{
  "llm": {
    "conf": 0.7374255,
    "grade": "benign",
    "model": "Qwen/Qwen3.6-27B",
    "review": false,
    "outcome": "benign",
    "interpretation": "Legitimate ASP.NET library"
  },
  "ml": {
    "v": "7",
    "eng": "2.2.0-rc.1",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.18962076,
        "rte": "az",
        "prob": 0.18962076
      }
    ],
    "prob": 0.6248936,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.6248936057090759,
        "type": "nupkg"
      },
      {
        "id": 1,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000010261933311994653,
        "type": "xml"
      },
      {
        "id": 2,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00004094839096069336,
        "type": "xml"
      },
      {
        "id": 3,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000017801919966586865,
        "type": "png"
      },
      {
        "id": 4,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00001138448715209961,
        "type": "markdown"
      },
      {
        "id": 5,
        "lvl": -1,
        "conf": 0,
        "prob": 0.6248936057090759,
        "type": "pe"
      },
      {
        "id": 6,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00001239776611328125,
        "type": "xml"
      },
      {
        "id": 7,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00001012285520118894,
        "type": "xml"
      },
      {
        "id": 8,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00001085797975974856,
        "type": "xml"
      },
      {
        "id": 9,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00001085797975974856,
        "type": "registry"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-06-28T23:50:59Z"
  },
  "path": "AsiBackbone.AspNetCore.2.1.0.nupkg",
  "raw": {
    "files": [
      {
        "id": 0,
        "mol": "O(Al)H₂(CmDb)",
        "sha": "58a9156ebde38f18f7daa59ee774b7aaf6e631739c54860a74a7a19b1ad62ffe",
        "path": "AsiBackbone.AspNetCore.2.1.0.nupkg",
        "risk": 4,
        "size": 555922,
        "type": "nupkg",
        "facts": {
          "metrics": {
            "file": {
              "size": 555922.0,
              "entropy": 8.0,
              "size_bytes": 555922.0
            },
            "binary": {
              "overall_entropy": 8.0,
              "peak_region_bytes": 549888.0,
              "peak_region_entropy": 7.85
            },
            "archive": {
              "file_count": 9.0,
              "member_count": 9.0,
              "script_count": 0.0,
              "zip_bomb_ratio": 9.56,
              "directory_count": 0.0,
              "executable_count": 1.0,
              "extra_field_size": 0.0,
              "noise_file_count": 0.0,
              "total_compressed": 554706.0,
              "compression.ratio": 0.79,
              "hidden_file_count": 2.0,
              "total_uncompressed": 701540.0,
              "crc_collision_count": 0.0,
              "entry_comment_count": 0.0,
              "max_filename_length": 81.0,
              "rtlo_filename_count": 0.0,
              "format.regular_count": 9.0,
              "nested_archive_count": 0.0,
              "path_traversal_count": 0.0,
              "symlink_escape_count": 0.0,
              "security.setgid_count": 0.0,
              "security.setuid_count": 0.0,
              "security.sticky_count": 0.0,
              "double_extension_count": 0.0,
              "duplicate_member_count": 0.0,
              "security.symlink_count": 0.0,
              "unicode_filename_count": 0.0,
              "homoglyph_filename_count": 0.0,
              "security.encrypted_count": 0.0,
              "timing.mtime_unique_count": 4.0,
              "timing.mtime_unique_ratio": 0.44,
              "misplaced_executable_count": 1.0,
              "timing.mtime_dominant_count": 4.0,
              "timing.mtime_spread_seconds": 25132.0,
              "timing.sentinel_mtime_count": 0.0,
              "security.world_writable_count": 0.0,
              "timing.mtime_dominant_fraction": 0.44,
              "compression.method_counts.stored": 1.0,
              "compression.method_counts.deflate": 8.0
            }
          }
        },
        "ident": {
          "name": {
            "value": "AsiBackbone ASP.NET Core",
            "source": "nupkg.title",
            "verified": false
          },
          "urls": [
            {
              "url": "https://cdcavell.github.io/AsiBackbone/",
              "kind": "homepage",
              "source": "nupkg.project_url"
            },
            {
              "url": "https://github.com/cdcavell/AsiBackbone",
              "kind": "repository",
              "source": "nupkg.repository_url"
            }
          ],
          "trust": "unsigned",
          "authors": [
            {
              "name": "Christopher D. Cavell",
              "role": "author",
              "source": "nupkg.authors"
            }
          ],
          "version": {
            "value": "2.1.0",
            "source": "nupkg.version",
            "verified": false
          },
          "identifier": {
            "value": "AsiBackbone.AspNetCore",
            "source": "nupkg.id",
            "verified": false
          }
        },
        "traits": [
          {
            "id": "metadata/package/versioning::pe-fileversion-field",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "PE FileVersion metadata field",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "metadata/package/versioning::pe-productversion-field",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "PE ProductVersion metadata field",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/path/extension::dll-dup",
