{ "ml": { "v": "7", "eng": "2.0.1-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.00024539232, "rte": "az", "prob": 0.00024539232 }, { "cls": 0, "raw": 0.03404051, "rte": "az/native", "prob": 0.03404051 }, { "cls": 0, "raw": 0.5598875, "rte": "az/pe", "prob": 0.5598875 } ], "prob": 0.00024539232, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.0002453923225402832, "type": "pe" } ], "version": "v18.18", "analyzed_at": "2026-06-15T02:06:20Z" }, "path": "cc8e79ce79d0078b6483062f8fc8d187f5fdcf92c9f51db25551a19d22af0a87.exe", "raw": { "v": "7", "tv": "061e3", "files": [ { "id": 0, "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47", "l": 0, "n": [ { "c": 3, "d": "Manifest is MyApplication template name", "i": "metadata/build/manifest::pe-manifest-myapplication-template", "o": 0, "z": 1 } ], "x": true }, { "b": "00B2n0v!6H8H-a}00B+Klq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "l": 9652, "n": [ { "c": 2, "d": ".NET Metadata Root (BSJB)", "i": "metadata/binary/framework::dotnet-metadata", "o": 9668, "z": 4 } ], "x": true }, { "b": "m/Vs]ygQ)%08[e:By/p?zf6i9A+]D00ba=it30I1pGI:lvr1hCp!kWdD2lkPAw}Ggp\u003cu$J", "l": 14490, "n": [ { "c": 2, "d": "mscorlib reference", "i": "metadata/lang/compiler/managed::mscorlib", "o": 14506, "z": 8 } ], "x": true }, { "b": "q-DHCAX.JEh.W6?rXWqGs7L\u0026dy?WD#Bo2l+B97#ge(2#10b+enCslNCrwviTC5xb\u003clR*CSCXfovzGwrSiz\u003cEd", "l": 14556, "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 14582, "z": 10 }, { "c": 2, "d": "System.Net.WebClient class usage", "i": "micro-behaviors/communications/http/client/managed::webclient", "o": 14572, "z": 9 } ], "x": true }, { "b": "A==2bA@XG@p?-set30GWq/)4]zF5@:s9Engvr1hC07HZkye]a.vkpk?wls1vk@Idiz7#", "l": 16128, "n": [ { "c": 1, "d": "Regex component marker", "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "o": 16144, "z": 6 } ], "x": true }, { "b": "s-esR09j2Lwb]hsBtCVLnow@)s7L\u0026swPq\u003c7B94y-wNX8Mv}xR3x(v\u003e?q/)4\u003evqM0yD2[7sz7XyQ09r-vqE%]*z/fSc08)#WwNPBNwNPaXASxfLvP3=SB.bSo07QQxqE%]*z/fSc07QQxqE%]*z/fScq/)4\u003evqL#%v@#Tf090JOBw=WU", "l": 16185, "n": [ { "c": 3, "d": "HTTP response retrieval method", "i": "micro-behaviors/communications/http/client/managed::getresponse", "o": 16282, "z": 11 }, { "c": 3, "d": "System.Net.HttpWebRequest class usage", "i": "micro-behaviors/communications/http/client/managed::httpwebrequest", "o": 16201, "z": 14 }, { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 16236, "z": 9 } ], "x": true }, { "b": "x(v\u003e?xjVf(o\u003ewx!vp%cKxjVf(nm=juwPz?(s7L\u0026iwNPaXAZK+Yy?m9#x(v\u003e?pgn0Jr://!wKyxLy?m9#x(v\u003e?q*ACawO\u003c4!z!%l3v@#B6zGvBeAaJJ[vqGU7wN\u003e=", "l": 16383, "n": [ { "c": 3, "d": "Usage of NameValueCollection (headers/params)", "i": "micro-behaviors/communications/http/server/managed::name-value-collection", "o": 16431, "z": 19 }, { "c": 1, "d": "Regex component marker", "i": "micro-behaviors/communications/http/client/managed::webclient--rx-6", "o": 16399, "z": 11 } ], "x": true }, { "b": "AaJSIxIyt:lVl\u003c=wPz\u003e)rbU9iB7El^q/)4]zF5@ogi^+nwl7yfAwgcVt6hJqhVMi-zEW9%0aQjYx\u0026a", "l": 