{
  "ml": {
    "v": "7",
    "eng": "2.0.1-rc.1",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.20175841,
        "rte": "az",
        "prob": 0.20175841
      },
      {
        "cls": 0,
        "raw": 0.26708853,
        "rte": "az/native",
        "prob": 0.26708853
      },
      {
        "cls": 0,
        "raw": 0.09029686,
        "rte": "az/pe",
        "prob": 0.09029686
      }
    ],
    "prob": 0.20175841,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.20175841450691223,
        "type": "pe"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-06-15T04:34:36Z"
  },
  "path": "VirusShare_b0c21ed56070bc0eaefe511332e29936",
  "raw": {
    "v": "7",
    "tv": "061e3",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000",
            "l": 0,
            "n": [
              {
                "c": 3,
                "d": "PE binary has trailing overlay data",
                "i": "metadata/binary/layout::has-overlay",
                "o": 0,
                "z": 25
              }
            ],
            "x": true
          },
          {
            "b": "00000000000000000000lq{Gy0rrc2000003\u0026*ncB$$W7e\u0026tswgb/gk000f5yYBCn",
            "l": 576,
            "n": [
              {
                "c": 2,
                "d": ".NET Metadata Root (BSJB)",
                "i": "metadata/binary/framework::dotnet-metadata",
                "o": 592,
                "z": 4
              }
            ],
            "x": true
          },
          {
            "b": "v]D@XB-n%NwPI^jA:@W4e[w^m07QQrwPzG{q!p5[A4VfxB8Mhwv}xYYA=?vAo(BM+y?k^gzf6i9A+]D006$WEwO\u003e))C#OH1y?k[OBAh88B-.f{q*ACawO\u003c4$",
            "l": 979,
            "n": [
              {
                "c": 2,
                "d": "mscorlib reference",
                "i": "metadata/lang/compiler/managed::mscorlib",
                "o": 1035,
                "z": 8
              },
              {
                "c": 2,
                "d": ".dll extension reference",
                "i": "micro-behaviors/fs/path/extension::dll-dup",
                "o": 995,
                "z": 4
              }
            ],
            "x": true
          },
          {
            "b": "0rru\u003cwmoW\u003cA+bjJ9SVlUlVl{?A+Pf1BrFD1avfKDCvtJ6atLSaf-RgS0rAc101n(d2r1g\u003ee=",
            "l": 1461,
            "n": [
              {
                "c": 2,
                "d": "Copyright notice",
                "i": "metadata/package/license::copyright-word",
                "o": 1477,
                "z": 9
              }
            ],
            "x": true
          },
          {
            "b": "mh2U3=DtQ\u00260rr91KPkvYy/tR2By/qwqE%]/B-H#6B1Qv4B8Mhwv}wLHvpS}\u0026efF!Jv@Dy7x\u003c@Ror+lq)x(v(Lga\u003emkfFk4gavyo/BAIRnj-j?NBAg/aefE=ivR/:*oj-xFz!\u0026{4jZ{uevkRKLhzEiFg?wv2iu}EFB97#ge(Dn4z/{8gwPGF4B-8qnzdMQRB8Mhwv}wOIBohBx02\u003e[r0000008L%H",
            "l": 1524,
            "n": [
              {
                "c": 2,
                "d": "mscorlib reference",
                "i": "metadata/lang/compiler/managed::mscorlib",
                "o": 1540,
                "z": 128
              }
            ],
            "x": true
          },
          {
            "b": "0049y000000049ygYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrl51][S",
            "l": 7754,
            "n": [
              {
                "c": 2,
                "d": "PE version resource metadata",
                "i": "metadata/package/versioning::version-resource-metadata",
                "o": 7770,
                "z": 15
              }
            ],
            "x": true
          },
          {
            "b": "yYFnKwDl-J001XM2MK(9lJz38z2!IPve$fBC(QOtve$cAwDhYg002p+wb{3rCk#4KASxUJ002y!4fczemGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002H?wDlPFwDl-Jx-IS",
            "l": 8034,
            "n": [
              {
                "c": 2,
                "d": "PE CompanyName metadata field",
                "i": "metadata/package/versioning::pe-companyname-field",
                "o": 8050,
                "z": 11
              },
              {
                "c": 2,
                "d": "PE FileDescription metadata field",
                "i": "metadata/package/versioning::pe-filedescription-field",
