{ "ml": { "v": "7", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.00005846222, "rte": "az", "prob": 0.00005846222 }, { "cls": 0, "raw": 0.0025856793, "rte": "az/native", "prob": 0.0025856793 }, { "cls": 0, "raw": 0.14241065, "rte": "az/pe", "prob": 0.14241065 } ], "prob": 0.00005846222, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.000058462221204536036, "type": "pe" } ], "version": "v18.18", "analyzed_at": "2026-06-14T21:10:12Z" }, "path": "76506e2eab776fca3b25d360c68d7be1fd5f55063319c1977b78634624d29bcc.dll", "raw": { "v": "7", "tv": "061e3", "files": [ { "id": 0, "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000xAn8k4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47", "l": 0, "n": [ { "c": 2, "d": "Windows DLL extension", "i": "metadata/file/extension::dll", "o": 0, "z": 68 } ], "x": true }, { "b": "i?ciJ00000Sg9!/00000YQF{4^3\u003e4o]Qt\u003cY\u003cEleI00000aoqE)00000t:$/{000007mUy900000000000000000000", "l": 24584, "n": [ { "c": 3, "d": "Dynamic library loading via LoadLibraryW", "i": "micro-behaviors/dylib/load/runtime::load-library-w", "o": 24612, "z": 12 } ], "x": true }, { "b": "7mUy900000pFshyrA7+fe[w^m004fzqE%GtvrMiPwQcZ?k(:hsrZxLNgCQN[y?%7K[=h9@wkDYEwDkj*nI-aOwnD5ZFDe5TwNPW(l${WMv@#TfC#\u003c$C6-{)pBwlW:B.\u003eQ", "l": 105332, "n": [ { "c": 2, "d": ".dll extension reference", "i": "micro-behaviors/fs/path/extension::dll-dup", "o": 105348, "z": 4 }, { "c": 2, "d": "Reference to ADVAPI32.dll", "i": "micro-behaviors/os/module/load::advapi32-dll-reference", "o": 105370, "z": 12 }, { "c": 2, "d": "Reference to GDI32.dll", "i": "micro-behaviors/os/module/load::gdi32-dll-reference", "o": 105394, "z": 9 } ], "x": true }, { "b": "lT:FrwKQGUA^pk]w]y-Js4MdUpdnbmwnD5ZHx6XZD2N\u003c]zEWP}wLV=IwN/*JCMp9esX@6Nga)9NyYD0!m}D^iz!0{h0031$mn+]%e[w^m0000000000000000000000000000000000000000", "l": 105502, "n": [ { "c": 2, "d": "WinInet DLL import name", "i": "micro-behaviors/communications/http/get::wininet-dll-import-name", "o": 105518, "z": 11 }, { "c": 2, "d": "Reference to USER32.dll", "i": "micro-behaviors/os/module/load::user32-dll-reference", "o": 105576, "z": 10 } ], "x": true }, { "b": "36oC1vn^jY000\u0026CgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrDbnDpN", "l": 169326, "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 169342, "z": 15 } ], "x": true }, { "b": "fAr{fwDjK!002E*6954klJz38z2!IPve$fBC(QOtve$cAwDhYg002^{ASxIFv/QrBwDi?MlJz3", "l": 169478, "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 169494, "z": 11 } ], "x": true }, { "b": "x-J5Kzu6Up005k-hui:TmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002v^yYE(zA@ZmYx-IS", "l": 169550, "n": [ { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 169566, "z": 15 } ], "x": true }, { "b": "wDlcszua.T001[S3JHhcmGvc5yYF2DrSDXhASydXx-J5Kzu6Up001}Tgxo3cf-S)ce=W\u003che=W:eg5}pO001[S3JHhcmGvMhyYFnKaokBx", "l": 169810, "n": [ { "c": 2, "d": "External IPv4 values in PE version metadata", "i": "objectives/command-and-control/infrastructure/ip::version-resource-ip-values", "o": 169826, "z": 11 }, { "c": 