{ "llm": { "conf": 0.7127836, "grade": "benign", "model": "Qwen/Qwen3.6-27B", "review": false, "outcome": "benign", "interpretation": "Standard .NET library assembly" }, "ml": { "v": "7", "eng": "2.2.0-beta.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.5896908, "rte": "az", "prob": 0.5896908 }, { "cls": 0, "raw": 0.037427723, "rte": "az/nupkg", "prob": 0.037427723 } ], "prob": 0.5896908, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.5896908044815063, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.01010921597480774, "type": "xml" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.009734094142913818, "type": "markdown" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.4696013033390045, "type": "pe" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.000010848045349121094, "type": "xml" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "xml" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" } ], "version": "v18.18", "analyzed_at": "2026-07-03T20:26:11Z" }, "path": "VellumPdf.Conformance.1.8.1.nupkg", "raw": { "files": [ { "id": 0, "mol": "O(Al)H(Db)", "sha": "a7a7823d032499828946e26b4dacff76564bf7ea6ad21ec5b45ef8471b6dc495", "path": "VellumPdf.Conformance.1.8.1.nupkg", "risk": 3, "size": 266999, "type": "nupkg", "facts": { "metrics": { "file": { "size": 266999.0, "entropy": 8.0, "size_bytes": 266999.0 }, "binary": { "overall_entropy": 8.0, "peak_region_bytes": 263168.0, "peak_region_entropy": 7.85 }, "archive": { "file_count": 8.0, "member_count": 8.0, "script_count": 0.0, "zip_bomb_ratio": 4.48, "directory_count": 0.0, "executable_count": 1.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 265897.0, "compression.ratio": 0.31, "hidden_file_count": 2.0, "total_uncompressed": 853069.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 8.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 5.0, "timing.mtime_unique_ratio": 0.63, "misplaced_executable_count": 1.0, "timing.mtime_dominant_count": 4.0, "timing.mtime_spread_seconds": 25168.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.5, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 7.0 } } }, "ident": { "name": { "value": "VellumPdf.Conformance", "source": "nupkg.title", "verified": false }, "urls": [ { "url": "https://github.com/Tim81/VellumPDF", "kind": "homepage", "source": "nupkg.project_url" }, { "url": "https://github.com/Tim81/VellumPDF", "kind": "repository", "source": "nupkg.repository_url" } ], "trust": "unsigned", "authors": [ { "name": "Timothy van der Ham", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "1.8.1", "source": "nupkg.version", "verified": false }, "identifier": { "value": "VellumPdf.Conformance", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "from": [ { "file": 4 } ] }, { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4000000059604645, "crit": 2, "desc": "version word (lowercase)", "from": [ { "file": 4 } ] }, { "id": "objectives/command-and-control/dropper/staging/encrypted::dotnet-hexstring-conversion", "atk": "T1027", "mbc": "C0025", "conf": 0.8600000143051147, "crit": 1, "desc": ".NET hex string conversion", "from": [ { "file": 4 } ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "from": [ { "off": 166396, "file": 4 } ] }, { "id": "objectives/anti-analysis/self-modify/runtime::dotnet-getexecutingassembly-token", "atk": "T1027.005", "conf": 0.8799999952316284, "crit": 3, "desc": ".NET current assembly lookup", "from": [ { "file": 4 } ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 4 } ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "from": [ { "file": 4 } ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/crypto/library/keyword::encrypt-keyword", "conf": 0.4000000059604645, "crit": 3, "desc": "Generic 'encrypt' term in strings", "from": [ { "file": 4 } ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "from": [ { "file": 4 } ] }, { "id": "objectives/command-and-control/dropper/staging/encrypted::dotnet-stringbuilder-append", "atk": "T1027", "mbc": "C0025", "conf": 0.8199999928474426, "crit": 1, "desc": ".NET StringBuilder Append use", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "from": [ { "file": 4 } ] } ] }, { "depth": 1, "facts": { "metrics": { "file": { "size": 511.0, "entropy": 5.18, "size_bytes": 511.0 }, "binary": { "overall_entropy": 5.18, "peak_region_bytes": 511.0, "peak_region_entropy": 5.18 } } }, "id": 1, "path": "VellumPdf.Conformance.1.8.1.nupkg!!_rels/.rels", "sha": "1e3d8bb35f5826abfaff07e803555283a51ff91efc3c18e33aeac5f89cfc3042", "size": 511, "type": "xml" }, { "ctx": [ { "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj]", "n": [ { "c": 2, "d": "NuGet nuspec manifest file", "i": "metadata/build/manifest::nuspec-file", "o": 0, "z": 28, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "jAa.syHH\u003c!aB4:tzGv@+xMOuniXJdcv}YB\u003cvrj5rx\u003e8g4B8LVje[n*pfk$ufyHH\u003c\u0026zF7QTfFLvpfF$I3B-RIkv\u003eJ1EwfKh", "ln": 2, "addr": 42 }, { "b": "arS^-wPRu\u003evrt{w", "ln": 3, "addr": 118 }, { "b": "arR^Hjy-qGD2^RixMMB9z/x#xx\u003eIa3aI$92rb3h/Bzb}xC42nhwmY^7nmuuTc{Q:Cz8:m0jtgh.AcVFrxj#xJ", "ln": 12, "addr": 950 }, { "b": "arR^HjAL1AB3sLNw/#56w)(*3wm/%)aAhvjw]8f]xMLwbz/ff9A=2l5v}u^avqGT*vruj4zxJwaBuzi#vp%TB", "ln": 13, "addr": 1019 }, { "b": "arR^HjAt1Lz/YSmz/QaCBA}?pjTaJMBrR\u0026IA+)(.xMOunB2\u003e%cxk8E3BZ=$kz/4dbx(b*:fihU2y\u0026%O\u003el}evyv@Dj3x((GZh-9oFgby*BhE[WPg=5YPg+{\u003cEwJhUWv(dTPwJhUahdOTPgI79ba%nK5", "n": [ { "c": 2, "d": "NuGet package declares repository", "i": "metadata/package/files/nuget::nuspec-repository", "o": 1092, "z": 71, "cf": 0.8999999761581421 } ], "ln": 14, "addr": 1088 }, { "b": "arR^Hjy\u00262xwO#3\u0026zEWx(B3o", "n": [ { "c": 2, "d": "NuGet package declares dependencies", "i": "metadata/package/files/nuget::nuspec-dependencies", "o": 1213, "z": 161, "cf": 0.8999999761581421 } ], "ln": 15, "addr": 1209 }, { "b": "arR^HarS^VA=l8taAR4jxjVfOA:-/@Cw?IqjTa=PBtkE4fD@W", "ln": 16, "addr": 1228 }, { "b": "arR^HarR^Hjy\u00262xwO#3\u0026zEW@mx\u003efvJr+l8-B.%@=w?D./A=bD8a%q5uA=U@kzAPf#e\u0026UEra%pDwv@co#wJ.k7B.LV5ej1eZy\u003cytrA=SAEffP", "ln": 17, "addr": 1268 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 1501.0, "entropy": 5.15, "size_bytes": 1501.0 }, "binary": { "overall_entropy": 5.15, "peak_region_bytes": 1501.0, "peak_region_entropy": 5.11 } } }, "id": 2, "path": "VellumPdf.Conformance.1.8.1.nupkg!!VellumPdf.Conformance.nuspec", "risk": 1, "sha": "92211b6ea8184a77030cc1e5b21bb5ac802517652955ae9a060bf7e5d76840fe", "size": 1501, "traits": [ { "id": "metadata/package/files/nuget::nuspec-repository", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares repository", "spans": [ [ 1092, 71 ] ] }, { "id": "metadata/package/files/nuget::nuspec-dependencies", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares dependencies", "spans": [ [ 1213, 161 ] ] }, { "id": "metadata/build/manifest::nuspec-file", "conf": 0.9800000190734863, "crit": 2, "desc": "NuGet nuspec manifest file", "spans": [ [ 0, 28 ] ] } ], "type": "xml" }, { "ctx": [ { "b": "boQ2#y\u00261lhp?je", "n": [ { "c": 3, "d": "Recognized domain reference marker", "i": "objectives/command-and-control/infrastructure/domain/tld::recognized-reference-marker", "o": 0, "z": 9, "cf": 0.8999999761581421 } ], "ln": 1, "addr": 0 }, { "b": "", "ln": 2, "addr": 12 }, { "b": "toNirnNi-TBAzFyiXJd0x([3hvLheez7!