                "o": 8098,
                "z": 15
              }
            ],
            "x": true
          },
          {
            "b": "Bo3B-z#Y\u003er001XM2MK(9mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001[Se=WZde=WQae=WN9003a38VP)snDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002H?wDlPFwDl-Jx-ISyqVHwe",
            "l": 8150,
            "n": [
              {
                "c": 2,
                "d": "PE FileVersion metadata field",
                "i": "metadata/package/versioning::pe-fileversion-field",
                "o": 8166,
                "z": 11
              },
              {
                "c": 2,
                "d": "PE InternalName metadata field",
                "i": "metadata/package/versioning::pe-internalname-field",
                "o": 8214,
                "z": 12
              },
              {
                "c": 1,
                "d": "PE FileVersion resembles IPv4",
                "i": "metadata/package/versioning::pe-file-version-ipv4-shape",
                "o": 8192,
                "z": 7
              }
            ],
            "x": true
          },
          {
            "b": "fAr\u003cdf-RgN003yb8VP)spxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002H?wDlPFwDl-Jx-ISy",
            "l": 8374,
            "n": [
              {
                "c": 2,
                "d": "PE OriginalFilename metadata field",
                "i": "metadata/package/versioning::pe-originalfilename-field",
                "o": 8390,
                "z": 16
              }
            ],
            "x": true
          },
          {
            "b": "wb{ACyYBCn002aY4fczepYLIozVBqFBPt[KBo25ove$cAwDhYg002H?wDlPFwDl-Jx-ISyqVHweBo3B-z#Y\u003er001?Q2MK(9pYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001[Se=WZde=WQae=WN9001$U2MK(9k(+%aA@Y+Kz2!2ByYF.Xao",
            "l": 8470,
            "n": [
              {
                "c": 2,
                "d": "PE ProductName metadata field",
                "i": "metadata/package/versioning::pe-productname-field",
                "o": 8486,
                "z": 11
              },
              {
                "c": 2,
                "d": "PE ProductVersion metadata field",
                "i": "metadata/package/versioning::pe-productversion-field",
                "o": 8546,
                "z": 14
              },
              {
                "c": 1,
                "d": "PE ProductVersion resembles IPv4",
                "i": "metadata/package/versioning::pe-product-version-ipv4-shape",
                "o": 8576,
                "z": 7
              }
            ],
            "x": true
          },
          {
            "b": "0000000000000000000005axM3\u0026*ncrYQiX000000000000000000000000000000000",
            "l": 8688,
            "n": [
              {
                "c": 2,
                "d": "PE .reloc section presence",
                "i": "metadata/binary/section/names::reloc-section-presence",
                "o": 8704,
                "z": 6
              }
            ],
            "x": true
          },
          {
            "b": "Bs}6wz80+0f9RIU1oPq=l${pFlUgpWax7/%g9w(7B9hImwfsDiaxi5(wPI%4ze:ibxcoMcfDI2tgbgEqfFLmnfFCgms@dS7f!+sohzu*sfFCg:",
            "l": 14146,
            "n": [
              {
                "c": 2,
                "d": "DigiCert timestamp certificate chain",
                "i": "micro-behaviors/data/embedded/certificate::digicert-timestamp-chain",
                "o": 14162,
                "z": 40
              }
            ],
            "x": true
          },
          {
            "b": "aw3DXe?[F59ThZD1oPqNl${pFlUgpWaxi5(wPI%4zeZQMfFUvpF=N5H4f^a*HdE6[4flFg1POTR0s]e:F=MhWF=L(",
            "l": 14269,
            "n": [
              {
                "c": 2,
                "d": "DigiCert timestamp certificate chain",
                "i": "micro-behaviors/data/embedded/certificate::digicert-timestamp-chain",
                "o": 14285,
                "z": 23
              }
            ],
            "x": true
          }
        ],
        "idn": {
          "name": {
            "value": "GenericSetup.resources.dll",
            "source": "pe.version.original_filename",
            "verified": false
          },
