{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.8249525427818298,
        "class": 0
      }
    ],
    "prob": 0.82495254,
    "class": 0,
    "models": [
      {
        "m": "az",
        "prob": 0.18095171,
        "class": 0
      },
      {
        "m": "az/native",
        "prob": 0.59157467,
        "class": 0
      },
      {
        "m": "az/pe",
        "prob": 0.82495254,
        "class": 0
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961138,
      0.99909174
    ],
    "analyzed_at": "2026-05-10T08:35:10Z"
  },
  "path": "Properties.Resources.Designer.cs.dll",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "Md₂(Bi₂Si)",
        "k": {
          "hash.imp": "0fbf32532db2d14e7ac3ea5fae7eb05b",
          "pe.timestamp": 1647347834,
          "hash.authenti": "4a4523cff0877af590302d20a4cd334377a51a0912c7b7b855849f9978a0d2d7",
          "build.target_arch": "x86",
          "pe.linker_version": "48.0",
          "pe.data_directories[0].rva": 11512,
          "pe.data_directories[1].rva": 16384,
          "pe.data_directories[2].rva": 8192,
          "pe.data_directories[3].rva": 8200,
          "pe.data_directories[0].name": "import",
          "pe.data_directories[0].size": 79,
          "pe.data_directories[1].name": "base_relocation",
          "pe.data_directories[1].size": 12,
          "pe.data_directories[2].name": "iat",
          "pe.data_directories[2].size": 8,
          "pe.data_directories[3].name": "clr_runtime_header",
          "pe.data_directories[3].size": 72,
          "pe.dll_characteristics.no_seh": true,
          "pe.dll_characteristics.nx_compat": true,
          "pe.section_characteristics[0].name": ".text",
          "pe.section_characteristics[1].name": ".reloc",
          "pe.dll_characteristics.dynamic_base": true,
          "pe.section_characteristics[0].raw_size": 3584,
          "pe.section_characteristics[1].raw_size": 512,
          "pe.section_characteristics[0].virtual_size": 3408,
          "pe.section_characteristics[1].virtual_size": 12,
          "pe.dll_characteristics.terminal_server_aware": true,
          "pe.section_characteristics[0].virtual_address": 8192,
          "pe.section_characteristics[1].virtual_address": 16384,
          "pe.section_characteristics[0].characteristics_hex": "60000020",
          "pe.section_characteristics[1].characteristics_hex": "42000040"
        },
        "x": 5,
        "id": 0,
        "is": [
          "CorDllMain"
        ],
        "ms": {
          "pe": {
            "entry": 11594.0,
            "machine": 332.0,
            "checksum": 0.0,
            "is_dotnet": true,
            "subsystem": 3.0,
            "timestamp": 1647347834.0,
            "image_base": 268435456.0,
            "clr_version": "2.5",
            "entry_section": ".text",
            "size_of_image": 24576.0,
            "file_alignment": 512.0,
            "characteristics": 8226.0,
            "size_of_headers": 512.0,
            "export_timestamp": 0.0,
            "import_dll_count": 1.0,
            "computed_checksum": 21709.0,
            "section_alignment": 8192.0,
            "resource_timestamp": 0.0,
            "dll_characteristics": 34112.0,
            "has_export_timestamp": false,
            "linker_major_version": 48.0,
            "has_resource_timestamp": false,
            "number_of_rva_and_sizes": 16.0
          },
          "file": {
            "size": 4608.0
          },
          "binary": {
            "code_size": 3584.0,
            "code_entropy": 4.91,
            "import_count": 1.0,
            "string_count": 68.0,
            "section_count": 2.0,
            "import_density": 0.29,
            "string_density": 19.43,
            "overall_entropy": 2.5,
            "avg_section_size": 2048.0,
            "dependency_count": 1.0,
            "entropy_variance": 2.42,
            "avg_string_length": 19.53,
            "max_string_length": 75.0,
            "avg_string_entropy": 3.27,
            "code_to_data_ratio": 7.0,
            "text_to_file_ratio": 0.78,
            "string_length_stddev": 14.1,
            "largest_section_ratio": 0.78,
            "sentence_string_count": 1.0,
            "sentence_string_ratio": 0.01
          }
        },
        "ss": [
          [
            77,
            "!This program cannot be run in DOS mode."