16807, "n": [ { "c": 1, "d": "Regex component marker", "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "o": 16823, "z": 14 } ], "x": true }, { "b": "wNPAQz/x5LADLYax([R2xjVf(qE%]*z/fSc07eN%sWL$Whd=?VBAzF6wNXLGB8V5nB7CtJz=p:#x(mL-s2a.GzBeF5vROOcxg=r1mTa]3vru6Wx(dzYxjVe", "l": 17460, "n": [ { "c": 3, "d": "Access to ASP.NET Response object", "i": "micro-behaviors/communications/http/server/managed::http-response-get", "o": 17476, "z": 12 }, { "c": 1, "d": "Regex component marker", "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "o": 17515, "z": 8 } ], "x": true }, { "b": "xKL}507y^FzdN-@vR/PQq*ACawO\u003c4[x(m[\u003cq*ACawO\u003c4!z/Py?qEKDQwDkp\u003czGP/cA:-A[wNEj", "l": 18031, "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 18047, "z": 11 } ], "x": true }, { "b": "wDkkyx\u003efIKBAh88B-.f{q*ACawO\u003c4$B-8qnzdLs\u003ezGGDgz/wS^A=#ebwPE\u0026Jvrc0(BvHpVzdN{fA+^%.BAh88B-.f{q*ACawO?", "l": 20029, "n": [ { "c": 2, "d": "Runtime interop services", "i": "metadata/lang/compiler/managed::runtime-interop", "o": 20045, "z": 30 } ], "x": true }, { "b": "wN[eDwmX5GBAh88B-.f{q*ACawO\u003c4!z!9AEz/49]z/6Dcy?mR!l$G?Ixj\u003e^@ph+2IB7GwVz!9ABBAzLqvS=^708[d", "l": 20367, "n": [ { "c": 2, "d": "CodeDom compiler access", "i": "metadata/lang/compiler/managed::codedom-compiler", "o": 20383, "z": 23 } ], "x": true }, { "b": "0ab.80cwiV0ce6R0b}{D0cwiO0abZ(08JU!0ab.w0a=dQ0ab.E0a=du0ce6J0cwhv5K#", "l": 20905, "n": [ { "c": 1, "d": "secret keyword", "i": "micro-behaviors/data/text/keywords/lexicon::secret", "o": 20921, "z": 6 } ], "x": true }, { "b": "iaB%dfGp)Cf/Pdkm/-Pde(1\u0026mmSI{OwP@6kyB\u0026H$A=U@kzASe1e?^qar1oQiA:-/@Cw?Iql${ZYy*?P:vqPM!e(1\u0026mavV", "l": 23360, "n": [ { "c": 2, "d": ".NET Framework reference", "i": "metadata/lang/compiler/managed::framework-reference", "o": 23376, "z": 26 } ], "x": true }, { "b": "/eKxy=DtQ\u00260rr91KPkvYy/tR2By/qwqE%]/B-H#6B1Qv4B8Mhwv}wLHvpS}\u0026efF!Jv@Dy7x\u003c@Ror+lq)x(v(Lg+HEmfFk4gavyo/BAIRnj-j?NBAg/aefE=ivR/:*oj-xFz!\u0026{4jZ{uevkRKLhzEiFg?wv2iu}EFB97#ge(Dn4z/{8gwPGF4B-8qnzdMQRB8Mhwv}wOIBohBx009610000008L%H", "l": 23632, "n": [ { "c": 2, "d": "mscorlib reference", "i": "metadata/lang/compiler/managed::mscorlib", "o": 23648, "z": 128 } ], "x": true }, { "b": "w\u0026qC6vLxF[f/y)Df/H\u003cCgD40BgD4fIvM4ZIfF$Qzh8WfEg=mcEiw$Ccg=3{zgb7yuix3", "l": 371804, "n": [ { "c": 2, "d": "Golden Ratio constant (0x9e3779b9)", "i": "micro-behaviors/os/random/prng/cmwc::cmwc-prng-constants", "o": 371820, "z": 6 } ], "x": true }, { "b": "AZ+j:o\u003c}:N0bV^!z/PA2e[w^m000000rjtBav2]b0000000000000000000000000", "l": 1217893, "n": [ { "c": 2, "d": ".dll extension reference", "i": "micro-behaviors/fs/path/extension::dll-dup", "o": 1217909, "z": 4 } ], "x": true }, { "b": "0rskxc{^[l0SY.jgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrx92lj-", "l": 1235298, "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 1235314, "z": 15 } ], "x": true }, { "b": "x-JkPzVB!T002W)6-XmmlJz38z2!IPve$fBC(QOtve$cAwDhYg002y!zVBUPaoj}jpxhHqwb{J", "l": 1235630, "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 