pe-version-file-version-value", "conf": 0.9, "crit": 3, "desc": "PE version resource carries a file version", "spans": [ [ 289808, 13 ] ] }, { "id": "metadata/package/versioning/scheme::pe-version-product-name-value", "conf": 0.9, "crit": 3, "desc": "PE version resource names a product", "spans": [ [ 290268, 34 ] ] }, { "id": "metadata/package/versioning/scheme::pe-version-resource", "conf": 0.8, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 289374, 0 ] ] }, { "id": "metadata/package/versioning/scheme::version-info-file-version-present", "conf": 0.95, "crit": 3, "desc": "PE FileVersion value is present", "spans": [ [ 289808, 13 ] ] }, { "id": "metadata/signed/certificate/identity::pe-cert-shallow-chain", "conf": 1.0, "crit": 3, "desc": "Cert chain has only 2 entries" }, { "id": "metadata/signed/certificate/identity::pe-signature-verified", "conf": 1.0, "crit": 2, "desc": "PE Authenticode integrity check reports intact" }, { "id": "metadata/signed/certificate/identity::pe-signature-verified-kv", "conf": 1.0, "crit": 2, "desc": "PE Authenticode signer cryptography verifies" }, { "id": "metadata/signed/trust-level::dotnet-strong-name-signed", "conf": 0.95, "crit": 3, "desc": "Managed assembly is strong-name signed" }, { "id": "micro-behaviors/data/embedded/certificate::microsoft-code-signing-pca", "conf": 0.95, "crit": 2, "desc": "Microsoft code-signing certificate chain", "spans": [ [ 291623, 0 ] ] }, { "id": "micro-behaviors/data/embedded/certificate::microsoft-timestamp-chain", "conf": 0.95, "crit": 2, "desc": "Microsoft timestamp certificate chain", "spans": [ [ 296173, 0 ] ] }, { "id": "micro-behaviors/data/embedded/payload/resource::dotnet-resource-reader", "atk": "T1027.009", "conf": 0.86, "crit": 3, "desc": "References the .NET ResourceReader type", "spans": [ [ 2004, 128 ] ] }, { "id": "micro-behaviors/fs/path/extension::utf16-exe-suffix-token", "conf": 0.84, "crit": 3, "desc": "UTF-16 exe filename suffix token", "spans": [ [ 49177, 17 ] ] }, { "id": "objectives/anti-static/obfuscation/payload/fragmentation::pe-script-vbscript-end-marker", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "VBScript function termination marker", "spans": [ [ 159996, 12 ], [ 160638, 7 ] ] }, { "id": "objectives/evasion/masquerade/binary::dense-microsoft-cert-text", "atk": "T1036", "mbc": "OB0006", "conf": 0.9, "crit": 3, "desc": "Dense Microsoft certificate text", "spans": [ [ 1789, 21 ], [ 1818, 43 ], [ 242583, 39 ], [ 290004, 46 ], [ 291591, 25 ], [ 291751, 22 ], [ 293222, 25 ], [ 296061, 25 ] ] }, { "id": "objectives/evasion/masquerade/version-resource/contradiction::microsoft-company-versioninfo-kv", "atk": "T1036.005", "conf": 0.95, "crit": 3, "desc": "Microsoft company version identity", "spans": [ [ 289620, 21 ] ] }, { "id": "well-known/lib/ui/wpf::wpf-namespace-ref", "conf": 0.9, "crit": 3, "desc": ".NET WPF namespace reference", "spans": [ [ 251815, 14 ] ] }, { "id": "well-known/tool/development/toolchain/roslyn::roslyn-runtime-assembly", "conf": 0.96, "crit": 3, "desc": "Roslyn CodeAnalysis runtime assembly" }, { "id": "metadata/binary/provenance/build::pe-far-future-timestamp", "conf": 0.95, "crit": 3, "desc": "PE COFF timestamp encodes a future date" }, { "id": "metadata/binary/symbols/imports::single-import-count", "conf": 0.7, "crit": 3, "desc": "PE with single import" }, { "id": "metadata/binary/vendor::microsoft-corp-versioninfo", "conf": 0.9, "crit": 2, "desc": "Claims Microsoft in version resource", "spans": [ [ 289620, 0 ] ] }, { "id": "metadata/package/versioning/scheme::pe-productname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes ProductName", "spans": [ [ 290242, 11 ] ] }, { "id": "micro-behaviors/crypto/certificate/usage::certificate-ref", "conf": 0.5, "crit": 2, "desc": "References certificate terminology", "spans": [ [ 293269, 0 ] ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.7, "crit": 3, "desc": "References the .NET System.Linq namespace", "spans": [ [ 240372, 11 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET managed assembly", "uses": [ 3, 4 ], "spans": [ [ 592, 0 ] ] }, { "id": "metadata/binary/vendor::microsoft-corp-marker", "conf": 0.9, "crit": 3, "desc": "Parsed Microsoft vendor claim", "uses": [ 13, 15 ], "spans": [ [ 289620, 21 ] ] }, { "id": "metadata/signed/platform::microsoft-signature-verified", "conf": 1.0, "crit": 2, "desc": "Microsoft certificate chain has verified Authenticode signature", "uses": [ 13, 41, 43, 44 ], "spans": [ [ 296173, 0 ] ] }, { "id": "metadata/signed/trust-level::signer-evidence-present", "conf": 1.0, "crit": 3, "desc": "Platform or developer signing evidence", "uses": [ 40, 41 ] }, { "id": "metadata/binary/symbols/imports::managed-resource-bootstrap-import", "conf": 0.95, "crit": 1, "desc": ".resources.dll with CLR bootstrap-only import", "uses": [ 9, 11, 58 ], "spans": [ [ 592, 0 ] ] }, { "id": "metadata/signed/platform::microsoft", "conf": 0.98, "crit": 2, "desc": "Microsoft-signed Windows binary", "uses": [ 1, 60 ], "spans": [ [ 296173, 0 ] ] }, { "id": "metadata/binary/resource/identity::managed-resource-stub", "conf": 0.95, "crit": 1, "desc": ".NET .resources.dll bootstrap stub", "uses": [ 9, 58, 62 ], "spans": [ [ 592, 0 ] ] }, { "id": "metadata/binary/vendor::common-fp-context", "conf": 0.9, "crit": 2, "desc": "Common Windows binary compatibility context", "uses": [ 63 ], "spans": [ [ 296173, 0 ] ] }, { "id": "metadata/binary/vendor::benign-token-privilege-context", "conf": 0.95, "crit": 2, "desc": "Benign token privilege adjustment context", "uses": [ 65 ], "spans": [ [ 296173, 0 ] ] }, { "id": "objectives/privilege-escalation/token-manipulation::dynamic-token-privilege-recognized-marker", "conf": 0.8, "crit": 3, "desc": "Recognized token privilege marker", "uses": [ 66 ], "spans": [ [ 291623, 31 ], [ 296173, 28 ], [ 296351, 29 ] ] }, { "id": "micro-behaviors/data/embedded/payload/resource::dotnet-managed-resource-access", "atk": "T1027.009", "conf": 0.9, "crit": 3, "desc": ".NET embedded-resource API references", "uses": [ 45 ], "spans": [ [ 2004, 128 ] ] } ], "type": "pe" }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47aAzQxazCZol@c-7zeS@@e!5l%bME/A00000p^\u003eu:oAtj}%2Fn*0000000000?