{
  "llm": {
    "conf": 0.84136814,
    "grade": "benign",
    "model": "Qwen/Qwen3.6-27B",
    "outcome": "benign",
    "interpretation": "Legitimate .NET library package"
  },
  "ml": {
    "v": "7",
    "eng": "2.3.0-beta.0",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.7733831,
        "rte": "az",
        "prob": 0.7733831
      }
    ],
    "prob": 0.7733831,
    "skip": [
      {
        "rte": "az/zip",
        "why": "unavailable"
      },
      {
        "rte": "az/zip",
        "why": "unavailable"
      }
    ],
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.7733830809593201,
        "type": "nupkg"
      },
      {
        "id": 1,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00012001395225524902,
        "type": "xml"
      },
      {
        "id": 2,
        "lvl": -1,
        "conf": 0,
        "prob": 0.008743494749069214,
        "type": "xml"
      },
      {
        "id": 3,
        "lvl": -1,
        "conf": 0,
        "prob": 0.009137243032455444,
        "type": "markdown"
      },
      {
        "id": 4,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00006663799285888672,
        "type": "png"
      },
      {
        "id": 5,
        "lvl": -1,
        "conf": 0,
        "prob": 0.7544367909431458,
        "type": "pe"
      },
      {
        "id": 6,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000033408403396606445,
        "type": "xml"
      },
      {
        "id": 7,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00003331899642944336,
        "type": "xml"
      },
      {
        "id": 8,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000033408403396606445,
        "type": "registry"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-07-07T13:07:01Z"
  },
  "path": "BridgingIT.DevKit.Common.Results.10.0.109-preview.0.2.nupkg",
  "raw": {
    "files": [
      {
        "id": 0,
        "mol": "O(Al)H(Db)",
        "sha": "62cb4770ffc456a03e53ab92eb52d3705dccc370af4aec477cff5c72b06f5f52",
        "path": "BridgingIT.DevKit.Common.Results.10.0.109-preview.0.2.nupkg",
        "risk": 3,
        "size": 426480,
        "type": "nupkg",
        "facts": {
          "metrics": {
            "file": {
              "size": 426480.0,
              "entropy": 8.0,
              "size_bytes": 426480.0
            },
            "binary": {
              "overall_entropy": 8.0,
              "peak_region_bytes": 413696.0,
              "peak_region_entropy": 7.84
            },
            "archive": {
              "file_count": 8.0,
              "member_count": 8.0,
              "script_count": 0.0,
              "zip_bomb_ratio": 2.75,
              "directory_count": 0.0,
              "executable_count": 1.0,
              "extra_field_size": 0.0,
              "noise_file_count": 0.0,
              "total_compressed": 425392.0,
              "compression.ratio": 0.5,
              "hidden_file_count": 2.0,
              "total_uncompressed": 850194.0,
              "crc_collision_count": 0.0,
              "entry_comment_count": 0.0,
              "max_filename_length": 81.0,
              "rtlo_filename_count": 0.0,
              "format.regular_count": 8.0,
              "nested_archive_count": 0.0,
              "path_traversal_count": 0.0,
              "symlink_escape_count": 0.0,
              "security.setgid_count": 0.0,
              "security.setuid_count": 0.0,
              "security.sticky_count": 0.0,
              "double_extension_count": 0.0,
              "duplicate_member_count": 0.0,
              "security.symlink_count": 0.0,
              "unicode_filename_count": 0.0,
              "homoglyph_filename_count": 0.0,
              "security.encrypted_count": 0.0,
              "timing.mtime_unique_count": 4.0,
              "timing.mtime_unique_ratio": 0.5,
              "misplaced_executable_count": 1.0,
              "timing.mtime_dominant_count": 4.0,
              "timing.mtime_spread_seconds": 25034.0,
              "timing.sentinel_mtime_count": 0.0,
              "security.world_writable_count": 0.0,
              "timing.mtime_dominant_fraction": 0.5,
              "compression.method_counts.stored": 1.0,
              "compression.method_counts.deflate": 7.0
            }
          }
        },
        "ident": {
          "name": {
            "value": "BridgingIT.DevKit.Common.Results",
            "source": "nupkg.title",
            "verified": false
          },
          "urls": [
            {
              "url": "https://github.com/BridgingIT-GmbH/bITdevKit",
              "kind": "homepage",
              "source": "nupkg.project_url"
            },
            {
              "url": "https://github.com/BridgingIT-GmbH/bITdevKit",
              "kind": "repository",
              "source": "nupkg.repository_url"
            }
          ],
          "trust": "unsigned",
          "authors": [
            {
              "name": "BridgingIT GmbH",
              "role": "author",
              "source": "nupkg.authors"
            }
          ],
          "version": {
            "value": "10.0.109-preview.0.2",
            "source": "nupkg.version",
            "verified": false
          },
          "identifier": {
            "value": "BridgingIT.DevKit.Common.Results",
            "source": "nupkg.id",
            "verified": false
          }
        },
        "traits": [
          {
            "id": "micro-behaviors/fs/path/extension::dll-dup",
            "crit": 2,