          ],
          [
            376,
            ".text"
          ],
          [
            1084,
            "BSJB"
          ],
          [
            2037,
            "\u003cModule\u003e"
          ],
          [
            2046,
            "System.IO"
          ],
          [
            2056,
            "get_istockphoto_1316460284_170667a"
          ],
          [
            2091,
            "mscorlib"
          ],
          [
            2100,
            "Synchronized"
          ],
          [
            2113,
            "defaultInstance"
          ],
          [
            2129,
            "RuntimeTypeHandle"
          ],
          [
            2147,
            "GetTypeFromHandle"
          ],
          [
            2165,
            "Type"
          ],
          [
            2170,
            "get_dredererderderedre"
          ],
          [
            2193,
            "get_Culture"
          ],
          [
            2205,
            "set_Culture"
          ],
          [
            2217,
            "resourceCulture"
          ],
          [
            2233,
            "ApplicationSettingsBase"
          ],
          [
            2257,
            "get_noise"
          ],
          [
            2267,
            "EditorBrowsableState"
          ],
          [
            2288,
            "CompilerGeneratedAttribute"
          ],
          [
            2315,
            "GeneratedCodeAttribute"
          ],
          [
            2338,
            "DebuggerNonUserCodeAttribute"
          ],
          [
            2367,
            "DebuggableAttribute"
          ],
          [
            2387,
            "EditorBrowsableAttribute"
          ],
          [
            2412,
            "CompilationRelaxationsAttribute"
          ],
          [
            2444,
            "RuntimeCompatibilityAttribute"
          ],
          [
            2474,
            "value"
          ],
          [
            2480,
            "get_vig"
          ],
          [
            2488,
            "System.Drawing"
          ],
          [
            2503,
            "get_original"
          ],
          [
            2516,
            "System.ComponentModel"
          ],
          [
            2538,
            "Properties.Resources.Designer.cs.dll.dll"
          ],
          [
            2579,
            "Properties.Resources.Designer.cs.dll"
          ],
          [
            2616,
            "GetStream"
          ],
          [
            2626,
            "UnmanagedMemoryStream"
          ],
          [
            2648,
            "System"
          ],
          [
            2655,
            "resourceMan"
          ],
          [
            2667,
            "System.Configuration"
          ],
          [
            2688,
            "System.Globalization"
          ],
          [
            2709,
            "System.Reflection"
          ],
          [
            2727,
            "get_geometric_gradient_pattern"
          ],
          [
            2758,
            "CultureInfo"
          ],
          [
            2770,
            "Bitmap"
          ],
          [
            2777,
            "get_ResourceManager"
          ],
          [
            2797,
            "System.CodeDom.Compiler"
          ],
          [
            2821,
            "get__443640_pink_and_blue_backgrounddownload_free_cool_wallpaper"
          ],
          [
            2886,
            ".ctor"
          ],
          [
            2892,
            ".cctor"
          ],
          [
            2899,
            "System.Diagnostics"
          ],
          [
            2918,
            "System.Runtime.CompilerServices"
          ],
          [
            2950,
            "System.Resources"
          ],
          [
            2967,
            "DebuggingModes"
          ],
          [
            2982,
            "bmp.Properties"
          ],
          [
            2997,
            "Settings"
          ],
          [
            3006,
            "GetObject"
          ],
          [
            3016,
            "get_Default"
          ],
          [
            3028,
            "get_Assembly"
          ],
          [
            3046,
            "bmp.Properties.Resources"
          ],
          [
            3096,
            "443640-pink-and-blue-backgrounddownload-free-cool-wallpaper"
          ],
          [
            3216,
            "dredererderderedre"
          ],
          [
            3254,
            "geometric-gradient-pattern"
          ],
          [
            3308,
            "istockphoto-1316460284-170667a"
          ],
          [
            3370,
            "noise"
          ],
          [
            3382,
            "original"
          ],
          [
            3629,
            "WrapNonExceptionThrows"
          ],
          [
            3665,
            "System.Resources.Tools.StronglyTypedResourceBuilder"
          ],
          [
            3736,
            "Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator"
          ],
          [
            3898,
            "mscoree.dll"
          ]
        ],
        "sz": 4608,
        "ts": [
          {
            "c": 1.0,
            "d": ".NET assembly detected via BSJB CLR metadata signature",
            "e": [
              "BSJB at offset 0x43c"
            ],
