{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 1.0,
        "class": 2,
        "threshold": 1.0
      }
    ],
    "prob": 1.0,
    "class": 2,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.9591549,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.99918854,
        "class": 0
      },
      {
        "m": "az/powershell",
        "prob": 1.0,
        "class": 2
      }
    ],
    "version": "v17.17",
    "threshold": 1.0,
    "analyzed_at": "2026-05-31T08:07:13Z"
  },
  "path": "1baafac42896587ee5ad0fcd8ab29d8366d166bde6d8c5732af7105a719b239d.ps1",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "O₂(As₃Xe)",
        "x": 36,
        "ff": {
          "m": {
            "ast": {
              "max_depth": 183.0,
              "call_count": 25.0,
              "node_count": 20447.0,
              "identifier_count": 34.0,
              "string_literal_count": 15.0,
              "array_literal_max_length": 55.0
            },
            "file": {
              "size": 20542.0,
              "entropy": 5.96,
              "size_bytes": 20542.0
            },
            "text": {
              "tab_count": 7.0,
              "digit_ratio": 0.4,
              "space_count": 342.0,
              "total_lines": 30.0,
              "char_entropy": 5.96,
              "mixed_indent": 1.0,
              "unique_chars": 87.0,
              "lines_over_200": 12.0,
              "lines_over_500": 6.0,
              "string_density": 0.5,
              "avg_line_length": 682.73,
              "lines_over_1000": 2.0,
              "max_line_length": 10732.0,
              "empty_line_ratio": 0.13,
              "last_line_length": 10732.0,
              "long_token_count": 23.0,
              "whitespace_ratio": 0.02,
              "most_common_ratio": 0.04,
              "identifier_density": 3.73,
              "line_length_stddev": 2044.71,
              "encoded_string_ratio": 0.33,
              "normalized_string_count": 2.74,
              "repeated_char_sequences": 15.0,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 2.0,
              "trailing_whitespace_lines": 1.0,
              "most_common_char_codepoint": 48.0,
              "normalized_unique_identifiers": 6.93
            },
            "calls": {
              "count": 25.0
            },
            "source": {
              "function_count": 1.0
            },
            "strings": {
              "total": 15.0,
              "avg_length": 717.33,
              "max_length": 10452.0,
              "avg_entropy": 2.77,
              "empty_count": 9.0,
              "hex_strings": 4.0,
              "total_bytes": 10760.0,
              "entropy_stddev": 1.65,
              "base64_candidates": 1.0,
              "very_long_strings": 1.0,
              "high_entropy_count": 1.0
            },
            "functions": {
              "count": 1.0
            },
            "identifiers": {
              "count": 34.0,
              "total": 112.0,
              "avg_length": 13.85,
              "max_length": 33.0,
              "min_length": 2.0,
              "avg_entropy": 3.11,
              "reuse_ratio": 0.3,
              "unique_count": 34.0,
              "length_stddev": 8.6,
              "has_digit_ratio": 0.5,
              "high_entropy_count": 16.0,
              "high_entropy_ratio": 0.47,
              "all_lowercase_ratio": 0.09,
              "numeric_suffix_count": 5.0
            }
          },
          "s": [
            [
              80,
              "10",
              "9647"
            ],
            [
              80,
              "10",
              "9647"
            ],
            [
              85,
              "10",
              "9594"
            ],
            [
              85,
              "10",
              "9594"
            ],
            [
              93,
              "10",
              "8576"
            ],
            [
              93,
              "10",
              "8576"
            ],
            [
              98,
              "10",
              "8628"
            ],
            [
              98,
              "10",
              "8628"
            ],
            [
              105,
              "10",
              "6145"
            ],
            [
              105,
              "10",
              "6145"
            ],
            [
              110,
              "10",
              "6088"
            ],
            [
              110,
              "10",
              "6088"
            ],
            [
              117,
              "10",
              "4866"
            ],
            [
              117,
              "10",
              "4866"
            ],
            [
              122,
              "10",
              "4816"
            ],
            [
              122,
              "10",
              "4816"
            ],
            [
              129,
              "10",
              "331744"
            ],
            [
              129,
              "10",
              "331744"
            ],
            [
              136,
              "10",
              "5924"
            ],
            [
              136,
              "10",
              "5924"
            ],
            [
              143,
              "10",
              "972"
            ],
            [
              143,
              "10",
              "972"
            ],
            [
              147,
              "10",
              "918"
            ],
            [
              147,
              "10",
              "918"
            ],
            [
              154,
              "10",
              "10180"
            ],
            [
              154,
              "10",
              "10180"
            ],
            [
              160,
              "10",
              "10236"
            ],
            [
              160,
              "10",
              "10236"
            ],
            [
              168,
              "10",
              "6275"
            ],
            [
              168,
              "10",
              "6275"
            ],
            [
              174,
              "10",
              "49803540"
            ],
            [
              174,
              "10",
              "49803540"
            ],