            "desc": ".dll extension reference",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "metadata/binary/framework::dotnet-assembly",
            "conf": 1.0,
            "crit": 2,
            "desc": ".NET Assembly (mscoree.dll)",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref",
            "conf": 1.0,
            "crit": 3,
            "desc": "JSON polymorphism runtime marker",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "metadata/binary/framework::dotnet-metadata",
            "conf": 1.0,
            "crit": 2,
            "desc": ".NET Metadata Root (BSJB)",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "metadata/package/versioning::pe-productversion-field",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "PE ProductVersion metadata field",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "metadata/package/versioning::pe-fileversion-field",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "PE FileVersion metadata field",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "micro-behaviors/data/db/linq::linq-queries",
            "conf": 0.699999988079071,
            "crit": 3,
            "desc": "LINQ query operations",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "metadata/package/versioning::pe-version-resource",
            "conf": 0.800000011920929,
            "crit": 2,
            "desc": "PE version resource structure",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "metadata/binary/framework::clr-runtime-header",
            "conf": 1.0,
            "crit": 2,
            "desc": "PE CLR runtime header present (COM descriptor)"
          },
          {
            "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal",
            "conf": 0.699999988079071,
            "crit": 1,
            "desc": ".NET code entropy in unpacked range",
            "from": [
              {
                "file": 5
              }
            ]
          }
        ]
      },
      {
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 522.0,
              "entropy": 5.18,
              "size_bytes": 522.0
            },
            "binary": {
              "overall_entropy": 5.18,
              "peak_region_bytes": 522.0,
              "peak_region_entropy": 5.18
            }
          }
        },
        "id": 1,
        "path": "BridgingIT.DevKit.Common.Results.10.0.109-preview.0.2.nupkg!!_rels/.rels",
        "sha": "b2e4ffa75d8eca7deb2439ccf3a83fbc30a8e8bdd3009aec226f4193a881a725",
        "size": 522,
        "type": "xml"
      },
      {
        "ctx": [
          {
            "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj]",
            "n": [
              {
                "c": 2,
                "d": "NuGet nuspec manifest file",
                "i": "metadata/build/manifest::nuspec-file",
                "o": 0,
                "z": 39,
                "cf": 0.9800000190734863
              }
            ],
            "ln": 1,
            "addr": 0
          },
          {
            "b": "jAa.syHH\u003c!aB4:tzGv@+xMOuniXJdcv}YB\u003cvrj5rx\u003e8g4B8LVje[n*pfk$ufyHH\u003c\u0026zF7QTfFLvpfF$I3B-RIkv\u003eJ1EwfKh",
            "ln": 2,
            "addr": 42
          },
          {
            "b": "arS^-wPRu\u003evrt{w",
            "ln": 3,
            "addr": 118
          },
          {
            "b": "arR^Hjy-qGD2^RixMMB9z/x#xx\u003eIa3atLSah6sqSdiH@$x\u003eg\u003c\u003czF8Kuav*oTng(2Jy?$kmx\u003eIa3B0bHmB7GxnwN)zQfjO{tD2^RixMMA",
            "ln": 251,
            "addr": 11807
          },
          {
            "b": "arR^HjAL1AB3s5Nx\u003eg\u003c\u003czF9W9ay]5byIv(kvRG{{wP?\u003c6BrCajBz+Viay/k0vqWV9A:@=%By!%7B-I4oB8L(qBzkVhay/ziB0b17wiqI!vp%TB",
            "ln": 252,
            "addr": 11891
          },
          {
            "b": "arR^HjAt1Lz/YSmz/QaCBA}?pjTaJMBrR\u0026IA+)(.xMOunB2\u003e%cxk8E3BZ=$kz/4c]A+P5%x(mMPr4QQSvN@dYnMokiC1VK\u003ea%pxlzeB0ejTauTx(4rnfFUKuh.WfBfF$*Ei3GE#j]",
            "n": [
              {
                "c": 2,
                "d": "NuGet package declares repository",
                "i": "metadata/package/files/nuget::nuspec-repository",
                "o": 11984,
                "z": 81,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 253,
            "addr": 11980
          },
          {
            "b": "arR^Hjy\u00262xwO#3\u0026zEWx(B3o",
            "n": [
              {
                "c": 2,
                "d": "NuGet package declares dependencies",
                "i": "metadata/package/files/nuget::nuspec-dependencies",
                "o": 12094,
                "z": 600,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 254,
            "addr": 12090
          },
          {
            "b": "arR^HarS^VA=l8taAR4jxjVfOA:-/@Cw?IqjTa=PBtkE4fD@W",
            "ln": 255,
            "addr": 12109
          },
          {
            "b": "arR^HarR^Hjy\u00262xwO#3\u0026zEW@mx\u003efvJlul^Jxk8l@nMmrgwP*ZXBs]}0zeBiee\u003cS@/BAg/1BzkVhB0q-IwPz\u003caz/dYZf!+jle?]4uePt-wC4\u003eJie?![ka%pDwv@co#wJ.k7B.LV5ej1eZy\u003cytrA=SAEffP",
            "ln": 256,
            "addr": 12149
          }
        ],
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 12859.0,
              "entropy": 4.97,
              "size_bytes": 12859.0
            },
            "binary": {
              "overall_entropy": 4.97,
              "peak_region_bytes": 11835.0,
              "peak_region_entropy": 5.11
            }
          }
        },
        "id": 2,
        "path": "BridgingIT.DevKit.Common.Results.10.0.109-preview.0.2.nupkg!!BridgingIT.DevKit.Common.Results.nuspec",