1, "d": "PE FileVersion resembles IPv4", "i": "metadata/package/versioning::pe-file-version-ipv4-shape", "o": 169852, "z": 10 } ], "x": true }, { "b": "e=W:eg5}pO0024W4fczenDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002W)ASyaWA@Wr.so8+fx-J2J", "l": 169922, "n": [ { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 169938, "z": 12 } ], "x": true }, { "b": "z#+d-ASx!Nx8(PBBn#pvlJz38z#+d-ASx!Nx8(PBBo0A-Sq[4vg5%0df-T3g00000apnkP0r", "l": 170012, "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 170028, "z": 9 } ], "x": true }, { "b": "vGo%tve$fB002E*4/=Rgpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE003*nASyaWA@Y+Kf-S)c", "l": 172646, "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 172662, "z": 16 } ], "x": true }, { "b": "wb{ACyYBCn003418VP)spYLIozVBqFBPt[KBo25ove$cAwDhYg002W)ASyaWA@WP*so7R!df7E", "l": 172718, "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 172734, "z": 11 } ], "x": true }, { "b": "l\u0026YaBfAq7M0024W3JHhcpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001}Te=WWce=WQafAs6je=W:eg5}pO002y!00031rSDLdASwMex-I@H", "l": 172806, "n": [ { "c": 2, "d": "PE ProductVersion metadata field", "i": "metadata/package/versioning::pe-productversion-field", "o": 172822, "z": 14 }, { "c": 1, "d": "PE ProductVersion resembles IPv4", "i": "metadata/package/versioning::pe-product-version-ipv4-shape", "o": 172852, "z": 10 } ], "x": true }, { "b": "0000000000000000000001Ybgh#\u0026{U5?$T^B$}5)5I^VFQb5@f...]Z8Af=qzA2P{@5j", "l": 176112, "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 176128, "z": 6 } ], "x": true } ], "idn": { "name": { "value": "lrrse10602.dll", "source": "pe.version.original_filename", "verified": false }, "trust": "unsigned", "project": { "value": "Lrrs(XA) Heieitze YT 7 D60", "source": "pe.version.product_name", "verified": false }, "version": { "value": "73.10.8.52", "source": "pe.version.file_version", "verified": false }, "organization": { "value": "Oracle Corporation", "source": "pe.version.company", "verified": false } }, "mol": "H(Ds)", "sha": "76506e2eab776fca3b25d360c68d7be1fd5f55063319c1977b78634624d29bcc", "fact": { "id": "pe", "imp": [ [ "oleaut32", "ORDINAL 288" ], [ "advapi32", "RegSaveKeyExA" ], [ "gdi32", "EndPage" ], [ "kernel32", "CreateDirectoryW" ], [ "kernel32", "GetModuleHandleA" ], [ "kernel32", "GetModuleHandleW" ], [ "kernel32", "LoadLibraryW" ], [ "wininet", "GetUrlCacheEntryInfoW" ], [ "crypt32", "CryptEncodeObjectEx" ], [ "user32", "GetFocus" ] ], "met": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 3.0, "cert_table_size": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 208897.0, "reloc_overhang_bytes": 3784.0, "reloc_overhang_ratio": 0.92, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.81, "base_relocation_block_count": 4.0, "base_relocation_entry_count": 140.0, "version.identity_symbol_ratio": 0.13 }, "file": { "size": 180224.0, "entropy": 6.71, "size_bytes": 180224.0 }, "binary": { "is_pie": 1.0, "code_entropy": 3.21, "data_entropy": 6.8, "string_count": 123.0, "overall_entropy": 6.71, "entropy_variance": 