            "crit": 2,
            "desc": ".dll extension reference",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/server/managed::http-context-item-setter",
            "conf": 0.8500000238418579,
            "crit": 3,
            "desc": "Modification of HTTP context items",
            "from": [
              {
                "off": 41659,
                "file": 5
              }
            ]
          },
          {
            "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref",
            "conf": 1.0,
            "crit": 3,
            "desc": "JSON polymorphism runtime marker",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal",
            "conf": 0.699999988079071,
            "crit": 1,
            "desc": ".NET code entropy in unpacked range",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/server/managed::http-item-setter",
            "conf": 1.0,
            "crit": 1,
            "desc": "Modification of HTTP context items",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "metadata/binary/framework::dotnet-metadata",
            "conf": 1.0,
            "crit": 2,
            "desc": ".NET Metadata Root (BSJB)",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/server/managed::http-headers-getter",
            "conf": 1.0,
            "crit": 1,
            "desc": "Access to Headers getter",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "metadata/package/versioning::pe-version-resource",
            "conf": 0.800000011920929,
            "crit": 2,
            "desc": "PE version resource structure",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "metadata/binary/framework::dotnet-assembly",
            "conf": 1.0,
            "crit": 2,
            "desc": ".NET Assembly (mscoree.dll)",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/server/managed::http-request-get",
            "conf": 1.0,
            "crit": 3,
            "desc": "Access to ASP.NET Request object",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "metadata/binary/framework::clr-runtime-header",
            "conf": 1.0,
            "crit": 2,
            "desc": "PE CLR runtime header present (COM descriptor)"
          },
          {
            "id": "micro-behaviors/data/db/linq::linq-queries",
            "conf": 0.699999988079071,
            "crit": 3,
            "desc": "LINQ query operations",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/server/managed::http-context",
            "conf": 1.0,
            "crit": 3,
            "desc": "Access to ASP.NET HttpContext",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/server/managed::http-headers-access",
            "conf": 0.8500000238418579,
            "crit": 3,
            "desc": "Access to server-side HTTP headers",
            "from": [
              {
                "off": 56016,
                "file": 5
              }
            ]
          }
        ]
      },
      {
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 512.0,
              "entropy": 5.16,
              "size_bytes": 512.0
            },
            "binary": {
              "overall_entropy": 5.16,
              "peak_region_bytes": 512.0,
              "peak_region_entropy": 5.16
            }
          }
        },
        "id": 1,
        "path": "AsiBackbone.AspNetCore.2.1.0.nupkg!!_rels/.rels",
        "sha": "35f71c85bae5431ff78ee57c00ca9c14f81a8b7de3af398cf653302f5971ce4a",
        "size": 512,
        "type": "xml"
      },
      {
        "ctx": [
          {
            "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj]",
            "n": [
              {
                "c": 2,
                "d": "NuGet nuspec manifest file",
                "i": "metadata/build/manifest::nuspec-file",
                "o": 0,
                "z": 29,
                "cf": 0.9800000190734863
              }
            ],
            "ln": 1,
            "addr": 0
          },
          {
            "b": "jAa.syHH\u003c!aB4:tzGv@+xMOuniXJdcv}YB\u003cvrj5rx\u003e8g4B8LVje[n*pfk$ufyHH\u003c\u0026zF7QTfFLvpfF$I3B-RIkv\u003eJ1EwfKh",
            "ln": 2,
            "addr": 42
          },
          {
            "b": "arS^-wPRu\u003evrt{w",
            "ln": 3,
            "addr": 118
          },
          {
            "b": "arR^Hjy\u00262Av@=p5BzkVhk0-aze(1\u0026mavy6/wGUV8B95KkwmoC0wPz\u0026mw]zYjl1szyB-8qfvR/P#q*ACawO(GhnP5cXvrlKhBZ]JoA+cw4v@#Tfay/tcBy/YsefF$AADL\u0026lBrC7iA=L-cvruj4zy=]3r8=WpA+frmy\u0026*!pvq{g1zF7HyvqYP#vpK7\u003cz*c2ewm]:\u003czGE1hxKLZ[wO#c(azbCdCxkx0fjXTnv@=p5BzkVhj]",
            "ln": 13,
            "addr": 524
          },
          {
            "b": "arR^HjAL1AB3s2xv@DHcBywS{wI4$GB97#gB1I9zw].s3BAhIlBAIRnayPt9eN\u0026c#yHRj1wGUJ4Bz+ViazkRowPzV%zEWl2vrly9wPRB2A+cwqwNV=}z/Z1Lx(n37xl4B5x(v(ixMOunayO+}zF%-nwN]B\u003cwO#PLflySnB3o",
            "ln": 14,
            "addr": 714
          },
          {
            "b": "arR^HjAt1Lz/YSmz/QaCBA}?pjTaJMBrR\u0026IA+)(.xMOunB2\u003e%cxk8E3BZ=$kz/4dqwmG4\u003ewO=fol33:bvpK7Zz/fbgay/tbze18Pa#9N.whMq2ggq[Ew[kE.gDmoFixe#Qh!s{dh8F/NvkfMFvpy#IvJ({Fj]",
            "n": [
              {
                "c": 2,
                "d": "NuGet package declares repository",
                "i": "metadata/package/files/nuget::nuspec-repository",
                "o": 853,
                "z": 76,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 15,
            "addr": 849
          },
          {
            "b": "arR^Hjy\u00262xwO#3\u0026zEWx(B3o",
            "n": [
              {
                "c": 2,
