{
  "ml": {
    "v": "7",
    "eng": "2.3.0-beta.1",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.03963554,
        "rte": "az",
        "prob": 0.03963554
      },
      {
        "cls": 0,
        "raw": 0.22333097,
        "rte": "az/nupkg",
        "prob": 0.22333097
      }
    ],
    "prob": 0.03963554,
    "skip": [
      {
        "rte": "az/zip",
        "why": "unavailable"
      },
      {
        "rte": "az/zip",
        "why": "unavailable"
      }
    ],
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.039635539054870605,
        "type": "nupkg"
      },
      {
        "id": 1,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00012001395225524902,
        "type": "xml"
      },
      {
        "id": 2,
        "lvl": -1,
        "conf": 0,
        "prob": 0.01702636480331421,
        "type": "xml"
      },
      {
        "id": 3,
        "lvl": -1,
        "conf": 0,
        "prob": 0.0002447366714477539,
        "type": "markdown"
      },
      {
        "id": 4,
        "lvl": -1,
        "conf": 0,
        "prob": 0.025415927171707153,
        "type": "pe"
      },
      {
        "id": 5,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000033408403396606445,
        "type": "xml"
      },
      {
        "id": 6,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000033408403396606445,
        "type": "xml"
      },
      {
        "id": 7,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00012001395225524902,
        "type": "xml"
      },
      {
        "id": 8,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00022560358047485352,
        "type": "registry"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-07-10T16:12:57Z"
  },
  "path": "Strawhats.Framework.Cqrs.Abstractions.0.5.0.nupkg",
  "raw": {
    "files": [
      {
        "id": 0,
        "mol": "H₂(Db₂F)",
        "sha": "d54b690d6f06dbdaaa00b07b32fd78498fa1206d8a7efc875e1fe1342b305459",
        "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Strawhats.Framework.Cqrs.Abstractions/Strawhats.Framework.Cqrs.Abstractions.0.5.0.nupkg",
        "risk": 4,
        "size": 27716,
        "type": "nupkg",
        "facts": {
          "metrics": {
            "file": {
              "size": 27716.0,
              "entropy": 7.87,
              "size_bytes": 27716.0
            },
            "binary": {
              "overall_entropy": 7.87,
              "peak_region_bytes": 24576.0,
              "peak_region_entropy": 7.8
            },
            "archive": {
              "file_count": 8.0,
              "member_count": 8.0,
              "script_count": 0.0,
              "zip_bomb_ratio": 6.1,
              "directory_count": 0.0,
              "executable_count": 1.0,
              "extra_field_size": 0.0,
              "noise_file_count": 0.0,
              "total_compressed": 26558.0,
              "compression.ratio": 0.54,
              "hidden_file_count": 2.0,
              "total_uncompressed": 49292.0,
              "crc_collision_count": 0.0,
              "entry_comment_count": 0.0,
              "max_filename_length": 81.0,
              "rtlo_filename_count": 0.0,
              "format.regular_count": 8.0,
              "nested_archive_count": 0.0,
              "path_traversal_count": 0.0,
              "symlink_escape_count": 0.0,
              "security.setgid_count": 0.0,
              "security.setuid_count": 0.0,
              "security.sticky_count": 0.0,
              "double_extension_count": 0.0,
              "duplicate_member_count": 0.0,
              "security.symlink_count": 0.0,
              "unicode_filename_count": 0.0,
              "homoglyph_filename_count": 0.0,
              "security.encrypted_count": 0.0,
              "timing.mtime_unique_count": 4.0,
              "timing.mtime_unique_ratio": 0.5,
              "misplaced_executable_count": 1.0,
              "timing.mtime_dominant_count": 4.0,
              "timing.mtime_spread_seconds": 25122.0,
              "timing.sentinel_mtime_count": 0.0,
              "security.world_writable_count": 0.0,
              "timing.mtime_dominant_fraction": 0.5,
              "compression.method_counts.stored": 1.0,
              "compression.method_counts.deflate": 7.0
            }
          }
        },
        "ident": {
          "name": {
            "value": "Strawhats.Framework.Cqrs.Abstractions",