          "trust": "ca_signed",
          "signer": {
            "issuer": "CN=Entrust Extended Validation Code Signing CA - EVCS1,OU=(c) 2015 Entrust\\, Inc. - for authorized use only,OU=See www.entrust.net/legal-terms,O=Entrust\\, Inc.,C=US",
            "source": "pe.signatures[0]",
            "subject": "CN=6785719 Canada Inc.,SERIALNUMBER=678571-9,BUSINESSCATEGORY=Private Organization,O=6785719 Canada Inc.,1.3.6.1.4.1.311.60.2.1.3=#13024341,L=Saint Laurent,ST=Quebec,C=CA",
            "common_name": "6785719 Canada Inc.",
            "organization": "6785719 Canada Inc."
          },
          "project": {
            "value": "GenericSetup",
            "source": "pe.version.product_name",
            "verified": false
          },
          "version": {
            "value": "6.4.1.0",
            "source": "pe.version.file_version",
            "verified": false
          },
          "unique_ids": {
            "authenticode_thumbprint_sha256": "69c5365cb5600fb416f3c63b6bc4862fc9b72e96307099952fc273afd453eb8f"
          },
          "organization": {
            "value": "6785719 Canada Inc.",
            "source": "pe.signatures[0]",
            "verified": true
          }
        },
        "mol": "Md₂(BiSi₂)",
        "sha": "b3c47e070c0b30363a7dde7788504b5f32232527c52d14c51c7ae9669b9c4bee",
        "fact": {
          "id": "pe",
          "imp": [
            [
              "mscoree",
              "CorDllMain"
            ]
          ],
          "met": {
            "pe": {
              "checksum": 59104.0,
              "checksum_valid": 1.0,
              "resource_count": 1.0,
              "cert_table_size": 8096.0,
              "has_version_info": 1.0,
              "computed_checksum": 59104.0,
              "reloc_overhang_bytes": 500.0,
              "reloc_overhang_ratio": 0.98,
              "bss_like_section_count": 0.0,
              "section_overflow_count": 0.0,
              "misaligned_section_count": 0.0,
              "version.identity_entropy": 3.59,
              "clr.managed_resource_count": 2.0,
              "base_relocation_block_count": 1.0,
              "base_relocation_entry_count": 1.0,
              "clr.managed_resource_max_size": 4933.0,
              "version.identity_symbol_ratio": 0.0,
              "clr.managed_resource_max_entropy": 5.39
            },
            "file": {
              "size": 17312.0,
              "entropy": 6.42,
              "size_bytes": 17312.0
            },
            "binary": {
              "is_pie": 1.0,
              "has_overlay": 1.0,
              "code_entropy": 5.18,
              "overlay_size": 8096.0,
              "string_count": 126.0,
              "overlay_ratio": 0.47,
              "overall_entropy": 6.42,
              "overlay_entropy": 7.33,
              "entropy_variance": 4.38,
              "avg_string_length": 22.5,
              "max_string_length": 145.0,
              "code_to_data_ratio": 1.0,
              "string_length_stddev": 18.1,
              "largest_section_ratio": 0.41,
              "sentence_string_count": 16.0,
              "sentence_string_ratio": 0.13,
              "high_entropy_string_count": 0.0
            },
            "imports": {
              "count": 1.0
            },
            "sections": {
              "count": 3.0,
              "code_size": 7168.0,
              "entropy_max": 5.18,
              "entropy_mean": 2.79,
              "name_entropy": 3.03,
              "writable_count": 0.0,
              "executable_count": 1.0,
              "nonstandard_count": 0.0,
              "executable_writable_count": 0.0
            },
            "dependencies": {
              "count": 1.0
            }
          },
          "sec": [
            [
              ".text",
              512,
              7168,
              5.18,
              "r-x"
            ],
            [
              ".rsrc",
              7680,
              1024,
              3.1,
              "r--"
            ],
            [
              ".reloc",
              8704,
              512,
              0.08,
              "r--"
            ]
          ],
          "str": [
            [
              77,
              "u8",
              "!This program cannot be run in DOS mode."