        "risk": 1,
        "sha": "5ce36ca08c06a0a2388e933e6365cf991088c8497c45b1a7e231e18bff81bd8a",
        "size": 12859,
        "traits": [
          {
            "id": "metadata/build/manifest::nuspec-file",
            "conf": 0.9800000190734863,
            "crit": 2,
            "desc": "NuGet nuspec manifest file",
            "spans": [
              [
                0,
                39
              ]
            ]
          },
          {
            "id": "metadata/package/files/nuget::nuspec-repository",
            "conf": 0.8999999761581421,
            "crit": 2,
            "desc": "NuGet package declares repository",
            "spans": [
              [
                11984,
                81
              ]
            ]
          },
          {
            "id": "metadata/package/files/nuget::nuspec-dependencies",
            "conf": 0.8999999761581421,
            "crit": 2,
            "desc": "NuGet package declares dependencies",
            "spans": [
              [
                12094,
                600
              ]
            ]
          }
        ],
        "type": "xml"
      },
      {
        "ctx": [
          {
            "b": "aZnzEr77qvokeGNc$)ZAAc15[flgGBe[X)uxMW^bB7Gx4z/fVdzGEHvz/4dpA+P5%x(mMPr4?YLraGM-okeG3zddc@fjEHLl$HKmx()YQz!A#vAbGqq3oZKnjV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV%cvze:AqwPzH5xcp.@C4CGdAaK6haA}KwxDRegwozY%AV!\u003egze:AhwO#QhazbLjaz(4cwPzVhvq{g4x\u003e7N[x(v(iwmY{}y\u0026sofwO#Pvay!#2By/G7wftr3z/]@d3pF/HvqfQhl#)0+wO@RUwPIM#zxJ[sx(mA{Abo9be^.}YB-FQqz^^D8x(+zs",
            "ln": 0,
            "col": 1,
            "line": 1
          },
          {
            "b": "AbP@iAV![7C4CGdAaK6hayYQsz!rP)A+PA7az(4cB.\u003eGbay/tbAbPS9zGG}xBzb98ay!?$ayX[8wNPT]y\u003cvdqzGGD5A::63wftP7Bz?Iiz/{7yAb](iwN/?6e*akewPRP%AV/TCBTIivaA}:AyIvW0aA}KwxDRtbAbP/iBz(hlwPGyBv@Dj3vqYQ%efF}PwPzG@B1wCLAV/pxxK#ibv@Dj6z/fc7BAn#QBzbj)vO6J!wP*ZXBrCKyz*2\u00269wPF#ay?m\u003c9vR/P#B8L(qBzkVhB0bNrvrrS4vqWh@wmoC0aARJAD2E?CaAIHkv}/K?v\u003c2V2wN]\u003cm3jo:Cx(+zqwPhNex([olC{3*sv@co#wPF#oxK@q@z/6DfwPRGaB8Mhwv}u=)z!9A4w]zYjBzbkdvO6J!wP*ZXBsXLyy\u0026si7aA}KwxDQ.aC42A9wPShuz!pbkvqP$1wEn",
            "ln": 280,
            "col": 18,
            "line": 6
          },
          {
            "b": "t{%xdBz#pZfe4J[Cp)=QxjVfqz/PFzAa9l(vp%d)kxe?}x((:OC1VK\u003ecu9y6yHH\u003c!BA}?pjTLb*wPzu#j-\u003eZ!wHqFpA=+=oj-UaIwP?H1v}v8w3jomvAV/EqwGU!$By/JnaA.Tlvru74ayPd#aAz4fwNPT\u003eaz#atwPGyBAbo8]B7DFmwObH]aARJeBzbkdtsg}EpdE-DpE!XsxMOunB2\u003e%cA::eAxk8E3BZ/GmwPzp0zGGDcBs}6wz7/vsx\u003eg\u003c\u003czF8KufjEHL",
            "ln": 882,
            "col": 19,
            "line": 14
          }
        ],
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 1196,
              "entropy": 4.83
            },
            "text": {
              "lines": 19,
              "top_char": 101,
              "max_ws_run": 1,
              "space_count": 115,
              "char_entropy": 4.83,
              "unique_chars": 57,
              "top_char_null": 0,
              "top_char_ratio": 0.1,
              "ascii_art_lines": 1,
              "avg_line_length": 62,
              "max_line_length": 106,
              "empty_line_ratio": 0.21,
              "last_line_length": 74,
              "whitespace_ratio": 0.11,
              "line_length_stddev": 39.91,
              "repeated_char_sequences": 1
            },
            "binary": {
              "peak_region_bytes": 1196,
              "peak_region_entropy": 5.02
            }
          }
        },
        "id": 3,
        "mol": "H₂(Cm₂Db)",
        "path": "BridgingIT.DevKit.Common.Results.10.0.109-preview.0.2.nupkg!!README.md",
        "pid": 0,
        "risk": 2,
        "sha": "377154f3f41cb21284c5adfda321acbc305e02c223c99d5469a89df6833c75d0",
        "size": 1196,
        "traits": [
          {
            "id": "metadata/lang/natural::lang-english--atom-1",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"the\"",
            "spans": [
              [
                460,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-2",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"and\"",
            "spans": [
              [
                995,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-3",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"that\"",
            "spans": [
              [
                328,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-5",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"for\"",
            "spans": [
              [
                177,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-6",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"with\"",
            "spans": [
              [
                153,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-7",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"this\"",
            "spans": [
              [
                542,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/http/url/forge::github-raw-url",
            "conf": 0.92,
            "crit": 3,
            "desc": "GitHub raw-content URL",
            "spans": [
              [
                13,
                34
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/http/url/path::image-file-url",
            "conf": 0.85,
            "crit": 3,
            "desc": "HTTP URL targets an image file",
            "spans": [
              [
                13,
                78
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/format/html::markdown-remote-image-source",