            "source": "nupkg.title",
            "verified": false
          },
          "urls": [
            {
              "url": "https://github.com/muharremkackin/Strawhats.Framework",
              "kind": "homepage",
              "source": "nupkg.project_url"
            },
            {
              "url": "https://github.com/muharremkackin/Strawhats.Framework",
              "kind": "repository",
              "source": "nupkg.repository_url"
            }
          ],
          "trust": "unsigned",
          "authors": [
            {
              "name": "Muharrem Kaçkın",
              "role": "author",
              "source": "nupkg.authors"
            }
          ],
          "version": {
            "value": "0.5.0",
            "source": "nupkg.version",
            "verified": false
          },
          "identifier": {
            "value": "Strawhats.Framework.Cqrs.Abstractions",
            "source": "nupkg.id",
            "verified": false
          }
        },
        "traits": [
          {
            "id": "metadata/binary/framework::clr-runtime-header",
            "conf": 1.0,
            "crit": 2,
            "desc": "PE CLR runtime header present (COM descriptor)"
          },
          {
            "id": "micro-behaviors/communications/http/oauth::oauth-protocol-reference",
            "crit": 3,
            "desc": "OAuth protocol reference",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "metadata/package/versioning::pe-fileversion-field",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "PE FileVersion metadata field",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/data/string/library::dotnet-stringbuilder-append",
            "conf": 0.8199999928474426,
            "crit": 3,
            "desc": ".NET StringBuilder Append use",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "metadata/package/versioning::pe-version-resource",
            "conf": 0.800000011920929,
            "crit": 2,
            "desc": "PE version resource structure",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/path/extension::dll-dup",
            "crit": 2,
            "desc": ".dll extension reference",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "metadata/binary/framework::dotnet-assembly",
            "conf": 1.0,
            "crit": 2,
            "desc": ".NET Assembly (mscoree.dll)",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/path/application/config::agent-instruction-file",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "References AI agent instruction file",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "metadata/package/versioning::pe-productversion-field",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "PE ProductVersion metadata field",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "metadata/binary/framework::dotnet-metadata",
            "conf": 1.0,
            "crit": 2,
            "desc": ".NET Metadata Root (BSJB)",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal",
            "conf": 0.699999988079071,
            "crit": 1,
            "desc": ".NET code entropy in unpacked range",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/data/db/linq::linq-queries",
            "conf": 0.699999988079071,
            "crit": 3,
            "desc": "LINQ query operations",
            "from": [
              {
                "file": 4
              }
            ]
          }
        ]
      },
      {
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 527.0,
              "entropy": 5.18,
              "size_bytes": 527.0
            },
            "binary": {
              "overall_entropy": 5.18,
              "peak_region_bytes": 527.0,
              "peak_region_entropy": 5.18
            }
          }
        },
        "id": 1,
        "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Strawhats.Framework.Cqrs.Abstractions/Strawhats.Framework.Cqrs.Abstractions.0.5.0.nupkg!!_rels/.rels",
        "pid": 0,
        "sha": "1d93f1e20c86ad4d6667e47292c755c11f65130747fd3a4aa018ff1da6ac3f0b",
        "size": 527,
        "type": "xml"
      },
      {
        "ctx": [
          {
            "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj]",
            "n": [
              {
                "c": 2,
                "d": "NuGet nuspec manifest file",
