{
  "llm": {
    "conf": 0.86549485,
    "grade": "benign",
    "model": "Qwen/Qwen3.6-27B",
    "outcome": "benign",
    "interpretation": "Legitimate .NET plugin assembly"
  },
  "ml": {
    "v": "7",
    "eng": "2.3.0-beta.0",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.80784976,
        "rte": "az",
        "prob": 0.80784976
      }
    ],
    "prob": 0.80784976,
    "skip": [
      {
        "rte": "az/zip",
        "why": "unavailable"
      },
      {
        "rte": "az/zip",
        "why": "unavailable"
      }
    ],
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.8078497648239136,
        "type": "nupkg"
      },
      {
        "id": 1,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00012001395225524902,
        "type": "xml"
      },
      {
        "id": 2,
        "lvl": -1,
        "conf": 0,
        "prob": 0.012280523777008057,
        "type": "xml"
      },
      {
        "id": 3,
        "lvl": -1,
        "conf": 0,
        "prob": 0.007709085941314697,
        "type": "markdown"
      },
      {
        "id": 4,
        "lvl": -1,
        "conf": 0,
        "prob": 0.008222907781600952,
        "type": "markdown"
      },
      {
        "id": 5,
        "lvl": -1,
        "conf": 0,
        "prob": 0.6386661529541016,
        "type": "pe"
      },
      {
        "id": 6,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000033408403396606445,
        "type": "xml"
      },
      {
        "id": 7,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00012001395225524902,
        "type": "xml"
      },
      {
        "id": 8,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000033408403396606445,
        "type": "registry"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-07-07T08:16:01Z"
  },
  "path": "TestIT.Adapter.SpecFlowPlugin.2.2.0-TMS-5.8.nupkg",
  "raw": {
    "files": [
      {
        "id": 0,
        "mol": "O(Al)H(Db)",
        "sha": "e8b3a338569a94d38b98f68106c6ac13976f6fd0fdb97828c00b31719d148447",
        "path": "TestIT.Adapter.SpecFlowPlugin.2.2.0-TMS-5.8.nupkg",
        "risk": 3,
        "size": 32363,
        "type": "nupkg",
        "facts": {
          "metrics": {
            "file": {
              "size": 32363.0,
              "entropy": 7.91,
              "size_bytes": 32363.0
            },
            "binary": {
              "overall_entropy": 7.91,
              "peak_region_bytes": 29696.0,
              "peak_region_entropy": 7.8
            },
            "archive": {
              "file_count": 8.0,
              "member_count": 8.0,
              "script_count": 0.0,
              "zip_bomb_ratio": 3.75,
              "directory_count": 0.0,
              "executable_count": 1.0,
              "extra_field_size": 0.0,
              "noise_file_count": 0.0,
              "total_compressed": 31275.0,
              "compression.ratio": 0.53,
              "hidden_file_count": 2.0,
              "total_uncompressed": 59068.0,
              "crc_collision_count": 0.0,
              "entry_comment_count": 0.0,
              "max_filename_length": 81.0,
              "rtlo_filename_count": 0.0,
              "format.regular_count": 8.0,
              "nested_archive_count": 0.0,
              "path_traversal_count": 0.0,
              "symlink_escape_count": 0.0,
              "security.setgid_count": 0.0,
              "security.setuid_count": 0.0,
              "security.sticky_count": 0.0,
              "double_extension_count": 0.0,
              "duplicate_member_count": 0.0,
              "security.symlink_count": 0.0,
              "unicode_filename_count": 0.0,
              "homoglyph_filename_count": 0.0,
              "security.encrypted_count": 0.0,
              "timing.mtime_unique_count": 4.0,
              "timing.mtime_unique_ratio": 0.5,
              "misplaced_executable_count": 1.0,
              "timing.mtime_dominant_count": 4.0,
              "timing.mtime_spread_seconds": 25158.0,
              "timing.sentinel_mtime_count": 0.0,
              "security.world_writable_count": 0.0,
              "timing.mtime_dominant_fraction": 0.5,
              "compression.method_counts.stored": 1.0,
              "compression.method_counts.deflate": 7.0
            }
          }
        },
        "ident": {
          "name": {
            "value": "Test IT SpecFlow adapter",
            "source": "nupkg.title",
            "verified": false
          },
          "urls": [
            {
              "url": "https://testit.software/",
              "kind": "homepage",
              "source": "nupkg.project_url"
            },
            {
              "url": "https://github.com/testit-tms/adapters-dotnet",
              "kind": "repository",
              "source": "nupkg.repository_url"
            }
          ],
          "trust": "unsigned",
          "authors": [
            {
              "name": "Integration team",