            "conf": 0.9,
            "crit": 3,
            "desc": "Markdown references a remote image",
            "spans": [
              [
                0,
                91
              ]
            ]
          }
        ],
        "type": "markdown"
      },
      {
        "ctx": [
          {
            "b": "Ibl@q4gj0X0000dnK#lE0001I0001I2Ngne0oZ3dpYHE}32\u0026BrA@VgF5=.[t5={CpE/6fC3uO\u003cck#-90)vy}db1\u0026\u0026e",
            "n": [
              {
                "c": 1,
                "d": "File has a .png extension",
                "i": "metadata/package/files/included::png-extension-basename",
                "o": 0,
                "z": 8,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 0
          }
        ],
        "depth": 1,
        "facts": {
          "metrics": {
            "png": {
              "a_entropy": 1.4,
              "chunk_count": 4.0,
              "trailing_bytes": 0.0,
              "idat_chunk_count": 1.0,
              "text_chunk_bytes": 0.0,
              "chunks_after_iend": 0.0,
              "compression_ratio": 0.04,
              "unknown_chunk_count": 0.0
            },
            "file": {
              "size": 2754.0,
              "entropy": 7.88,
              "size_bytes": 2754.0
            },
            "image": {
              "width": 129.0,
              "height": 129.0,
              "channels": 4.0,
              "b_entropy": 1.22,
              "g_entropy": 1.22,
              "r_entropy": 1.22,
              "edge_density": 0.02,
              "pixel_entropy": 2.19,
              "histogram_flatness": 0.27
            },
            "binary": {
              "overall_entropy": 7.88,
              "peak_region_bytes": 2754.0,
              "peak_region_entropy": 7.77
            }
          }
        },
        "id": 4,
        "path": "BridgingIT.DevKit.Common.Results.10.0.109-preview.0.2.nupkg!!icon.png",
        "pid": 0,
        "sha": "1500812c384fb9134a0dcd6a274c920c4b3835d8787cfce0a67cf0e32ecfe61c",
        "size": 2754,
        "traits": [
          {
            "id": "metadata/package/files/included::png-extension-basename",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "File has a .png extension",
            "spans": [
              [
                0,
                8
              ]
            ]
          }
        ],
        "type": "png"
      },
      {
        "ctx": [
          {
            "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(00",
            "n": [
              {
                "c": 3,
                "d": "HTTP fingerprinting evasion campaign",
                "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign",
                "o": 0,
                "z": 34,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 0
          },
          {
            "b": "00000000000000000000A/pzb00000nb@R\u00260SSx7D@ydFnBuPX0rr91000000000000",
            "n": [
              {
                "c": 1,
                "d": "PE standard code/data section",
                "i": "metadata/binary/section/names::pe-code-data-standard-section",
                "o": 512,
                "z": 5,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 496
          },
          {
            "b": "000l7HMhuMdGxCH1$xPMlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn",
            "n": [
              {
                "c": 3,
                "d": "Recognized PE anti-analysis marker",
                "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker",
                "o": 275836,
                "z": 4,
                "cf": 1.0
              }
            ],
            "ln": 275820
          },
          {
            "b": ".VfVq0iEzBuh%%a0mAa\u0026t(T\u003c903iCW0rr920h.65g5}pP0kf.tg5}pP02V94x8?]j05tDr",
            "n": [
              {
                "c": 3,
                "d": "Embedded LZMA compressed data",
                "i": "micro-behaviors/data/embedded/payload/compression::lzma-magic",
                "o": 285973,
                "z": 8,
                "cf": 0.699999988079071
              }
            ],
            "ln": 285957
          },
          {
            "b": "s]XK60iEzBuh%%a0mAa\u0026t(T\u003c903iCW0rr920oUV}f-RgO0f[[#f-RgO0dVD:f-RgO02V8=",
            "n": [
              {
                "c": 1,
                "d": "LZMA header nonzero size pos 1",
                "i": "micro-behaviors/data/embedded/payload/compression::lzma-sized-nonzero-1",
                "o": 287077,
                "z": 8,
                "cf": 1.0
              }
            ],
            "ln": 287061
          },
          {
            "b": "0rr920oUIGu\u0026Qfc0mAa\u0026t(T\u003c903iCW0rr920j9#gqVD^#0f[)\u003eg5}pP0dVCSg5}pP0p}N%",
            "n": [
              {
                "c": 1,
                "d": "LZMA header nonzero size pos 1",
                "i": "micro-behaviors/data/embedded/payload/compression::lzma-sized-nonzero-1",
                "o": 287317,
                "z": 8,
                "cf": 1.0
              }
            ],
            "ln": 287301
          },
          {
            "b": "aohxC06\u0026REdGxCH01]Rot(T\u003c904O$Y0rr9204PmNg5}pP0mA9Lg5}pP0pq4\u003cqVD^#0oUU*",
            "n": [
              {
                "c": 1,
                "d": "LZMA header nonzero size pos 2",
                "i": "micro-behaviors/data/embedded/payload/compression::lzma-sized-nonzero-2",
                "o": 289677,
                "z": 8,
                "cf": 1.0