                "i": "metadata/build/manifest::nuspec-file",
                "o": 0,
                "z": 44,
                "cf": 0.9800000190734863
              }
            ],
            "ln": 1,
            "addr": 0
          },
          {
            "b": "jAa.syHH\u003c!aB4:tzGv@+xMOuniXJdcv}YB\u003cvrj5rx\u003e8g4B8LVje[n*pfk$ufyHH\u003c\u0026zF7QTfFLvpfF$I3B-RIkv\u003eJ1EwfKh",
            "ln": 2,
            "addr": 42
          },
          {
            "b": "arS^-wPRu\u003evrt{w",
            "ln": 3,
            "addr": 118
          },
          {
            "b": "arR^Hjy-qGD2^RixMMB9z/x#xx\u003eIa3aI$92o)7bTA=L-dawldXR!:kQzAGNZz/x#xx\u003eIa3j]",
            "ln": 12,
            "addr": 737
          },
          {
            "b": "arR^HjAL1AB3sU!A::f9vruMkw].r%wP@6kyANbbA=Svky?m3)eN-WfxLzN1v@#\u003clwGUI]wiqI!vp%TB",
            "ln": 13,
            "addr": 795
          },
          {
            "b": "arR^HjAt1Lz/YSmz/QaCBA}?pjTaJMBrR\u0026IA+)(.xMOunB2\u003e%cxk8E3BZ=$kz/4dAB.Ci7A+f96vpK7!zza}gA::f9vruMymSI{OwP@6kyA:)hz/6u9BuH*8hA0DMhz^iAvp?l7h8mfIwm^Sei5C53ixeYHf/p*Dgb7ywiwAumatk[",
            "n": [
              {
                "c": 2,
                "d": "NuGet package declares repository",
                "i": "metadata/package/files/nuget::nuspec-repository",
                "o": 864,
                "z": 90,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 14,
            "addr": 860
          },
          {
            "b": "arR^Hjy\u00262xwO#3\u0026zEWx(B3o",
            "n": [
              {
                "c": 2,
                "d": "NuGet package declares dependencies",
                "i": "metadata/package/files/nuget::nuspec-dependencies",
                "o": 1004,
                "z": 74,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 15,
            "addr": 1000
          },
          {
            "b": "arR^HarS^VA=l8taAR4jxjVfOA:-/@Cw?IqjTa=PBtkE4fD@W",
            "ln": 16,
            "addr": 1019
          },
          {
            "b": "arR^HarR^Hjy\u00262xwO#3\u0026zEW@mx\u003efvJo\u003e!9Tz/Y\u0026eBs{1bBy/uhx(v)ge\u003c%n\u0026wO#3\u0026zEW@-zFA-)BzkVhe\u003cS@/BAg/1BzkVhB0q-IwPz\u003caz/dYZf!+jle\u0026+9#wQ4Z3B.25Db0{A^y?b7.zEEvbDs.bra%nK5",
            "ln": 17,
            "addr": 1059
          }
        ],
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 1243.0,
              "entropy": 5.2,
              "size_bytes": 1243.0
            },
            "binary": {
              "overall_entropy": 5.2,
              "peak_region_bytes": 1243.0,
              "peak_region_entropy": 5.21
            }
          }
        },
        "id": 2,
        "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Strawhats.Framework.Cqrs.Abstractions/Strawhats.Framework.Cqrs.Abstractions.0.5.0.nupkg!!Strawhats.Framework.Cqrs.Abstractions.nuspec",
        "pid": 0,
        "risk": 1,
        "sha": "4fff6c1c716eddf86ee682d24a187163c96553b9243e2c54a9151c28ace1a7ec",
        "size": 1243,
        "traits": [
          {
            "id": "metadata/package/files/nuget::nuspec-dependencies",
            "conf": 0.8999999761581421,
            "crit": 2,
            "desc": "NuGet package declares dependencies",
            "spans": [
              [
                1004,
                74
              ]
            ]
          },
          {
            "id": "metadata/build/manifest::nuspec-file",
            "conf": 0.9800000190734863,
            "crit": 2,
            "desc": "NuGet nuspec manifest file",
            "spans": [
              [
                0,
                44
              ]
            ]
          },
          {
            "id": "metadata/package/files/nuget::nuspec-repository",
            "conf": 0.8999999761581421,
            "crit": 2,
            "desc": "NuGet package declares repository",
            "spans": [
              [
                864,
                90
              ]
            ]
          }
        ],
        "type": "xml"
      },
      {
        "ctx": [
          {
            "b": "B75J]wH[@\u0026nIaB\u003cwnb{]eOo3qwO#3{C{1N^e(1\u0026matCM1dJ\u0026tzvqPO1z/PRow]zYjvS=y3wnb{]awUpCBz8!9B-.qdzGGP5vruj4zxK1iA=#2mB1vVnx\u003e8g4B7Gxnx\u003e7Z}efF!FzF%u9Bzb.DayPd#ax8YSqY{dbB97#gB1OObBrC4nzE^M{B0a)lxKL^?ePL=Cy?mc1lS3-Way]hcAa9\u0026#xK#inaA?gfx\u003egT]x(v(u3s^HOxLzu%efF[yA=U@oBy/u1wGSywwPhNe",