6.31, "avg_string_length": 56.8, "max_string_length": 1283.0, "code_to_data_ratio": 0.38, "string_length_stddev": 168.69, "largest_section_ratio": 0.45, "sentence_string_count": 21.0, "sentence_string_ratio": 0.17, "high_entropy_string_count": 0.0 }, "imports": { "count": 10.0 }, "sections": { "count": 7.0, "code_size": 20480.0, "entropy_max": 7.8, "entropy_mean": 4.81, "name_entropy": 3.59, "writable_count": 2.0, "executable_count": 1.0, "nonstandard_count": 5.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 7.0 } }, "sec": [ [ ".rdata0", 4096, 20480, 3.21, "r-x" ], [ ".Rdata", 24576, 81920, 7.8, "r-x" ], [ ".qdata", 106496, 4096, 3.37, "rw-" ], [ ".CRT", 110592, 12288, 7.47, "r--" ], [ ".crt3", 122880, 28672, 7.28, "rw-" ], [ ".rsrc", 151552, 24576, 3.77, "r--" ], [ ".reloc", 176128, 4096, 0.77, "r--" ] ], "str": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 608, "u8", ".rdata0" ], [ 687, "u8", "@.qdata" ], [ 728, "u8", ".CRT" ], [ 767, "u8", "@.crt3" ], [ 808, "u8", ".rsrc" ], [ 847, "u8", "@.reloc" ], [ 28677, "u8", "b5y7" ], [ 34107, "u8", "KNN3" ], [ 39385, "u8", "1Jlz2" ], [ 40391, "u8", "bGmik9" ], [ 48953, "u8", "2IF6fT" ], [ 52101, "u8", "NK3hrO" ], [ 52864, "u8", "WEX8" ], [ 55146, "u8", "8Yav9" ], [ 58841, "u8", "ws1LrF" ], [ 61043, "u8", "MF5DA" ], [ 62665, "u8", "/CTk" ], [ 66732, "u8", "Tlvz" ], [ 68843, "u8", "}y{x" ], [ 71016, "u8", "NIF6" ], [ 73482, "u8", "5T2UH" ], [ 73688, "u8", "y52b" ], [ 80054, "u8", "ot5LN" ], [ 82221, "u8", "zWav" ], [ 83964, "u8", "ws0WQ" ], [ 84183, "u8", "dle 46" ], [ 84513, "u8", "BhvDH" ], [ 88253, "u8", "ws0Tt" ], [ 90382, "u8", "5y7v" ], [ 91011, "u8", "oP7WK" ], [ 93597, "u8", "WnJF5" ], [ 102539, "u8", "m27BF" ], [ 104969, "u8", "zO48w6NN4_Ma2AF0J" ], [ 104988, "u8", "RSDS" ], [ 105012, "u8", "plfm.pdb" ], [ 105340, "u8", "OLEAUT32.dll" ], [ 105356, "u8", "RegSaveKeyExA" ], [ 105370, "u8", "ADVAPI32.dll" ], [ 105386, "u8", "EndPage" ], [ 105394, "u8", "GDI32.dll" ], [ 105406, "u8", "CreateDirectoryW" ], [ 105426, "u8", "GetModuleHandleA" ], [ 105446, "u8", "LoadLibraryW" ], [ 105462, "u8", "GetModuleHandleW" ], [ 105480, "u8", "KERNEL32.dll" ], [ 105496, "u8", "GetUrlCacheEntryInfoW" ], [ 105518, "u8", "WININET.dll" ], [ 105532, "u8", "CryptEncodeObjectEx" ], [ 105552, "u8", "CRYPT32.dll" ], [ 105566, "u8", "GetFocus" ], [ 105576, "u8", "USER32.dll" ], [ 112529, "u8", "hqWm" ], [ 112756, "u8", "JFZuO" ], [ 115539, "u8", "LNnUU" ], [ 117880, "u8", "5J6ld" ], [ 130895, "u8", "X1Uazz" ], [ 131737, "u8", "c29j" ], [ 141726, "u8", "/ivs1H8c" ], [ 104592, "wide", "estapp" ], [ 104616, "wide", "self.ex" ], [ 104634, "wide", "Kthattxwasgf2Taba" ], [ 104670, "wide", "tandthem.165" ], [ 104696, "wide", "ChromiumformeranwantedListening3issued5performance.57" ], [ 104804, "wide", "YJanuaryGoogleWSn" ], [ 152262, "wide", "Java-Plug-in-Warnung" ], [ 152306, "wide", "MS Sans Serif" ], [ 152358, "wide", "IDI_DUKE_ICON" ], [ 152470, "wide", "Advertencia de Java Plug-in" ], [ 152702, "wide", "Avertissement du plug-in Java" ], [ 152926, "wide", "Avvertenza