              "role": "author",
              "source": "nupkg.authors"
            }
          ],
          "version": {
            "value": "2.2.0-TMS-5.8",
            "source": "nupkg.version",
            "verified": false
          },
          "identifier": {
            "value": "TestIT.Adapter.SpecFlowPlugin",
            "source": "nupkg.id",
            "verified": false
          }
        },
        "traits": [
          {
            "id": "metadata/binary/framework::dotnet-metadata",
            "conf": 1.0,
            "crit": 2,
            "desc": ".NET Metadata Root (BSJB)",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal",
            "conf": 0.699999988079071,
            "crit": 1,
            "desc": ".NET code entropy in unpacked range",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "metadata/package/versioning::pe-productversion-field",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "PE ProductVersion metadata field",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref",
            "conf": 1.0,
            "crit": 3,
            "desc": "JSON polymorphism runtime marker",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "micro-behaviors/data/db/linq::linq-queries",
            "conf": 0.699999988079071,
            "crit": 3,
            "desc": "LINQ query operations",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "metadata/package/versioning::pe-version-resource",
            "conf": 0.800000011920929,
            "crit": 2,
            "desc": "PE version resource structure",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "metadata/package/versioning::pe-fileversion-field",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "PE FileVersion metadata field",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/path/extension::dll-dup",
            "crit": 2,
            "desc": ".dll extension reference",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "metadata/binary/framework::dotnet-assembly",
            "conf": 1.0,
            "crit": 2,
            "desc": ".NET Assembly (mscoree.dll)",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "metadata/binary/framework::clr-runtime-header",
            "conf": 1.0,
            "crit": 2,
            "desc": "PE CLR runtime header present (COM descriptor)"
          }
        ]
      },
      {
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 519.0,
              "entropy": 5.19,
              "size_bytes": 519.0
            },
            "binary": {
              "overall_entropy": 5.19,
              "peak_region_bytes": 519.0,
              "peak_region_entropy": 5.19
            }
          }
        },
        "id": 1,
        "path": "TestIT.Adapter.SpecFlowPlugin.2.2.0-TMS-5.8.nupkg!!_rels/.rels",
        "sha": "30fdd669a0f4a1863e26af9c4bd4b187898d3d0e22e2f493e09b6f0428a1ca0b",
        "size": 519,
        "type": "xml"
      },
      {
        "ctx": [
          {
            "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj]",
            "n": [
              {
                "c": 2,
                "d": "NuGet nuspec manifest file",
                "i": "metadata/build/manifest::nuspec-file",
                "o": 0,
                "z": 36,
                "cf": 0.9800000190734863
              }
            ],
            "ln": 1,
            "addr": 0
          },
          {
            "b": "jAa.syHH\u003c!aB4:tzGv@+xMOuniXJdcv}YB\u003cvrj5rx\u003e8g4B8LVje[n*pfk$ufyHH\u003c\u0026zF7QTfFLvpfF$I3B-RIkv\u003eJ1EwfKh",
            "ln": 2,
            "addr": 42
          },
          {
            "b": "arS^-wPRu\u003evrt{w",
            "ln": 3,
            "addr": 118
          },
          {
            "b": "arR^Hjy\u00262Av@=p5BzkVhk2=9mBrBdOax9k\u003cv[7oMCoys8vq{s1AY=0=wPIv4x(Ffdz/d-",
            "ln": 12,
            "addr": 490
          },
          {
            "b": "arR^Hjy-qGD2^RixMMB9z/x#xx\u003eIa3asH.GatLS9iuP)@gb7Euaxh][BrBdOjtgh.AcVFrxj#xJ",
            "ln": 13,
            "addr": 546
          },
          {
            "b": "arR^HjAt1Lz/YSmz/QaCBA}?pjTaJMBrR\u0026IA+)(.xMOunB2\u003e%cxk8E3BZ=$kz/4dHwPI%cBs?PKB1Z%jvq{s1A=S*yz//(dBrR\u0026qz/6u9BuH*8hzM%Bh!a^3gC?9CfFN6Hi5$I6gbJP6gCH?0fFUNwfFLByh-rDoatk[",
            "n": [
              {
                "c": 2,
                "d": "NuGet package declares repository",
                "i": "metadata/package/files/nuget::nuspec-repository",
                "o": 611,
                "z": 82,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 14,
            "addr": 607
          },
          {
            "b": "arR^Hjy\u00262xwO#3\u0026zEWx(B3o",
            "n": [
              {
                "c": 2,
                "d": "NuGet package declares dependencies",
                "i": "metadata/package/files/nuget::nuspec-dependencies",
                "o": 743,