            [
              184,
              "10",
              "66634254"
            ],
            [
              184,
              "10",
              "66634254"
            ],
            [
              194,
              "10",
              "4513"
            ],
            [
              194,
              "10",
              "4513"
            ],
            [
              200,
              "10",
              "3983"
            ],
            [
              200,
              "10",
              "3983"
            ],
            [
              207,
              "10",
              "1743"
            ],
            [
              207,
              "10",
              "1743"
            ],
            [
              212,
              "10",
              "1917"
            ],
            [
              212,
              "10",
              "1917"
            ],
            [
              224,
              "10",
              "7541"
            ],
            [
              224,
              "10",
              "7541"
            ],
            [
              229,
              "10",
              "7486"
            ],
            [
              229,
              "10",
              "7486"
            ],
            [
              236,
              "10",
              "259350"
            ],
            [
              236,
              "10",
              "259350"
            ],
            [
              245,
              "10",
              "3321"
            ],
            [
              245,
              "10",
              "3321"
            ],
            [
              250,
              "10",
              "8508"
            ],
            [
              250,
              "10",
              "8508"
            ],
            [
              258,
              "10",
              "7124"
            ],
            [
              258,
              "10",
              "7124"
            ],
            [
              264,
              "10",
              "5888"
            ],
            [
              264,
              "10",
              "5888"
            ],
            [
              270,
              "10",
              "10797"
            ],
            [
              270,
              "10",
              "10797"
            ],
            [
              277,
              "10",
              "1661"
            ],
            [
              277,
              "10",
              "1661"
            ],
            [
              283,
              "10",
              "14829"
            ],
            [
              283,
              "10",
              "14829"
            ],
            [
              290,
              "10",
              "6960"
            ],
            [
              290,
              "10",
              "6960"
            ],
            [
              295,
              "10",
              "87"
            ],
            [
              295,
              "10",
              "87"
            ],
            [
              305,
              "10",
              "350448"
            ],
            [
              305,
              "10",
              "350448"
            ],
            [
              312,
              "10",
              "7301"
            ],
            [
              312,
              "10",
              "7301"
            ],
            [
              319,
              "10",
              "1261"
            ],
            [
              319,
              "10",
              "1261"
            ],
            [
              324,
              "10",
              "1212"
            ],
            [
              324,
              "10",
              "1212"
            ],
            [
              332,
              "10",
              "9017"
            ],
            [
              332,
              "10",
              "9017"
            ],
            [
              338,
              "10",
              "6254"
            ],
            [
              338,
              "10",
              "6254"
            ],
            [
              344,
              "10",
              "662230"
            ],
            [
              344,
              "10",
              "662230"
            ],
            [
              352,
              "10",
              "6715"
            ],
            [
              352,
              "10",
              "6715"
            ],
            [
              357,
              "10",
              "6480"
            ],
            [
              357,
              "10",
              "6480"
            ],
            [
              367,
              "10",
              "7352"
            ],
            [
              367,
              "10",
              "7352"
            ],
            [
              373,
              "10",
              "9099"
            ],
            [
              373,
              "10",
              "9099"
            ],
            [
              379,
              "10",
              "7082663"
            ],
            [
              379,
              "10",
              "7082663"
            ],
            [
              387,
              "10",
              "3937"
            ],
            [
              387,
              "10",
              "3937"
            ],
            [
              396,
              "10",
              "10143"
            ],
            [
              396,
              "10",
              "10143"
            ],
            [
              402,
              "10",
              "10087"
            ],
            [
              402,
              "10",
              "10087"
            ],
            [
              410,
              "10",
              "296892"
            ],
            [
              410,
              "10",
              "296892"
            ],
            [
              417,
              "10",
              "5498"
            ],
            [
              417,
              "10",
              "5498"
            ],
            [
              424,
              "10",
              "2102"
            ],
            [
              424,
              "10",
              "2102"
            ],
            [
              430,
              "10",
              "17255964"