            "i": "metadata/dotnet/bsjb-signature",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary has low average string entropy",
            "e": [
              "binary.avg_string_entropy = 3.27"
            ],
            "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max",
            "l": 2
          },
          {
            "a": "T1027.003",
            "c": 0.7799999713897705,
            "d": ".NET resource manager reference",
            "e": [
              "get_ResourceManager"
            ],
            "i": "micro-behaviors/data/embedded/payload/image::dotnet-resource-manager-token",
            "l": 1,
            "m": "F0001.006"
          },
          {
            "a": "T1055.012",
            "c": 1.0,
            "d": "Lacks substantial resources",
            "e": [
              "binary.rsrc_to_file_ratio = 0.00"
            ],
            "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-resources",
            "l": 1,
            "m": "E1055.012"
          },
          {
            "c": 0.699999988079071,
            "d": "PE has low overall entropy",
            "e": [
              "binary.overall_entropy = 2.50"
            ],
            "i": "metadata/binary/layout::low-overall-entropy",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "Small PE resource section",
            "e": [
              "pe.rsrc_size = 0.00"
            ],
            "i": "metadata/package/versioning::pe-small-rsrc",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Tiny PE stub footprint",
            "e": [
              "Properties.Resources.Designer.cs.dll"
            ],
            "i": "well-known/malware/trojan/shellobject/revengerat::tiny-pe-footprint",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Zero recovered functions",
            "e": [
              "binary.func_count = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/encrypted::zero-function-count",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8500000238418579,
            "d": "DLL filename extension present",
            "e": [
              "Properties.Resources.Designer.cs.dll"
            ],
            "i": "objectives/evasion/masquerade/dll/name::dll-basename",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary has low average complexity",
            "e": [
              "binary.avg_complexity = 0.00"
            ],
            "i": "metadata/binary/metrics/threshold::avg-complexity-15-max",
            "l": 2
          },
          {
            "d": ".dll extension reference",
            "e": [
              ".dll"
            ],
            "i": "micro-behaviors/fs/path/extension::dll-dup",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "CompanyName field absent from PE version info",
            "e": [
              "field 'pe.version_info.company_name' does not exist"
            ],
            "i": "metadata/binary/anomaly/format::version-info-company-name-absent",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "Reflection method namespace token",
            "e": [
              "System.Reflection"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/invoke::namespace-import",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE import table has exactly one entry",
            "e": [
              "binary.import_count = 1.00"
            ],
            "i": "metadata/binary/symbols/imports::single-import-raw",
            "l": 1
          },
          {
            "d": "Few detected functions (stub-like or analysis-limited)",
            "e": [
              "binary.func_count = 0.00"
            ],
            "i": "metadata/binary/metrics/structural::no-functions",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "PE imports from one DLL",
            "e": [
              "pe.import_dll_count = 1.00"
            ],
            "i": "metadata/binary/symbols/imports::pe-single-import-dll",
            "l": 1
          },
          {
            "c": 0.6499999761581421,
            "d": ".NET Diagnostics namespace token",
            "e": [
              "System.Diagnostics"
            ],
            "i": "micro-behaviors/process/create/spawn::diagnostics-namespace-token-dotnet",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Regex component marker",
            "e": [
              "443640-pink-and-blue-backgrounddownload-free-cool-wallpaper",
              "get__443640_pink_and_blue_backgrounddownload_free_cool_wallpaper"
            ],
            "i": "micro-behaviors/communications/http/client/managed::webclient--rx-5",
            "l": 1
          },
          {
            "a": "T1070.006",
            "c": 0.699999988079071,
            "d": "PE header compile timestamp predates 2025",
            "e": [
              "pe.timestamp = 1647347834.00"
            ],
            "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard code/data section",
            "e": [
              ".text"
            ],
            "i": "metadata/binary/section/names::pe-code-data-standard-section",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "DEP / NX enabled (NX_COMPAT)",
            "e": [
              "true"
            ],
            "i": "metadata/hardening/mitigation::pe-dep",
            "l": 2
          },
          {
            "a": "T1036.005",
            "c": 0.9700000286102295,
            "d": "Console subsystem on dw20 claim",
            "e": [
              "pe.subsystem = 3.00"
            ],