\u003e5z8:m6r+l8-B.%@ymLwgWBzkVhB1.-QA+/o6z*cmQv}^Mvzep\u003emvpT1Ze]#hGdp1unBAzFyiXJd0x([3hvLheez7!\u003e5z8:m6r+l8-B.%@ymLwgWBzkVhB1.-QA+/o6z*cmQv}^MvzepT", "ln": 3, "addr": 13 }, { "b": "toNiCBW{1+t{%xdBz#pZfe43Rxd!msx\u003eq9\u003eB1RfBfk+]BwPPOGfihU2y\u0026%O\u003ewm^CYz/ff9A=2l5v}volC4T3QvpA!:jYVcgy\u0026%O\u003ewm^CYz/ff9A=2l5v}v8{c$)ZAAc15[fl.R:e]C/AwPPLyA+v4AvpK7YxjVcqr+l8-B.%@=w?DC?zF0*czddr(wHN", "ln": 5, "addr": 289 }, { "b": "", "ln": 6, "addr": 440 }, { "b": "k{g2.wmY!0efDz(wmYZ\u003ezE^r@v%GUrA+e/8p^^+}xjU%(A::67z/cXlx\u003c#9\u003eA^n^tz/M%Mpdnb8f!+7befFUzAbo95wO#Q3wb", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 492, "z": 3, "cf": 0.800000011920929 } ], "ln": 7, "addr": 441 }, { "b": "v@bZ+zy])Ez/3ReA=k!qBzbkdz/xo9asX\u003cjq+[I(gb7yodK(MZByx5$vrb)h", "ln": 8, "addr": 519 }, { "b": "", "ln": 9, "addr": 568 }, { "b": "D(#/$wO=g9zbs+Pe\u003ef+%BAo6kByx5$vrb)kg*?CNax9w\u003cvR/P#D(#j7BzkVhvqEFqwO\u003e)/wmPaTy?j-awPR%bv\u003ezheze-{9x\u003c$)\u0026aAIWmB98brB-.hoazbLjaARpdaAITkzE^f@wgYI)azbLfBAnMMoLE%EA::67z/cW@vqZctq!o#-w?M\u003e%zF}6Gq+oU9pEX22f!Lgiay/tkwPzH5xcqqfwGTJPy\u003c6xix\u003e7N8rb3hXB1Y[0B-IhcAV!$5ze0*2wPGpMaxi2=ayYFcy\u0026?myzxJs=Byx5$vrb)kg*?Crz/fVrayPq4az#ataz2z0wN]s.wfx(ZLPTNLzE\u003c@5z/M$sA+5)4vrcSop^^=]ayYFnay]hcvqG:#Cv+qcvTf7)l}e*}cVZzxz/fUGwO\u003e)/wmPy(xcqkqy?kWJu$sg=e\u003e6R^wN[.YvqYQ:A+3)YmSif^c[Wb8dpsoswOkZ#By/GlayMylBZ/A6BsXLCzdm6!wmYo]B9g@kBzk\u0026tBy=OozY\u003cayvqYQ:A+3:Rg+A=\u003cD2d4mBy/YsazC)tp^^=ak}MO+zF0*czdds7aA}KwxM53nayMy5vqG:\u003eAXhuPAbYScwN(]}z/fUtAb](fA:-/qasHflzdmB1ayPd#ax\u0026h)w\u003c*uJxjtp\u003eB0a[iwGU(eBrC7iC4CY9wg/qND\u0026", "ln": 37, "addr": 2393 }, { "b": "D(#/$wO=g9zbs+Pe\u003e/Y0z/{efaBCqgBywS{wGVvynnhZIeO]0wwO-G1z!0{bwO#PjvS=y3wmY^xaAg+fvp%Q?Aa\u003cqzazts{wnb{]B1wCIx(!xqefG4yvR/Q%efFUzvp%d)efF[CwGUF@vrcEhefFRqvpS}\u0026fj]cvBy/FnvQTd+B1wCyz/oAdvrcd8efFwswftr6Bz(28BzkkcAa9x[zEET3z/dfID\u0026", "ln": 38, "addr": 2927 }, { "b": "D(#/$wO=g9zbs+Pe(ME%zFs03u)6?tq/(CSy?j-paw+vmmn\u003erZaw+Y#qZjjzwmY\u003c\u003ev}YB:ay]h0x()^1aAImfzEETfA+fqmCwhejaw$V@eI/atf^7KKxkRd1B-I4oBzkP6B97\u0026cAc0dgzE:(az/fhtBy/GfaA?gfx\u003egT]x(v(wawuu\u0026wO=Aglm(d/avmUNr3iP2zdm6!wmYo]pEw5SfgeShazCZoviw@hl@N2(dj=PIzE:\u003eReLGbfasHVsv}YO1wGUJ4v%8T1zGE1yx(dB5Byx39dj=P+x\u003c\u0026c6y\u0026%x6vpB4:aARsmwPI%4zeZRazE:(gwP\u002604vruj4zxJC9x\u003eqg7B1OO.", "n": [ { "c": 1, "d": "JSON cookie repeats or detaches stage (detached)", "i": "objectives/command-and-control/dropper/delivery/fetch-eval::json-cookie-stage-repeat-or-detach--detached", "o": 3153, "z": 8, "cf": 0.8999999761581421 } ], "ln": 39, "addr": 3105 }, { "b": "D(#/$wO=g9zbs+Pe(Dm?wmY^?aBCqdA+fAdwP]nAawV@/zGu}iCXIkvx(mMap^^=]asH-ovrlH7v\u003c2o4z/Y$KA+e\u0026]A+fb#wGV86vR/Q%efFCyz/Y$KA+e\u0026]A+fb#wGUA0wft/1ygQ)%aAITBwNPB%efFRKvSDf[ePLAmwPzv1v}u={x(4v4j0nV-wO#0#D2N\u003epwgnTfzE:(3CYmOxwPF#oxK@q@vrt{]z!yQzB7]o8vruTjwPGyBvqYP#wmYm?wmYo]B98ClvqNb$vrt{gaxi2=ayX=2x(+zez/M$xxK@rcx\u003eIr$zF77=r8$bXvruflaARpday/tcw]zZbvqYN^aA?gfx\u003egT]z/NxKvqYP#vixh]zE)\u0026%y-)+fvpS}\u0026e*bJ", "ln": 40, "addr": 3382 }, { "b": "D(#/$wO=g9zbs+Pe\u003c\u003cL{w]zZbvqYN^u)6?tp\u0026Zb\u003cx\u003eqGhD(#0#ePt-Gv}x.5aw+D}ff}fBvLoGVfeu@UvqYP#p^^=ary5h\u003eaAhvjw]8f]xMMoTA=(nvay/k0vqWVqz/oFnv@Dl%z/PY6zEWl2A=(hfB0a[lBzbPkwN(]}A=k!qBzbkdnMezcB8UY2x\u003ez6?vruj4zGu}ezE:(gwPS6nzGu}qvpJ$+zE\u003ezuwNPaTvR/P#vrlH3A==2lzGu{GA=(hfazCvqaw2Hcay/j@B-RaBaAIaqwPzHbC}p7RvRPE:BrCQnw[u0]zEWlbaMv{oaz#9uwQ5rdA=br4aA?spvnGuYavHcTyH}Jex(do\u003ewGU(4wN]v.e*9CQr4Pk3zE:(iA+PwxA+eV\u0026C{1IQB.