                "z": 260,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 15,
            "addr": 739
          },
          {
            "b": "arR^HarS^VA=l8taAR4jxjVfOA:-/@Cw?IqjT8HNmo0icvqYQ:A+3{Tf^n^",
            "ln": 16,
            "addr": 758
          },
          {
            "b": "arR^HarR^Hjy\u00262xwO#3\u0026zEW@mx\u003efvJraQb)nMmrdwmoC0wPxy\u003cz/PzkaA?spB7]MgjT8Tlga\u003emjr83pyh7*\u003cjaz2!cy\u0026%o1jT9jnx(4rhl2HaED3T4xB0q.Wj]",
            "ln": 17,
            "addr": 806
          }
        ],
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 1130.0,
              "entropy": 5.18,
              "size_bytes": 1130.0
            },
            "binary": {
              "overall_entropy": 5.18,
              "peak_region_bytes": 1024.0,
              "peak_region_entropy": 5.19
            }
          }
        },
        "id": 2,
        "path": "TestIT.Adapter.SpecFlowPlugin.2.2.0-TMS-5.8.nupkg!!TestIT.Adapter.SpecFlowPlugin.nuspec",
        "risk": 1,
        "sha": "26b51ed30ef6bd2517f01dac57c1ff1db6c93d32fae95cb0bc4787f50732f5f5",
        "size": 1130,
        "traits": [
          {
            "id": "metadata/build/manifest::nuspec-file",
            "conf": 0.9800000190734863,
            "crit": 2,
            "desc": "NuGet nuspec manifest file",
            "spans": [
              [
                0,
                36
              ]
            ]
          },
          {
            "id": "metadata/package/files/nuget::nuspec-repository",
            "conf": 0.8999999761581421,
            "crit": 2,
            "desc": "NuGet package declares repository",
            "spans": [
              [
                611,
                82
              ]
            ]
          },
          {
            "id": "metadata/package/files/nuget::nuspec-dependencies",
            "conf": 0.8999999761581421,
            "crit": 2,
            "desc": "NuGet package declares dependencies",
            "spans": [
              [
                743,
                260
              ]
            ]
          }
        ],
        "type": "xml"
      },
      {
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 10782,
              "entropy": 4.53
            },
            "text": {
              "lines": 202,
              "top_char": 101,
              "max_ws_run": 2,
              "digit_ratio": 0,
              "space_count": 1958,
              "char_entropy": 4.53,
              "unique_chars": 76,
              "top_char_null": 0,
              "top_char_ratio": 0.08,
              "avg_line_length": 52.38,
              "max_line_length": 74,
              "empty_line_ratio": 0.16,
              "last_line_length": 30,
              "whitespace_ratio": 0.2,
              "line_length_stddev": 25.14,
              "repeated_char_sequences": 3
            },
            "binary": {
              "peak_region_bytes": 8734,
              "peak_region_entropy": 4.84
            }
          }
        },
        "id": 3,
        "path": "TestIT.Adapter.SpecFlowPlugin.2.2.0-TMS-5.8.nupkg!!LICENSE.md",
        "pid": 0,
        "risk": 1,
        "sha": "6e5d9c0da6ba0046a13b43d7de7962bb3ab77ea8c4a58845a4c0a87475ef8949",
        "size": 10782,
        "traits": [
          {
            "id": "metadata/file/extension/identity::doc-or-config-extension",
            "conf": 1.0,
            "crit": 2,
            "desc": "Text, document, or config extension"
          },
          {
            "id": "metadata/file/extension/identity::markdown-file-basename",
            "conf": 1.0,
            "crit": 2,
            "desc": "Markdown document file extension"
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-1",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"the\"",
            "spans": [
              [
                262,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-2",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"and\"",
            "spans": [
              [
                165,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-3",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"that\"",
            "spans": [
              [
                476,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-4",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"have\"",
            "spans": [
              [
                4018,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-5",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"for\"",
            "spans": [
              [
                180,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-6",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"with\"",
            "spans": [
              [
                657,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-7",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"this\"",
            "spans": [
              [
                368,
                0
              ]