            ],
            [
              376,
              "u8",
              ".text"
            ],
            [
              455,
              "u8",
              "@.reloc"
            ],
            [
              592,
              "u8",
              "BSJB"
            ],
            [
              973,
              "u8",
              "GenericSetup.resources.dll"
            ],
            [
              1000,
              "u8",
              "GenericSetup.resources"
            ],
            [
              1026,
              "u8",
              "\u003cModule\u003e"
            ],
            [
              1035,
              "u8",
              "mscorlib"
            ],
            [
              1044,
              "u8",
              "AssemblyTitleAttribute"
            ],
            [
              1067,
              "u8",
              "System.Reflection"
            ],
            [
              1085,
              "u8",
              ".ctor"
            ],
            [
              1091,
              "u8",
              "AssemblyDescriptionAttribute"
            ],
            [
              1120,
              "u8",
              "AssemblyCompanyAttribute"
            ],
            [
              1145,
              "u8",
              "AssemblyProductAttribute"
            ],
            [
              1170,
              "u8",
              "AssemblyCopyrightAttribute"
            ],
            [
              1197,
              "u8",
              "AssemblyTrademarkAttribute"
            ],
            [
              1224,
              "u8",
              "AssemblyFileVersionAttribute"
            ],
            [
              1253,
              "u8",
              "GenericSetup.LanguageResource.GenericBundleResources.ru.resources"
            ],
            [
              1319,
              "u8",
              "GenericSetup.LanguageResource.SciterScriptResources.ru.resources"
            ],
            [
              1422,
              "u8",
              "GenericSetup"
            ],
            [
              1441,
              "u8",
              "Adaware Installer"
            ],
            [
              1464,
              "u8",
              "Adaware"
            ],
            [
              1477,
              "u8",
              "Copyright"
            ],
            [
              1489,
              "u8",
              "Adaware 2021"
            ],
            [
              1514,
              "u8",
              "6.4.1.0"
            ],
            [
              1540,
              "u8",
              "lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R"
            ],
            [
              1697,
              "u8",
              "PADPADP"
            ],
            [
              3226,
              "u8",
              "{Resource ProductName}?"
            ],
            [
              3870,
              "u8",
              "{OfferSoftwareName}"
            ],
            [
              4638,
              "u8",
              "{Resource ProductName}"
            ],
            [
              5968,
              "u8",
              "{Resource ProductName}."