#B@z3JR{Y0b.=p00\u0026M800000[@iRH03zmw0h6", "ln": 0 }, { "b": "3\u0026*nc0kFNm00ic20cOtx000000000000000kMy^J00000000000000000000!qTCd00000nb@R\u00260SSx7p-]-r1o[\u0026a2(\u003c@900000r3?OBUX0\u003en1DrxYFb/MH0000000000000000000000000000000000000000lq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCnnc5X\u003cbyPQ)V\u0026HdbGAqbNbu5Y8x(mN800000i0oiY1onA4bumUxjoLS:5c8Xgbs+:9l\u0026Wh!oAUs}Xb=Nfbsli+vGlxd000000SSi32nvdr2($2a0qVZL02tLm0rr913ig5a0rr912(\u003c@92(\u003c@90rr910rr910@@r3000Sj0rr91000i6Hx8e(1{1n}z2\u003c?v830?v4/*RK000i6*w\u003cLv1]#Bslidn\u003cl\u0026YKO1]@6ilidn\u003cRVo3:1]{jPlid5^00031000000rrc22(){90rrYiq#)g6830Rp3ihHPq#)Kgf-UeN5caY\u003cq#)Kgk(:\u003c+5cbo4q#)Kgq2\u003cL@5car.3JN%xe=VK+:P9{[8VY74e=W9@[C\u003efwd/Y$Ue=WWckMJFqi@\u0026gWe=XlsKPv6mo8$7P1B{EL1POS8000000rr919SOUhy5[Uw0000000000000-l3ig5a0000000031004#V007wh00031000i8004mz00031006$s0000006A$]wozZ1j]!JbB97#ge(D?fBzkP607pycB.tt}vR/QwBAzLqvS=^706$WEwO\u003e))C#OH1y?k[OBAh88B-.f{l349UzdmsbmRMWIr+lq)x(v(PBAzLq", "ln": 464 }, { "b": "vS=^708mfqA=l2qw]]T)z!9ABzEEvbB7]XFs8Sa{B8UL$wPGFAwPI^jA:@W4e[w^m08[e:By/qwqE%DRwN/*@z/bLcv@#Tf08[e:By/qwl${7xzF%Prx\u003e8h:q*ACawO\u003c4$B-8qnzdLs!z/6Dcy?mS=wPz%dv}xYYo\u003e!9Tz/Y\u0026eBs]}0wmX5AvqHjgx(+[dz/PSmAa9l/B5DN\u003cz/{8gwPGFlB1RGAB8Mhwv}xYYo\u003e!9Tz/Y*", "ln": 1297 }, { "b": "f/AM0gC?2\u003c044ZDaX=VXA=l2qw]]T)z!9ABzEEvbB7]XFs8Sa{B8UL$wPE?K:3oR8=DtQ\u00260rr91KPkvYy/tR2By/qwqE%]/B-H#6B1Qv4B8Mhwv}wLHvpS}\u0026efF!Jv@Dy7x\u003c@Ror+lq)x(v(Lg+HEmfFk4gavyo/BAIRnj-j?NBAg/aefE=ivR/:*oj-xFz!\u0026{4jZ{uevkRKLhzEiFg?wv2iu}EFB97#ge(Dn4z/{8gwPGF4B-8qnzdMQRB8Mhwv}wOIBohBx0d1RB0000008L%Hp^EGC!p9\u003cz6Xm2S\u003crHEUC$v^]15Gw*BQZQ2tY9(jOZlO=!#5zhc!UbT(yP(0Sd5ozL{7alo+^=4W5a81\u0026wH[l1QxTMxJCUrKM6oszRgzUg0+0zCJtx#4W7q8", "ln": 2084 }, { "b": "DbWHawozS#aAIvw-Lb!\u0026aAR)FBS=2+EjMHUwP2z/ayP7$aBkeHA:-D@C5Cj1xM22jA=l2vz/P$yDOG{\u003ewn=KhB-qloP!lu*t5N\u003e\u003cvr#TfaARTjB8MltP(d=IaBp{", "ln": 16657 }, { "b": "CeHp4zE)^9wmY.3vq-#Zay!#0.(j=%JL?(ty\u0026p{b8C[zvwN]$5y*}VjAb]\u003etBzbxfe*aNBo\u003et{S00000001!!007r![4F/5005bY003?lD2[7sz7XZ$B8Mhwv}xZlqE%]/B-H#6qE%oEwPxsAzf6i9A+]D0efE#8A=U@kzAP*efFk4ifF1tlB.(ex", "ln": 23946 }, { "b": "BAhqpaAI*CByxA9efFwqwGUJ4yJTG9zGE1FfNU6SzY\u0026}eAbPoaz/P#nwIa0vra]?=B8L(qBzkVhay]z4B0bvsBrC7izGGr3zxK4mwGV5kwN/B^x\u003ep/$wn+$2zdNQbe==y0Jbi6yC{4iOAk/0YkuhVvDt^?w-g7UZTVvN)wOV9\u003cA:-D?az]5^zO@N", "ln": 28239 }, { "b": "00000003v[z/OlZy!XtLzuaJ{v@Dy0wIdIfyYBCn0093B03zmM0000000000000000000000000000315c8Xg7YTL^000000000000000000310rr91fAq960000000000000000003100000nb@R\u0026sFbS]J06aX0000000000J07%q00341qVHe8rSCL*qufR}nDqJ^p5[S3nDqG=mGui:00000Y-^*600031ecb[OEi6pb0000000000kl7V-000001onA40SSi2000000000000000l\u0026Wh!0rud2ve$rFmGvc5yYF2DnDrSdw=", "ln": 28624 }, { "b": "00031qVH[tASx!NzuaqHmGvc5yYF2DnDrSdw=M-H0077x00031fAr^bfAr^bfAr{fvGn7Z002W)761vnlJz38z2!IPve$fBC(QOtve$cAwDhYg002Z[x-ISyASy1TA@ZaUw=M]Maoj+ezVB!Tz#:!RASxIFBo31PzVBUP003*na]?SzmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002Z[x-ISyASy1TA@ZaUw=M]Me=XlszVBqFwDk0@zua8ByYF.XA@Y[OA@W/)r@^dsASx\u003ePA@ZdVve%^qwDl=K002aY4GDIfmGvc5yYF2DrSDXhASydXx-J5Kzu6Up001\u003eRe=WWcfAr^be=WTbhukufhVL/qfAr%g004JHfAqaNnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002Z[x-ISyASy1TA@ZaUw=M]Me=XlszVBqFwDk0@zua8ByYF.XA@Y[OA@W/)r@^dsASx\u003ePA@ZdVve%^qwDl=Ke=Y[(wDl=KzVB[WASxOHwDl=Ke=YzZyYFnK004JHe=U[LoAnS7x8(uuyYD*5", "ln": 28922 }, { "b": "k(+Z3yYCNTASx!Nx8(PBBo3vZaolAZwDl=KwDl-JB]V7Nwb[jZ004/PfAqaNpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002Z[x-ISyASy1TA@ZaUw=M]Me=XlszVBqFwDk0@zua8ByYF.XA@Y[OA@W/)r@^dsASx\u003ePA@ZdVve%^qwDl=Ke=Y[(wDl=KzVB[WASxOHwDl=Ke=YzZyYFnK003Kfa]?SzpYLIozVBqFBPt[KBo25ove$cAwDhYg002Z[x-ISyASy1TA@ZaUw=M]Me=XlszVBqFwDk0@zua8ByYF.XA@Y[OA@W/)r@^dsASx\u003ePA@ZdVve%^qwDl=K005q+irf6WpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001\u003eRe=WWce=WN9eDvKae=WTbhukAhhVL/qe=W:ed/.p7hums?iriH*wb[v+h#\u003e=nv/Q3tgYPJohukAhgYQ}:v/OE*g5%rmirh2svGp0uwDjT?hVL/qve@m!wDlftf-T9iwb[B^gxolihVJ*T001$U2MK(9k(+%aA@Y+Kz2!2ByYF.XaokBxwDl-JA@Y[OzVBUP001\u003eRe=WWce=WN9e=WN9000000000000000000000000000000", "ln": 29438 }, { "b": "0000000000000000000000000000000000000000000000000000000000000dU4H3\u0026*nc]GrfO00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", "ln": 30160 }, { "b": "000000000000000000000000000000000000000000000000000000000000000002Q]-N00ii4fOg.J1{(=lnqu\u003cF0s5X0F**1uF*/\u003c+0rB[=fBXi)v1}hMwDJ5p0r\u0026DStM$J=1{1\u0026cF\u0026r-i1FwHzoFvm!3m=qY1oB9k0S-/=2)ghdPAH$\u003cFb?nTfBXi)v1}hMwDJ5p0r\u0026DaaIBr*Iy\u0026UqV}Z9n7v:%#\u0026O3qj7U\u003c\u003evZW{a(agM\u003cE4wnpZ\u003cUhn\u003cv\u003e-Gqop#v*0rJrogxmyTTADn@", "ln": 30668 }, { "b": "Bz(4K5hjN#162Ee69?ADwnMm5whbbV90MHB1pt!So\u003e!9Tz/Y\u0026eBrA}?A=t@qvruj4zzrK[ci:ML1oPqVo\u003e!9Tz/Y\u0026eBrA}?wmV(Zx\u003eIr$zF77*lQq?IfFLpo9V2nvh843Bi59uHi5JZ17y-bTfGgWzf/H%Hh91?]v\u003e!uB2)HGi1o]Ivrz$Q=fCaG\u003errJNv3rHUSxLzu%Bz(4K5hjN#162Ee69?ADwnMm5whbbV90MHB1pt!So\u003e!9Tz/Y\u0026eBrA}?A=t@qvruj4zzqOO3KcYk1oPq", "ln": 30951 }, { "b": "6?@yLA=l2qw]]d.z/P/nA::67z/do+fFAXkrrJyqdnsI^A=l2qw]]d[z/o.ulUgpWx\u003ez6?vru66l3mo.z/PMlC{1\u003c@f!\u003ev67y-8NfGgWBgb7NCfGAqM4kG*}h.WiDf!+QwiA!a=f:/Vw1{m\u003cd1}}5rq.X}t5E5tq1pbUFs7ce-x(mN9z/dovfB!o?rrJKu2u2a", "ln": 32613 }, { "b": "1{m\u003cd3LKO0q!P(Ry?aU/q=s/cq+/wfh.W3tfF#oMeKRPQh.