                "d": "NuGet package declares dependencies",
                "i": "metadata/package/files/nuget::nuspec-dependencies",
                "o": 979,
                "z": 161,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 16,
            "addr": 975
          },
          {
            "b": "arR^HarS^VA=l8taAR4jxjVfOA:-/@Cw?IqjTa=PBtkE4fD@W",
            "ln": 17,
            "addr": 994
          },
          {
            "b": "arR^HarR^Hjy\u00262xwO#3\u0026zEW@mx\u003efvJl33:bvpK7Zz/fbslVm0Ra%q5uA=U@kzAPg0e?[$ja%pDwv@co#wJ.k7B.LV5ej1eZy\u003cytrA=SAEffP",
            "ln": 18,
            "addr": 1034
          }
        ],
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 1453.0,
              "entropy": 5.08,
              "size_bytes": 1453.0
            },
            "binary": {
              "overall_entropy": 5.08,
              "peak_region_bytes": 1453.0,
              "peak_region_entropy": 5.13
            }
          }
        },
        "id": 2,
        "path": "AsiBackbone.AspNetCore.2.1.0.nupkg!!AsiBackbone.AspNetCore.nuspec",
        "risk": 1,
        "sha": "535c8092fadc4d500554103bb2178be2871f953374c2e752fbc08e92516fec16",
        "size": 1453,
        "traits": [
          {
            "id": "metadata/package/files/nuget::nuspec-dependencies",
            "conf": 0.8999999761581421,
            "crit": 2,
            "desc": "NuGet package declares dependencies",
            "spans": [
              [
                979,
                161
              ]
            ]
          },
          {
            "id": "metadata/build/manifest::nuspec-file",
            "conf": 0.9800000190734863,
            "crit": 2,
            "desc": "NuGet nuspec manifest file",
            "spans": [
              [
                0,
                29
              ]
            ]
          },
          {
            "id": "metadata/package/files/nuget::nuspec-repository",
            "conf": 0.8999999761581421,
            "crit": 2,
            "desc": "NuGet package declares repository",
            "spans": [
              [
                853,
                76
              ]
            ]
          }
        ],
        "type": "xml"
      },
      {
        "ctx": [
          {
            "b": "Ibl@q4gj0X0000dnK#lE00062000622Ngne0q7J=}tZG}0DRdeliagl9o^C600D}2o*F:VV5Yp\u003cvfDSh010Qns-TMy4-ehC4-ekYc}Y0",
            "ln": 0,
            "col": 1,
            "line": 1
          },
          {
            "b": "xk8D@y/tm{A:@VWD2NttmRD)=A5]T9v%fFsAcbOxz/PFzzE[3kv@C)?B1.6rxk8D@y\u0026:JqA:@W5D2NsFBAg/7zE)uAy?EWbx([39x\u003e6\u003eGwnbFDw)]g\u003ex(v)bv\u003e@1ie[n*qC4CYowN]s}xK#7%BttK9hz3QveIYp+fFCKwfGH)wtb2Rqv@#B6zG)1dgh{UOCvtP8A=2l9yH}3eB-7VbB-7-2Cw7M9Z\u0026Rs=gbZZrhz3Wzr4{0!fFCKwfJ[CR6+Un7zdiFB07*{FzdEb",
            "ln": 3357,
            "col": 185,
            "line": 8
          }
        ],
        "depth": 1,
        "facts": {
          "metrics": {
            "png": {
              "a_entropy": 0,
              "chunk_count": 15,
              "trailing_bytes": 0,
              "idat_chunk_count": 8,
              "text_chunk_bytes": 391,
              "chunks_after_iend": 0,
              "compression_ratio": 0.47,
              "unknown_chunk_count": 1
            },
            "file": {
              "size": 496072,
              "entropy": 7.96
            },
            "image": {
              "width": 512,
              "height": 512,
              "channels": 4,
              "b_entropy": 6.75,
              "g_entropy": 6.34,
              "r_entropy": 3.83,
              "edge_density": 0.08,
              "pixel_entropy": 5.39,
              "histogram_flatness": 0.67
            },
            "binary": {
              "peak_region_bytes": 466376,
              "peak_region_entropy": 7.85
            }
          }
        },
        "id": 3,
        "mol": "Md(Bi)",
        "path": "AsiBackbone.AspNetCore.2.1.0.nupkg!!PACKAGE-ICON.png",
        "pid": 0,
        "risk": 1,
        "sha": "ab79fee948917117b29f5127ac09463388d814dab8e65c7f9f3a665cf5d698e0",
        "size": 496072,
        "traits": [
          {
            "id": "metadata/binary/provenance::c2pa-generative-ai-source",
            "conf": 0.95,
            "crit": 3,
            "desc": "Asset declares AI-generated provenance",
            "spans": [
              [
                3421,
                23
              ]
            ]
          }
        ],
        "type": "png"
      },
      {
        "ctx": [
          {
            "b": "boPo[x*MlryHRj1wIcn\u0026A86$^lVm0R",
            "n": [
              {
                "c": 3,
                "d": "Recognized domain reference marker",
                "i": "objectives/command-and-control/infrastructure/domain/tld::recognized-reference-marker",
                "o": 0,
                "z": 9,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 1,
            "addr": 0
          },
          {
            "b": "",
            "ln": 2,
            "addr": 26
          },
          {
            "b": "k#QPjpdnb8lVm0RaztXmBrC15vq{s1A=Svnz/M%^v}fC1zGGq@y?j./D2[7szf3*\u003ezF0]$B98CBv@#\u003clwGUS7C4CYivqYN^aAhvnze19aC4C.E",
            "n": [
              {
                "c": 2,
                "d": "English language detection",
                "i": "metadata/file/profile/language::lang-english",
                "o": 55,
                "z": 3,
                "cf": 0.800000011920929
              }
            ],
            "ln": 3,
            "addr": 28
          },
          {
            "b": "",
            "ln": 4,
            "addr": 118
          },
          {