plugin Java" ], [ 153142, "wide", "Java Plug-in: varning" ], [ 153350, "wide", "Java Plug-in" ], [ 153558, "wide", "Java Plug-in Warning" ], [ 153796, "wide", "MS UI Gothic" ], [ 153966, "wide", "Java" ], [ 154166, "wide", "Advertência do Plug-in Java" ], [ 154582, "wide", "Los applet de esta página HTML necesitan una versión de Java distinta de la que está utilizando actualmente el explorador. Pa" ], [ 155874, "wide", "Consola de Sun JavaʼnSun Java no es la opción de Java seleccionada por defecto para el explorador.\nLa Consola de Sun Java es la" ], [ 157860, "wide", "Console Sun JavaĺSun Java n'est actuellement pas sélectionné comme Java par défaut du navigateur.\nL'option Console Sun Java " ], [ 158550, "wide", "L'applet o le applet presenti in questa pagina HTML richiedono una versione di Java differente da quella utilizzata attualmente " ], [ 159904, "wide", "Sun Java ConsoleńSun Java non è attualmente selezionato come funzionalità Java predefinita del browser.\nL'opzione Sun Java Co" ], [ 160612, "wide", "ÞAppletarna på den här HTML-sidan kräver en annan Javaversion än den webbläsaren använder nu. För att köra appletarna p" ], [ 161668, "wide", "Sun Java-konsolþSun Java är för närvarande inte standardjava för webbläsaren.\nAlternativet Sun Java-konsol är endast till" ], [ 162240, "wide", "HTML" ], [ 162260, "wide", "Applet" ], [ 162282, "wide", "java" ], [ 162614, "wide", "Netscape" ], [ 162750, "wide", "Sun Java" ], [ 162774, "wide", "zSun Java" ], [ 164170, "wide", "Sun Java ConsoleĉSun Java is not currently selected as the default Java for the browser.\nThe Sun Java Console option is only av" ], [ 166208, "wide", ". HTML" ], [ 166600, "wide", ". Sun Java" ], [ 166742, "wide", "O(s) applet(s) desta página HTML requere(m) uma versão do Java diferente da usada atualmente pelo browser. Para executar o(s) " ], [ 167966, "wide", "Console Sun JavaďO Sun Java não está selecionado atualmente como o browser padrão Java.\nA opção Console Sun Java está dis" ], [ 169166, "wide", ", Sun Java" ], [ 169342, "wide", "VS_VERSION_INFO" ], [ 169434, "wide", "StringFileInfo" ], [ 169470, "wide", "040904e4" ], [ 169494, "wide", "CompanyName" ], [ 169520, "wide", "Oracle Corporation" ], [ 169566, "wide", "FileDescription" ], [ 169600, "wide", "Classic Java Plug-in 10.60.2 for Netscape and Mozilla" ], [ 169714, "wide", "FileExtents" ], [ 169750, "wide", "FileOpenName" ], [ 169776, "wide", "Java Applet|JavaBeans" ], [ 169826, "wide", "FileVersion" ], [ 169852, "wide", "73.10.8.52" ], [ 169882, "wide", "Full Version" ], [ 169938, "wide", "InternalName" ], [ 169964, "wide", "Lrrs Xain-ei" ], [ 169998, "wide", "LegalCopyright" ], [ 170028, "wide", "Copyright © 2014" ], [ 170070, "wide", "MIMEType" ], [ 170088, "wide", "application/x-java-applet;jpi-version=1.7.0_60|application/x-java-bean;jpi-version=1.7.0_60|application/x-java-applet;version=1." ], [ 172662, "wide", "OriginalFilename" ], [ 172696, "wide", "lrrse10602.dll" ], [ 172734, "wide", "ProductName" ], [ 172760, "wide", "Lrrs(XA) Heieitze YT 7 D60" ], [ 