=Qjbl!lI1oPqSo\u003e!9Tz/Y\u0026eBrBK%zdLp$Byx39ax8\u0026(C4\u003eC$PN)^vfOfJLfOfDlPAtk@0S\u003c2\u003e0006cn3S\u0026Z)Y%ef009610TZQ\u003c1{(=lnqu\u003cF0rAMi05e^P3OR\u003e\u003e162Ed69qfjf+VkM1{m\u003cd2ONLDvrl9@zFa6fzzqXR4H92n", "ln": 35517 }, { "b": "wnMm5whbbV90MHB1pt!So\u003e!9Tz/Y\u0026eBrA}?A=t@qvruj4zzrE(bNauJ1oPqTo\u003e!9Tz/Y\u0026eBrBK%zdLp$Byx39aw+A\u003eatLS9fFBK:4kG^{f/7Hriw-GGh^d1bgbZ*ygbpNAg+{{Es$\u003eJJf:/Vw1{m\u003cd1}}5rq.X}t5E5tq1pbUFs7ce-x(mN9z/dovfB!o?rrJKu2u2bzzeTr5f=\u00261*1{m\u003cd3i", "ln": 35695 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 28160, 4.94, "r-x" ], [ ".rsrc", 28672, 1536, 2.9, "r--" ], [ ".reloc", 30208, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 46982, "timestamp": 2529901055, "image_size": 57344, "headers_size": 512, "checksum_valid": 1, "clr.is_il_only": 1, "file_alignment": 512, "resource_count": 1, "cert_table_size": 10504, "has_version_info": 1, "computed_checksum": 46982, "headers_size_ratio": 0.01, "prose_section_count": 0, "reloc_overhang_bytes": 500, "reloc_overhang_ratio": 0.98, "clr.is_32bit_required": 0, "bss_like_section_count": 0, "clr.is_32bit_preferred": 0, "clr.strong_name_signed": 1, "section_overflow_count": 0, "signature_expired_days": 80.19, "clr.is_native_entrypoint": 0, "clr.strong_name_sig_size": 128, "misaligned_section_count": 0, "version.identity_entropy": 4.09, "clr.managed_resource_count": 1, "base_relocation_block_count": 1, "base_relocation_entry_count": 1, "clr.managed_resource_max_size": 16583, "declared_data_directory_count": 7, "version.identity_symbol_ratio": 0.05, "executable_prose_section_count": 0, "clr.managed_resource_max_entropy": 4.8, "directory_section_mismatch_count": 0 }, "file": { "size": 41224, "entropy": 5.81 }, "binary": { "is_pie": 1, "has_overlay": 1, "code_entropy": 4.94, "overlay_size": 10504, "string_count": 557, "overlay_ratio": 0.25, "overlay_entropy": 7.52, "entropy_variance": 3.97, "avg_string_length": 20.02, "max_string_length": 145, "peak_region_bytes": 11528, "code_to_data_ratio": 1, "peak_region_entropy": 7.45, "string_length_stddev": 18.07, "largest_section_ratio": 0.68, "sentence_string_count": 129, "sentence_string_ratio": 0.23, "high_entropy_string_count": 0 }, "imports": { "count": 1 }, "strings": { "truncated": 0, "retained_count": 557, "extracted_count": 557 }, "sections": { "count": 3, "code_size": 28160, "entropy_max": 4.94, "entropy_mean": 2.64, "name_entropy": 3.03, "writable_count": 0, "executable_count": 1, "nonstandard_count": 0, "executable_writable_count": 0 }, "consistency": { "internal_name_original_filename_mismatch": 0 }, "dependencies": { "count": 1 } } }, "id": 58, "ident": { "name": { "value": "Microsoft.CodeAnalysis.Workspaces.resources.dll", "source": "pe.version.original_filename", "verified": false }, "title": { "value": "Microsoft.CodeAnalysis.Workspaces", "source": "pe.version.description", "verified": false }, "trust": "platform", "signer": { "issuer": "CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US", "source": "pe.signatures[0]", "subject": "CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US", "signed_at": "2026-01-28 19:02:01 UTC", "common_name": ".NET", "organization": "Microsoft Corporation" }, "project": { "value": "Microsoft.CodeAnalysis.Workspaces", "source": "pe.version.product_name", "verified": false }, "version": { "value": "5.300.26.7805", "source": "pe.version.file_version", "verified": false }, "unique_ids": { "authenticode_thumbprint_sha256": "51282e7ce7c8cd8d908b1c2e1a7b54f7ced3e54c4c1b3d6d3747181a322051d3" }, "organization": { "value": "Microsoft Corporation", "source": "pe.signatures[0]", "verified": true } }, "mol": "K(Te)O₂(Er₂Pr)H(Db)Md₄(Bi₅PaPtSi₄)", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/cs/Microsoft.CodeAnalysis.Workspaces.resources.dll", "pid": 0, "risk": 16, "sha": "c76d28e9bdd3d7199e81c9dbc2aacb70286e823ff81c3481c36a337bcf78c098", "size": 41224, "traits": [ { "id": "metadata/signed/unknown::.net", "conf": 1.0, "crit": 3, "desc": "Authenticode chain CN: .NET" }, { "id": "metadata/signed/leaf::microsoft-corporation", "conf": 1.0, "crit": 3, "desc": "Signed by Microsoft Corporation" }, { "id": "metadata/binary/code/entropy::code-entropy-at-most-7-5", "conf": 0.7, "crit": 2, "desc": "Code entropy is 7.5 or lower", "spans": [ [ 512, 28160 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR header (COM descriptor)" }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET metadata root signature (BSJB)", "spans": [ [ 592, 0 ] ] }, { "id": "metadata/binary/layout/overlay::image-under-768kb", "conf": 0.9, "crit": 3, "desc": "PE mapped image under 768 KiB" }, { "id": "metadata/binary/layout/size::small-pe", "conf": 0.6, "crit": 3, "desc": "Small PE binary (\u003c100KB)" }, { "id": "metadata/binary/resource/identity::pe-description-equals-product-name", "conf": 0.9, "crit": 3, "desc": "PE description duplicates ProductName" }, { "id": "metadata/binary/resource/identity::pe-resource-version-first", "conf": 1.0, "crit": 2, "desc": "PE first resource is RT_VERSION" }, { "id": "metadata/binary/resource/identity::resources-dll-extension", "conf": 0.9, "crit": 3, "desc": ".resources.dll satellite assembly" }, { "id": "metadata/binary/section/prose::rich-sentence-strings-20pct", "conf": 0.8, "crit": 2, "desc": "Binary has many sentence-like strings" }, { "id": "metadata/binary/symbols/imports::single-import-raw", "conf": 0.7, "crit": 2, "desc": "PE import table has exactly one entry" }, { "id": "metadata/binary/vendor::is-microsoft-named", "conf": 0.8, "crit": 3, "desc": "File name contains Microsoft" }, { "id": "metadata/binary/vendor::microsoft-corp-marker-cert", "conf": 0.9, "crit": 3, "desc": "Microsoft certificate-chain identity marker" }, { "id": "metadata/binary/vendor::microsoft-corp-marker-rsrc", "conf": 0.9, "crit": 3, "desc": "Microsoft vendor marker in resource section", "spans": [ [ 29012, 21 ] ] }, { "id": "metadata/binary/vendor::microsoft-prefixed-company", "conf": 0.9, "crit": 3, "desc": "PE company name identifies Microsoft", "spans": [ [ 29012, 21 ] ] }, { "id": "metadata/build/reproducible::pe-reproducible-build", "conf": 