            "b": "ra]#!aAg+0yHH\u003c!ayO=4B0a[jayMymxLzubCv+knxM4%layO!?AcbViayPqeB-7.ju{O\u003cFlsBwtvScc}e\u003c\u003cL$wNEa",
            "ln": 5,
            "addr": 120
          }
        ],
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 10621.0,
              "entropy": 4.93,
              "size_bytes": 10621.0
            },
            "text": {
              "digit_ratio": 0.0,
              "space_count": 1059.0,
              "total_lines": 235.0,
              "char_entropy": 4.93,
              "unique_chars": 81.0,
              "lines_over_200": 11.0,
              "avg_line_length": 43.2,
              "max_line_length": 431.0,
              "empty_line_ratio": 0.27,
              "last_line_length": 197.0,
              "whitespace_ratio": 0.14,
              "most_common_ratio": 0.1,
              "line_length_stddev": 72.25,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 1.0,
              "most_common_char_codepoint": 101.0
            },
            "binary": {
              "overall_entropy": 4.93,
              "peak_region_bytes": 10240.0,
              "peak_region_entropy": 5.0
            }
          }
        },
        "id": 4,
        "path": "AsiBackbone.AspNetCore.2.1.0.nupkg!!README.md",
        "risk": 1,
        "sha": "e4b7da8609c0bebc677bcca0e3286b00b54ffc867939d5f4c8357aa75c88d0ed",
        "size": 10621,
        "traits": [
          {
            "id": "metadata/file/profile/language::lang-english",
            "conf": 0.800000011920929,
            "crit": 2,
            "desc": "English language detection",
            "spans": [
              [
                55,
                3
              ]
            ]
          },
          {
            "id": "metadata/file/extension/identity::markdown-file-basename",
            "conf": 1.0,
            "crit": 1,
            "desc": "Markdown document file extension",
            "spans": [
              [
                0,
                9
              ]
            ]
          },
          {
            "id": "metadata/file/extension/identity::doc-or-config-extension",
            "conf": 1.0,
            "crit": 1,
            "desc": "Document or config file extension",
            "spans": [
              [
                0,
                9
              ]
            ]
          }
        ],
        "type": "markdown"
      },
      {
        "ctx": [
          {
            "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(",
            "n": [
              {
                "c": 3,
                "d": "HTTP fingerprinting evasion campaign",
                "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign",
                "o": 0,
                "z": 34,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 0
          },
          {
            "b": "00000000000000000000EWQoq00000nb@R\u00260SSx7YK.6y\u003cL*dt0rr91000000000000",
            "n": [
              {
                "c": 1,
                "d": "PE standard code/data section",
                "i": "metadata/binary/section/names::pe-code-data-standard-section",
                "o": 512,
                "z": 5,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 496
          },
          {
            "b": "017h911mgI016Iv0v!6Hlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn",
            "n": [
              {
                "c": 3,
                "d": "Recognized PE anti-analysis marker",
                "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker",
                "o": 18364,
                "z": 4,
                "cf": 1.0
              }
            ],
            "ln": 18348
          },
          {
            "b": "y*?B1z/ecS0b2\u003e+uSzeUnow@)lVl\u003c:wQ5q@A:-D?nN#yIBzku3wPy7TlVm0=wO+^%x(v(Xwb{WZBye3?wK{]+A6[LYBy/Ysrb#zSwL3AzzGGP8x\u003eqrJB3\u003c\u003e^A+f5}BzkVhnN}*h",
            "n": [
              {
                "c": 3,
                "d": "Access to ASP.NET HttpContext",
                "i": "micro-behaviors/communications/http/server/managed::http-context",
                "o": 41659,
                "z": 11,
                "cf": 1.0
              }
            ],
            "ln": 41643
          },
          {
            "b": "AaK5#BzkVhp*[S=z^^eRAaa3dz^^eRq*ACawO\u003c4!z!%l3v@#B6zGvB2wO#71x\u003e5+!lVl=",
            "n": [
              {
                "c": 1,
                "d": "Regex component marker",
                "i": "objectives/command-and-control/dropper/staging/encrypted::staged-payload-file-name--rx-1",
                "o": 41819,
                "z": 7,
                "cf": 0.8500000238418579
              }
            ],
            "ln": 41803
          },
          {
            "b": "xgc=Gx(ljUBy/rdBy!$.xjVf(qE%\u0026\u003cwPI@VvScpewN\u003e^uxMw3nnOgs#zEWl]y*?B1z/eD:ADL*",
            "n": [
              {
                "c": 3,
                "d": "Access to ASP.NET Request object",
                "i": "micro-behaviors/communications/http/server/managed::http-request-get",
                "o": 42205,
                "z": 11,
                "cf": 1.0
              }
            ],
            "ln": 42189
          },
          {
            "b": "vpK7!zF8BMwO+(SjxlDlnow@)lVl\u003c:wQ5q@A:-D?nN#yIBzku3wPy7TlVm0=wO+^%x(v(XwiK=",
            "n": [
              {
                "c": 3,
                "d": "Access to ASP.NET HttpContext",
                "i": "micro-behaviors/communications/http/server/managed::http-context",
                "o": 42625,
                "z": 11,
                "cf": 1.0
              }
            ],
            "ln": 42609
          },
          {