              }
            ],
            "ln": 289661
          },
          {
            "b": "zu6Uq0k6LnqVD^#02V8pt(T\u003c905tE}zu6Uv06SJs0rr970kRp?2MK\u0026e0oDKvhuiZY01IJ8",
            "n": [
              {
                "c": 1,
                "d": "LZMA header nonzero size pos 2",
                "i": "micro-behaviors/data/embedded/payload/compression::lzma-sized-nonzero-2",
                "o": 301589,
                "z": 8,
                "cf": 1.0
              }
            ],
            "ln": 301573
          },
          {
            "b": "2MK\u0026e0g)a4mf0q*01]Rot(T\u003c904O$Y0rr92081I{qVD^#02V7*qVD!406SJs0rr970kRo*",
            "n": [
              {
                "c": 1,
                "d": "LZMA header nonzero size pos 2",
                "i": "micro-behaviors/data/embedded/payload/compression::lzma-sized-nonzero-2",
                "o": 306085,
                "z": 8,
                "cf": 1.0
              }
            ],
            "ln": 306069
          },
          {
            "b": "2MK\u0026e0g)b*.VfVq01]Rot(T\u003c904O$Y0rr920cGC(.t\u003cMp01p8^4fcwe03iC24fcwe0j9#g",
            "n": [
              {
                "c": 1,
                "d": "LZMA header nonzero size pos 2",
                "i": "micro-behaviors/data/embedded/payload/compression::lzma-sized-nonzero-2",
                "o": 311965,
                "z": 8,
                "cf": 1.0
              }
            ],
            "ln": 311949
          },
          {
            "b": "0097ei@/lZ0l!\u003cK0096@t(T\u003ca03jc200rjUiUh\u002690qF?\u003e5cS4OeF5D$075%K0097Nve{oe",
            "n": [
              {
                "c": 1,
                "d": "LZMA header nonzero size pos 1",
                "i": "micro-behaviors/data/embedded/payload/compression::lzma-sized-nonzero-1",
                "o": 349715,
                "z": 8,
                "cf": 1.0
              }
            ],
            "ln": 349699
          },
          {
            "b": "00rk{s}zkF0gugO0096@t(T\u003ca0qoOc5cz{2lJv8!0ej?Y00ic%t(T\u003cb0qoN@00Ap\u0026lJv8!",
            "n": [
              {
                "c": 1,
                "d": "LZMA header nonzero size pos 3",
                "i": "micro-behaviors/data/embedded/payload/compression::lzma-sized-nonzero-3",
                "o": 349823,
                "z": 8,
                "cf": 1.0
              }
            ],
            "ln": 349807
          },
          {
            "b": "-TuR-4GTYWyxa?B+Nnm/4/$2+yxa\u003eC^Hf)(5cpt\u0026yxa[D/B8J@5DQU{yxa}E?v1f25={#1",
            "n": [
              {
                "c": 2,
                "d": "XGETBV instruction bytes",
                "i": "metadata/binary/instruction::xgetbv-instr",
                "o": 445092,
                "z": 8,
                "cf": 0.30000001192092896
              }
            ],
            "ln": 445076
          },
          {
            "b": "007EF\u003e[B9$IVJR/004]T1R?1qIVBz8004]T9tFLOAreiq000rdjRW}%8Wbvt001kDu\u003c=@mNGKP",
            "n": [
              {
                "c": 1,
                "d": "DJB2 hash algorithm constant (5381)",
                "i": "objectives/anti-static/obfuscation/imports::djb2-hash-constant",
                "o": 462580,
                "z": 11,
                "cf": 0.75
              }
            ],
            "ln": 462564
          },
          {
            "b": "Bs]}0zeBiee(Dn4B.(eve[w^m08)rrwLNw:yYEBFA=ld[w\u003e)F+yYF9VBye3*yYFP#",
            "n": [
              {
                "c": 3,
                "d": "References Windows executable or script",
                "i": "objectives/execution/interpreter/script/shell::windows-executable-ref",
                "o": 485297,
                "z": 4,
                "cf": 0.6000000238418579
              }
            ],
            "ln": 485281
          },
          {
            "b": "z/bL+z/6D8zGxldx(v\u003e?q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/bL/wPRoBv@#B6zua-?Bydsz",
            "n": [
              {
                "c": 3,
                "d": "JSON polymorphism runtime marker",
                "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref",
                "o": 486006,
                "z": 16,
                "cf": 1.0
              }
            ],
            "ln": 485990
          },
          {
            "b": "0b(*-q/#L\u003eA:-E1x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9l}z!%l3v@#B6zuarXBydyNzE^E6x(v\u003e?B7GD2lJ",
            "n": [
              {
                "c": 2,
                "d": "Benign high-entropy PE context",
                "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context",
                "o": 486117,
                "z": 17,
                "cf": 0.949999988079071
              }
            ],
            "ln": 486101
          },
          {
            "b": "r4ZNIC1VK\u003ee\u003c\u003cL]zeTp(q*ACawO\u003c50wQ5qHn][]*08^@S07p-9phZbhD2[7sz7Xg]y\u00260V)BzkVhB1P%]",
            "n": [
              {
                "c": 2,
                "d": "System.Text.Json library reference",
                "i": "micro-behaviors/data/serialize/json::json-system",
                "o": 486601,
                "z": 16,
                "cf": 0.8500000238418579
              }
            ],
            "ln": 486585
          },
          {
            "b": "wPRoUx(dB5Byx390b(/Rq*ACawO\u003c4{wPPK}BAzE4xl4{kz#-*FBAIK5q*ACawO\u003c4[x(m[\u003cq*ACawO\u003c4!z!%l3v@#B6zGvB2wO#71x\u003e5+!lVl=",
            "n": [
              {