\u003eSgaAz4ax(!xcA+e=7wQ5fgx\u003e7\u003e0y\u003cvMOzF{UrwOb:\u0026v@#B6zyEgXlVmcVA=Svnx(4u6B98CBv@#\u003clwH[%lz!%umAV!!dwft/kBz#wAazC.nwO#QhasH@wv@co#x(mManKC\u0026/Ab](ex(4u6C42i3wncdhayPd#aw1{/lsB}DwgZeysXx(QC4CYkA+PAkdj=P-A:-\u003cbAa9=#zEW@yazCX3xjVcbvqYP#swJyvwN/?6asH@wv@co#x(mMaviwfsmmP9!fFBRVz!9B2BAg@3z6i!aA=U/jdj=PNz/fVrasHVoazCZBAb](bwPI]nB7PriazbLfBs?DLz!B90z6i!aA=U/jazbLjazkIoAa*wkA+fr6zEWl2vqYP#CwgPfxMCZEwO\u003e)/wmPmZeKJlvA3dItl[.Roz!9AjB-Rb7zddxav}YB-yJy{Qay/tcBy/uiaAITBwNPB%asG/WpARCGfFCgjf^7yNwPzj3z/NxKx(m:3zE\u003ezlzdd6*eOnZkBy/FzayPd#azk.6Aa\u0026@}B1IDPvru66C42i3wmoN]z/d0Pay]h0x()^1aAImfzEETfA+fqmc$alAwPzYvwmYZ\u003ezE^r@v%Gg:o\u0026AYhq+!@1aAz44wmY^7w]zYj.LYpAg+HNkefFwszF%S9BzkVhB1wCFzGGDgvpKy[C4z!dz/PYoefFwhBzkVhB1wCxzE:\u003e(o\u00268%HwPRu\u003evrt{2d0xrkayPdgx(kIwA=kD0B8@Eao\u00268%KvrcB2AW-KZAboVraARpdatO6)ggqqowO=D%B0a[ewftq6Byw/{wN)xlBAhIlBAIRnaA}mgyH}Jew]zYjBzbkdp^^=ary5h\u003easG/WpARwGgb}oCf!1kNv}f7\u003eB7]8$y?X0pay/7@v@3cravpi+", "ln": 41, "addr": 3690 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 11265.0, "entropy": 5.15, "size_bytes": 11265.0 }, "text": { "digit_ratio": 0.02, "space_count": 1374.0, "total_lines": 193.0, "char_entropy": 5.15, "unique_chars": 96.0, "lines_over_200": 7.0, "lines_over_500": 2.0, "avg_line_length": 57.37, "high_byte_ratio": 0.01, "lines_over_1000": 1.0, "max_line_length": 1440.0, "non_ascii_ratio": 0.01, "empty_line_ratio": 0.23, "last_line_length": 70.0, "long_token_count": 3.0, "whitespace_ratio": 0.14, "most_common_ratio": 0.08, "line_length_stddev": 122.44, "repeated_char_sequences": 3.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 13.0, "most_common_char_codepoint": 101.0 }, "binary": { "overall_entropy": 5.15, "peak_region_bytes": 11264.0, "peak_region_entropy": 5.22 } } }, "id": 3, "path": "VellumPdf.Conformance.1.8.1.nupkg!!README.md", "risk": 1, "sha": "9b3a1a04f4590ec8760ef1826903f3c1cadaff75441b7419aa1c8a1f65380b23", "size": 11265, "traits": [ { "id": "metadata/file/extension/identity::doc-or-config-extension", "conf": 1.0, "crit": 1, "desc": "Document or config file extension", "spans": [ [ 0, 9 ] ] }, { "id": "metadata/file/extension/identity::markdown-file-basename", "conf": 1.0, "crit": 1, "desc": "Markdown document file extension", "spans": [ [ 0, 9 ] ] }, { "id": "metadata/file/profile/language::lang-english", "conf": 0.800000011920929, "crit": 2, "desc": "English language detection", "spans": [ [ 492, 3 ] ] } ], "type": "markdown" }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47aAzQxazCZol@c-7zeP", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 }, { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 78, "z": 4, "cf": 0.800000011920929 } ], "ln": 0 }, { "b": "000000000000000000009Y:Ja00000nb@R\u00260SSx7@hfO@XmU)z0rr9100000V\u003e0uvso", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "Ruu(60^!\u003e*00BY4001J0lq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 2, "d": ".NET Metadata Root (BSJB)", "i": "metadata/binary/framework::dotnet-metadata", "o": 166396, "z": 4, "cf": 1.0 } ], "ln": 166380 }, { "b": "00Jw[h2)QS05U(000idpt(T\u003c903tqy00icjqucX00kfAN0098UgxmyQ0o2Zl0098UgxmyQ", "n": [ { "c": 3, "d": "Embedded LZMA compressed data", "i": "micro-behaviors/data/embedded/payload/compression::lzma-magic", "o": 195831, "z": 8, "cf": 0.699999988079071 } ], "ln": 195815 }, { "b": "00rkWgxmyQ02xLO00id=t(T\u003c902xLO00id=t(T\u003c9026tL0096kAr2$u01}f\u003e00rilyYBCn000000096Hso5s4", "n": [ { "c": 