            "b": "o\u003ewx!vp%cKzdN^fvp%cKwmYm+B7]Mgq/(CXwDk8rwNPW(lUG[Ay?mG%wDlvOBydszyI[6my?mc\u0026z2",
            "n": [
              {
                "c": 1,
                "d": "Regex component marker",
                "i": "objectives/command-and-control/dropper/staging/encrypted::staged-payload-file-name--rx-3",
                "o": 47022,
                "z": 13,
                "cf": 0.8500000238418579
              }
            ],
            "ln": 47006
          },
          {
            "b": "A=2l3x)Kt^Acb/jzEEtYq*ACawO\u003c4#wN/\u003e6x([RMp\u0026Zn/v}/)\u003cyYD?svqfO1p\u0026Zn/v}/)\u003cyYFx)uRC2",
            "n": [
              {
                "c": 2,
                "d": "System namespace reference",
                "i": "metadata/lang/compiler/managed::system-namespace",
                "o": 50526,
                "z": 15,
                "cf": 0.800000011920929
              }
            ],
            "ln": 50510
          },
          {
            "b": "yHRj1wIcn\u0026A86$^lVm0Re[w^m090SLz*a=+piyw?0b2\u003e+uQOEGwO=p7zdNQbl${7x",
            "n": [
              {
                "c": 3,
                "d": "References Windows executable or script",
                "i": "objectives/execution/interpreter/script/shell::windows-executable-ref",
                "o": 50799,
                "z": 4,
                "cf": 0.6000000238418579
              }
            ],
            "ln": 50783
          },
          {
            "b": "wO#71x\u003e5+!oLFM\u0026jxaG%B7GD2nPXJX08[e:By/qwlVl^SwN/*@z/fRGnLA\u0026tBs}SCBydQYwO?AYBy/p?xjVf(q*ACawO?Amy*?3{090#Mz2^1xB.}",
            "n": [
              {
                "c": 3,
                "d": "Modification of HTTP context items",
                "i": "micro-behaviors/communications/http/server/managed::http-context-item-setter",
                "o": 51123,
                "z": 8,
                "cf": 0.8500000238418579
              }
            ],
            "ln": 51107
          },
          {
            "b": "zE^r@v%HT-ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9l}z!%l3v@#B6zu9aywn(E3zGFP:BywY*ByvKPyY",
            "n": [
              {
                "c": 2,
                "d": "Benign high-entropy PE context",
                "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context",
                "o": 51722,
                "z": 17,
                "cf": 0.949999988079071
              }
            ],
            "ln": 51706
          },
          {
            "b": "xlw65zGFr(v}xR3x(v\u003e?q*ACawO\u003c50wQ5qHn][]*08EMBA::67z/eD:vrlv80chTVB8L{@q/)4]zF8sP",
            "n": [
              {
                "c": 3,
                "d": "JSON polymorphism runtime marker",
                "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref",
                "o": 51926,
                "z": 16,
                "cf": 1.0
              }
            ],
            "ln": 51910
          },
          {
            "b": "l340uwPQpTA+c\u003c]BAzE4q*ACawO\u003c4[x(m[\u003cq*ACawO\u003c4!z!%l3v@#B6zGvB2wO#71x\u003e5+!lVl=",
            "n": [
              {
                "c": 3,
                "d": "LINQ query operations",
                "i": "micro-behaviors/data/db/linq::linq-queries",
                "o": 52233,
                "z": 11,
                "cf": 0.699999988079071
              }
            ],
            "ln": 52217
          },
          {
            "b": "x(){b07QQxl3D:KBy/E)now@)lVl\u003c:wQ5q.B7)%Hv@2K(zE(ZSADL\u0026lBvf$!A+f5}BzkVhqE%[",
            "n": [
              {
                "c": 3,
                "d": "Access to ASP.NET HttpContext",
                "i": "micro-behaviors/communications/http/server/managed::http-context",
                "o": 52791,
                "z": 11,
                "cf": 1.0
              }
            ],
            "ln": 52775
          },
          {
            "b": "wO+^%x(v(!wPI^aC4CW]now@)lVl\u003c:wQ5q.B7)%Hv@2K(zE(azBz(g!z/fVdCYV?{B8L(rwPv+",
            "n": [
              {
                "c": 3,
                "d": "Access to ASP.NET HttpContext",
                "i": "micro-behaviors/communications/http/server/managed::http-context",
                "o": 52910,
                "z": 11,
                "cf": 1.0
              }
            ],
            "ln": 52894
          },
          {
            "b": "Bw=W\u003ez!%PdASy5!x(ThBnow@)lVl\u003c:wQ5q.v}f7\u003eB8M70l1BH%BAzE?z/fVdCYVkYv}x.5z/L?\u003eBAzE?z/fVdCYVkYv}x.5z/L?Hl30",
            "n": [
              {
                "c": 3,
                "d": "Access to ASP.NET HttpContext",
                "i": "micro-behaviors/communications/http/server/managed::http-context",
                "o": 53017,
                "z": 11,
                "cf": 1.0
              }
            ],
            "ln": 53001
          },
          {
            "b": "wod--wPRoTwPz%dv}xYYq*ACawO\u003c4$B-8qnzdLs\u003ezGGDgz/wS^A=#ebwPE\u0026ID2[7sz7X.ezGGPfwIct*ze:i9wPyZXA=#ebwPE\u0026:wPRoSwPq\u003c7B97t(A=#ebwPE\u0026)wPz%dv}xYYxjVf(qE%oTz/d{XwmU",
            "n": [
              {
                "c": 3,
                "d": "Access to ASP.NET Request object",
                "i": "micro-behaviors/communications/http/server/managed::http-request-get",
                "o": 53580,
                "z": 11,
                "cf": 1.0
              },
              {
                "c": 3,
                "d": "Packed binary marker",
                "i": "objectives/anti-static/obfuscation/eval/loader::packed-binary-marker",
                "o": 53517,
                "z": 30,
                "cf": 0.8500000238418579
              }
            ],