            ],
            [
              430,
              "10",
              "17255964"
            ],
            [
              439,
              "10",
              "8434"
            ],
            [
              439,
              "10",
              "8434"
            ],
            [
              447,
              "10",
              "6485"
            ],
            [
              447,
              "10",
              "6485"
            ],
            [
              453,
              "10",
              "5504"
            ],
            [
              453,
              "10",
              "5504"
            ],
            [
              459,
              "10",
              "4273500"
            ],
            [
              459,
              "10",
              "4273500"
            ],
            [
              467,
              "10",
              "4620"
            ],
            [
              467,
              "10",
              "4620"
            ],
            [
              476,
              "10",
              "372008"
            ],
            [
              476,
              "10",
              "372008"
            ],
            [
              483,
              "10",
              "7592"
            ],
            [
              483,
              "10",
              "7592"
            ],
            [
              490,
              "10",
              "410616"
            ],
            [
              490,
              "10",
              "410616"
            ],
            [
              498,
              "10",
              "5175"
            ],
            [
              498,
              "10",
              "5175"
            ],
            [
              504,
              "10",
              "9392943"
            ],
            [
              504,
              "10",
              "9392943"
            ],
            [
              513,
              "10",
              "96"
            ],
            [
              513,
              "10",
              "96"
            ],
            [
              517,
              "10",
              "428"
            ],
            [
              517,
              "10",
              "428"
            ],
            [
              522,
              "10",
              "29054013"
            ],
            [
              522,
              "10",
              "29054013"
            ],
            [
              531,
              "10",
              "8691"
            ],
            [
              531,
              "10",
              "8691"
            ],
            [
              544,
              "10",
              "6983"
            ],
            [
              544,
              "10",
              "6983"
            ],
            [
              551,
              "10",
              "1849"
            ],
            [
              551,
              "10",
              "1849"
            ],
            [
              557,
              "10",
              "80"
            ],
            [
              557,
              "10",
              "80"
            ],
            [
              560,
              "10",
              "8808"
            ],
            [
              560,
              "10",
              "8808"
            ],
            [
              570,
              "10",
              "6262"
            ],
            [
              570,
              "10",
              "6262"
            ],
            [
              575,
              "10",
              "6317"
            ],
            [
              575,
              "10",
              "6317"
            ],
            [
              582,
              "10",
              "1506"
            ],
            [
              582,
              "10",
              "1506"
            ],
            [
              587,
              "10",
              "1454"
            ],
            [
              587,
              "10",
              "1454"
            ],
            [
              594,
              "10",
              "467775"
            ],
            [
              594,
              "10",
              "467775"
            ],
            [
              603,
              "10",
              "1401"
            ],
            [
              603,
              "10",
              "1401"
            ],
            [
              609,
              "10",
              "12897"
            ],
            [
              609,
              "10",
              "12897"
            ],
            [
              616,
              "10",
              "25958889"
            ],
            [
              616,
              "10",
              "25958889"
            ],
            [
              626,
              "10",
              "6839052"
            ],
            [
              626,
              "10",
              "6839052"
            ],
            [
              634,
              "10",
              "788"
            ],
            [
              634,
              "10",
              "788"
            ],
            [
              644,
              "10",
              "215550"
            ],
            [
              644,
              "10",
              "215550"
            ],
            [
              652,
              "10",
              "42976359"
            ],
            [
              652,
              "10",
              "42976359"
            ],
            [
              661,
              "10",
              "9969"
            ],
            [
              661,
              "10",
              "9969"
            ],
            [
              670,
              "10",
              "295"
            ],
            [
              670,
              "10",
              "295"
            ],
            [
              674,
              "10",
              "351"
            ],
            [
              674,
              "10",
              "351"
            ],
            [
              681,
              "10",
              "5395"
            ],
            [
              681,
              "10",
              "5395"
            ],
            [
              687,
              "10",
              "9540"
            ],
            [
              687,