            "ln": 28,
            "col": 6,
            "line": 3
          },
          {
            "b": "v}W0axLzB8wN(](B0a)lw]zg4B7F(8pix6rBrCKhv@2H=wIaq%j%igmx(4(lCwhejavx%RvqWhNA:@=%By!%7B-I4AavGagefFwswfs/DoI4R{BzbYkB.txaB-YkUl$HsGzE^r@v}/H}aAhmkzGE1nzG/Jfwft/dy\u003cvSu3l{=rp*)\u003cHvp%d)3jojg",
            "ln": 358,
            "col": 41,
            "line": 6
          },
          {
            "b": "zE^/qaBBJzayFb\u0026A::f9vruMymSI{OwP@6kyC5g?wO#Q7BA}mpD(#BgwPxCAz!@#rv@bN/z6iXlwmYNdaw+x$l}e{OAa9*eCw?Ijazth8xLzu%aBBJzayFb\u0026A::f9vruMymSI{OwP@6kyC4[}Bzbl6Bzkk[BzkVhu)6?tn([$mx(!urvqYN^flQ=ux\u003egT]x(v(uawUpCBz9A.pF0@waAhvnze19aC4C.qD\u003cUlzu@Ie/vrVx[BAo67A:-/@",
            "ln": 1908,
            "col": 113,
            "line": 27
          },
          {
            "b": "ay/7@v@3cdc$2tKwkuVQwPz%5vRGT)BA}myaBBI6bo[sdB.Lu3aAITkA=.S}u%)wKvrl8?wn=NcwPP57B.LV5ax9x5vrVx[BAo67A:-/@Cw?Iqe]$\u0026DCPXaKarR)KvS=y3wftDbwPA6rxLzu%3s[6%zE)]jBy/JnarTQ8A::f9vruMymSI{OwP@6kyC6V",
            "ln": 2305,
            "col": 84,
            "line": 31
          },
          {
            "b": "wn+%[wPw]6z/6DiB7DFpA3c.:vS=y3wfr0qarR^HarR^HarR^HarR)KA=(mxBzbkdA+e\u0026]A+fb#wGUA2A3cMIwN##{z!0\u0026wqDlE!nLR=dzdC75u%)vH3rgXIayD\u003czA:@G1Ab](iwN/?6ayPq4ayMxxdRAsgwPzG{aAz49wPzv1v}u=\u003eAbYScv{%D",
            "ln": 2512,
            "col": 1,
            "line": 38
          },
          {
            "b": "v}fC1zGE1wwOkZ#BAg/ix(v(i\u0026!AQsy\u0026r%2zxN}[K%1%Wy?4y2wEro.x(2jvBzb98aAhvtC4C.qBzbkdw].r%wP@6kyANhawft#jaz2C3aMv{oaAIa9ax@k:z!0\u0026wqDlE!nLR=dzdE3Wc$)ZAAc15[fk20vxMW=pv@DiqzfoJ2A=L-dyHHZ*x(kO5BAg/lxKM17e\u003ef\u003e\u0026zdN{fA+^sqy\u0026r=ozddc@fjY0hB1ZA\u003epejwQm\u003eOT?dj#-mBrCpsas.nEBsFzwzvff9B-.pLfhCeclM*CYA=#2mj0nSUvrrSaB0a)lwmYp=v{%E\u003cwftr1A3fmFAaHe2",
            "ln": 2667,
            "col": 63,
            "line": 41
          }
        ],
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 3890,
              "entropy": 5.17
            },
            "text": {
              "lines": 55,
              "top_char": 101,
              "max_ws_run": 17,
              "digit_ratio": 0,
              "space_count": 360,
              "char_entropy": 5.17,
              "unique_chars": 78,
              "top_char_null": 0,
              "top_char_ratio": 0.07,
              "avg_line_length": 69.73,
              "max_line_length": 187,
              "non_ascii_ratio": 0.01,
              "empty_line_ratio": 0.22,
              "last_line_length": 113,
              "long_token_count": 3,
              "whitespace_ratio": 0.11,
              "line_length_stddev": 55.55,
              "repeated_char_sequences": 1
            },
            "binary": {
              "peak_region_bytes": 3890,
              "peak_region_entropy": 5.23
            }
          }
        },
        "id": 3,
        "mol": "H₂(CmCr)",
        "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Strawhats.Framework.Cqrs.Abstractions/Strawhats.Framework.Cqrs.Abstractions.0.5.0.nupkg!!README.md",
        "pid": 0,
        "risk": 2,
        "sha": "1522fa69fd8b1de973f9e336ac921b96d07c1f3289bfb06530cae6856f92771c",
        "size": 3890,
        "traits": [
          {
            "id": "metadata/lang/natural::lang-english--atom-1",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"the\"",
            "spans": [
              [
                2560,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-2",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"and\"",
            "spans": [
              [
                145,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-3",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"that\"",
            "spans": [
              [
                2715,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-5",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"for\"",
            "spans": [
              [
                76,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-6",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"with\"",
            "spans": [
              [
                406,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url",
            "conf": 0.9,
            "crit": 3,
            "desc": "References a public code-forge URL",
            "spans": [
              [
                2780,