            ],
            [
              6107,
              "u8",
              ": {Resource CarrierCurrentExitCode}"
            ],
            [
              7240,
              "u8",
              "mscoree.dll"
            ],
            [
              9282,
              "u8",
              "N0L0"
            ],
            [
              9426,
              "u8",
              "Entrust, Inc.1(0\u0026"
            ],
            [
              9450,
              "u8",
              "See www.entrust.net/legal-terms1907"
            ],
            [
              9491,
              "u8",
              "0(c) 2009 Entrust, Inc. - for authorized use only1200"
            ],
            [
              9550,
              "u8",
              ")Entrust Root Certification Authority - G20"
            ],
            [
              9596,
              "u8",
              "090707172554Z"
            ],
            [
              9611,
              "u8",
              "301207175554Z0"
            ],
            [
              10047,
              "u8",
              "N2Lbw"
            ],
            [
              10695,
              "u8",
              "150610134249Z"
            ],
            [
              10710,
              "u8",
              "301110141249Z0"
            ],
            [
              10815,
              "u8",
              "0(c) 2015 Entrust, Inc. - for authorized use only1\u003c0:"
            ],
            [
              10874,
              "u8",
              "3Entrust Extended Validation Code Signing CA - EVCS10"
            ],
            [
              11315,
              "u8",
              "http://ocsp.entrust.net00"
            ],
            [
              11357,
              "u8",
              "http://crl.entrust.net/g2ca.crl0;"
            ],
            [
              11396,
              "u8",
              "40200"
            ],
            [
              11423,
              "u8",
              "http://www.entrust.net/rpa0"
            ],
            [
              12042,
              "u8",
              "210317210614Z"
            ],
            [
              12057,
              "u8",
              "220525210613Z0"
            ],
            [
              12097,
              "u8",
              "Quebec1"
            ],
            [
              12114,
              "u8",
              "Saint Laurent1"
            ],
            [
              12159,
              "u8",
              "6785719 Canada Inc.1"
            ],
            [
              12189,
              "u8",
              "Private Organization1"
            ],
            [
              12220,
              "u8",
              "678571-91"
            ],
            [
              12239,
              "u8",
              "6785719 Canada Inc.0"
            ],
            [
              12668,
              "u8",
              "http://ocsp.entrust.net05"
            ],
            [
              12704,
              "u8",
              ")http://aia.entrust.net/evcs1-chain256.cer01"
            ],
            [
              12764,
              "u8",
              "http://crl.entrust.net/evcs1.crl0"
            ],
            [
              12842,
              "u8",
              "D0B07"
            ],
            [
              12875,
              "u8",
              "https://www.entrust.net/rpa0"
            ],
            [
              13352,
              "u8",
              "3Entrust Extended Validation Code Signing CA - EVCS1"
            ],
            [
              13771,
              "u8",
              "/OKd"
            ],
            [
              14021,
              "u8",
              "20210915134525Z"
            ],
            [
              14112,
              "u8",
              "DigiCert Inc1"
            ],
            [
              14135,
              "u8",
              "www.digicert.com110/"
            ],
            [
              14161,
              "u8",
              "(DigiCert SHA2 Assured ID Timestamping CA0"
            ],
            [
              14221,
              "u8",
              "310106000000Z0H1"
            ],
            [
              14260,
              "u8",
              "DigiCert, Inc.1 0"
            ],
            [
              14285,
              "u8",
              "DigiCert Timestamp 20210"
            ],
            [
              14704,
              "u8",
              "http://www.digicert.com/CPS0"
            ],
            [
              14803,
              "u8",
              "j0h02"
            ],
            [
              14813,
              "u8",
              ",http://crl3.digicert.com/sha2-assured-ts.crl02"
            ],
            [