1235646, "z": 11 } ], "x": true }, { "b": "e=YF-ASu7t004JHec2XJmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002:]zVB\u003eVwDlVHve%*", "l": 1235706, "n": [ { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 1235722, "z": 15 } ], "x": true }, { "b": "x-JkPzVB!T001XM2MK(9mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001}Te=W\u003che=W*ge=WN9001?Q3ig8bnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE003ZkC(RQWwDl@Pe=YC.CMqpP", "l": 1235834, "n": [ { "c": 2, "d": "PE FileVersion metadata field", "i": "metadata/package/versioning::pe-fileversion-field", "o": 1235850, "z": 11 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 1235898, "z": 12 }, { "c": 1, "d": "PE FileVersion resembles IPv4", "i": "metadata/package/versioning::pe-file-version-ipv4-shape", "o": 1235876, "z": 7 } ], "x": true }, { "b": "aoj}jpxgv{002aY3ig8bpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE003ZkC(RQWwDl@Pe=YC.CMqpP001?Q3ig8bpYLIozVBqFBPt[KBo25ove$cAwDhYg002:]zVB\u003eVwDlVHve%*rd/.71001?Q2MK(9pYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001}Te=W\u003che=W*ge=WN9001$U2MK(9k(+%aA@Y+Kz2!2ByYF.Xao", "l": 1236030, "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 1236046, "z": 16 }, { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 1236106, "z": 11 }, { "c": 2, "d": "PE ProductVersion metadata field", "i": "metadata/package/versioning::pe-productversion-field", "o": 1236158, "z": 14 }, { "c": 1, "d": "PE ProductVersion resembles IPv4", "i": "metadata/package/versioning::pe-product-version-ipv4-shape", "o": 1236188, "z": 7 } ], "x": true }, { "b": "Bs?0vz8#9Dz7Y#/b0DCyarR^HarR^HjAt1MB.bSowN[kOwN/\u003e8x(v(.wP?T3az+RjwO:HNvrk1TC5IecAV#SGx*DlswPI]Qb4+n1B7DKGj}d\u0026warR^HauRq$wPq\u003c7B97#7p\u0026Zn[x-", "l": 1236587, "n": [ { "c": 2, "d": "asInvoker manifest tag in resources", "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "o": 1236603, "z": 61 } ], "x": true }, { "b": "000000000000000000000i^7o3\u0026*ncFhmf9000000000000000000000000000000000", "l": 1236976, "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 1236992, "z": 6 } ], "x": true } ], "idn": { "name": { "value": "iykex.exe", "source": "pe.version.original_filename", "verified": false }, "trust": "unsigned", "project": { "value": "Notepad++", "source": "pe.version.product_name", "verified": false }, "version": { "value": "7.8.7.0", "source": "pe.version.file_version", "verified": false }, "organization": { "value": "Don HO don.h@free.fr", "source": "pe.version.company", "verified": false } }, "mol": "H₂(Cm₂Db)Md(Bk)", "sha": "cc8e79ce79d0078b6483062f8fc8d187f5fdcf92c9f51db25551a19d22af0a87", "fact": { "id": "pe", "imp": [ [ "mscoree", "CorExeMain" ] ], "met": { "pe": { "checksum": 0.0, "icon_count": 2.0, "has_manifest": 1.0, "checksum_valid": 0.0, "resource_count": 4.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 1281266.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.3, "clr.managed_resource_count": 1.