            "ln": 53501
          },
          {
            "b": "wO#N6z/fQ@mq=TPz!T9hnow@)lVl\u003c:wQ5q=CYWImB7]MgA@X:HB96\u0026*C4\u003e#nzF-%5Bvy7\u003cmr\u0026[",
            "n": [
              {
                "c": 3,
                "d": "Access to ASP.NET HttpContext",
                "i": "micro-behaviors/communications/http/server/managed::http-context",
                "o": 55341,
                "z": 11,
                "cf": 1.0
              }
            ],
            "ln": 55325
          },
          {
            "b": "z/{eozF7N#vruQ5A=b{#xjVf(nm=juwPz?(l33:bvpK7Zz/fbslVm0Re\u003cS#?z/P[0l33:bvpK6",
            "n": [
              {
                "c": 1,
                "d": "Access to Headers getter",
                "i": "micro-behaviors/communications/http/server/managed::http-headers-getter",
                "o": 56016,
                "z": 11,
                "cf": 1.0
              }
            ],
            "ln": 56000
          },
          {
            "b": "zGvB4oLFM\u0026e\u003eG@4wPz\u003e)xjVf(qE%\u0026\u003cwPI}[l33:bvpK7Zz/fbLv@2$2CwH\u00263xkIi$Bvf.Iy\u00260U",
            "n": [
              {
                "c": 3,
                "d": "Access to ASP.NET Request object",
                "i": "micro-behaviors/communications/http/server/managed::http-request-get",
                "o": 57607,
                "z": 11,
                "cf": 1.0
              }
            ],
            "ln": 57591
          },
          {
            "b": "01AArzVBXQyxe5GwDhYHve$AIBo2$OzVB!Tx-JCVve$xHx-J5Kzu6Uwyxd]CC(N?Of92L-zuahEz#",
            "n": [
              {
                "c": 2,
                "d": "Authorization header",
                "i": "micro-behaviors/communications/http/request/client::auth-header-dup",
                "o": 64329,
                "z": 13,
                "cf": 0.5
              }
            ],
            "ln": 64313
          },
          {
            "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000",
            "n": [
              {
                "c": 1,
                "d": "PE resource section",
                "i": "metadata/binary/section/names::pe-resource-section",
                "o": 97792,
                "z": 5,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 97776
          },
          {
            "b": "0000000000008S]gYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrc20SSi",
            "n": [
              {
                "c": 3,
                "d": "Recognized marker for timing checks",
                "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker",
                "o": 97886,
                "z": 15,
                "cf": 0.949999988079071
              }
            ],
            "ln": 97870
          },
          {
            "b": "Ck#W:e=U\u003eK002W)761vnlJz38z2!IPve$fBC(QOtve$cAwDhYg002v^xAi5Mx-JhOBo3jVz#:L",
            "n": [
              {
                "c": 2,
                "d": "PE CompanyName metadata field",
                "i": "metadata/package/versioning::pe-companyname-field",
                "o": 98450,
                "z": 11,
                "cf": 0.699999988079071
              }
            ],
            "ln": 98434
          },
          {
            "b": "B]V7NyYFnK003417xsEomGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002p+A@Y[Oli7A]v/Qo",
            "n": [
              {
                "c": 2,
                "d": "PE FileDescription metadata field",
                "i": "metadata/package/versioning::pe-filedescription-field",
                "o": 98526,
                "z": 15,
                "cf": 0.699999988079071
              }
            ],
            "ln": 98510
          },
          {
            "b": "zVB!TwDhYg001XM2MK(9mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001+Oe=WQae=WN9e=WN9003418VP)snDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002p+A@Y[Oli7A]v/QoAvGprD",
            "n": [
              {
                "c": 3,
                "d": "Dotted-quad PE version metadata marker",
                "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker",
                "o": 98614,
                "z": 11,
                "cf": 0.9399999976158142
              },
              {
                "c": 2,
                "d": "PE InternalName metadata field",
                "i": "metadata/package/versioning::pe-internalname-field",
                "o": 98662,
                "z": 12,
                "cf": 0.699999988079071
              }
            ],
            "ln": 98598
          },
          {
            "b": "xAibO001bw003s98VP)spxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002p+A@Y[Oli7A]v/QoA",
            "n": [
              {
                "c": 2,
                "d": "PE OriginalFilename metadata field",
                "i": "metadata/package/versioning::pe-originalfilename-field",
                "o": 98790,
                "z": 16,
                "cf": 0.699999988079071
              }
            ],
            "ln": 98774
          },
          {
            "b": "wb{ACyYBCn002:]7xsEopYLIozVBqFBPt[KBo25ove$cAwDhYg002p+A@Y[Oli7A]v/QoAvGpr",
            "n": [
              {
                "c": 2,
                "d": "PE ProductName metadata field",
                "i": "metadata/package/versioning::pe-productname-field",
                "o": 98886,
                "z": 11,
                "cf": 0.699999988079071
              }
            ],
            "ln": 98870
          },
          {
            "b": "zVB!TwDhYg004VLfAqaNpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001+Oe=WQae=WN9d/.g4f-R",