172822, "wide", "ProductVersion" ], [ 172852, "wide", "7.3.108.52" ], [ 172882, "wide", "VarFileInfo" ], [ 172914, "wide", "Translation" ] ], "val": { "file.stem": "76506e2eab776fca3b25d360c68d7be1fd5f55063319c1977b78634624d29bcc", "pe.imphash": "2d959bb2447e1082d477db6c861bb148", "pe.machine": "i386", "pe.rich.key": 673249717, "pe.rich.hash": "bcbc5cc790dc0d03c2f511575979843e", "pe.subsystem": "windows_gui", "pe.timestamp": 1605883875, "file.basename": "76506e2eab776fca3b25d360c68d7be1fd5f55063319c1977b78634624d29bcc.dll", "pe.image_base": 4194304, "pe.image_size": 184320, "pe.machine_id": 332, "pe.os_version": "5.0", "pe.version.os": "unknown", "pe.entry_point": 17462, "pe.headers_size": 4096, "pe.version.type": "dll", "pe.entry_section": ".rdata0", "pe.subsystem_raw": 2, "pe.file_alignment": 4096, "pe.image_hash.sha1": "ea5522c4dc136fd464cbb8aae38c5d7806357716", "pe.version.company": "Oracle Corporation", "pe.image_hash.sha256": "8fbd7253f91fc5761631bbfd5d093cb3c7652d5a59a196f2b0b8c49e21c8d6d3", "pe.image_hash.sha384": "ace5577bebe3d20edd0cc1ad748ab2cc173d6e0b783cf89abd89deab1cae7c5760206e791a690f819a064e0e51fff799", "pe.image_hash.sha512": "6529fe24adaa3766f6d443d5fde62fc0deac4a6d73501207edbc3998e38cba6f686d07f71b9a450327f8a261756085e36050500b2520f599eb22624785c88554", "pe.resource_types[0]": "RT_DIALOG", "pe.resource_types[1]": "RT_STRING", "pe.resource_types[2]": "RT_VERSION", "pe.section_alignment": 4096, "pe.subsystem_version": "5.1", "pe.version.copyright": "Copyright © 2014", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.characteristics[2]": "dll", "pe.characteristics_raw": 8450, "pe.version.description": "Classic Java Plug-in 10.60.2 for Netscape and Mozilla", "pe.linker_major_version": 12, "pe.linker_minor_version": 1, "pe.version.file_version": "73.10.8.52", "pe.version.product_name": "Lrrs(XA) Heieitze YT 7 D60", "build.toolchain.compiler": "msvc", "pe.debug.entries[0].type": "other", "pe.debug.entries[1].type": "other", "pe.version.internal_name": "Lrrs Xain-ei", "pe.dll_characteristics[0]": "dynamic_base", "pe.dll_characteristics[1]": "nx_compat", "pe.dll_characteristics[2]": "terminal_server_aware", "pe.version.company_offset": 169520, "pe.data_directories[0].rva": 105112, "pe.data_directories[1].rva": 155648, "pe.data_directories[2].rva": 4096, "pe.data_directories[3].rva": 180224, "pe.data_directories[4].rva": 20529, "pe.data_directories[5].rva": 24576, "pe.dll_characteristics_raw": 33092, "pe.number_of_rva_and_sizes": 16, "pe.version.product_version": "7.3.108.52", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 160, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 21392, "pe.data_directories[2].name": "certificate", "pe.data_directories[2].size": 1, "pe.data_directories[3].name": "base_relocation", "pe.data_directories[3].size": 312, "pe.data_directories[4].name": "debug", "pe.data_directories[4].size": 56, "pe.data_directories[5].name": "iat", "pe.data_directories[5].size": 68, "pe.debug.entries[0].type_id": 3277676120, "pe.debug.entries[1].type_id": 2299459715, "pe.rich.entries[0].build_id": 