                19
              ]
            ]
          },
          {
            "id": "micro-behaviors/crypto/kdf/algorithm::pbkdf2",
            "conf": 0.75,
            "crit": 3,
            "desc": "PBKDF2 key-derivation reference",
            "spans": [
              [
                1972,
                8
              ]
            ]
          }
        ],
        "type": "markdown"
      },
      {
        "ctx": [
          {
            "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J+",
            "n": [
              {
                "c": 3,
                "d": "HTTP fingerprinting evasion campaign",
                "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign",
                "o": 0,
                "z": 34,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 0
          },
          {
            "b": "00000000000000000000mQb][00000nb@R\u00260SSx7fF0h7@4m%H0rr91000000000000",
            "n": [
              {
                "c": 1,
                "d": "PE standard code/data section",
                "i": "metadata/binary/section/names::pe-code-data-standard-section",
                "o": 512,
                "z": 5,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 496
          },
          {
            "b": "huFnA000udd5u[z3mV2Qlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn",
            "n": [
              {
                "c": 3,
                "d": "Recognized PE anti-analysis marker",
                "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker",
                "o": 3632,
                "z": 4,
                "cf": 1.0
              }
            ],
            "ln": 3616
          },
          {
            "b": "y*?B1z/eD:ADL\u0026lBy!$.q!o\u0026S06$NywO#2UzdN*5z!5\u0026XwPRoJB4Hm\u003ewPzx\u003ev}tTg",
            "n": [
              {
                "c": 1,
                "d": ".NET Socket Send/Receive methods (Send)",
                "i": "micro-behaviors/communications/socket/create::socket-receive-send-str--send",
                "o": 10019,
                "z": 4,
                "cf": 0.800000011920929
              }
            ],
            "ln": 10003
          },
          {
            "b": "ADlaMl1j[SA:-E1x(v)ge[w^m090SLz*a=+piyw?0b2\u003e+uRbuJz2^HWB97#g07ggj",
            "n": [
              {
                "c": 3,
                "d": "References Windows executable or script",
                "i": "objectives/execution/interpreter/script/shell::windows-executable-ref",
                "o": 11202,
                "z": 4,
                "cf": 0.6000000238418579
              }
            ],
            "ln": 11186
          },
          {
            "b": "zE^r@v%HT-ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9mbwPz%dv}w2Cy\u00260V)BzkVh0b2\u003e+uRbrewO#71x-",
            "n": [
              {
                "c": 2,
                "d": "Benign high-entropy PE context",
                "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context",
                "o": 11353,
                "z": 17,
                "cf": 0.949999988079071
              }
            ],
            "ln": 11337
          },
          {
            "b": "x(v(Sx(!l4ByO#QzF0!!q*ACawO\u003c4[x(m[\u003cnMfhvC4\u003eC$p\u0026ZF$x\u003eg^}0cqZ(C4\u003eC$p\u0026ZF$x\u003eg=",
            "n": [
              {
                "c": 3,
                "d": "LINQ query operations",
                "i": "micro-behaviors/data/db/linq::linq-queries",
                "o": 11564,
                "z": 11,
                "cf": 0.699999988079071
              }
            ],
            "ln": 11548
          },
          {
            "b": "B8aGYBzbP6luN0UwmY=Yq/)4]zF8pUx(4r\u003eASwi=Byex:B.LV5wPv=xq!o\u0026SwPv=xp\u003c3k-x(^%0AS",
            "n": [
              {
                "c": 3,
                "d": ".NET StringBuilder Append use",
                "i": "micro-behaviors/data/string/library::dotnet-stringbuilder-append",
                "o": 11632,
                "z": 13,
                "cf": 0.8199999928474426
              }
            ],
            "ln": 11616
          },
          {
            "b": "0rrv5wO+{^B7CsKblm==lVl{?A+Pf1BrFD1awD#(vrcy1z6hFW.(4p*V2fKwFz{OfFzs7BAS",
            "n": [
              {
                "c": 2,
                "d": "Copyright notice",