            "n": [
              {
                "c": 2,
                "d": "PE version resource metadata",
                "i": "metadata/package/versioning::version-resource-metadata",
                "o": 98966,
                "z": 14,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 98950
          },
          {
            "b": "000000000000000000000fviY3\u0026*ncPGi5M000000000000000000000000000000000",
            "n": [
              {
                "c": 2,
                "d": "PE .reloc section presence",
                "i": "metadata/binary/section/names::reloc-section-presence",
                "o": 99328,
                "z": 6,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 99312
          }
        ],
        "depth": 1,
        "facts": {
          "imp": [
            [
              "mscoree",
              "CorDllMain"
            ]
          ],
          "sec": [
            [
              ".text",
              512,
              97280,
              6.59,
              "r-x"
            ],
            [
              ".rsrc",
              97792,
              1536,
              3.08,
              "r--"
            ],
            [
              ".reloc",
              99328,
              512,
              0.1,
              "r--"
            ]
          ],
          "metrics": {
            "pe": {
              "checksum": 0.0,
              "checksum_valid": 0.0,
              "resource_count": 1.0,
              "has_version_info": 1.0,
              "checksum_stripped": 1.0,
              "computed_checksum": 152640.0,
              "reloc_overhang_bytes": 500.0,
              "reloc_overhang_ratio": 0.98,
              "bss_like_section_count": 0.0,
              "section_overflow_count": 0.0,
              "misaligned_section_count": 0.0,
              "version.identity_entropy": 4.28,
              "base_relocation_block_count": 1.0,
              "base_relocation_entry_count": 1.0,
              "version.identity_symbol_ratio": 0.05
            },
            "file": {
              "size": 99840.0,
              "entropy": 6.51,
              "size_bytes": 99840.0
            },
            "binary": {
              "is_pie": 1.0,
              "code_entropy": 6.59,
              "string_count": 1027.0,
              "overall_entropy": 6.51,
              "entropy_variance": 7.03,
              "avg_string_length": 24.26,
              "max_string_length": 158.0,
              "peak_region_bytes": 20480.0,
              "code_to_data_ratio": 1.0,
              "peak_region_entropy": 7.82,
              "string_length_stddev": 17.01,
              "largest_section_ratio": 0.97,
              "sentence_string_count": 51.0,
              "sentence_string_ratio": 0.05,
              "high_entropy_string_count": 0.0
            },
            "imports": {
              "count": 1.0
            },
            "sections": {
              "count": 3.0,
              "code_size": 97280.0,
              "entropy_max": 6.59,
              "entropy_mean": 3.26,
              "name_entropy": 3.03,
              "writable_count": 0.0,
              "executable_count": 1.0,
              "nonstandard_count": 0.0,
              "executable_writable_count": 0.0
            },
            "dependencies": {
              "count": 1.0
            }
          }
        },
        "id": 5,
        "mol": "O(Al)H₂(CmDb)",
        "path": "AsiBackbone.AspNetCore.2.1.0.nupkg!!lib/net10.0/AsiBackbone.AspNetCore.dll",
        "risk": 4,
        "sha": "c73b886a54a1f1224c57bcf453f0dcd2acc34363fe09a3dcee4ac0ebbe8b041f",
        "size": 99840,
        "traits": [
          {
            "id": "micro-behaviors/communications/http/server/managed::http-context",
            "conf": 1.0,
            "crit": 3,
            "desc": "Access to ASP.NET HttpContext",
            "spans": [
              [
                41659,
                11
              ],
              [
                41708,
                11
              ],
              [
                42625,
                11
              ],
              [
                52791,
                11
              ],
              [
                52910,
                11
              ],
              [
                53017,
                11
              ],
              [
                53040,
                11
              ],
              [
                55341,
                11
              ]
            ]
          },
          {
            "id": "metadata/package/versioning::pe-productversion-field",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "PE ProductVersion metadata field",
            "spans": [
              [
                98966,
                14
              ]
            ]
          },
          {
            "id": "micro-behaviors/fs/path/extension::dll-dup",
            "crit": 2,
            "desc": ".dll extension reference",
            "spans": [
              [
                50799,
                4
              ]
            ]
          },
          {
            "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal",
            "conf": 0.699999988079071,
            "crit": 1,
            "desc": ".NET code entropy in unpacked range",
            "spans": [
              [
                0,
                26
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/db/linq::linq-queries",
            "conf": 0.699999988079071,
            "crit": 3,
            "desc": "LINQ query operations",
            "spans": [
              [
                52233,
                11
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/http/server/managed::http-request-get",