1.0, "crit": 2, "desc": "Built with /Brepro (deterministic)" }, { "id": "metadata/file/magic/identity::pe-dos-stub", "conf": 1.0, "crit": 2, "desc": "PE/DOS MZ header at file start", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/lang/compiler/managed::mscorlib", "conf": 0.9, "crit": 3, "desc": "mscorlib reference", "spans": [ [ 2148, 128 ] ] }, { "id": "metadata/lang/compiler/managed::reflection-namespace", "conf": 0.7, "crit": 2, "desc": ".NET System.Reflection namespace reference", "spans": [ [ 1350, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 28287, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 78, 0 ] ] }, { "id": "metadata/lang/natural::polish-common-word-ale", "conf": 1.0, "crit": 1, "desc": "Polish common word ale", "spans": [ [ 16689, 0 ] ] }, { "id": "metadata/package/versioning/scheme::pe-companyname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes CompanyName", "spans": [ [ 28986, 11 ] ] }, { "id": "metadata/package/versioning/scheme::pe-filedescription-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes FileDescription", "spans": [ [ 29062, 15 ] ] }, { "id": "metadata/package/versioning/scheme::pe-fileversion-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes FileVersion", "spans": [ [ 29170, 11 ] ] }, { "id": "metadata/package/versioning/scheme::pe-internalname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes InternalName", "spans": [ [ 29230, 12 ] ] }, { "id": "metadata/package/versioning/scheme::pe-productversion-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes ProductVersion", "spans": [ [ 29722, 14 ] ] }, { "id": "metadata/package/versioning/scheme::pe-version-file-version-value", "conf": 0.9, "crit": 3, "desc": "PE version resource carries a file version", "spans": [ [ 29196, 13 ] ] }, { "id": "metadata/package/versioning/scheme::pe-version-product-name-value", "conf": 0.9, "crit": 3, "desc": "PE version resource names a product", "spans": [ [ 29648, 33 ] ] }, { "id": "metadata/package/versioning/scheme::pe-version-resource", "conf": 0.8, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 28766, 0 ] ] }, { "id": "metadata/package/versioning/scheme::version-info-file-version-present", "conf": 0.95, "crit": 3, "desc": "PE FileVersion value is present", "spans": [ [ 29196, 13 ] ] }, { "id": "metadata/signed/certificate/identity::pe-cert-shallow-chain", "conf": 1.0, "crit": 3, "desc": "Cert chain has only 2 entries" }, { "id": "metadata/signed/certificate/identity::pe-signature-verified", "conf": 1.0, "crit": 2, "desc": "PE Authenticode integrity check reports intact" }, { "id": "metadata/signed/certificate/identity::pe-signature-verified-kv", "conf": 1.0, "crit": 2, "desc": "PE Authenticode signer cryptography verifies" }, { "id": "metadata/signed/trust-level::dotnet-strong-name-signed", "conf": 0.95, "crit": 3, "desc": "Managed assembly is strong-name signed" }, { "id": "micro-behaviors/data/embedded/certificate::microsoft-code-signing-pca", "conf": 0.95, "crit": 2, "desc": "Microsoft code-signing certificate chain", "spans": [ [ 31015, 0 ] ] }, { "id": "micro-behaviors/data/embedded/certificate::microsoft-timestamp-chain", "conf": 0.95, "crit": 2, "desc": "Microsoft timestamp certificate chain", "spans": [ [ 35565, 0 ] ] }, { "id": "micro-behaviors/data/embedded/payload/resource::dotnet-resource-reader", "atk": "T1027.009", "conf": 0.86, "crit": 3, "desc": "References the .NET ResourceReader type", "spans": [ [ 2148, 128 ] ] }, { "id": "objectives/evasion/masquerade/binary::overlay-pkcs7-signeddata-oid", "atk": "T1036.001", "conf": 0.9, "crit": 3, "desc": "PKCS7 SignedData OID in overlay", "spans": [ [ 30732, 32 ] ] }, { "id": "objectives/evasion/masquerade/version-resource/contradiction::microsoft-company-versioninfo-kv", "atk": "T1036.005", "conf": 0.95, "crit": 3, "desc": "Microsoft company version identity", "spans": [ [ 29012, 21 ] ] }, { "id": "well-known/tool/development/toolchain/roslyn::roslyn-runtime-assembly", "conf": 0.96, "crit": 3, "desc": "Roslyn CodeAnalysis runtime assembly" }, { "id": "metadata/binary/provenance/build::pe-far-future-timestamp", "conf": 0.95, "crit": 3, "desc": "PE COFF timestamp encodes a future date" }, { "id": "metadata/binary/symbols/imports::single-import-count", "conf": 0.7, "crit": 3, "desc": "PE with single import" }, { "id": "metadata/binary/vendor::microsoft-corp-versioninfo", "conf": 0.9, "crit": 2, "desc": "Claims Microsoft in version resource", "spans": [ [ 29012, 0 ] ] }, { "id": "metadata/package/versioning/scheme::pe-productname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes ProductName", "spans": [ [ 29622, 11 ] ] }, { "id": "micro-behaviors/crypto/certificate/usage::certificate-ref", "conf": 0.5, "crit": 2, "desc": "References certificate terminology", "spans": [ [ 32661, 0 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET managed assembly", "uses": [ 3, 4 ], "spans": [ [ 592, 0 ] ] }, { "id": "metadata/binary/vendor::microsoft-corp-marker", "conf": 0.9, "crit": 3, "desc": "Parsed Microsoft vendor claim", "uses": [ 13, 15 ], "spans": [ [ 29012, 21 ] ] }, { "id": "metadata/package/versioning/scheme::version-resource-metadata", "conf": 0.9, "crit": 2, "desc": "PE version resource metadata", "uses": [ 25, 27, 30 ], "spans": [ [ 29722, 0 ] ] }, { "id": "metadata/signed/platform::microsoft-signature-verified", "conf": 1.0, "crit": 2, "desc": "Microsoft certificate chain has verified Authenticode signature", "uses": [ 13, 34, 36, 37 ], "spans": [ [ 35565, 0 ] ] }, { "id": "metadata/signed/trust-level::signer-evidence-present", "conf": 1.0, "crit": 3, "desc": "Platform or developer signing evidence", "uses": [ 33, 34 ] }, { "id": "micro-behaviors/data/embedded/payload/resource::dotnet-embedded-resource-read-any", "atk": "T1027.009", "conf": 0.86, "crit": 3, "desc": ".NET resource-reading API references", "uses": [ 