                "c": 3,
                "d": "LINQ query operations",
                "i": "micro-behaviors/data/db/linq::linq-queries",
                "o": 486841,
                "z": 11,
                "cf": 0.699999988079071
              },
              {
                "c": 2,
                "d": "System namespace reference",
                "i": "metadata/lang/compiler/managed::system-namespace",
                "o": 486813,
                "z": 10,
                "cf": 0.800000011920929
              }
            ],
            "ln": 486797
          },
          {
            "b": "B8aGYBzbP6luN0UwmY=Yq/)4]zF8pUx(4r\u003eASx0GB9hqvq!p5)x(mN8luN0UwmY=Yju^\u003c]uT!d(yY",
            "n": [
              {
                "c": 3,
                "d": ".NET StringBuilder Append use",
                "i": "micro-behaviors/data/string/library::dotnet-stringbuilder-append",
                "o": 487021,
                "z": 13,
                "cf": 0.8199999928474426
              }
            ],
            "ln": 487005
          },
          {
            "b": "z/dguwPRoTD2va\u0026z/oZ$q*ACawO\u003c4$B-8qnzdLs\u003ezGGDgz/wS^A=#ebwPGE@vrM6Tv@=p5Bo2@+BydsQBy/rdBo1*xBvoXRvr\u003esXAZs!?wO(yd00",
            "n": [
              {
                "c": 3,
                "d": "Packed binary marker",
                "i": "objectives/anti-static/obfuscation/eval/loader::packed-binary-marker",
                "o": 492470,
                "z": 30,
                "cf": 0.8500000238418579
              }
            ],
            "ln": 492454
          },
          {
            "b": "aol0Nve$0wyYF2Dwb(POpYL5bASx}Rx-JhOA@Y[OzVBUPaok{LwDlPFx-IYAwb(QrrSDLdyYFeHwb{3rBn",
            "n": [
              {
                "c": 2,
                "d": "POSIX \"Permission denied\" error message",
                "i": "micro-behaviors/os/message/error::permission-denied",
                "o": 494754,
                "z": 17,
                "cf": 0.5
              }
            ],
            "ln": 494738
          },
          {
            "b": "015-b1W({hB.pWOjPLKxlVl{?A+Pf1BrAs)gbQg5v\u003c@J!A+P5%x(mMPr3jXFvN@9]l2puWAS",
            "n": [
              {
                "c": 2,
                "d": "Copyright notice",
                "i": "metadata/package/license::copyright-word",
                "o": 573439,
                "z": 9,
                "cf": 0.6000000238418579
              }
            ],
            "ln": 573423
          },
          {
            "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000",
            "n": [
              {
                "c": 1,
                "d": "PE resource section",
                "i": "metadata/binary/section/names::pe-resource-section",
                "o": 815104,
                "z": 5,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 815088
          },
          {
            "b": "0000000000007ZTgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rr913ig5",
            "n": [
              {
                "c": 3,
                "d": "Recognized marker for timing checks",
                "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker",
                "o": 815198,
                "z": 15,
                "cf": 0.949999988079071
              }
            ],
            "ln": 815182
          },
          {
            "b": "aoiI:aoiI:002m:5c8.hlJz38z2!IPve$fBC(QOtve$cAwDhYg002s=ASx!Nwb{lxx-J2Jx8\u003eH",
            "n": [
              {
                "c": 2,
                "d": "PE CompanyName metadata field",
                "i": "metadata/package/versioning::pe-companyname-field",
                "o": 816326,
                "z": 11,
                "cf": 0.699999988079071
              }
            ],
            "ln": 816310
          },
          {
            "b": "m/WxavGn}0003:laPIJymGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002s=ASx!Nwb{lxx-J2",
            "n": [
              {
                "c": 2,
                "d": "PE FileDescription metadata field",
                "i": "metadata/package/versioning::pe-filedescription-field",
                "o": 816390,
                "z": 15,
                "cf": 0.699999988079071
              }
            ],
            "ln": 816374
          },
          {
            "b": "yYFLSA@Vgu001[S3JHhcmGvc5yYF2DrSDXhASydXx-J5Kzu6Up001.NfArZ9fArZ9f-S)cirgVifAq7M003:lb(^@CnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002s=ASx!Nwb{lxx-J2Jx8\u003eH6",
            "n": [
              {
                "c": 3,
                "d": "Dotted-quad PE version metadata marker",
                "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker",
                "o": 816498,
                "z": 11,
                "cf": 0.9399999976158142
              },
              {
                "c": 2,
                "d": "PE InternalName metadata field",
                "i": "metadata/package/versioning::pe-internalname-field",
                "o": 816554,
                "z": 12,
                "cf": 0.699999988079071
              }
            ],
            "ln": 816482
          },
          {
            "b": "wDllve=U\u003eK0043tb(^@Cpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002s=ASx!Nwb{lxx-J2J",
            "n": [
              {
                "c": 2,
                "d": "PE OriginalFilename metadata field",
                "i": "metadata/package/versioning::pe-originalfilename-field",
                "o": 816814,
                "z": 16,
                "cf": 0.699999988079071