            "conf": 1.0,
            "crit": 3,
            "desc": "Access to ASP.NET Request object",
            "spans": [
              [
                42205,
                11
              ],
              [
                53580,
                11
              ],
              [
                57607,
                11
              ]
            ]
          },
          {
            "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref",
            "conf": 1.0,
            "crit": 3,
            "desc": "JSON polymorphism runtime marker",
            "spans": [
              [
                51926,
                16
              ]
            ]
          },
          {
            "id": "metadata/package/versioning::pe-fileversion-field",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "PE FileVersion metadata field",
            "spans": [
              [
                98614,
                11
              ]
            ]
          },
          {
            "id": "metadata/binary/framework::dotnet-metadata",
            "conf": 1.0,
            "crit": 2,
            "desc": ".NET Metadata Root (BSJB)",
            "spans": [
              [
                18364,
                4
              ]
            ]
          },
          {
            "id": "metadata/package/versioning::pe-version-resource",
            "conf": 0.800000011920929,
            "crit": 2,
            "desc": "PE version resource structure",
            "spans": [
              [
                97886,
                15
              ]
            ]
          },
          {
            "id": "metadata/binary/framework::clr-runtime-header",
            "conf": 1.0,
            "crit": 2,
            "desc": "PE CLR runtime header present (COM descriptor)"
          },
          {
            "id": "micro-behaviors/communications/http/server/managed::http-item-setter",
            "conf": 1.0,
            "crit": 1,
            "desc": "Modification of HTTP context items",
            "spans": [
              [
                51123,
                8
              ],
              [
                51157,
                8
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/http/server/managed::http-headers-getter",
            "conf": 1.0,
            "crit": 1,
            "desc": "Access to Headers getter",
            "spans": [
              [
                56016,
                11
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/http/server/managed::http-context-item-setter",
            "conf": 0.8500000238418579,
            "crit": 3,
            "desc": "Modification of HTTP context items",
            "spans": [
              [
                41659,
                11
              ],
              [
                41708,
                11
              ],
              [
                42625,
                11
              ],
              [
                51123,
                8
              ],
              [
                51157,
                8
              ],
              [
                52791,
                11
              ],
              [
                52910,
                11
              ],
              [
                53017,
                11
              ]
            ]
          },
          {
            "id": "metadata/binary/framework::dotnet-assembly",
            "conf": 1.0,
            "crit": 2,
            "desc": ".NET Assembly (mscoree.dll)",
            "spans": [
              [
                18364,
                4
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/http/server/managed::http-headers-access",
            "conf": 0.8500000238418579,
            "crit": 3,
            "desc": "Access to server-side HTTP headers",
            "spans": [
              [
                41659,
                11
              ],
              [
                41708,
                11
              ],
              [
                42205,
                11
              ],
              [
                42625,
                11
              ],
              [
                52791,
                11
              ],
              [
                52910,
                11
              ],
              [
                53017,
                11
              ],
              [
                53040,
                11
              ]
            ]
          }
        ],
        "type": "pe"
      },
      {
        "id": 6,
        "sha": "46c04315ec4ed7488b9cd139b80c0ab6d31b5bbafb7026767748418a57f45b0e",
        "path": "AsiBackbone.AspNetCore.2.1.0.nupkg!!lib/net10.0/AsiBackbone.AspNetCore.xml",
        "size": 78528,
        "type": "xml",
        "depth": 1
      },
      {
        "id": 7,
        "sha": "b858fadd5794c5a53fcbaa7a45db7aa5f6ab1fd173ba71cc2625214ee1509c6a",
        "path": "AsiBackbone.AspNetCore.2.1.0.nupkg!![Content_Types].xml",
        "size": 644,
        "type": "xml",
        "depth": 1
      },
      {
        "id": 8,
        "sha": "77038ac3b28d7bc123a586b3613f0b36ac7e33f3471f8ffca8d770e64fafc694",
        "path": "AsiBackbone.AspNetCore.2.1.0.nupkg!!package/services/metadata/core-properties/a1f4e8b8ad1a46c0b45fda900a32089a.psmdcp",
        "size": 887,
        "type": "xml",
        "depth": 1
      },
      {
        "id": 9,
        "sha": "fc4879f21f3c4ef3c67d45dc6a66f738c3688489973442e7b37040c5b464dbb6",
        "path": "AsiBackbone.AspNetCore@2.1.0.registry.json",
        "size": 937,
        "type": "registry",
        "depth": 1
      }
    ],
    "omitted_files": 4,
    "v": "8"
  }
}