drop managed PE · parse CLR header and BSJB metadata · assembly identity · typedef methoddef assemblyref · flag suspicious P/Invoke APIs · csv · runs locally
drop .NET PE assembly · exe or dll