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "clr.managed_resource_max_size": 1194199.0, "version.identity_symbol_ratio": 0.14, "clr.managed_resource_max_entropy": 3.89 }, "file": { "size": 1237504.0, "entropy": 4.14, "size_bytes": 1237504.0 }, "binary": { "is_pie": 1.0, "code_entropy": 4.04, "string_count": 555.0, "overall_entropy": 4.14, "entropy_variance": 3.6, "avg_string_length": 2166.43, "max_string_length": 1193985.0, "code_to_data_ratio": 1.0, "string_length_stddev": 50635.52, "largest_section_ratio": 0.98, "sentence_string_count": 15.0, "sentence_string_ratio": 0.03, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 1217536.0, "entropy_max": 4.21, "entropy_mean": 2.78, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "sec": [ [ ".text", 512, 1217536, 4.04, "r-x" ], [ ".rsrc", 1218048, 18944, 4.21, "r--" ], [ ".reloc", 1236992, 512, 0.1, "r--" ] ], "str": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 376, "u8", ".text" ], [ 455, "u8", "@.reloc" ], [ 9668, "u8", "BSJB" ], [ 14429, "u8", "iykex" ], [ 14435, "u8", "iykex.exe" ], [ 14445, "u8", "\u003cModule\u003e" ], [ 14454, "u8", "m1boYnAtNfSt2nNUCw" ], [ 14473, "u8", "DZ51H9UVHlFRmaTVaG" ], [ 14492, "u8", "Object" ], [ 14499, "u8", "System" ], [ 14506, "u8", "mscorlib" ], [ 14515, "u8", "hDeZW3qOWwLaq6rPHt" ], [ 14534, "u8", "ymLUq7fVPxqHJ3o66i" ], [ 14553, "u8", "eXwS81ir2nj704VV1M" ], [ 14572, "u8", "WebClient" ], [ 14582, "u8", "System.Net" ], [ 14593, "u8", "nCewDuJU1Mcvn40CON" ], [ 14612, "u8", "xfBSnsGb9QhoNA0eh3" ], [ 14631, "u8", "TkTNgdPvKTRPw5hqjy" ], [ 14650, "u8", "\u003c\u003ec__DisplayClass3" ], [ 14669, "u8", "huLQ7imxqJPrIUQMs7" ], [ 14688, "u8", "ADxtqOOsbVvHaxcG93" ], [ 14707, "u8", "s0klW7tM8o0FEd8he2" ], [ 14726, "u8", "QYHxAVVUptkFfOWL8b" ], [ 14745, "u8", "zNQeUSYcJ3d75TdKIx" ], [ 14764, "u8", "towuBqEtAJhSTjQOTj" ], [ 14783, "u8", "PewawQrmcfmbkRXqPy" ], [ 14802, "u8", "kbOTLQDXHGHHBEBvfh" ], [ 14821, "u8", "MjeGpJ05p4x6509SRa" ], [ 14840, "u8", "ioZkmVFohkwCaEAFw5" ], [ 14859, "u8", "xP4hey4FV2wtFJ1E5v" ], [ 14878, "u8", "KC9ZXrwAiJ4spAqDJs" ], [ 14897, "u8", "mFeOndMm0nnN2xevAb" ], [ 14916, "u8", "I6DracbkyHhm6DIimX" ], [ 14935, "u8", "K6OeKHj5wjBhKHPNpa" ], [ 14954, "u8", "a5gXxKKR8xiR6KiDBj" ], [ 14973, "u8", "R0iOXydLeiCSrE9Hss" ], [ 14992, "u8", "QdJ1dRvdUpcQUcShpa" ], [ 15011, "u8", "p0JWibZHRED3iLAiUs" ], [ 15030, "u8", "t3XiYO5DSVgkn8Fs62" ], [ 15049, "u8", "ercBoL97jKfqyHPE5U" ], [ 15068, "u8", "Lq7d4opjeVTeIt9Bbq" ], [ 15087, "u8", "sVtGykaPc5sTviPiba" ], [ 15106, "u8", "exN8TCgtHe7ylsBfFa" ], [ 15125, "u8", "e0kjY2y0jlo4BnlcsW" ], [ 15144, "u8", "pMdmcUnhvLcK00qSq9" ], [ 15163, "u8", "eG1UgICSmm6WLAUvI7" ], [ 15182, "u8", "s26X6csAJmtVTP6Bkg" ], [ 15201, "u8", "kUbhl06W98M9fqN60p" ], [ 15220, "u8", "sdOH9B1ZxDbJFUDyCg" ], [ 15239, "u8", "OiqtZoxOUTyEAPAHJY" ], [ 15258, "u8", "RRRCFYQQmcQl7hSh45" ], [ 15277, "u8", "jsahcrRppkRvQbDjf7" ], [ 15296, "u8", "Y4pHPGW5B6BlvHIAxr" ], [ 15315, "u8", "vntJByXEvgMGTdFaaL" ], [ 15334, "u8", "lbkoBLTl18UrmiXkMA" ], [ 15353, "u8", "bdZYGZBIEme0eiZuLe" ], [ 15372, "u8", "mYCUe6uqnsppcQ3tEG" ], [ 15391, "u8", "tY5V2mNtbo5gj09yZJ" ], [ 15410, "u8", "XJ3d3XcPMl1ap174in" ], [ 15429, "u8", "pp9UIESyjly1NNZMgd" ], [ 