1, "d": "LZMA header nonzero size pos 1", "i": "micro-behaviors/data/embedded/payload/compression::lzma-sized-nonzero-1", "o": 198651, "z": 8, "cf": 1.0 } ], "ln": 198635 }, { "b": "00000000010bA8B00id-t(T\u003c90bA8B0096kAr2$t026tL00idYa]?PB0i)ao0096kAr2$u", "n": [ { "c": 1, "d": "LZMA header nonzero size pos 2", "i": "micro-behaviors/data/embedded/payload/compression::lzma-sized-nonzero-2", "o": 200889, "z": 8, "cf": 1.0 } ], "ln": 200873 }, { "b": "0096kAr2$u0h13b00rj(t(T\u003cc0i)ao0096kAr2$u0bliG00rivsPwB80i)ao0096kAr2$u", "n": [ { "c": 1, "d": "LZMA header nonzero size pos 2", "i": "micro-behaviors/data/embedded/payload/compression::lzma-sized-nonzero-2", "o": 201909, "z": 8, "cf": 1.0 } ], "ln": 201893 }, { "b": "0096kAr2$u0h13b00rj(t(T\u003cc0lCxA00Jw^1][S7026tL00iclmGrz\u003c0lCxA00Aq=1][S6", "n": [ { "c": 1, "d": "LZMA header nonzero size pos 2", "i": "micro-behaviors/data/embedded/payload/compression::lzma-sized-nonzero-2", "o": 202023, "z": 8, "cf": 1.0 } ], "ln": 202007 }, { "b": "00000000010ep%-00id=t(T\u003c90ep%-00id=t(T\u003cb0nd+X0097O4GDFg0l5\u003cR00rjhiSGcX", "n": [ { "c": 1, "d": "LZMA header nonzero size pos 2", "i": "micro-behaviors/data/embedded/payload/compression::lzma-sized-nonzero-2", "o": 203127, "z": 8, "cf": 1.0 } ], "ln": 203111 }, { "b": "BAz8io8}L8pgl($ju=Kvq*ACawO\u003c4\u003epxj-$pYJ{}CX7w.07gBdA=Vtyx(mMY08@}{wm!a.rr", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 230752, "z": 9, "cf": 0.800000011920929 } ], "ln": 230736 }, { "b": "wO#71x\u003e5+!oLFM\u0026jxaG%Bzbxftu}kcD2[7sz7Xg]y\u00260V)BzkVhB1P%]zE)\u003c5v\u003eHtJ", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 230892, "z": 4, "cf": 0.800000011920929 } ], "ln": 230876 }, { "b": "uTDcdv@2^@xguPDy?9Jdo\u003ewA!x\u003e8iFyHpBnvpK7!zF8BMwO+(Sjv\u0026[4ph+2sy?mD{zGFI", "n": [ { "c": 3, "d": "Application has metrics/telemetry", "i": "metadata/package/quality/profile::has-metrics", "o": 233950, "z": 7, "cf": 0.8500000238418579 } ], "ln": 233934 }, { "b": "lUG[Go\u003c@0Wx(mMYB.\u003eQ?nm^3ABAh8kxhS\u003e*wDkkvvq])]v@\u003eN\u003cvru6QwPI%czF8\u003c\u0026y?iPDve", "n": [ { "c": 1, "d": ".NET hex string conversion", "i": "objectives/command-and-control/dropper/staging/encrypted::dotnet-hexstring-conversion", "o": 237628, "z": 9, "cf": 0.8600000143051147 } ], "ln": 237612 }, { "b": "zbs+Pe\u003c\u003cL{w]zZbvqYN^e[w^m0aPORyYD?owN/HBx(4O=ra{q\u003cCs=ywB.\u003e\u003c]p?jfk", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 243463, "z": 4, "cf": 0.6000000238418579 } ], "ln": 243447 }, { "b": "vqM0gAbYxawk^O\u003cwNPAQm}D^pvqY^\u003ewPI@\u003ewPI^jA:@VVBAg@3z2=$nv@C)?q/)4\u003evqM0xwPI^aC4BP]A+eV@0aP\u003eOz#", "n": [ { "c": 2, "d": ".NET manifest resource stream access", "i": "micro-behaviors/data/embedded/payload/resource::dotnet-getmanifestresourcestream", "o": 243650, "z": 25, "cf": 0.8500000238418579 } ], "ln": 243634 }, { "b": "q*ACawO\u003c54zep*#x(m[\u003cq*ACawO\u003c4[x(m[\u003cuVDcBD2[7sz7Xg]y\u00260V)BzkVhB1P%]zE)\u003c5v\u003eHs", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 245901, "z": 11, "cf": 0.699999988079071 } ], "ln": 245885 }, { "b": "nK^SszddJ.A=lbnwmY=Yq/)4]zF8pUx(4r\u003eASxM\u003ex(4r\u003eASxD+A+5:408#pcw[CQ{0aH7.w[t#.pY", "n": [ { "c": 1, "d": ".NET StringBuilder Append use", "i": "objectives/command-and-control/dropper/staging/encrypted::dotnet-stringbuilder-append", "o": 246335, "z": 13, "cf": 0.8199999928474426 } ], "ln": 246319 }, { "b": "ze:r5mSif^o\u003ewA!x\u003e8h:zdN*fx\u003e8h:q*ACawO\u003c4/x\u003c\u003eT(z/Z2mv@?SSv}Yp\u003ep\u0026ZF:A@Y2", "n": [ { "c": 2, "d": "metrics word (lowercase)", "i": "metadata/package/metrics::metrics-word-lower", "o": 247763, "z": 7, "cf": 0.4000000059604645 } ], "ln": 247747 }, { "b": "y*?u}wklMIwPI*0v}xYYq*ACawO\u003c4$B-8qnzdLs\u003ezGGDgz/wS^A=#ebwPE\u0026ID2[7sz7X.ezGGPfwIct*ze:i9wPyZXA=#ebwPE", "n": [ { "c": 3, "d": "Packed binary context", "i": "objectives/anti-static/obfuscation/eval/loader::packed-binary-context", "o": 248266, "z": 30, "cf": 0.8500000238418579 } ], "ln": 248250 }, { "b": "xK$W?l2HNUByxo9z/fQ@r+l8-B.