            "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-cui-subsystem",
            "l": 1,
            "m": "F0004"
          },
          {
            "c": 0.800000011920929,
            "d": "CodeDom compiler access",
            "e": [
              "System.CodeDom.Compiler"
            ],
            "i": "metadata/lang/compiler/managed::codedom-compiler",
            "l": 2
          },
          {
            "c": 0.8199999928474426,
            "d": "PE has DLL characteristics",
            "e": [
              "pe.characteristics = 8226.00"
            ],
            "i": "metadata/binary/metrics/pe-details::pe-dll-characteristics",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "PE built after 2020-01-01",
            "e": [
              "pe.timestamp = 1647347834.00"
            ],
            "i": "metadata/hardening/mitigation::post-2020-pe",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Tiny PE by file size",
            "e": [
              "pe.machine = 332.00"
            ],
            "i": "metadata/binary/metrics/size::tiny-pe",
            "l": 3
          },
          {
            "c": 0.7799999713897705,
            "d": "Assembly accessor token (get_Assembly)",
            "e": [
              "get_Assembly"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/invoke::get-assembly-token",
            "l": 1
          },
          {
            "a": "T1113",
            "c": 0.699999988079071,
            "d": "System.Drawing.Bitmap class reference",
            "e": [
              "Bitmap"
            ],
            "i": "micro-behaviors/hardware/display/screen::bitmap-fromscratch-str",
            "l": 1,
            "m": "C0014"
          },
          {
            "a": "T1027.007",
            "c": 1.0,
            "d": "WININET.DLL absent from PE import table",
            "e": [
              "pe.import_dll_count = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent",
            "l": 2,
            "m": "B0032"
          },
          {
            "c": 0.8799999952316284,
            "d": "Sparse function count stub",
            "e": [
              "binary.func_count = 0.00"
            ],
            "i": "well-known/malware/trojan/shellobject/revengerat::sparse-function-stub",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "System namespace reference",
            "e": [
              "System.IO"
            ],
            "i": "metadata/lang/compiler/managed::system-namespace",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "PE with six or fewer imports",
            "e": [
              "binary.import_count = 1.00"
            ],
            "i": "metadata/binary/symbols/imports::pe-imports-max-six",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE has few sections",
            "e": [
              "binary.section_count = 2.00"
            ],
            "i": "metadata/binary/layout::legacy-few-sections",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "NO_SEH (SafeSEH not used)",
            "e": [
              "true"
            ],
            "i": "metadata/hardening/mitigation::pe-no-seh",
            "l": 2
          },
          {
            "a": "T1027.009",
            "c": 0.7200000286102295,
            "d": ".NET resource GetObject token",
            "e": [
              "GetObject"
            ],
            "i": "micro-behaviors/data/embedded/payload/resource::dotnet-getobject-token",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Code section dominates file layout",
            "e": [
              "binary.largest_section_ratio = 0.78"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 1.0,
            "d": "Binary has 4 or fewer sections",
            "e": [
              "binary.section_count = 2.00"
            ],
            "i": "objectives/command-and-control/infrastructure/config::max-sections-4",
            "l": 1
          },
          {
            "a": "T1036.005",
            "c": 0.9700000286102295,
            "d": "PE has no Authenticode signature",
            "e": [
              "binary.has_signature = 0.00"
            ],
            "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned",
            "l": 1,
            "m": "F0004"
          },
          {
            "c": 0.8999999761581421,
            "d": "mscorlib reference",
            "e": [
              "mscorlib"
            ],
            "i": "metadata/lang/compiler/managed::mscorlib",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "PE .reloc section presence",
            "e": [
              ".reloc"
            ],
            "i": "metadata/binary/section/names::reloc-section-presence",
            "l": 2
          },
          {
            "c": 1.0,
            "d": ".NET binary (PE with BSJB metadata)",
            "e": [
              "pe.is_dotnet = 1.00"
            ],
            "i": "metadata/binary/metrics/threshold::dotnet-binary",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard runtime section",
            "e": [
              ".reloc"
            ],
            "i": "metadata/binary/section/names::pe-runtime-standard-section",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Binary has low overall entropy",
            "e": [
              "binary.overall_entropy = 2.50"
            ],
            "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary",
            "l": 1
          },
          {
            "c": 0.8799999952316284,
            "d": "Small string table footprint",