38 ], "spans": [ [ 2148, 128 ] ] }, { "id": "metadata/binary/symbols/imports::managed-resource-bootstrap-import", "conf": 0.95, "crit": 1, "desc": ".resources.dll with CLR bootstrap-only import", "uses": [ 9, 11, 47 ], "spans": [ [ 592, 0 ] ] }, { "id": "metadata/signed/platform::microsoft", "conf": 0.98, "crit": 2, "desc": "Microsoft-signed Windows binary", "uses": [ 1, 50 ], "spans": [ [ 35565, 0 ] ] }, { "id": "metadata/binary/resource/identity::managed-resource-stub", "conf": 0.95, "crit": 1, "desc": ".NET .resources.dll bootstrap stub", "uses": [ 9, 47, 53 ], "spans": [ [ 592, 0 ] ] }, { "id": "metadata/binary/vendor::common-fp-context", "conf": 0.9, "crit": 2, "desc": "Common Windows binary compatibility context", "uses": [ 54 ], "spans": [ [ 35565, 0 ] ] }, { "id": "metadata/binary/vendor::benign-token-privilege-context", "conf": 0.95, "crit": 2, "desc": "Benign token privilege adjustment context", "uses": [ 56 ], "spans": [ [ 35565, 0 ] ] }, { "id": "objectives/privilege-escalation/token-manipulation::dynamic-token-privilege-recognized-marker", "conf": 0.8, "crit": 3, "desc": "Recognized token privilege marker", "uses": [ 57 ], "spans": [ [ 31015, 31 ], [ 35565, 28 ], [ 35743, 29 ] ] }, { "id": "micro-behaviors/data/embedded/payload/resource::dotnet-managed-resource-access", "atk": "T1027.009", "conf": 0.9, "crit": 3, "desc": ".NET embedded-resource API references", "uses": [ 38 ], "spans": [ [ 2148, 128 ] ] } ], "type": "pe" }, { "id": 59, "mol": "Md(Si₂)", "sha": "8640bd05a77d031c3e106b98a368e4f51618e2aacf1027f9e0e28b260997839f", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/cs/Microsoft.CodeAnalysis.resources.dll", "risk": 2, "size": 40752, "type": "pe", "depth": 1 }, { "id": 60, "mol": "Md(Si₂)", "sha": "6acf19018932c80bf35a516f2eb9fe056dbfe642d3f59a22bd92d3ba8ed6e063", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/de/Microsoft.CodeAnalysis.CSharp.Workspaces.resources.dll", "risk": 2, "size": 17680, "type": "pe", "depth": 1 }, { "id": 61, "mol": "Md(Si₂)", "sha": "f2ef12aae4aff749ed5963075da86aa8fd3dec43890e5fd7b00bc227daad28b6", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/de/Microsoft.CodeAnalysis.CSharp.resources.dll", "risk": 2, "size": 476936, "type": "pe", "depth": 1 }, { "id": 62, "mol": "Md(Si₂)", "sha": "557e2fc143e44efc73c4db9f7f43d45eb61044b9c93af69fb0cf80fbfa91aab1", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/de/Microsoft.CodeAnalysis.VisualBasic.Workspaces.resources.dll", "risk": 2, "size": 25360, "type": "pe", "depth": 1 }, { "id": 63, "mol": "Md(Si₂)", "sha": "66c8986f13d1977d1cefc90fb06c44c303abefe12fa48c12212e9a6fb7fd82d5", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/de/Microsoft.CodeAnalysis.VisualBasic.resources.dll", "risk": 2, "size": 318736, "type": "pe", "depth": 1 }, { "id": 64, "mol": "Md(Si₂)", "sha": "e362f8aceff1dfea9edf9f24962df1ad050d2f745847000cfeb89f71ccc79aac", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/de/Microsoft.CodeAnalysis.Workspaces.resources.dll", "risk": 2, "size": 42768, "type": "pe", "depth": 1 }, { "id": 65, "mol": "Md(Si₂)", "sha": "94d6757fb39d637408cae00569779a58ed5ba91cfe17484b7d9c37b5e686ea85", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/de/Microsoft.CodeAnalysis.resources.dll", "risk": 2, "size": 42248, "type": "pe", "depth": 1 }, { "id": 66, "sha": "32aea09e5450cbd02dade8c8a42e71c3fe6efc96f2ce11b114ab2edbac8237d6", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/de/Spectre.Console.Cli.resources.dll", "size": 5120, "type": "pe", "depth": 1 }, { "id": 67, "mol": "Md(Si₂)", "sha": "2299aeec02fabebf07d4a369cb6d9d25de737e66865a530b170c95d5967c285e", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/es/Microsoft.CodeAnalysis.CSharp.Workspaces.resources.dll", "risk": 2, "size": 17672, "type": "pe", "depth": 1 }, { "id": 68, "mol": "Md(Si₂)", "sha": "be4dc7f5d2b6c074601d4acf1404350fad40196d8edb0a4e3d04d59ea3dd530d", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/es/Microsoft.CodeAnalysis.CSharp.resources.dll", "risk": 2, "size": 466704, "type": "pe", "depth": 1 }, { "id": 69, "mol": "Md(Si₂)", "sha": "119fefc2aeda9d89e0a7e1339c86dee6c4fa507fa796ce69bf34d5bf5bfaec28", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/es/Microsoft.CodeAnalysis.VisualBasic.Workspaces.resources.dll", "risk": 2, "size": 25360, "type": "pe", "depth": 1 }, { "id": 70, "mol": "Md(Si₂)", "sha": "957dea23376f98ec24d8d64f9e5e2e27938429ace8cab3cf1e220f9d9a5e84e4", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/es/Microsoft.CodeAnalysis.VisualBasic.resources.dll", "risk": 2, "size": 314120, "type": "pe", "depth": 1 }, { "id": 71, "mol": "Md(Si₂)", "sha": "5780e176c9be023a177c079d42ab8dedbc5116329181d88e51c8b14c5faf87f1", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/es/Microsoft.CodeAnalysis.Workspaces.resources.dll", "risk": 2, "size": 42248, "type": "pe", "depth": 1 }, { "id": 72, "mol": "Md(Si₂)", "sha": "99940d1871054ae5bbd831d93f827bf3f46cfac13ec637d630be4490ce80e537", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/es/Microsoft.CodeAnalysis.resources.dll", "risk": 2, "size": 41736, "type": "pe", "depth": 1 }, { "id": 73, "sha": "9fa38778e99f757cb55a2ffeed1fb9683ce4b59698127bb83b1757f6cfb59819", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/es/Spectre.Console.Cli.resources.dll", "size": 5120, "type": "pe", "depth": 1 }, { "id": 74, "mol": "Md(Si₂)", "sha": "111c09e2c8ab0e93b8e232ca1c82759c7b768461a092204874a4cde5fe74be31", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/fr/Microsoft.CodeAnalysis.CSharp.Workspaces.resources.dll", "risk": 2, "size": 17672, "type": "pe", "depth": 1 }, { "id": 75, "mol": "Md(Si₂)", "sha": "cb54a8579e7d85a17e08bb72b1a675264ee92f51b00a1d5e9a3b88367da85ef9", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/fr/Microsoft.CodeAnalysis.CSharp.resources.dll", "risk": 2, "size": 