              14865,
              "u8",
              ",http://crl4.digicert.com/sha2-assured-ts.crl0"
            ],
            [
              14941,
              "u8",
              "http://ocsp.digicert.com0O"
            ],
            [
              14978,
              "u8",
              "Chttp://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0"
            ],
            [
              15417,
              "u8",
              "www.digicert.com1$0\""
            ],
            [
              15444,
              "u8",
              "DigiCert Assured ID Root CA0"
            ],
            [
              15475,
              "u8",
              "160107120000Z"
            ],
            [
              15490,
              "u8",
              "310107120000Z0r1"
            ],
            [
              16072,
              "u8",
              "http://ocsp.digicert.com0C"
            ],
            [
              16109,
              "u8",
              "7http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0"
            ],
            [
              16184,
              "u8",
              "4http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:"
            ],
            [
              16244,
              "u8",
              "4http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P"
            ],
            [
              16305,
              "u8",
              "I0G08"
            ],
            [
              16338,
              "u8",
              "https://www.digicert.com/CPS0"
            ],
            [
              16744,
              "u8",
              "(DigiCert SHA2 Assured ID Timestamping CA"
            ],
            [
              16866,
              "u8",
              "210915134525Z0+"
            ],
            [
              1982,
              "wide",
              "ConnectionErrorȇ"
            ],
            [
              2082,
              "wide",
              "OptInPromptMessageɎ"
            ],
            [
              2176,
              "wide",
              "MultiInstancesCaptionΞ"
            ],
            [
              2242,
              "wide",
              "OfferAlreadyInstalledϣ"
            ],
            [
              2360,
              "wide",
              "FileNotFoundErrorӳ"
            ],
            [
              2438,
              "wide",
              "MessageSkipOffer"
            ],
            [
              2534,
              "wide",
              "FileNotFoundCaption"
            ],
            [
              2620,
              "wide",
              "WizardServerError"
            ],
            [
              2708,
              "wide",
              "Message64BitInstallerOnOs32Bit"
            ],
            [
              2806,
              "wide",
              "MessageCloseInstaller"
            ],
            [
              2918,
              "wide",
              "MessageCarrierInstallError"
            ],
            [
              3020,
              "wide",
              "AdministratorRightsRequiredCaption"
            ],
            [
              3126,
              "wide",
              "OptInPromptHeader"
            ],
            [
              6726,
              "wide",
              "Cancel"
            ],
            [
              6784,
              "wide",
              "InvalidPathH"
            ],
            [
              6840,
              "wide",
              "Errorw"
            ],
            [
              6884,
              "wide",
              "SelectFolder¼"
            ],
            [
              7770,
              "wide",
              "VS_VERSION_INFO"
            ],
            [
              7862,
              "wide",
              "VarFileInfo"
            ],
            [
              7894,
              "wide",
              "Translation"
            ],
            [
              7930,
              "wide",
              "StringFileInfo"
            ],
            [
              7990,
              "wide",
              "Comments"
            ],
            [
              8008,
              "wide",
              "Adaware Installer"
            ],
            [
              8050,
              "wide",
              "CompanyName"
            ],
            [
              8076,
              "wide",
              "Adaware"
            ],
            [
              8098,
              "wide",
              "FileDescription"
            ],
            [
              8132,
              "wide",
              "GenericSetup"
            ],
            [
              8166,
              "wide",
              "FileVersion"
            ],
            [
              8192,
              "wide",
              "6.4.1.0"