            ]
          },
          {
            "id": "metadata/permission/prose::permission-grant-verb-english",
            "conf": 0.9,
            "crit": 2,
            "desc": "Grant or authorization verb text",
            "spans": [
              [
                4995,
                0
              ]
            ]
          }
        ],
        "type": "markdown"
      },
      {
        "ctx": [
          {
            "b": "boP@%B95J@r3kdmqY[wpvq{s1AV!$jAV!q1wN!hCz*8",
            "n": [
              {
                "c": 3,
                "d": "Recognized domain reference marker",
                "i": "objectives/command-and-control/infrastructure/domain/tld::recognized-reference-marker",
                "o": 0,
                "z": 9,
                "cf": 0.8999999761581421
              },
              {
                "c": 2,
                "d": "English language detection",
                "i": "metadata/file/profile/language::lang-english",
                "o": 22,
                "z": 3,
                "cf": 0.800000011920929
              }
            ],
            "ln": 1,
            "addr": 0
          },
          {
            "b": "aZm]SB95J@r9Z[=BAzFyiXJdbvrTtpx([3hvS=:6A:%39By/uie[n*pfly=DBzk?GBzV7LvpS!=By/GleO5^wzE)]yzddc@fkkoixjVcqvQTd(wPxzxzF7x",
            "ln": 2,
            "addr": 35
          },
          {
            "b": "",
            "ln": 3,
            "addr": 131
          }
        ],
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 9954.0,
              "entropy": 4.29,
              "size_bytes": 9954.0
            },
            "text": {
              "digit_ratio": 0.02,
              "space_count": 3626.0,
              "total_lines": 176.0,
              "char_entropy": 4.29,
              "unique_chars": 90.0,
              "lines_over_200": 14.0,
              "ascii_art_lines": 1.0,
              "avg_line_length": 55.56,
              "high_byte_ratio": 0.0,
              "max_line_length": 393.0,
              "non_ascii_ratio": 0.0,
              "empty_line_ratio": 0.24,
              "last_line_length": 103.0,
              "long_token_count": 3.0,
              "whitespace_ratio": 0.38,
              "most_common_ratio": 0.06,
              "line_length_stddev": 102.96,
              "repeated_char_sequences": 38.0,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 297.0,
              "trailing_whitespace_lines": 6.0,
              "most_common_char_codepoint": 116.0
            },
            "binary": {
              "overall_entropy": 4.29,
              "peak_region_bytes": 2048.0,
              "peak_region_entropy": 5.4
            }
          }
        },
        "id": 4,
        "path": "TestIT.Adapter.SpecFlowPlugin.2.2.0-TMS-5.8.nupkg!!README.md",
        "risk": 1,
        "sha": "a0e8403d284b6327d4a0a1c091c8bac724b3bead22ec03bbf0f86565c8c51ac4",
        "size": 9954,
        "traits": [
          {
            "id": "metadata/file/extension/identity::doc-or-config-extension",
            "conf": 1.0,
            "crit": 1,
            "desc": "Document or config file extension",
            "spans": [
              [
                0,
                9
              ]
            ]
          },
          {
            "id": "metadata/file/profile/language::lang-english",
            "conf": 0.800000011920929,
            "crit": 2,
            "desc": "English language detection",
            "spans": [
              [
                22,
                3
              ]
            ]
          },
          {
            "id": "metadata/file/extension/identity::markdown-file-basename",
            "conf": 1.0,
            "crit": 1,
            "desc": "Markdown document file extension",
            "spans": [
              [
                0,
                9
              ]
            ]
          }
        ],
        "type": "markdown"
      },
      {
        "ctx": [
          {
            "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J+",
            "n": [
              {
                "c": 3,
                "d": "HTTP fingerprinting evasion campaign",
                "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign",
                "o": 0,
                "z": 34,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 0
          },
          {
            "b": "00000000000000000000J+[:@00000nb@R\u00260SSx7Q+R]IOh*MH0rr91000000000000",
            "n": [
              {
                "c": 1,
                "d": "PE standard code/data section",
                "i": "metadata/binary/section/names::pe-code-data-standard-section",
                "o": 512,
                "z": 5,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 496
          },
          {
            "b": "00Ekw000vATPetddGxCGlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn",
            "n": [