480016, "type": "pe", "depth": 1 }, { "id": 76, "mol": "Md(Si₂)", "sha": "cb8b039608cf8f8a963f6fd9e436d7de427364ae5d558f19e535bdd9c7c0e9fb", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/fr/Microsoft.CodeAnalysis.VisualBasic.Workspaces.resources.dll", "risk": 2, "size": 25400, "type": "pe", "depth": 1 }, { "id": 77, "mol": "Md(Si₂)", "sha": "41ebeacf251cac2296cb766594f9269ddc85f321cc288287fba187498c5c10dc", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/fr/Microsoft.CodeAnalysis.VisualBasic.resources.dll", "risk": 2, "size": 321296, "type": "pe", "depth": 1 }, { "id": 78, "mol": "Md(Si₂)", "sha": "d71ad86a3ed20a967ded02c53a2453d089546cc6f5721e88a686e3f18172ffbc", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/fr/Microsoft.CodeAnalysis.Workspaces.resources.dll", "risk": 2, "size": 43272, "type": "pe", "depth": 1 }, { "id": 79, "mol": "Md(Si₂)", "sha": "6034effb82164c43030f0452400b537d8955b1e9a84b7ae76e5f7a1f7fecf728", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/fr/Microsoft.CodeAnalysis.resources.dll", "risk": 2, "size": 42288, "type": "pe", "depth": 1 }, { "id": 80, "sha": "e7aea3a961db7018864a1ba2d467b154a14131b946567570f964b4e89cfe04a3", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/fr/Spectre.Console.Cli.resources.dll", "size": 5120, "type": "pe", "depth": 1 }, { "id": 81, "mol": "Md(Si₂)", "sha": "ef5fa5d7d101a1edc26208a6dd19b3f1b28c1be228fb2114e9112c88f330c513", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/it/Microsoft.CodeAnalysis.CSharp.Workspaces.resources.dll", "risk": 2, "size": 17672, "type": "pe", "depth": 1 }, { "id": 82, "mol": "Md(Si₂)", "sha": "683c808be9efd6c87ce6a7de06d7fc8df152324db3d72bdcffce209a382a75ae", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/it/Microsoft.CodeAnalysis.CSharp.resources.dll", "risk": 2, "size": 472848, "type": "pe", "depth": 1 }, { "id": 83, "mol": "Md(Si₂)", "sha": "c486c71462732634e4542d9f400e35d67ebc5a39f9163c06d1bc55f17409d0d2", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/it/Microsoft.CodeAnalysis.VisualBasic.Workspaces.resources.dll", "risk": 2, "size": 25352, "type": "pe", "depth": 1 }, { "id": 84, "mol": "Md(Si₂)", "sha": "3f0ab392aeae40b718e2ed3692fb099982864abd1d6353ee722cced35b1fd42b", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/it/Microsoft.CodeAnalysis.VisualBasic.resources.dll", "risk": 2, "size": 318256, "type": "pe", "depth": 1 }, { "id": 85, "mol": "Md(Si₂)", "sha": "798cedb5fe679e9f7a0cf47ba74048692a04a3848bbf5f01528b7ef59b87b7e3", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/it/Microsoft.CodeAnalysis.Workspaces.resources.dll", "risk": 2, "size": 42760, "type": "pe", "depth": 1 }, { "id": 86, "mol": "Md(Si₂)", "sha": "d1ed76fd23fac3e03ba72ebb66b129f7dc2771cdf9d8ba441b2dd4046dccb769", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/it/Microsoft.CodeAnalysis.resources.dll", "risk": 2, "size": 42256, "type": "pe", "depth": 1 }, { "id": 87, "sha": "1fea40b0ff4878d1b6688a8f2a53fbea82de59cc40bff68880379d7683f2a73c", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/it/Spectre.Console.Cli.resources.dll", "size": 5120, "type": "pe", "depth": 1 }, { "id": 88, "mol": "Md(Si₂)", "sha": "8b6a4c0894b0eecb8915a4b0635418078704ae320c27bf2aa46e07eedfda97e2", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/ja/Microsoft.CodeAnalysis.CSharp.Workspaces.resources.dll", "risk": 2, "size": 17680, "type": "pe", "depth": 1 }, { "id": 89, "mol": "Md(Si₂)", "sha": "dddc1b5e4a5492699e66596d5398e3ba7aeff0c1a4417baede5a44f8419f8967", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/ja/Microsoft.CodeAnalysis.CSharp.resources.dll", "risk": 2, "size": 521488, "type": "pe", "depth": 1 }, { "id": 90, "mol": "Md(Si₂)", "sha": "6b84ab6ef7f4eb12d5b69cf9a70e6e220451a15889231f6f8edba63b8fa44be8", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/ja/Microsoft.CodeAnalysis.VisualBasic.Workspaces.resources.dll", "risk": 2, "size": 25352, "type": "pe", "depth": 1 }, { "id": 91, "mol": "Md(Si₂)", "sha": "e87563e178675b9da18ba11b360347015e070f03cb06dfb096deb93767fbcf37", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/ja/Microsoft.CodeAnalysis.VisualBasic.resources.dll", "risk": 2, "size": 354616, "type": "pe", "depth": 1 }, { "id": 92, "mol": "Md(Si₂)", "sha": "c531884373511a2120ce2a6758c777602b313707397c358a42e2784189acbd24", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/ja/Microsoft.CodeAnalysis.Workspaces.resources.dll", "risk": 2, "size": 45320, "type": "pe", "depth": 1 }, { "id": 93, "mol": "Md(Si₂)", "sha": "06baf68aeeee8eed6a6d6e8ce9036ef3edcfeb12de876583eddb8eaec60db2bb", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/ja/Microsoft.CodeAnalysis.resources.dll", "risk": 2, "size": 44848, "type": "pe", "depth": 1 }, { "id": 94, "sha": "42a8fc05e1b72063652ae2ab76a009cc0852771607a03290b8754594162f81cb", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/ja/Spectre.Console.Cli.resources.dll", "size": 5120, "type": "pe", "depth": 1 }, { "id": 95, "mol": "Md(Si₂)", "sha": "d679f1de28dec5aac4e9310231897d9a8f307a6d93ab850b05989a28203e5049", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/ko/Microsoft.CodeAnalysis.CSharp.Workspaces.resources.dll", "risk": 2, "size": 17680, "type": "pe", "depth": 1 }, { "id": 96, "mol": "Md(Si₂)", "sha": "3d6defb5ce07fd17cb00ca5633e57a3a65e5ab7967732d506af1a16e09f0baa0", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/ko/Microsoft.CodeAnalysis.CSharp.resources.dll", "risk": 2, "size": 477968, "type": "pe", "depth": 1 }, { "id": 97, "mol": "Md(Si₂)", "sha": "3526b50e27f5568b2d51897b47d5113dc2ff3c116a3e138ff5a2e387db5bf664", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/ko/Microsoft.CodeAnalysis.VisualBasic.Workspaces.resources.dll", "risk": 2, "size": 25360, "type": "pe", "depth": 1 }, { "id": 98, "mol": "Md(Si₂)", "sha": "c9b3f15877a12ca86a4180bf3fa302fb9b0ba2163731a26d33f54008dc8664c7", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/ko/Microsoft.CodeAnalysis.VisualBasic.resources.dll", "risk": 