%@=w?DC?zF0*czddr(wIc(6y?mVul1t1Jz/fQ@uVoN%ze19lwN[LAzdNlzv@#B6zGt!+AaK6bx([Ddwi\u003cZEx(v)g07gBhv@1?FzdMW!wO1eqBzkVhA@XNvwN/HwwmPy@x(v($y^zMMx(v)g08[e:By/qwlVl^SwN/*@z/fQ@q/)4]zF8)!y?W#!", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-4", "o": 251244, "z": 35, "cf": 0.8799999952316284 } ], "ln": 251228 }, { "b": "oKR*KnP47kwPzj1v}Zb/m}D^hCX7xcBzkS9l349Uzdmsb08[e:By/qwlVl^SwN/*@z/fRGm}DNHA+P2onKEAj", "n": [ { "c": 3, "d": ".NET current assembly lookup", "i": "objectives/anti-analysis/self-modify/runtime::dotnet-getexecutingassembly-token", "o": 257355, "z": 20, "cf": 0.8799999952316284 } ], "ln": 257339 }, { "b": "0b}{U0b?\u003cE0a=dK0cnb.0b}{U0a=dx0bITH0a#pB0cwh-0a(jH0ce5Z00a\u003e#0bhA", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 257969, "z": 3, "cf": 0.800000011920929 } ], "ln": 257953 }, { "b": "aolM+x-JhOx-IPxyYF2Daol9Qzua.Tx-IVzwDi?MBo2$OwDi?Mv/QJHzVB.Raok\u003c", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 260179, "z": 3, "cf": 0.800000011920929 } ], "ln": 260163 }, { "b": "c\u0026=%wlJxWTl\u0026Xtf09pPHaolG-xAhDvBo0A-ASxUJA@ZaUyYFRUwDl=KaolG-zVy)W", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 263352, "z": 4, "cf": 0.800000011920929 } ], "ln": 263336 }, { "b": "x8(MAwDllvaok)KzVBUPBo2\u003eLzua+Uaoi!\u0026li6yNlJwkeCk#sSBo2$OaokaolJxWT", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 263595, "z": 4, "cf": 0.800000011920929 } ], "ln": 263579 }, { "b": "e=WTbf-S*agxo3cg5}tdq#*OiwDi?MlJxWTl\u0026YWRzVBUPBo2nuC(R^-wDjE=aol0", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 265682, "z": 3, "cf": 0.800000011920929 } ], "ln": 265666 }, { "b": "ve$9zBo2\u003eLASx$Sve$xHwDi?Mw=MJBwDlJDwb).Lzua8Bz2!bEdf7E\u003cwDlPFBo3s", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 268650, "z": 3, "cf": 0.800000011920929 } ], "ln": 268634 }, { "b": "0aV7F0a=dK03znV0b?\u003cV03znQ0b.^D0bITT0aV7v03zn-0b8vz03zn.0bhBC0b.^F0ce5!0cnb", "n": [ { "c": 2, "d": "certificate string reference", "i": "micro-behaviors/crypto/certificate/usage::certificate-ref", "o": 317170, "z": 11, "cf": 0.5 } ], "ln": 317154 }, { "b": "ve%^qwDi?MjPDP802Wr/aolM+wDl-JA@Y[OzVBUPaojL8aohxFe=Za@df7E\u003c0c-bSA@Wr", "n": [ { "c": 2, "d": "Contains version information", "i": "metadata/package/quality/profile::versioned", "o": 351054, "z": 7, "cf": 0.8500000238418579 } ], "ln": 351038 }, { "b": "wDlcswb{fvASv-)wDlPFv/QJHC(R^-Bo31PzVBUPaok%Mz#:OLv/NRKblf.7hVLGhblfB#fAr^bdf8yeaoloVwDlowwb{VJaolG-xAhPzaolAZwDlcswb{fvASviZBo3jVaok{LwDliuASyv+z#:$Waok%M", "n": [ { "c": 4, "d": "Ransomware tool marker", "i": "objectives/impact/ransom/note::ransomware-banner-comp", "o": 362930, "z": 23, "cf": 0.800000011920929 }, { "c": 3, "d": "Encryption API usage markers", "i": "micro-behaviors/crypto/library/keyword::encryption-functions", "o": 362999, "z": 7, "cf": 0.5 } ], "ln": 362914 }, { "b": "0rrv5wO+{^B7CsKe=+@3lVl{?A+Pf1BrFD1axi5(z//VraA?ghay]57av]{TasGGOx(b*:df", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 387636, "z": 9, "cf": 0.6000000238418579 } ], "ln": 387620 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 466432, "z": 5, "cf": 