157, "pe.rich.entries[1].build_id": 202, "pe.rich.entries[2].build_id": 259, "pe.rich.entries[3].build_id": 260, "pe.rich.entries[4].build_id": 223, "pe.rich.entries[5].build_id": 145, "pe.rich.entries[6].build_id": 255, "pe.rich.entries[7].build_id": 205, "pe.rich.entries[8].build_id": 202, "pe.rich.entries[9].build_id": 257, "pe.version.copyright_offset": 170028, "pe.rich.entries[0].use_count": 489, "pe.rich.entries[10].build_id": 225, "pe.rich.entries[11].build_id": 207, "pe.rich.entries[12].build_id": 155, "pe.rich.entries[1].use_count": 283, "pe.rich.entries[2].use_count": 21, "pe.rich.entries[3].use_count": 13, "pe.rich.entries[4].use_count": 263, "pe.rich.entries[5].use_count": 382, "pe.rich.entries[6].use_count": 21, "pe.rich.entries[7].use_count": 8, "pe.rich.entries[8].use_count": 43, "pe.rich.entries[9].use_count": 451, "pe.version.original_filename": "lrrse10602.dll", "pe.coff.dos_header_pe_pointer": 360, "pe.rich.entries[0].product_id": 30319, "pe.rich.entries[10].use_count": 185, "pe.rich.entries[11].use_count": 508, "pe.rich.entries[12].use_count": 388, "pe.rich.entries[1].product_id": 50727, "pe.rich.entries[2].product_id": 23026, "pe.rich.entries[3].product_id": 25834, "pe.rich.entries[4].product_id": 31101, "pe.rich.entries[5].product_id": 21022, "pe.rich.entries[6].product_id": 23918, "pe.rich.entries[7].product_id": 60610, "pe.rich.entries[8].product_id": 50727, "pe.rich.entries[9].product_id": 23026, "pe.version.description_offset": 169600, "pe.debug.entries[0].size_bytes": 2328380811, "pe.debug.entries[1].size_bytes": 3765815365, "pe.rich.entries[10].product_id": 30723, "pe.rich.entries[11].product_id": 61030, "pe.rich.entries[12].product_id": 30319, "pe.version.file_version_offset": 169852, "pe.version.product_name_offset": 172760, "pe.base_relocations.block_count": 4, "pe.base_relocations.entry_count": 140, "pe.version.internal_name_offset": 169964, "pe.version.product_version_offset": 172852, "pe.debug.entries[0].timestamp_unix": 2299548041, "pe.debug.entries[1].timestamp_unix": 88901632, "pe.version.original_filename_offset": 172696 } }, "find": [ { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field" }, { "id": "metadata/package/versioning::pe-file-version-ipv4-shape", "conf": 0.9200000166893005, "crit": 1, "desc": "PE FileVersion resembles IPv4" }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure" }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field" }, { "id": "metadata/package/versioning::pe-product-version-ipv4-shape", "conf": 0.9200000166893005, "crit": 1, "desc": "PE ProductVersion resembles IPv4" }, { "id": "micro-behaviors/dylib/load/runtime::load-library-w", "atk": "T1129", "conf": 0.8799999952316284, "crit": 3, "desc": "Dynamic library loading via LoadLibraryW" }, { "id": "metadata/package/versioning::version-resource-metadata", "conf": 0.8999999761581421, "crit": 2, "desc": "PE version resource metadata" } ], "path": "76506e2eab776fca3b25d360c68d7be1fd5f55063319c1977b78634624d29bcc.dll", "risk": 2, "size": 180224, "type": "pe" } ] } }