            "e": [
              "binary.string_count = 68.00"
            ],
            "i": "well-known/malware/trojan/shellobject/revengerat::tiny-string-table",
            "l": 1
          },
          {
            "c": 1.0,
            "d": ".NET Metadata Root (BSJB)",
            "e": [
              "BSJB"
            ],
            "i": "metadata/binary/framework::dotnet-metadata",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "WCF generated code attribute",
            "e": [
              "GeneratedCodeAttribute"
            ],
            "i": "micro-behaviors/communications/ipc/wcf::dotnet-wcf-generated-code-attribute",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "Properties.Resources.Designer.cs.dll"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "a": "T1055.012",
            "c": 1.0,
            "d": "Lacks substantial data section",
            "e": [
              "binary.data_to_file_ratio = 0.00"
            ],
            "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-data",
            "l": 1,
            "m": "E1055.012"
          },
          {
            "c": 0.800000011920929,
            "d": "Tiny PE single-function stub",
            "e": [
              "binary.func_count = 0.00"
            ],
            "i": "metadata/binary/layout::tiny-single-function-pe",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "ASLR enabled (DYNAMIC_BASE)",
            "e": [
              "true"
            ],
            "i": "metadata/hardening/mitigation::pe-aslr",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "mscoree name reference",
            "e": [
              "mscoree.dll"
            ],
            "i": "metadata/binary/framework::mscoree-name",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "PE mapped image under 768 KiB",
            "e": [
              "pe.size_of_image = 24576.00"
            ],
            "i": "metadata/binary/layout::image-under-768kb",
            "l": 1
          },
          {
            "c": 0.75,
            "d": "Binary exports no symbols",
            "e": [
              "binary.export_count = 0.00"
            ],
            "i": "metadata/binary/symbols/exports::no-exports",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Tiny .NET assembly (\u003c 8KB)",
            "e": [
              "pe.is_dotnet = 1.00"
            ],
            "i": "metadata/binary/metrics/size::tiny-dotnet",
            "l": 3
          },
          {
            "a": "T1055",
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "binary.import_count = 1.00"
            ],
            "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571",
            "l": 1,
            "m": "C0041"
          },
          {
            "a": "T1612",
            "c": 0.8500000238418579,
            "d": "PE has few icon resources",
            "e": [
              "pe.icon_count = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six",
            "l": 1,
            "m": "B0023"
          },
          {
            "c": 1.0,
            "d": "Binary is not digitally signed",
            "e": [
              "binary.has_signature = 0.00"
            ],
            "i": "metadata/signed/trust-level::unsigned",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)",
            "e": [
              "pe.resource_count = 0.00"
            ],
            "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources",
            "l": 1
          },
          {
            "c": 1.0,
            "d": ".NET BSJB metadata marker",
            "e": [
              "BSJB"
            ],
            "i": "metadata/binary/framework::bsjb-marker",
            "l": 1
          },
          {
            "a": "T1105",
            "c": 0.800000011920929,
            "d": "Compact PE import table",
            "e": [
              "binary.import_count = 1.00"
            ],
            "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table",
            "l": 1,
            "m": "E1105"
          },
          {
            "a": "T1070.006",
            "c": 0.8999999761581421,
            "d": "Export timestamp is absent",
            "e": [
              "pe.has_export_timestamp = 0.00"
            ],
            "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent",
            "l": 2
          },
          {
            "a": "T1070.006",
            "c": 0.7799999713897705,
            "d": "PE header timestamp after 2030",
            "e": [
              "pe.timestamp = 1647347834.00"
            ],
            "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-post-2030",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "links mscoree.dll (CorDllMain)",
            "e": [
              "mscoree.dll"
            ],
            "i": "metadata/dylib::mscoree/dll",
            "l": 2
          },
          {
            "c": 1.0,
            "d": ".NET Assembly (mscoree.dll)",
            "e": [
              "BSJB",
              "mscoree.dll"
            ],
            "i": "metadata/binary/framework::dotnet-assembly",
            "l": 2
          }
        ],
        "sha": "93d6d112eff7e7daa019733024b95d00a0c3950943cfb45497df4e45e378d68a",
        "path": "/data/samples/bad/projects/windows/malware/kapi2.0peys-malwares/bmp.exe-sourcecode-main/bmp/bmp/obj/Debug/TempPE/Properties.Resources.Designer.cs.dll",
        "type": "pe"
      }
    ],
    "tv": "d376d"
  }
}