              {
                "c": 3,
                "d": "Recognized PE anti-analysis marker",
                "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker",
                "o": 5284,
                "z": 4,
                "cf": 1.0
              }
            ],
            "ln": 5268
          },
          {
            "b": "AXppfwN!hCz*b2]B.tAae[w^m0b2\u003e+uSzb.0cqZ[uSzb.07zczv%8)4vR/QEBy/p?",
            "n": [
              {
                "c": 3,
                "d": "References Windows executable or script",
                "i": "objectives/execution/interpreter/script/shell::windows-executable-ref",
                "o": 14263,
                "z": 4,
                "cf": 0.6000000238418579
              }
            ],
            "ln": 14247
          },
          {
            "b": "z7Xs{z^)c\u003ex)Kifx(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9TEv}X?Iy?\u003eU4AaJJGy\u0026sIIltpsFx(mN8e(Dm)yY",
            "n": [
              {
                "c": 2,
                "d": "Benign high-entropy PE context",
                "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context",
                "o": 14596,
                "z": 17,
                "cf": 0.949999988079071
              }
            ],
            "ln": 14580
          },
          {
            "b": "B7GD2l$HBHA+PGmx(v\u003e?pgXS\u003ez/fSmw]]T$B8L{@q*ACawO\u003c50wQ5qHn][]*07?l7B8L{@q/)4]zF8sPze-{7x(!ig077mez/Pz*",
            "n": [
              {
                "c": 3,
                "d": "JSON polymorphism runtime marker",
                "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref",
                "o": 14782,
                "z": 16,
                "cf": 1.0
              },
              {
                "c": 2,
                "d": "Newtonsoft.Json serialization library ref",
                "i": "micro-behaviors/data/serialize/json::json-newtonsoft",
                "o": 14766,
                "z": 15,
                "cf": 0.8500000238418579
              }
            ],
            "ln": 14750
          },
          {
            "b": "A8Q\u003c\u0026z#-*UvrcD*By/y\u003eq*ACawO\u003c4[x(m[\u003cqE%/-vpJ\u003e?07*d3B97x4vpJ\u003e?090/RraQb)rb#y",
            "n": [
              {
                "c": 3,
                "d": "LINQ query operations",
                "i": "micro-behaviors/data/db/linq::linq-queries",
                "o": 15137,
                "z": 11,
                "cf": 0.699999988079071
              }
            ],
            "ln": 15121
          },
          {
            "b": "07pycB.tu3zF8WZwmY/Zq*ACawO\u003c50wQ5qHn][]*e(3s}wPE\u0026WwmP4mB-RUyze1rcraQb)ra{q-vpR=q",
            "n": [
              {
                "c": 2,
                "d": "System.Text.Json library reference",
                "i": "micro-behaviors/data/serialize/json::json-system",
                "o": 15965,
                "z": 16,
                "cf": 0.8500000238418579
              }
            ],
            "ln": 15949
          },
          {
            "b": "0rrv5wO+{^B7CsKcij8\u0026lVl{?A+Pf1Brz#wdiHx1f/ZvdatLSag:2+eB95J@q#=[s0rr%owD",
            "n": [
              {
                "c": 2,
                "d": "Copyright notice",
                "i": "metadata/package/license::copyright-word",
                "o": 19557,
                "z": 9,
                "cf": 0.6000000238418579
              }
            ],
            "ln": 19541
          },
          {
            "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000",
            "n": [
              {
                "c": 1,
                "d": "PE resource section",
                "i": "metadata/binary/section/names::pe-resource-section",
                "o": 20480,
                "z": 5,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 20464
          },
          {
            "b": "0000000000002*#gYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrf30SSi",
            "n": [
              {
                "c": 3,
                "d": "Recognized marker for timing checks",
                "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker",
                "o": 20574,
                "z": 15,
                "cf": 0.949999988079071
              }
            ],
            "ln": 20558
          },
          {
            "b": "Bo2\u003eLASu7t002s=5Dz?ilJz38z2!IPve$fBC(QOtve$cAwDhYg002N\u003czua+UwDluyASxIFBo31",
            "n": [
              {
                "c": 2,
                "d": "PE CompanyName metadata field",
                "i": "metadata/package/versioning::pe-companyname-field",
                "o": 20870,
                "z": 11,
                "cf": 0.699999988079071
              }
            ],
            "ln": 20854
          },
          {
            "b": "wDlcsz2:Lo003s98VP)smGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002%#z2!RSe=Xfqwb{3",