2, "size": 323896, "type": "pe", "depth": 1 }, { "id": 99, "mol": "Md(Si₂)", "sha": "e45ccf544e8aa2b524cce86b9da097127626b35046d7305359f01dde229d74a8", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/ko/Microsoft.CodeAnalysis.Workspaces.resources.dll", "risk": 2, "size": 43272, "type": "pe", "depth": 1 }, { "id": 100, "mol": "Md(Si₂)", "sha": "0166f80f1a55d947ca4151cb70f36f0cead39fad1fcf648ebe2419c3de1f9538", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/ko/Microsoft.CodeAnalysis.resources.dll", "risk": 2, "size": 42288, "type": "pe", "depth": 1 }, { "id": 101, "sha": "846bcae0b086e67cc0594eafd58a2ab7fbd2ac20dfc3b9ede3906759864043a4", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/ko/Spectre.Console.Cli.resources.dll", "size": 5120, "type": "pe", "depth": 1 }, { "id": 104, "mol": "Md(Si₂)", "sha": "f3eeb6af8e35080150917d38b557f70cf66355475905958e0cc84b87a9e3f749", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/pl/Microsoft.CodeAnalysis.CSharp.Workspaces.resources.dll", "risk": 2, "size": 17680, "type": "pe", "depth": 1 }, { "id": 105, "mol": "Md(Si₂)", "sha": "a9387ec315713a7e32861425159954939e6139b6dee171feb785b27d1d31ca85", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/pl/Microsoft.CodeAnalysis.CSharp.resources.dll", "risk": 2, "size": 479536, "type": "pe", "depth": 1 }, { "id": 106, "mol": "Md(Si₂)", "sha": "9f7ab8944aa417a412aef7d7eb6e703ba152c872fb9c9f7c68d05825e7cadeab", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/pl/Microsoft.CodeAnalysis.VisualBasic.Workspaces.resources.dll", "risk": 2, "size": 25392, "type": "pe", "depth": 1 }, { "id": 107, "mol": "Md(Si₂)", "sha": "58c7e5e43c3bc62ff696bd902045b3a16d8d24d88c4f5f692722a9823d29cb8c", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/pl/Microsoft.CodeAnalysis.VisualBasic.resources.dll", "risk": 2, "size": 328456, "type": "pe", "depth": 1 }, { "id": 108, "mol": "Md(Si₂)", "sha": "d1b6ce17fbed195419ac5132666ac9ea328613a5744a09607454699c2522cc31", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/pl/Microsoft.CodeAnalysis.Workspaces.resources.dll", "risk": 2, "size": 42800, "type": "pe", "depth": 1 }, { "id": 109, "mol": "Md(Si₂)", "sha": "f87d2a495d891868696e24c725d2c480779757df7e3bd22bc66ae927228f181a", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/pl/Microsoft.CodeAnalysis.resources.dll", "risk": 2, "size": 42288, "type": "pe", "depth": 1 }, { "id": 110, "mol": "Md(Si₂)", "sha": "d9ddfac08376cd788b8c586be8dd24e3ff46360c7e1057b9a0fb24e095836391", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/pt-BR/Microsoft.CodeAnalysis.CSharp.Workspaces.resources.dll", "risk": 2, "size": 17680, "type": "pe", "depth": 1 }, { "id": 111, "mol": "Md(Si₂)", "sha": "a7c1c4307ac34be111639f5addfa1729725fe7748703ff24add55d4bda35851b", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/pt-BR/Microsoft.CodeAnalysis.CSharp.resources.dll", "risk": 2, "size": 458512, "type": "pe", "depth": 1 }, { "id": 112, "mol": "Md(Si₂)", "sha": "22a579acfacd295b79f55a3c85ef7996128ca430f380672fbea793560d2252fa", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/pt-BR/Microsoft.CodeAnalysis.VisualBasic.Workspaces.resources.dll", "risk": 2, "size": 25352, "type": "pe", "depth": 1 }, { "id": 113, "mol": "Md(Si₂)", "sha": "4d241a0f7653157f19c91f9ee081fe493ef3bf7e8a36a1057cbc3c2322b9a771", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/pt-BR/Microsoft.CodeAnalysis.VisualBasic.resources.dll", "risk": 2, "size": 307000, "type": "pe", "depth": 1 }, { "id": 114, "mol": "Md(Si₂)", "sha": "377c1d846b08747bfc7bb0ea1c26c206ee31ab4992b479c452c0534ae37ea22b", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/pt-BR/Microsoft.CodeAnalysis.Workspaces.resources.dll", "risk": 2, "size": 42288, "type": "pe", "depth": 1 }, { "id": 115, "mol": "Md(Si₂)", "sha": "95f373f7055ac0342c2a116710688015ea3a662cc19b8aa66c5484409aa49369", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/pt-BR/Microsoft.CodeAnalysis.resources.dll", "risk": 2, "size": 41272, "type": "pe", "depth": 1 }, { "id": 116, "sha": "8cfaaebcd5c756b6628cae570a9188583bcfe04f35c38026310da89552b231b3", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/pt/Spectre.Console.Cli.resources.dll", "size": 5120, "type": "pe", "depth": 1 }, { "id": 117, "mol": "Md(Si₂)", "sha": "e57a0bb565681284a2bd4f0294499c06ec3faa16566e047eaa22a56624eb6c4b", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/ru/Microsoft.CodeAnalysis.CSharp.Workspaces.resources.dll", "risk": 2, "size": 18192, "type": "pe", "depth": 1 }, { "id": 118, "mol": "Md(Si₂)", "sha": "e180f350d6b38a19464045c2b1f0c3e409d303843e02321b8bfcf61d0616d513", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/ru/Microsoft.CodeAnalysis.CSharp.resources.dll", "risk": 2, "size": 629512, "type": "pe", "depth": 1 }, { "id": 119, "mol": "Md(Si₂)", "sha": "dd43f45a3fbe77bda57fb587691165202f08c06703c06787dfe2e57427b84957", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/ru/Microsoft.CodeAnalysis.VisualBasic.Workspaces.resources.dll", "risk": 2, "size": 27440, "type": "pe", "depth": 1 }, { "id": 120, "mol": "Md(Si₂)", "sha": "3b852a6a714d977fcbf0eba55410100d09f4bb714b43463af96cec9f10e7f1ea", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/ru/Microsoft.CodeAnalysis.VisualBasic.resources.dll", "risk": 2, "size": 411440, "type": "pe", "depth": 1 }, { "id": 121, "mol": "Md(Si₂)", "sha": "f3e4e564262f8ec58be6e2f84602585a9d5b33b9c7a8a72c4cae1df079f9f3c0", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/ru/Microsoft.CodeAnalysis.Workspaces.resources.dll", "risk": 2, "size": 47928, "type": "pe", "depth": 1 }, { "id": 122, "mol": "Md(Si₂)", "sha": "34b77c23625160b340098b33045997138ff042ca87fccf90f9bfab9deb132f8a", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/ru/Microsoft.CodeAnalysis.resources.dll", "risk": 