15448, "u8", "fpAMSPILmOvrnmXITs" ], [ 15467, "u8", "RcFWKb2BD0Hl2QQQhN" ], [ 15486, "u8", "FM6NcV72waUis2ZaEu" ], [ 15505, "u8", "fRUeIvl0LVwptU617L" ], [ 15524, "u8", "GE7MewLlBPa5FAEjDC" ], [ 15543, "u8", "bGdVvKk5nVd8cwX6V1" ], [ 15562, "u8", "kjVVu33fp3u1GuIWu8" ], [ 15581, "u8", "auBEeNh4QaJMmFpHwb" ], [ 15600, "u8", "a073wSenOPW7Vnam7X" ], [ 15619, "u8", "Pto0Bs8XpIRYwNMQFq" ], [ 15638, "u8", "eNjVW7oqc3PIkMgHOi" ], [ 15657, "u8", "s1bf1wzCFNs67ngilZ" ], [ 15676, "u8", "XMSwVvAHkqXNewqr1NX" ], [ 15696, "u8", "uFCy32AA02HmMvA8Vnj" ], [ 15716, "u8", "OQ40d9AUE1rMXmT60pR" ], [ 15736, "u8", "PdHMwRAqk2kOWI7fsrq" ], [ 15756, "u8", "sMvSueAfl6NamoPICUm" ], [ 15776, "u8", "rrAHC2AiZfVnlyqHMGg" ], [ 15796, "u8", "QbWy3lAJNK1uSGBE7J1" ], [ 15816, "u8", "TnQIZyAG9boA1DeSCws" ], [ 15836, "u8", "kQS3A3APtnYTgyhEBYc" ], [ 15856, "u8", "NykXLjAmxbwRyluQA7M" ], [ 15876, "u8", "jcs0lqAO7erNASUWMTQ" ], [ 15896, "u8", "cBhVdQAttT3CwO564bW" ], [ 15916, "u8", "EtoD9jAV9eNpVMTJvEb" ], [ 15936, "u8", "iOl8PVAYdW0eqola9sm" ], [ 15956, "u8", "DCW7nQAE9BnrNA0NBjc" ], [ 15976, "u8", "JM1tLGAr4AOpsitYKD0" ], [ 15996, "u8", "fgAOXjAD7bOBiZRfgxc" ], [ 16016, "u8", "FlZwbIA07EcAtZW2NKu" ], [ 16036, "u8", "P2oCTVAFJ82lgBbKRLX" ], [ 16056, "u8", "te9vcJA4AVNKnx4ICLN" ], [ 16076, "u8", "c0du4fAwwmHRus6fl55" ], [ 16096, "u8", "Resources" ], [ 16106, "u8", "WindowsFormsApp1.Properties" ], [ 16134, "u8", "AGPiDeZW3" ], [ 16144, "u8", "String" ], [ 16151, "u8", "jWwJLaq6r" ], [ 16161, "u8", "FjcjUmfa2DodXvAA6E" ], [ 16180, "u8", "m1bAoYntN" ], [ 16190, "u8", "Void" ], [ 16195, "u8", "Int32" ], [ 16201, "u8", "HttpWebRequest" ], [ 16216, "u8", "WebException" ], [ 16229, "u8", "Stream" ], [ 16236, "u8", "System.IO" ], [ 16246, "u8", "WebResponse" ], [ 16258, "u8", "StreamReader" ], [ 16271, "u8", "WebRequest" ], [ 16282, "u8", "GetResponse" ], [ 16294, "u8", "GetResponseStream" ], [ 16312, "u8", ".ctor" ], [ 16318, "u8", "TextReader" ], [ 16329, "u8", "ReadToEnd" ], [ 16339, "u8", "IDisposable" ], [ 16351, "u8", "Dispose" ], [ 16359, "u8", "Console" ], [ 16367, "u8", "WriteLine" ], [ 16377, "u8", "Exception" ], [ 16387, "u8", "get_Message" ], [ 16399, "u8", "get_Headers" ], [ 16411, "u8", "WebHeaderCollection" ], [ 16431, "u8", "NameValueCollection" ], [ 16451, "u8", "System.Collections.Specialized" ], [ 16482, "u8", "get_Item" ], [ 16491, "u8", "ReadKey" ], [ 16499, "u8", "ConsoleKeyInfo" ], [ 16514, "u8", "Boolean" ], [ 16522, "u8", "eStU2nNUC" ], [ 16534, "u8", "set_UserAgent" ], [ 16548, "u8", "set_Method" ], [ 16559, "u8", "set_ContentType" ], [ 16575, "u8", "Encoding" ], [ 16584, "u8", "System.Text" ], [ 16596, "u8", "GetBytes" ], [ 16605, "u8", "Byte" ], [ 16610, "u8", "qCZq51H9V" ], [ 16620, "u8", "alFfRmaTV" ], [ 16630, "u8", ".cctor" ], [ 16637, "u8", "OOmgGCra6hWU8q9MaB" ], [ 16656, "u8", "ec3IgGG8ANocPML99M" ], [ 16675, "u8", "ajbOT84O4S5w64p8G2" ], [ 16694, "u8", "Create" ], [ 16701, "u8", "PQUa7pDbCV2TscXExD" ], [ 16720, "u8", "set_AllowAutoRedirect" ], [ 16742, "u8", "aUkbyJiaOh79Bj6Rgg" ], [ 16761, "u8", "Format" ], [ 16768, "u8", "NPxIpONF2ubZXsogor" ], [ 