            "n": [
              {
                "c": 2,
                "d": "PE FileDescription metadata field",
                "i": "metadata/package/versioning::pe-filedescription-field",
                "o": 20938,
                "z": 15,
                "cf": 0.699999988079071
              }
            ],
            "ln": 20922
          },
          {
            "b": "x8(SCzu6Up001XM2MK(9mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001+Oe=WTbe=WN9e=WN9003s99@(rwnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002%#z2!RSe=Xfqwb{3rz#:$W",
            "n": [
              {
                "c": 3,
                "d": "Dotted-quad PE version metadata marker",
                "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker",
                "o": 21034,
                "z": 11,
                "cf": 0.9399999976158142
              },
              {
                "c": 2,
                "d": "PE InternalName metadata field",
                "i": "metadata/package/versioning::pe-internalname-field",
                "o": 21082,
                "z": 12,
                "cf": 0.699999988079071
              }
            ],
            "ln": 21018
          },
          {
            "b": "Bo0A-nDqY\u0026003Qh9@(rwpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002%#z2!RSe=Xfqwb{3r",
            "n": [
              {
                "c": 2,
                "d": "PE OriginalFilename metadata field",
                "i": "metadata/package/versioning::pe-originalfilename-field",
                "o": 21282,
                "z": 16,
                "cf": 0.699999988079071
              }
            ],
            "ln": 21266
          },
          {
            "b": "wb{ACyYBCn003418VP)spYLIozVBqFBPt[KBo25ove$cAwDhYg002%#z2!RSe=Xfqwb{3rz#:$",
            "n": [
              {
                "c": 2,
                "d": "PE ProductName metadata field",
                "i": "metadata/package/versioning::pe-productname-field",
                "o": 21386,
                "z": 11,
                "cf": 0.699999988079071
              }
            ],
            "ln": 21370
          },
          {
            "b": "x8(SCzu6Up005eZhVJ\u003cUpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001+Oe=WTbe=WN9eDw-Io-L",
            "n": [
              {
                "c": 2,
                "d": "PE version resource metadata",
                "i": "metadata/package/versioning::version-resource-metadata",
                "o": 21474,
                "z": 14,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 21458
          },
          {
            "b": "000000000000000000000ak^b3\u0026*ncUSR%^000000000000000000000000000000000",
            "n": [
              {
                "c": 2,
                "d": "PE .reloc section presence",
                "i": "metadata/binary/section/names::reloc-section-presence",
                "o": 22016,
                "z": 6,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 22000
          }
        ],
        "depth": 1,
        "facts": {
          "imp": [
            [
              "mscoree",
              "CorDllMain"
            ]
          ],
          "sec": [
            [
              ".text",
              512,
              19968,
              5.95,
              "r-x"
            ],
            [
              ".rsrc",
              20480,
              1536,
              2.78,
              "r--"
            ],
            [
              ".reloc",
              22016,
              512,
              0.08,
              "r--"
            ]
          ],
          "metrics": {
            "pe": {
              "checksum": 0.0,
              "checksum_valid": 0.0,
              "resource_count": 1.0,
              "has_version_info": 1.0,
              "checksum_stripped": 1.0,
              "computed_checksum": 42464.0,
              "reloc_overhang_bytes": 500.0,
              "reloc_overhang_ratio": 0.98,
              "bss_like_section_count": 0.0,
              "section_overflow_count": 0.0,
              "misaligned_section_count": 0.0,
              "version.identity_entropy": 4.46,
              "base_relocation_block_count": 1.0,
              "base_relocation_entry_count": 1.0,
              "version.identity_symbol_ratio": 0.06
            },
            "file": {
              "size": 22528.0,
              "entropy": 5.66,
              "size_bytes": 22528.0
            },
            "binary": {
              "is_pie": 1.0,
              "code_entropy": 5.95,
              "string_count": 380.0,
              "overall_entropy": 5.66,
              "entropy_variance": 5.76,
              "avg_string_length": 17.66,
              "max_string_length": 134.0,
              "peak_region_bytes": 4096.0,
              "code_to_data_ratio": 1.0,
              "peak_region_entropy": 5.73,