2, "size": 50448, "type": "pe", "depth": 1 }, { "id": 123, "sha": "639e7853be30264f090d3d70788072264799650e31d90d05ca0d906b13701c24", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/ru/Spectre.Console.Cli.resources.dll", "size": 5632, "type": "pe", "depth": 1 }, { "id": 124, "sha": "c4a5704b7be119f1b716e391ba182e5d0b7278d73bbdc3cf2721d93b26e4bb84", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/sv/Spectre.Console.Cli.resources.dll", "size": 5120, "type": "pe", "depth": 1 }, { "id": 125, "mol": "Md(Si₂)", "sha": "2739dcf468ad55ea78920c52e4918dca79e68146d0760b818a6d8991544be28f", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/tr/Microsoft.CodeAnalysis.CSharp.Workspaces.resources.dll", "risk": 2, "size": 17680, "type": "pe", "depth": 1 }, { "id": 126, "mol": "Md(Si₂)", "sha": "c31ef90f3205755bac7b531c92d2ce790f78950a360f438856222593ebddc784", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/tr/Microsoft.CodeAnalysis.CSharp.resources.dll", "risk": 2, "size": 453392, "type": "pe", "depth": 1 }, { "id": 127, "mol": "Md(Si₂)", "sha": "8a6f823cc0025b6bc7dd35525224211fd0ab4e6b17e4aa2700f4fafedaa4e9d1", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/tr/Microsoft.CodeAnalysis.VisualBasic.Workspaces.resources.dll", "risk": 2, "size": 25392, "type": "pe", "depth": 1 }, { "id": 128, "mol": "Md(Si₂)", "sha": "b315947eade35991a4a98abeaaebe3a7818316dd0d92078c20fbd019d95f7518", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/tr/Microsoft.CodeAnalysis.VisualBasic.resources.dll", "risk": 2, "size": 304440, "type": "pe", "depth": 1 }, { "id": 129, "mol": "Md(Si₂)", "sha": "6153099849db745190d8d3d6e42aa897f0881bd62e308b35f5577a86e6083cd2", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/tr/Microsoft.CodeAnalysis.Workspaces.resources.dll", "risk": 2, "size": 41744, "type": "pe", "depth": 1 }, { "id": 130, "mol": "Md(Si₂)", "sha": "32cb2b00f6460aaa372930b25adc772709e9d93ea983a6ca295ff5bc1c6b7472", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/tr/Microsoft.CodeAnalysis.resources.dll", "risk": 2, "size": 41264, "type": "pe", "depth": 1 }, { "id": 131, "mol": "Md(Si₂)", "sha": "c3adf98b31c74cc9757f7dc9adc8556d456c08765978ade3003b58f8f7569475", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/zh-Hans/Microsoft.CodeAnalysis.CSharp.Workspaces.resources.dll", "risk": 2, "size": 17672, "type": "pe", "depth": 1 }, { "id": 132, "mol": "Md(Si₂)", "sha": "b8b3c8a39143420dfecb2f64e51bb53613f554f1847a23245e8edd402a3cc9b1", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/zh-Hans/Microsoft.CodeAnalysis.CSharp.resources.dll", "risk": 2, "size": 404232, "type": "pe", "depth": 1 }, { "id": 133, "mol": "Md(Si₂)", "sha": "6b909096774d0e296c0b116b91d50e00837b8d677d3f217c22465d1cb5aa2373", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/zh-Hans/Microsoft.CodeAnalysis.VisualBasic.Workspaces.resources.dll", "risk": 2, "size": 24848, "type": "pe", "depth": 1 }, { "id": 134, "mol": "Md(Si₂)", "sha": "edc497892898cb8b2782e857730d510a404c887ca90dd23d13f41c527578f12d", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/zh-Hans/Microsoft.CodeAnalysis.VisualBasic.resources.dll", "risk": 2, "size": 278288, "type": "pe", "depth": 1 }, { "id": 135, "mol": "Md(Si₂)", "sha": "9a8be6a4fdf33eb8a7cdd45c95087205be799484d851d02f4d4fd5a649f93aa9", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/zh-Hans/Microsoft.CodeAnalysis.Workspaces.resources.dll", "risk": 2, "size": 40208, "type": "pe", "depth": 1 }, { "id": 136, "mol": "Md(Si₂)", "sha": "2555883f0feefe4491755e37feb6cb03e75d2448a88081270b5f240f5673e8d0", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/zh-Hans/Microsoft.CodeAnalysis.resources.dll", "risk": 2, "size": 38160, "type": "pe", "depth": 1 }, { "id": 137, "sha": "05b758c566335e34eeed114afa7406d17d42aa559af34f202f55cd35b92df174", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/zh-Hans/Spectre.Console.Cli.resources.dll", "size": 5120, "type": "pe", "depth": 1 }, { "id": 138, "mol": "Md(Si₂)", "sha": "9a71a7172ee00aa336add3192d168008eba6a0657ce6baa30c624a7540794bc6", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/zh-Hant/Microsoft.CodeAnalysis.CSharp.Workspaces.resources.dll", "risk": 2, "size": 17720, "type": "pe", "depth": 1 }, { "id": 139, "mol": "Md(Si₂)", "sha": "a1b9563e0b16da3afa1bb80514bb3d93282208b9ac14d4afa9a429369a7d89a0", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/zh-Hant/Microsoft.CodeAnalysis.CSharp.resources.dll", "risk": 2, "size": 404232, "type": "pe", "depth": 1 }, { "id": 140, "mol": "Md(Si₂)", "sha": "892ff2adb3061c5d2aefb532edd9b6b8490efe2b6a819bcf3e7044788c8788f6", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/zh-Hant/Microsoft.CodeAnalysis.VisualBasic.Workspaces.resources.dll", "risk": 2, "size": 24880, "type": "pe", "depth": 1 }, { "id": 141, "mol": "Md(Si₂)", "sha": "8960c60850becc18e77ef48b9b74f70787d4277b760d9398c4a3c9a2aa9bfc1f", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/zh-Hant/Microsoft.CodeAnalysis.VisualBasic.resources.dll", "risk": 2, "size": 277776, "type": "pe", "depth": 1 }, { "id": 142, "mol": "Md(Si₂)", "sha": "bcfd32d22630c62150b632de716c5f6168593809934fbf7c68fbbac6966c72d0", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/zh-Hant/Microsoft.CodeAnalysis.Workspaces.resources.dll", "risk": 2, "size": 40208, "type": "pe", "depth": 1 }, { "id": 143, "mol": "Md(Si₂)", "sha": "d8fb1c7d7135620d9d5ac330cc97face8912cd0afdd53c72ebd7875d3534b559", "path": "Assay.linux-x64.0.8.0.nupkg!!tools/net10.0/linux-x64/zh-Hant/Microsoft.CodeAnalysis.resources.dll", "risk": 2, "size": 38672, "type": "pe", "depth": 1 }, { "id": 146, "mol": "Md(Re)", "sha": "d63cf96c3268a22b7da57981c00c6c9346cd5eb27f76c64df31acb239550ef1c", "path": "Assay.linux-x64@0.8.0.registry.json", "risk": 1, "size": 942, "type": "registry", "depth": 1 } ], "omitted_files": 123, "rev": "e86a6", "v": "8" } }