              }
            ],
            "ln": 816798
          },
          {
            "b": "wb{ACyYBCn003EdaPIJypYLIozVBqFBPt[KBo25ove$cAwDhYg002s=ASx!Nwb{lxx-J2Jx8\u003eH",
            "n": [
              {
                "c": 2,
                "d": "PE ProductName metadata field",
                "i": "metadata/package/versioning::pe-productname-field",
                "o": 816930,
                "z": 11,
                "cf": 0.699999988079071
              }
            ],
            "ln": 816914
          },
          {
            "b": "yYFLSA@Vgu004fxdf6wGpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001.NfArZ9fArZ9f-S)cirf",
            "n": [
              {
                "c": 2,
                "d": "PE version resource metadata",
                "i": "metadata/package/versioning::version-resource-metadata",
                "o": 817030,
                "z": 14,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 817014
          },
          {
            "b": "000000000000000000000dUET3\u0026*ncLSO{C000000000000000000000000000000000",
            "n": [
              {
                "c": 2,
                "d": "PE .reloc section presence",
                "i": "metadata/binary/section/names::reloc-section-presence",
                "o": 817664,
                "z": 6,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 817648
          }
        ],
        "depth": 1,
        "facts": {
          "imp": [
            [
              "mscoree",
              "CorDllMain"
            ]
          ],
          "sec": [
            [
              ".text",
              512,
              814592,
              6.7,
              "r-x"
            ],
            [
              ".rsrc",
              815104,
              2560,
              2.94,
              "r--"
            ],
            [
              ".reloc",
              817664,
              512,
              0.1,
              "r--"
            ]
          ],
          "metrics": {
            "pe": {
              "checksum": 0.0,
              "checksum_valid": 0.0,
              "resource_count": 1.0,
              "has_version_info": 1.0,
              "checksum_stripped": 1.0,
              "computed_checksum": 844277.0,
              "reloc_overhang_bytes": 500.0,
              "reloc_overhang_ratio": 0.98,
              "bss_like_section_count": 0.0,
              "section_overflow_count": 0.0,
              "misaligned_section_count": 0.0,
              "version.identity_entropy": 4.43,
              "base_relocation_block_count": 1.0,
              "base_relocation_entry_count": 1.0,
              "version.identity_symbol_ratio": 0.08
            },
            "file": {
              "size": 818176.0,
              "entropy": 6.69,
              "size_bytes": 818176.0
            },
            "binary": {
              "is_pie": 1.0,
              "code_entropy": 6.7,
              "string_count": 1750.0,
              "overall_entropy": 6.69,
              "entropy_variance": 7.32,
              "avg_string_length": 27.08,
              "max_string_length": 419.0,
              "peak_region_bytes": 215040.0,
              "code_to_data_ratio": 1.0,
              "peak_region_entropy": 7.85,
              "string_length_stddev": 28.14,
              "largest_section_ratio": 1.0,
              "sentence_string_count": 108.0,
              "sentence_string_ratio": 0.06,
              "high_entropy_string_count": 0.0
            },
            "imports": {
              "count": 1.0
            },
            "sections": {
              "count": 3.0,
              "code_size": 814592.0,
              "entropy_max": 6.7,
              "entropy_mean": 3.25,
              "name_entropy": 3.03,
              "writable_count": 0.0,
              "executable_count": 1.0,
              "nonstandard_count": 0.0,
              "executable_writable_count": 0.0
            },
            "dependencies": {
              "count": 1.0
            }
          }
        },
        "id": 5,
        "mol": "O₂(AlEr)H(Db₂)",
        "path": "BridgingIT.DevKit.Common.Results.10.0.109-preview.0.2.nupkg!!lib/net10.0/BridgingIT.DevKit.Common.Results.dll",
        "risk": 5,
        "sha": "ea98f07784ed274467e5332a675887e0c1d03d6d27aa8bb4f3c0622dad1fecfb",
        "size": 818176,
        "traits": [
          {
            "id": "metadata/binary/framework::clr-runtime-header",
            "conf": 1.0,
            "crit": 2,
            "desc": "PE CLR runtime header present (COM descriptor)"
          },
          {
            "id": "objectives/anti-static/obfuscation/reflection/invoke::endinvoke-token",
            "conf": 0.699999988079071,
            "crit": 1,
            "desc": "Delegate EndInvoke token",
            "spans": [
              [
                482297,
                9
              ]
            ]
          },
          {
            "id": "metadata/package/versioning::pe-fileversion-field",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "PE FileVersion metadata field",
            "spans": [
              [
                816498,
                11
              ]
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/reflection/invoke::begininvoke-token",
            "conf": 0.699999988079071,
            "crit": 1,
            "desc": "Delegate BeginInvoke token",
            "spans": [
              [
                482307,
                11
              ]
            ]
          },
          {