              "string_length_stddev": 13.09,
              "largest_section_ratio": 0.89,
              "sentence_string_count": 7.0,
              "sentence_string_ratio": 0.02,
              "high_entropy_string_count": 0.0
            },
            "imports": {
              "count": 1.0
            },
            "sections": {
              "count": 3.0,
              "code_size": 19968.0,
              "entropy_max": 5.95,
              "entropy_mean": 2.94,
              "name_entropy": 3.03,
              "writable_count": 0.0,
              "executable_count": 1.0,
              "nonstandard_count": 0.0,
              "executable_writable_count": 0.0
            },
            "dependencies": {
              "count": 1.0
            }
          }
        },
        "id": 5,
        "mol": "O(Al)H(Db)",
        "path": "TestIT.Adapter.SpecFlowPlugin.2.2.0-TMS-5.8.nupkg!!lib/netstandard2.1/Tms.Adapter.SpecFlowPlugin.dll",
        "risk": 3,
        "sha": "dbaa8b3f8d4aefa72ad1814f80cb9a756c0a50ebf4db3093de5a5c83fffc0716",
        "size": 22528,
        "traits": [
          {
            "id": "metadata/package/versioning::pe-productversion-field",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "PE ProductVersion metadata field",
            "spans": [
              [
                21474,
                14
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/db/linq::linq-queries",
            "conf": 0.699999988079071,
            "crit": 3,
            "desc": "LINQ query operations",
            "spans": [
              [
                15137,
                11
              ]
            ]
          },
          {
            "id": "metadata/package/versioning::pe-version-resource",
            "conf": 0.800000011920929,
            "crit": 2,
            "desc": "PE version resource structure",
            "spans": [
              [
                20574,
                15
              ]
            ]
          },
          {
            "id": "metadata/binary/framework::clr-runtime-header",
            "conf": 1.0,
            "crit": 2,
            "desc": "PE CLR runtime header present (COM descriptor)"
          },
          {
            "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal",
            "conf": 0.699999988079071,
            "crit": 1,
            "desc": ".NET code entropy in unpacked range",
            "spans": [
              [
                0,
                26
              ]
            ]
          },
          {
            "id": "metadata/binary/framework::dotnet-metadata",
            "conf": 1.0,
            "crit": 2,
            "desc": ".NET Metadata Root (BSJB)",
            "spans": [
              [
                5284,
                4
              ]
            ]
          },
          {
            "id": "micro-behaviors/fs/path/extension::dll-dup",
            "crit": 2,
            "desc": ".dll extension reference",
            "spans": [
              [
                14263,
                4
              ]
            ]
          },
          {
            "id": "metadata/package/versioning::pe-fileversion-field",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "PE FileVersion metadata field",
            "spans": [
              [
                21034,
                11
              ]
            ]
          },
          {
            "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref",
            "conf": 1.0,
            "crit": 3,
            "desc": "JSON polymorphism runtime marker",
            "spans": [
              [
                14782,
                16
              ]
            ]
          },
          {
            "id": "metadata/binary/framework::dotnet-assembly",
            "conf": 1.0,
            "crit": 2,
            "desc": ".NET Assembly (mscoree.dll)",
            "spans": [
              [
                5284,
                4
              ]
            ]
          }
        ],
        "type": "pe"
      },
      {
        "id": 6,
        "sha": "1a6670ec6cb20a6520f5d6b9be859fcd7416bef2ba0e8e40bfbf0aaab5409e4f",
        "path": "TestIT.Adapter.SpecFlowPlugin.2.2.0-TMS-5.8.nupkg!![Content_Types].xml",
        "size": 520,
        "type": "xml",
        "depth": 1
      },
      {
        "id": 7,
        "sha": "c9a7adea0380cc65df750e15d95ce2acbb34e7e349fe115f61a74783c3c3164a",
        "path": "TestIT.Adapter.SpecFlowPlugin.2.2.0-TMS-5.8.nupkg!!package/services/metadata/core-properties/2f9d1d38ad084cca85ae8bcc441171bd.psmdcp",
        "size": 646,
        "type": "xml",
        "depth": 1
      },
      {
        "id": 8,
        "sha": "aa802835ec79c88886454776f400074453959ffea45a20c5582bfbc36feec6f5",
        "path": "TestIT.Adapter.SpecFlowPlugin@2.2.0-TMS-5.8.registry.json",
        "size": 808,
        "type": "registry",
        "depth": 1
      }
    ],
    "omitted_files": 3,
    "v": "8"
  }
}