                "i": "metadata/package/license::copyright-word",
                "o": 14856,
                "z": 9,
                "cf": 0.6000000238418579
              }
            ],
            "ln": 14840
          },
          {
            "b": "f!:.ZA:-/@Cw?IqazbLjawUpCBz8!9B-.qdzGGP5vruj4zxK1iA=#2mB1wCJx\u003e8g4A@",
            "n": [
              {
                "c": 3,
                "d": "OAuth token and endpoint markers",
                "i": "micro-behaviors/communications/http/oauth::oauth",
                "o": 14997,
                "z": 5,
                "cf": 0.6600000262260437
              }
            ],
            "ln": 14981
          },
          {
            "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000",
            "n": [
              {
                "c": 1,
                "d": "PE resource section",
                "i": "metadata/binary/section/names::pe-resource-section",
                "o": 16384,
                "z": 5,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 16368
          },
          {
            "b": "0000000000005w\u0026gYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rro60000",
            "n": [
              {
                "c": 3,
                "d": "Recognized marker for timing checks",
                "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker",
                "o": 16478,
                "z": 15,
                "cf": 0.949999988079071
              }
            ],
            "ln": 16462
          },
          {
            "b": "A@WS?e=U\u003eK001?Q3ig8blJz38z2!IPve$fBC(QOtve$cAwDhYg002{$Bo3sYve$GKxAhDvBo3vZ003yb8#{0tmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002W)x-IPxASxIFASx!",
            "n": [
              {
                "c": 2,
                "d": "PE CompanyName metadata field",
                "i": "metadata/package/versioning::pe-companyname-field",
                "o": 17162,
                "z": 11,
                "cf": 0.699999988079071
              },
              {
                "c": 2,
                "d": "PE FileDescription metadata field",
                "i": "metadata/package/versioning::pe-filedescription-field",
                "o": 17214,
                "z": 15,
                "cf": 0.699999988079071
              }
            ],
            "ln": 17146
          },
          {
            "b": "x-J5Kzua.T001XM2MK(9mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001XMe=W:ee=WN9e=WN9003ybaohAxnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002W)x-IPxASxIFASx!NwDl=K",
            "n": [
              {
                "c": 3,
                "d": "Dotted-quad PE version metadata marker",
                "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker",
                "o": 17310,
                "z": 11,
                "cf": 0.9399999976158142
              },
              {
                "c": 2,
                "d": "PE InternalName metadata field",
                "i": "metadata/package/versioning::pe-internalname-field",
                "o": 17358,
                "z": 12,
                "cf": 0.699999988079071
              }
            ],
            "ln": 17294
          },
          {
            "b": "\u003ekYn$f-=d(003WjaohAxpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002W)x-IPxASxIFASx!N",
            "n": [
              {
                "c": 2,
                "d": "PE OriginalFilename metadata field",
                "i": "metadata/package/versioning::pe-originalfilename-field",
                "o": 17546,
                "z": 16,
                "cf": 0.699999988079071
              }
            ],
            "ln": 17530
          },
          {
            "b": "e=YzZyYFnK002K\u00266AwdlpYLIozVBqFBPt[KBo25ove$cAwDhYg002{$Bo3sYve$GKxAhDvBo3v",
            "n": [
              {
                "c": 2,
                "d": "PE ProductName metadata field",
                "i": "metadata/package/versioning::pe-productname-field",
                "o": 17650,
                "z": 11,
                "cf": 0.699999988079071
              }
            ],
            "ln": 17634
          },
          {
            "b": "Ck#KYASx\u003eP004PJf8#1MpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001XMe=W:ee=WN9d/.yahukSnhukYphukMlgxocfve%)tf-UX-h2]xiirg@qwb{iwgxp$^h#\u003e=nve@d+irh2sfAr{ff-T6hh2]Jm",