            "id": "metadata/package/versioning::pe-productversion-field",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "PE ProductVersion metadata field",
            "spans": [
              [
                817030,
                14
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/string/library::dotnet-stringbuilder-append",
            "conf": 0.8199999928474426,
            "crit": 3,
            "desc": ".NET StringBuilder Append use",
            "spans": [
              [
                487021,
                13
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/db/linq::linq-queries",
            "conf": 0.699999988079071,
            "crit": 3,
            "desc": "LINQ query operations",
            "spans": [
              [
                486841,
                11
              ]
            ]
          },
          {
            "id": "micro-behaviors/fs/path/extension::dll-dup",
            "crit": 2,
            "desc": ".dll extension reference",
            "spans": [
              [
                485297,
                4
              ]
            ]
          },
          {
            "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref",
            "conf": 1.0,
            "crit": 3,
            "desc": "JSON polymorphism runtime marker",
            "spans": [
              [
                486006,
                16
              ]
            ]
          },
          {
            "id": "objectives/anti-static/pack/runtime::dotnet-interop-services-string",
            "atk": "T1027.002",
            "mbc": "B0032",
            "conf": 0.8500000238418579,
            "crit": 1,
            "desc": "Embedded System.Runtime.InteropServices name",
            "spans": [
              [
                492470,
                30
              ]
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/reflection/invoke::namespace-import",
            "conf": 0.699999988079071,
            "crit": 1,
            "desc": "Reflection method namespace token",
            "spans": [
              [
                486117,
                17
              ]
            ]
          },
          {
            "id": "metadata/binary/framework::dotnet-metadata",
            "conf": 1.0,
            "crit": 2,
            "desc": ".NET Metadata Root (BSJB)",
            "spans": [
              [
                275836,
                4
              ]
            ]
          },
          {
            "id": "metadata/package/versioning::pe-version-resource",
            "conf": 0.800000011920929,
            "crit": 2,
            "desc": "PE version resource structure",
            "spans": [
              [
                815198,
                15
              ]
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/reflection/invoke::activator",
            "conf": 0.800000011920929,
            "crit": 1,
            "desc": "Dynamic object instantiation via Activator",
            "spans": [
              [
                488795,
                9
              ]
            ]
          },
          {
            "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal",
            "conf": 0.699999988079071,
            "crit": 1,
            "desc": ".NET code entropy in unpacked range",
            "spans": [
              [
                0,
                26
              ]
            ]
          },
          {
            "id": "metadata/package/versioning::pe-file-version-ipv4-shape",
            "conf": 0.9200000166893005,
            "crit": 1,
            "desc": "PE FileVersion resembles IPv4",
            "spans": [
              [
                816524,
                10
              ]
            ]
          },
          {
            "id": "metadata/binary/resource::pe-resource-version-first",
            "conf": 1.0,
            "crit": 2,
            "desc": "PE first resource is RT_VERSION"
          },
          {
            "id": "metadata/binary/framework::dotnet-assembly",
            "conf": 1.0,
            "crit": 2,
            "desc": ".NET Assembly (mscoree.dll)",
            "spans": [
              [
                275836,
                4
              ]
            ]
          },
          {
            "id": "objectives/evasion/masquerade/identity/vendor::importless-microsoft-recognized-marker",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Recognized Microsoft importless PE marker",
            "spans": [
              [
                275836,
                4
              ]
            ]
          }
        ],
        "type": "pe"
      },
      {
        "id": 6,
        "sha": "014be50bead1e534b5c4260670332bbcb06ae1ba2fd5ee8f297a47d7605c8765",
        "path": "BridgingIT.DevKit.Common.Results.10.0.109-preview.0.2.nupkg!![Content_Types].xml",
        "size": 582,
        "type": "xml",
        "depth": 1
      },
      {
        "id": 7,
        "sha": "5329c5211e869ad020431842c58622d265a7be3b0dfc0f14643e1795a32b234b",
        "path": "BridgingIT.DevKit.Common.Results.10.0.109-preview.0.2.nupkg!!package/services/metadata/core-properties/cdf19372cc14435fad3012002592a484.psmdcp",
        "size": 1121,
        "type": "xml",
        "depth": 1
      },
      {
        "id": 8,
        "sha": "c1746f7bc2098cd45627c14e3516749e3dab601fe20672e4ddcc0e1513840a35",
        "path": "BridgingIT.DevKit.Common.Results@10.0.109-preview.0.2.registry.json",
        "size": 1240,
        "type": "registry",
        "depth": 1
      }
    ],
    "omitted_files": 3,
    "v": "8"
  }
}