            ],
            [
              8214,
              "wide",
              "InternalName"
            ],
            [
              8240,
              "wide",
              "GenericSetup.resources.dll"
            ],
            [
              8302,
              "wide",
              "LegalCopyright"
            ],
            [
              8332,
              "wide",
              "Copyright © Adaware 2021"
            ],
            [
              8390,
              "wide",
              "OriginalFilename"
            ],
            [
              8486,
              "wide",
              "ProductName"
            ],
            [
              8546,
              "wide",
              "ProductVersion"
            ],
            [
              8598,
              "wide",
              "Assembly Version"
            ]
          ],
          "val": {
            "file.stem": "VirusShare_b0c21ed56070bc0eaefe511332e29936",
            "pe.imphash": "dae02f32a21e03ce65412f6e56942daa",
            "pe.machine": "i386",
            "pe.subsystem": "windows_cui",
            "pe.timestamp": 1631699121,
            "file.basename": "VirusShare_b0c21ed56070bc0eaefe511332e29936",
            "pe.image_base": 4194304,
            "pe.image_size": 32768,
            "pe.machine_id": 332,
            "pe.os_version": "4.0",
            "pe.version.os": "unknown",
            "pe.entry_point": 14932,
            "pe.headers_size": 512,
            "pe.version.type": "dll",
            "pe.entry_section": ".text",
            "pe.subsystem_raw": 3,
            "pe.clr.is_il_only": 1,
            "pe.file_alignment": 512,
            "pe.image_hash.sha1": "fb8d2469693d22536aff625b11ba9da3fa570345",
            "pe.version.company": "Adaware",
            "pe.version.comments": "Adaware Installer",
            "pe.image_hash.sha256": "40da1fc66a1039e536c05070066f9fd5d0e64ef8a6be18232280916482f3e2db",
            "pe.image_hash.sha384": "66e4c2290a5b533c103d6e31bb8c13c1653815d416e433c6fd1c68ce417dca844ab7a68d04c4a6503469e8ce577c0651",
            "pe.image_hash.sha512": "4227ede8f030af68b1c51108ba3e7332ed3e44215bddf7fabb8f98ec6cbda33751b52a74163f5a43f033541c5b8cc2508d3d43c2329ddb95162b7c400bca8151",
            "pe.resource_types[0]": "RT_VERSION",
            "pe.section_alignment": 8192,
            "pe.subsystem_version": "4.0",
            "pe.version.copyright": "Copyright © Adaware 2021",
            "pe.characteristics[0]": "executable_image",
            "pe.characteristics[1]": "32bit_machine",
            "pe.characteristics[2]": "dll",
            "pe.characteristics_raw": 8450,
            "pe.clr.runtime_version": "2.5",
            "pe.version.description": "GenericSetup",
            "pe.linker_major_version": 8,
            "pe.signatures[0].issuer": "CN=Entrust Extended Validation Code Signing CA - EVCS1,OU=(c) 2015 Entrust\\, Inc. - for authorized use only,OU=See www.entrust.net/legal-terms,O=Entrust\\, Inc.,C=US",
            "pe.signatures[0].serial": "70d7b194bf98418c75738dafba2fb212",
            "pe.version.file_version": "6.4.1.0",
            "pe.version.product_name": "GenericSetup",
            "pe.signatures[0].subject": "CN=6785719 Canada Inc.,SERIALNUMBER=678571-9,BUSINESSCATEGORY=Private Organization,O=6785719 Canada Inc.,1.3.6.1.4.1.311.60.2.1.3=#13024341,L=Saint Laurent,ST=Quebec,C=CA",
            "pe.version.internal_name": "GenericSetup.resources.dll",
            "pe.dll_characteristics[0]": "dynamic_base",
            "pe.dll_characteristics[1]": "nx_compat",
            "pe.dll_characteristics[2]": "no_seh",
            "pe.dll_characteristics[3]": "terminal_server_aware",
            "pe.signatures[0].verified": true,
            "pe.version.company_offset": 8076,
            "pe.data_directories[0].rva": 14858,
            "pe.data_directories[1].rva": 16384,
            "pe.data_directories[2].rva": 9216,
            "pe.data_directories[3].rva": 24576,
            "pe.data_directories[4].rva": 8192,
            "pe.data_directories[5].rva": 8200,
            "pe.dll_characteristics_raw": 34112,
            "pe.number_of_rva_and_sizes": 16,
            "pe.signatures[0].not_after": "2022-05-25T21:06:13Z",
            "pe.version.comments_offset": 8008,
            "pe.version.product_version": "6.4.1.0",
            "pe.data_directories[0].name": "import",
            "pe.data_directories[0].size": 74,
            "pe.data_directories[1].name": "resource",
            "pe.data_directories[1].size": 968,
            "pe.data_directories[2].name": "certificate",
            "pe.data_directories[2].size": 8096,
            "pe.data_directories[3].name": "base_relocation",
            "pe.data_directories[3].size": 12,