16796, "u8", "ovJ2xP6sBLQpefEhM5" ], [ 16815, "u8", "Convert" ], [ 16823, "u8", "ToBase64String" ], [ 16838, "u8", "B2xpQdV0yq0NIZu0o7" ], [ 16857, "u8", "Concat" ], [ 16864, "u8", "cwaiQ8IAdlnbNWjhim" ], [ 16883, "u8", "HttpRequestHeader" ], [ 16905, "u8", "KtFqrHEaMHhYRCRxTI" ], [ 16924, "u8", "qVVt1MDCe" ], [ 16934, "u8", "tDXi1PlNJc67ekuteq" ], [ 16953, "u8", "hHtG9mLUq" ], [ 16963, "u8", "SVPPxqHJ3" ], [ 16973, "u8", "Y66mifXwS" ], [ 16993, "u8", "Type" ], [ 16998, "u8", "Assembly" ], [ 17007, "u8", "System.Reflection" ], [ 17025, "u8", "GetTypeFromHandle" ], [ 17043, "u8", "RuntimeTypeHandle" ], [ 17061, "u8", "GetMethod" ], [ 17071, "u8", "MethodInfo" ], [ 17082, "u8", "get_FullName" ], [ 17095, "u8", "InvokeMember" ], [ 17108, "u8", "BindingFlags" ], [ 17121, "u8", "Binder" ], [ 17128, "u8", "PYe04I8NMcfJSMQ2V0" ], [ 17147, "u8", "nPHHEcYkw077yxV001" ], [ 17166, "u8", "pcPC9j0fdAEKIU2OtH" ], [ 17185, "u8", "R5ST7WkwyqtiFxvlHr" ], [ 17204, "u8", "MethodBase" ], [ 17215, "u8", "Invoke" ], [ 17222, "u8", "CNwnZyJJNJ2dKCZwCc" ], [ 17241, "u8", "rCldLeQiNh8WHWCrXV" ], [ 17260, "u8", "CreateInstance" ], [ 17275, "u8", "tqTXYs17B0jCYoRD1k" ], [ 17294, "u8", "m1bAMoYntN" ], [ 17309, "u8", "DQFAjJUZQqtOiB1ZiY" ], [ 17328, "u8", "GetWebRequest" ], [ 17342, "u8", "dtWQS1plLJ0TuqJpPB" ], [ 17361, "u8", "ipHHChTSI713hmKbsv" ], [ 17380, "u8", "q2QSnhcm2FYH3XdFV3" ], [ 17399, "u8", "qDuVU1Mcv" ], [ 17409, "u8", "StreamWriter" ], [ 17422, "u8", "Empty" ], [ 17428, "u8", "IsNullOrWhiteSpace" ], [ 17447, "u8", "GetRequestStream" ], [ 17464, "u8", "op_Equality" ], [ 17476, "u8", "get_Response" ], [ 17489, "u8", "C40YCON5f" ], [ 17499, "u8", "HttpWebResponse" ], [ 17515, "u8", "ToString" ], [ 17524, "u8", "W2p0nBu4bjLHgJYKFx" ], [ 17543, "u8", "DateTime" ], [ 17563, "u8", "Oo4paT7NATLcoJjKIq" ], [ 17582, "u8", "set_Proxy" ], [ 17592, "u8", "IWebProxy" ], [ 17602, "u8", "JgK8Vayg3eAJyUJdZZ" ], [ 17621, "u8", "I9hvZRZ4aLUYdYEDji" ], [ 17640, "u8", "sge2FYxUydQlbGvsVN" ], [ 17659, "u8", "lvc3pywRIbZCarXunr" ], [ 17678, "u8", "ffLcRX5uHQC2usbR2Y" ], [ 17697, "u8", "TextWriter" ], [ 17708, "u8", "ARhVPAbUyHjepOlyr4" ], [ 17727, "u8", "nBQtcnh0qCBlTviv4Q" ], [ 17746, "u8", "Int64" ], [ 17752, "u8", "set_ContentLength" ], [ 17770, "u8", "F0C8Ug9qwc4QxsZQb0" ], [ 17789, "u8", "GDIM23Aly1tio2RCQE" ], [ 17808, "u8", "KuC9n6WGsVj1BVoGNG" ], [ 17827, "u8", "OKRY9POcUueNNcCin8" ], [ 17846, "u8", "hPZRKMCBOehjvhTLou" ], [ 17865, "u8", "uISLgSnY6ljutqqFyY" ], [ 17884, "u8", "HttpStatusCode" ], [ 17899, "u8", "get_StatusCode" ], [ 17914, "u8", "huLFQ7ixq" ], [ 17924, "u8", "AppDomain" ], [ 17934, "u8", "fPr4IUQMs" ], [ 17944, "u8", "RaDwxtqOs" ], [ 17961, "u8", "x0l1K3PvkJiUNmAC7e" ], [ 17980, "u8", "LSnEsb9Qh" ], [ 17990, "u8", "YNAr0eh3L" ], [ 18000, "u8", "TTNDgdvKT" ], [ 18010, "u8", "Char" ], [ 18015, "u8", "get_Length" ], [ 18026, "u8", "get_Chars" ], [ 18036, "u8", "Enumerable" ], [ 18047, "u8", "System.Linq" ], [ 18059, "u8", "System.Core" ], [ 18071, "u8", "Range" ], [ 18077, "u8", "IEnumerable`1" ], [ 18091, "u8", "System.Collections.Generic" ], [ 