            "n": [
              {
                "c": 2,
                "d": "PE ProductVersion has SemVer git hash",
                "i": "metadata/package/versioning::pe-productversion-semver-git-hash",
                "o": 17752,
                "z": 46,
                "cf": 0.8999999761581421
              },
              {
                "c": 2,
                "d": "PE version resource metadata",
                "i": "metadata/package/versioning::version-resource-metadata",
                "o": 17722,
                "z": 14,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 17706
          },
          {
            "b": "0000000000000000000008JT}3\u0026*ncxGMm{000000000000000000000000000000000",
            "n": [
              {
                "c": 2,
                "d": "PE .reloc section presence",
                "i": "metadata/binary/section/names::reloc-section-presence",
                "o": 17920,
                "z": 6,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 17904
          }
        ],
        "depth": 1,
        "facts": {
          "imp": [
            [
              "mscoree",
              "CorDllMain"
            ]
          ],
          "sec": [
            [
              ".text",
              512,
              15872,
              5.79,
              "r-x"
            ],
            [
              ".rsrc",
              16384,
              1536,
              3.41,
              "r--"
            ],
            [
              ".reloc",
              17920,
              512,
              0.08,
              "r--"
            ]
          ],
          "metrics": {
            "pe": {
              "checksum": 0.0,
              "checksum_valid": 0.0,
              "resource_count": 1.0,
              "has_version_info": 1.0,
              "checksum_stripped": 1.0,
              "computed_checksum": 30082.0,
              "reloc_overhang_bytes": 500.0,
              "reloc_overhang_ratio": 0.98,
              "bss_like_section_count": 0.0,
              "section_overflow_count": 0.0,
              "misaligned_section_count": 0.0,
              "version.identity_entropy": 3.98,
              "base_relocation_block_count": 1.0,
              "base_relocation_entry_count": 1.0,
              "version.identity_symbol_ratio": 0.05
            },
            "file": {
              "size": 18432.0,
              "entropy": 5.48,
              "size_bytes": 18432.0
            },
            "binary": {
              "is_pie": 1.0,
              "code_entropy": 5.79,
              "string_count": 242.0,
              "overall_entropy": 5.48,
              "entropy_variance": 5.48,
              "avg_string_length": 19.22,
              "max_string_length": 220.0,
              "peak_region_bytes": 2048.0,
              "code_to_data_ratio": 1.0,
              "peak_region_entropy": 5.94,
              "string_length_stddev": 21.73,
              "largest_section_ratio": 0.86,
              "sentence_string_count": 5.0,
              "sentence_string_ratio": 0.02,
              "high_entropy_string_count": 0.0
            },
            "imports": {
              "count": 1.0
            },
            "sections": {
              "count": 3.0,
              "code_size": 15872.0,
              "entropy_max": 5.79,
              "entropy_mean": 3.09,
              "name_entropy": 3.03,
              "writable_count": 0.0,
              "executable_count": 1.0,
              "nonstandard_count": 0.0,
              "executable_writable_count": 0.0
            },
            "dependencies": {
              "count": 1.0
            }
          }
        },
        "id": 4,
        "mol": "H(Db₂)",
        "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Strawhats.Framework.Cqrs.Abstractions/Strawhats.Framework.Cqrs.Abstractions.0.5.0.nupkg!!lib/net10.0/Libraries.Cqrs.Abstractions.dll",
        "pid": 0,
        "risk": 3,
        "sha": "473c1cdc5380f66c7eb7d5bea14a3548f0dc1f75f0279b3a5db3e4991594b410",
        "size": 18432,
        "traits": [
          {
            "id": "metadata/package/versioning::pe-version-resource",
            "conf": 0.800000011920929,
            "crit": 2,
            "desc": "PE version resource structure",
            "spans": [
              [
                16478,
                15
              ]