            "pe.data_directories[4].name": "iat",
            "pe.data_directories[4].size": 8,
            "pe.data_directories[5].name": "clr_runtime_header",
            "pe.data_directories[5].size": 72,
            "pe.signatures[0].not_before": "2021-03-17T21:06:14Z",
            "pe.version.copyright_offset": 8332,
            "pe.version.original_filename": "GenericSetup.resources.dll",
            "pe.coff.dos_header_pe_pointer": 128,
            "pe.version.description_offset": 8132,
            "pe.version.file_version_offset": 8192,
            "pe.version.product_name_offset": 8512,
            "pe.base_relocations.block_count": 1,
            "pe.base_relocations.entry_count": 1,
            "pe.version.internal_name_offset": 8240,
            "pe.signatures[0].thumbprint_sha1": "5472922fe3235328d67a38bdc6cb629623bb354b",
            "pe.base_relocations.padding_count": 1,
            "pe.signatures[0].cert_chain_depth": 3,
            "pe.signatures[0].digest_algorithm": "sha256",
            "pe.signatures[0].eku_code_signing": true,
            "pe.signatures[0].signature_digest": "40da1fc66a1039e536c05070066f9fd5d0e64ef8a6be18232280916482f3e2db",
            "pe.version.product_version_offset": 8576,
            "pe.signatures[0].thumbprint_sha256": "69c5365cb5600fb416f3c63b6bc4862fc9b72e96307099952fc273afd453eb8f",
            "pe.version.original_filename_offset": 8424,
            "pe.signatures[0].signature_algorithm": "sha256WithRSAEncryption",
            "pe.signatures[0].signature_digest_algorithm": "sha256"
          }
        },
        "find": [
          {
            "id": "metadata/signed/unknown::6785719-canada-inc.",
            "conf": 1.0,
            "crit": 3,
            "desc": "Authenticode chain CN: 6785719 Canada Inc."
          },
          {
            "id": "metadata/signed/leaf::6785719-canada-inc.",
            "conf": 1.0,
            "crit": 3,
            "desc": "Signed by 6785719 Canada Inc."
          },
          {
            "id": "metadata/signed/certificate::pe-signature-verified-kv",
            "conf": 1.0,
            "crit": 2,
            "desc": "PE Authenticode signature verified metadata"
          },
          {
            "id": "metadata/binary/framework::clr-runtime-header",
            "conf": 1.0,
            "crit": 2,
            "desc": "PE CLR runtime header present (COM descriptor)"
          },
          {
            "id": "metadata/binary/layout::overlay-over-35pct",
            "conf": 0.9399999976158142,
            "crit": 3,
            "desc": "PE overlay exceeds thirty-five percent"
          },
          {
            "id": "metadata/binary/framework::dotnet-metadata",
            "conf": 1.0,
            "crit": 2,
            "desc": ".NET Metadata Root (BSJB)"
          },
          {
            "id": "metadata/package/versioning::pe-product-version-ipv4-shape",
            "conf": 0.9200000166893005,
            "crit": 1,
            "desc": "PE ProductVersion resembles IPv4"
          },
          {
            "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal",
            "conf": 0.699999988079071,
            "crit": 1,
            "desc": ".NET code entropy in unpacked range"
          },
          {
            "id": "metadata/package/versioning::pe-productversion-field",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "PE ProductVersion metadata field"
          },
          {
            "id": "metadata/binary/layout::has-overlay",
            "conf": 1.0,
            "crit": 3,
            "desc": "PE binary has trailing overlay data"
          },
          {
            "id": "metadata/package/versioning::pe-file-version-ipv4-shape",
            "conf": 0.9200000166893005,
            "crit": 1,
            "desc": "PE FileVersion resembles IPv4"
          },
          {
            "id": "metadata/package/versioning::pe-version-resource",
            "conf": 0.800000011920929,
            "crit": 2,
            "desc": "PE version resource structure"
          },
          {
            "id": "metadata/package/versioning::pe-fileversion-field",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "PE FileVersion metadata field"
          },
          {
            "id": "metadata/binary/layout::overlay-dominates-third",
            "conf": 0.9200000166893005,
            "crit": 3,
            "desc": "Overlay exceeds one-third"
          },
          {
            "id": "metadata/binary/framework::dotnet-assembly",
            "conf": 1.0,
            "crit": 2,
            "desc": ".NET Assembly (mscoree.dll)"
          }
        ],
        "path": "VirusShare_b0c21ed56070bc0eaefe511332e29936",
        "risk": 4,
        "size": 17312,
        "type": "pe"
      }
    ]
  }
}