18118, "u8", "IntPtr" ], [ 18125, "u8", "Where" ], [ 18131, "u8", "Select" ], [ 18138, "u8", "ToArray" ], [ 18146, "u8", "IPw05hqjy" ], [ 18156, "u8", "COf3oitarkQ4RCe3UZ" ], [ 18175, "u8", "get_CurrentDomain" ], [ 18193, "u8", "FRDiK5s1Up9oXGBuuP" ], [ 18212, "u8", "kUMcuYg4a02WmbUCq7" ], [ 18231, "u8", "dGeXYJL7hQZAKcbl5H" ], [ 18250, "u8", "Load" ], [ 18255, "u8", "xkyjBGvmb4C14vEroC" ], [ 18274, "u8", "fc2PahF3Bruxij6BbX" ], [ 18293, "u8", "Thread" ], [ 18300, "u8", "System.Threading" ], [ 18317, "u8", "Sleep" ] ], "val": { "file.stem": "cc8e79ce79d0078b6483062f8fc8d187f5fdcf92c9f51db25551a19d22af0a87", "pe.imphash": "f34d5f2d4577ed6d9ceec516c1f5a744", "pe.machine": "i386", "pe.subsystem": "windows_gui", "pe.timestamp": 1605588225, "file.basename": "cc8e79ce79d0078b6483062f8fc8d187f5fdcf92c9f51db25551a19d22af0a87.exe", "pe.image_base": 4194304, "pe.image_size": 1261568, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.version.os": "unknown", "pe.entry_point": 1225598, "pe.headers_size": 512, "pe.version.type": "app", "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.clr.is_il_only": 1, "pe.file_alignment": 512, "pe.image_hash.sha1": "5b27327da8f528f1dfb6f62cf62b05c779fc520f", "pe.version.company": "Don HO don.h@free.fr", "pe.version.comments": "Notepad++ : a free (GNU) source code editor", "pe.image_hash.sha256": "70efe211dc813b80e386f12c56fc6fcd126ba5af3744c106e108a63d1e755def", "pe.image_hash.sha384": "32fa34a9c308c73e35996f1474bbac371d9b2e9ab58471e2c38635a5049fecd6d7bb7d25f1f89df7311bf25fd79735bb", "pe.image_hash.sha512": "a318744dd98ae80687c1bf6699524cb5c85db80ba65e3510fe551b19eeb6829469b1775d9d1d72cf736ac77d9105b8e6c7a1207fe8010378548a829115509143", "pe.resource_types[0]": "RT_ICON", "pe.resource_types[1]": "RT_GROUP_ICON", "pe.resource_types[2]": "RT_VERSION", "pe.resource_types[3]": "RT_MANIFEST", "pe.section_alignment": 8192, "pe.subsystem_version": "4.0", "pe.version.copyright": "Copyleft 1998-2017 by Don HO", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.manifest.ui_access": "false", "pe.characteristics_raw": 270, "pe.clr.runtime_version": "2.5", "pe.version.description": "Notepad++ : a free (GNU) source code editor", "pe.linker_major_version": 11, "pe.version.file_version": "7.8.7.0", "pe.version.product_name": "Notepad++", "pe.version.internal_name": "iykex.exe", "pe.dll_characteristics[0]": "dynamic_base", "pe.dll_characteristics[1]": "nx_compat", "pe.dll_characteristics[2]": "no_seh", "pe.dll_characteristics[3]": "terminal_server_aware", "pe.version.company_offset": 1235672, "pe.data_directories[0].rva": 1225520, "pe.data_directories[1].rva": 1228800, "pe.data_directories[2].rva": 1253376, "pe.data_directories[3].rva": 8192, "pe.data_directories[4].rva": 8200, "pe.dll_characteristics_raw": 34112, "pe.number_of_rva_and_sizes": 16, "pe.version.comments_offset": 1235552, "pe.version.product_version": "7.8.7.0", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 75, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 18704, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 