            ]
          },
          {
            "id": "metadata/binary/framework::clr-runtime-header",
            "conf": 1.0,
            "crit": 2,
            "desc": "PE CLR runtime header present (COM descriptor)"
          },
          {
            "id": "metadata/package/versioning::pe-fileversion-field",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "PE FileVersion metadata field",
            "spans": [
              [
                17310,
                11
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/string/library::dotnet-stringbuilder-append",
            "conf": 0.8199999928474426,
            "crit": 3,
            "desc": ".NET StringBuilder Append use",
            "spans": [
              [
                11632,
                13
              ]
            ]
          },
          {
            "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal",
            "conf": 0.699999988079071,
            "crit": 1,
            "desc": ".NET code entropy in unpacked range",
            "spans": [
              [
                0,
                26
              ]
            ]
          },
          {
            "id": "metadata/binary/framework::dotnet-metadata",
            "conf": 1.0,
            "crit": 2,
            "desc": ".NET Metadata Root (BSJB)",
            "spans": [
              [
                3632,
                4
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/db/linq::linq-queries",
            "conf": 0.699999988079071,
            "crit": 3,
            "desc": "LINQ query operations",
            "spans": [
              [
                11564,
                11
              ]
            ]
          },
          {
            "id": "metadata/package/versioning::pe-productversion-field",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "PE ProductVersion metadata field",
            "spans": [
              [
                17722,
                14
              ]
            ]
          },
          {
            "id": "micro-behaviors/fs/path/extension::dll-dup",
            "crit": 2,
            "desc": ".dll extension reference",
            "spans": [
              [
                11202,
                4
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/http/oauth::oauth-protocol-reference",
            "crit": 3,
            "desc": "OAuth protocol reference",
            "spans": [
              [
                14997,
                5
              ]
            ]
          },
          {
            "id": "metadata/binary/framework::dotnet-assembly",
            "conf": 1.0,
            "crit": 2,
            "desc": ".NET Assembly (mscoree.dll)",
            "spans": [
              [
                3632,
                4
              ]
            ]
          }
        ],
        "type": "pe"
      },
      {
        "id": 5,
        "sha": "a51b05e01e0607cce1a43c921ae53be000e52a8a518a92e8e22f77b717c7c8c4",
        "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Strawhats.Framework.Cqrs.Abstractions/Strawhats.Framework.Cqrs.Abstractions.0.5.0.nupkg!!lib/net10.0/Libraries.Cqrs.Abstractions.xml",
        "size": 10740,
        "type": "xml",
        "depth": 1
      },
      {
        "id": 6,
        "sha": "70b483c5066b0f062f2102cd8f0c4b2fde9e919b5a9204689dd67e64b0cc518e",
        "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Strawhats.Framework.Cqrs.Abstractions/Strawhats.Framework.Cqrs.Abstractions.0.5.0.nupkg!![Content_Types].xml",
        "size": 582,
        "type": "xml",
        "depth": 1
      },
      {
        "id": 7,
        "sha": "ff0d15d16f6cf86a71a5fbf1ee6d529d127a7e1eae798835b1bc1cc979f1f752",
        "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Strawhats.Framework.Cqrs.Abstractions/Strawhats.Framework.Cqrs.Abstractions.0.5.0.nupkg!!package/services/metadata/core-properties/7f7ee5e21fda424fadf9a6b0887a0cbd.psmdcp",
        "size": 890,
        "type": "xml",
        "depth": 1
      },
      {
        "id": 8,
        "mol": "Md",
        "sha": "b46f0f2858a6d3ea7ab5f81ce0e2f7b541c03ed47d84f4ab8689ac5a194a4b18",
        "path": "Strawhats.Framework.Cqrs.Abstractions@0.5.0.registry.json",
        "risk": 1,
        "size": 1145,
        "type": "registry",
        "depth": 1
      }
    ],
    "omitted_files": 4,
    "rev": "b8372",
    "v": "8"
  }
}