0.8999999761581421 } ], "ln": 466416 }, { "b": "0000000000004JOgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrx90rr9", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 466526, "z": 15, "cf": 0.8999999761581421 } ], "ln": 466510 }, { "b": "eDvH9e=U\u003eK002K\u00266AwdllJz38z2!IPve$fBC(QOtve$cAwDhYg002%#x-I#IzVB\u003eVxAiqTaolM", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 467706, "z": 11, "cf": 0.699999988079071 } ], "ln": 467690 }, { "b": "aoj}jve$cA002%#761vnmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up00341wDlJDyYFOTz2^x", "n": [ { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 467778, "z": 15, "cf": 0.699999988079071 } ], "ln": 467762 }, { "b": "ve$fBv/Q6u001XM2MK(9mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001.Ne=W\u003che=WQae=WN9002%#8uo^rnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE00341wDlJDyYFOTz2^xjwb{iw", "n": [ { "c": 2, "d": "PE FileVersion metadata field", "i": "metadata/package/versioning::pe-fileversion-field", "o": 467862, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 467910, "z": 12, "cf": 0.699999988079071 } ], "ln": 467846 }, { "b": "h#\u003eVkdf6tF003m78uo^rpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE00341wDlJDyYFOTz2^xj", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 468114, "z": 16, "cf": 0.699999988079071 } ], "ln": 468098 }, { "b": "e=YzZyYFnK001?Q3ig8bpYLIozVBqFBPt[KBo25ove$cAwDhYg00341wDlJDyYFOTz2^xjwb{iw004PJf8#1MpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001.Ne=W\u003che=WQad/.HdgYN", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 468206, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE ProductVersion metadata field", "i": "metadata/package/versioning::pe-productversion-field", "o": 468258, "z": 14, "cf": 0.699999988079071 } ], "ln": 468190 }, { "b": "0000000000000000000005aST3\u0026*nckSO(B000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 468480, "z": 6, "cf": 0.8999999761581421 } ], "ln": 468464 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 465920, 5.93, "r-x" ], [ ".rsrc", 466432, 2048, 3.45, "r--" ], [ ".reloc", 468480, 512, 0.1, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 474861.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.31, "clr.managed_resource_count": 1.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "clr.managed_resource_max_size": 76109.0, "version.identity_symbol_ratio": 0.02, "clr.managed_resource_max_entropy": 5.09 }, "file": { "size": 468992.0, "entropy": 5.91, "size_bytes": 468992.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.93, "string_count": 7225.0, "overall_entropy": 5.91, "entropy_variance": 5.69, "avg_string_length": 20.44, "max_string_length": 466.0, "peak_region_bytes": 1024.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 6.92, "string_length_stddev": 23.76, "largest_section_ratio": 0.99, "sentence_string_count": 449.0, "sentence_string_ratio": 0.06, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 465920.0, "entropy_max": 5.93, "entropy_mean": 3.16, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 4, "mol": "O(Al)H(Db)", "path": "VellumPdf.Conformance.1.8.1.nupkg!!lib/net10.0/VellumPdf.Conformance.dll", "risk": 3, "sha": "5a3c3de3cab58ca17ae4354d9d3119b60539d8f46f8d5b6d81fdbeceda767bff", "size": 468992, "traits": [ { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 466526, 15 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::dotnet-getexecutingassembly-token", "atk": "T1027.005", "conf": 0.8799999952316284, "crit": 3, "desc": ".NET current assembly lookup", "spans": [ [ 257355, 20 ] ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 245901, 11 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 166396, 4 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "objectives/command-and-control/dropper/staging/encrypted::dotnet-hexstring-conversion", "atk": "T1027", "mbc": "C0025", "conf": 0.8600000143051147, "crit": 1, "desc": ".NET hex string conversion", "spans": [ [ 237628, 9 ] ] }, { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4000000059604645, "crit": 2, "desc": "version word (lowercase)", "spans": [ [ 351054, 7 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 243463, 4 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 467862, 11 ] ] }, { "id": "objectives/command-and-control/dropper/staging/encrypted::dotnet-stringbuilder-append", "atk": "T1027", "mbc": "C0025", "conf": 0.8199999928474426, "crit": 1, "desc": ".NET StringBuilder Append use", "spans": [ [ 246335, 13 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 468258, 14 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "micro-behaviors/crypto/library/keyword::encrypt-keyword", "conf": 0.4000000059604645, "crit": 3, "desc": "Generic 'encrypt' term in strings", "spans": [ [ 362999, 7 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 166396, 4 ] ] } ], "type": "pe" }, { "ctx": [ { "b": "arR^HarR^HarR^Hp*[x=wPF#5zxJ4Qp-%Q^BywY*ByuqhvpK7:BrCpnBz\u0026pzxK@q#vpKz2aARpdaw+D}ff{Z$wPRu\u003evrt{2A=(hfB0bviwN(])wQeiiwft#cwGU@jz/xodBA)", "ln": 2128, "addr": 152986 }, { "b": "arR^HarR^HarR^HC42ifwPF#oxKM09jAC7Bay/C6w\u003c4tqi-Y*dy\u0026%O\u003ewm^CYz/ff9A=2l5v}vn\u003cB.\u003eSge\u003e]]0vpS!*vj\u003eV0A8HmQwmY^9ffQH\u0026CYmOxwPG)PCw7MfxK#ibBzbkdAa9l(wPP5eB0bWry?$Xnz/PYawfs#GoE}rdxK}", "ln": 2129, "addr": 153093 }, { "b": "arR^HarR^HarR^HAc2Pkwn:5dBAzLqvS=^7B0bykazC}sauTc$ctW==kx}cQv@2T$kpg2+j3kfaj%j/+z!0v1B7]J8eOP9zBAhIlBzkVhazts{wmY^jayPd#aARpdayYRrwD", "n": [ { "c": 1, "d": "LLM prompt/instruction context component", "i": "objectives/evasion/security-bypass/llm/override::llm-instruction-context", "o": 153305, "z": 11, "cf": 0.7200000286102295 } ], "ln": 2130, "addr": 153232 }, { "b": "arR^HarR^HarR^HwO#0@wnb{]azC{ux(+z9v@#\u003c4y\u00261wtB7GxavqGU0wN(]$zy$", "ln": 2131, "addr": 153338 }, { "b": "arR^HarR^HarR^Hjtg+#zeAZ4C%h", "ln": 2132, "addr": 153389 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 356113.0, "entropy": 4.72, "size_bytes": 356113.0 }, "binary": { "overall_entropy": 4.72, "peak_region_bytes": 329489.0, "peak_region_entropy": 4.88 } } }, "id": 5, "path": "VellumPdf.Conformance.1.8.1.nupkg!!lib/net10.0/VellumPdf.Conformance.xml", "sha": "a321155abd18fcd7a98567ad3d880101a37f23c82ae5ff21693d3f8b2d210951", "size": 356113, "traits": [ { "id": "metadata/file/extension/identity::doc-or-config-extension", "conf": 1.0, "crit": 1, "desc": "Document or config file extension", "spans": [ [ 0, 25 ] ] }, { "id": "objectives/evasion/security-bypass/llm/override::llm-instruction-context", "conf": 0.7200000286102295, "crit": 1, "desc": "LLM prompt/instruction context component", "spans": [ [ 153305, 11 ] ] } ], "type": "xml" }, { "id": 6, "sha": "70b483c5066b0f062f2102cd8f0c4b2fde9e919b5a9204689dd67e64b0cc518e", "path": "VellumPdf.Conformance.1.8.1.nupkg!![Content_Types].xml", "size": 582, "type": "xml", "depth": 1 }, { "id": 7, "sha": "fde6d1f5926d30b7be2c38d1cd400948d439badb2f2cf51515a8fe2fb8dcf5c5", "path": "VellumPdf.Conformance.1.8.1.nupkg!!package/services/metadata/core-properties/61df91e447674737a4523779a1eb056a.psmdcp", "size": 1126, "type": "xml", "depth": 1 } ], "omitted_files": 2, "rev": "868bd", "v": "8" } }