12, "pe.data_directories[3].name": "iat", "pe.data_directories[3].size": 8, "pe.data_directories[4].name": "clr_runtime_header", "pe.data_directories[4].size": 72, "pe.version.copyright_offset": 1235980, "pe.version.original_filename": "iykex.exe", "pe.coff.dos_header_pe_pointer": 128, "pe.version.description_offset": 1235756, "pe.version.file_version_offset": 1235876, "pe.version.product_name_offset": 1236132, "pe.base_relocations.block_count": 1, "pe.base_relocations.entry_count": 1, "pe.version.internal_name_offset": 1235924, "pe.base_relocations.padding_count": 1, "pe.version.product_version_offset": 1236188, "pe.manifest.assembly_identity.name": "MyApplication.app", "pe.version.original_filename_offset": 1236080, "pe.manifest.assembly_identity.version": "1.0.0.0", "pe.manifest.requested_execution_level": "asInvoker" } }, "find": [ { "id": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "conf": 0.800000011920929, "crit": 1, "desc": "Regex component marker" }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "micro-behaviors/communications/http/client/managed::webclient--rx-4", "conf": 0.800000011920929, "crit": 1, "desc": "Regex component marker" }, { "id": "micro-behaviors/communications/http/server/managed::name-value-collection", "conf": 1.0, "crit": 3, "desc": "Usage of NameValueCollection (headers/params)" }, { "id": "micro-behaviors/communications/http/client/managed::getresponse", "conf": 0.7200000286102295, "crit": 3, "desc": "HTTP response retrieval method" }, { "id": "micro-behaviors/communications/http/server/managed::http-response-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Response object" }, { "id": "metadata/build/manifest::pe-manifest-myapplication-template", "conf": 0.8999999761581421, "crit": 3, "desc": "Manifest is MyApplication template name" }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)" }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations" }, { "id": "metadata/package/versioning::pe-product-version-ipv4-shape", "conf": 0.9200000166893005, "crit": 1, "desc": "PE ProductVersion resembles IPv4" }, { "id": "micro-behaviors/data/text/keywords/lexicon::secret", "conf": 0.30000001192092896, "crit": 1, "desc": "secret keyword" }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range" }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field" }, { "id": "metadata/package/versioning::pe-file-version-ipv4-shape", "conf": 0.9200000166893005, "crit": 1, "desc": "PE FileVersion resembles IPv4" }, { "id": "micro-behaviors/communications/http/client/managed::httpwebrequest", "conf": 0.8199999928474426, "crit": 3, "desc": "System.Net.HttpWebRequest class usage" }, { "id": "micro-behaviors/communications/http/client/managed::webclient--rx-6", "conf": 0.800000011920929, "crit": 1, "desc": "Regex component marker" }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure" }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field" }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)" } ], "path": "cc8e79ce79d0078b6483062f8fc8d187f5fdcf92c9f51db25551a19d22af0a87.exe", "risk": 3, "size": 1237504, "type": "pe" } ] } }