              "10",
              "9540"
            ],
            [
              693,
              "10",
              "5899680"
            ],
            [
              693,
              "10",
              "5899680"
            ],
            [
              701,
              "10",
              "1440"
            ],
            [
              701,
              "10",
              "1440"
            ],
            [
              710,
              "10",
              "213895"
            ],
            [
              710,
              "10",
              "213895"
            ],
            [
              717,
              "10",
              "3889"
            ],
            [
              717,
              "10",
              "3889"
            ],
            [
              724,
              "10",
              "5047"
            ],
            [
              724,
              "10",
              "5047"
            ],
            [
              729,
              "10",
              "4997"
            ],
            [
              729,
              "10",
              "4997"
            ],
            [
              737,
              "10",
              "1800"
            ],
            [
              737,
              "10",
              "1800"
            ],
            [
              742,
              "10",
              "1856"
            ],
            [
              742,
              "10",
              "1856"
            ],
            [
              750,
              "10",
              "3920"
            ],
            [
              750,
              "10",
              "3920"
            ],
            [
              755,
              "10",
              "3969"
            ],
            [
              755,
              "10",
              "3969"
            ],
            [
              762,
              "10",
              "501536"
            ],
            [
              762,
              "10",
              "501536"
            ],
            [
              771,
              "10",
              "100"
            ],
            [
              771,
              "10",
              "100"
            ],
            [
              776,
              "10",
              "2233"
            ],
            [
              776,
              "10",
              "2233"
            ],
            [
              782,
              "10",
              "45850560"
            ],
            [
              782,
              "10",
              "45850560"
            ],
            [
              791,
              "10",
              "6720"
            ],
            [
              791,
              "10",
              "6720"
            ],
            [
              801,
              "10",
              "7"
            ],
            [
              801,
              "10",
              "7"
            ],
            [
              804,
              "10",
              "8066"
            ],
            [
              804,
              "10",
              "8066"
            ],
            [
              810,
              "10",
              "37179466"
            ],
            [
              810,
              "10",
              "37179466"
            ],
            [
              819,
              "10",
              "4637"
            ],
            [
              819,
              "10",
              "4637"
            ],
            [
              828,
              "10",
              "8735"
            ],
            [
              828,
              "10",
              "8735"
            ],
            [
              834,
              "10",
              "13221"
            ],
            [
              834,
              "10",
              "13221"
            ],
            [
              840,
              "10",
              "4535"
            ],
            [
              840,
              "10",
              "4535"
            ],
            [
              849,
              "10",
              "10077"
            ],
            [
              849,
              "10",
              "10077"
            ],
            [
              856,
              "10",
              "13971"
            ],
            [
              856,
              "10",
              "13971"
            ],
            [
              862,
              "10",
              "3839"
            ],
            [
              862,
              "10",
              "3839"
            ],
            [
              870,
              "10",
              "424881"
            ],
            [
              870,
              "10",
              "424881"
            ],
            [
              877,
              "10",
              "8331"
            ],
            [
              877,
              "10",
              "8331"
            ],
            [
              885,
              "10",
              "3738"
            ],
            [
              885,
              "10",
              "3738"
            ],
            [
              890,
              "10",
              "3792"
            ],
            [
              890,
              "10",
              "3792"
            ],
            [
              897,
              "10",
              "359520"
            ],
            [
              897,
              "10",
              "359520"
            ],
            [
              905,
              "10",
              "6280"
            ],
            [
              905,
              "10",
              "6280"
            ],
            [
              912,
              "10",
              "5216"
            ],
            [
              912,
              "10",
              "5216"
            ],
            [
              918,
              "10",
              "3540"
            ],
            [
              918,
              "10",
              "3540"
            ],
            [
              923,
              "10",
              "1816"
            ],
            [
              923,
              "10",
              "1816"
            ],
            [
              933,
              "10",
              "23240"
            ],
            [
              933,
              "10",
              "23240"
            ],
            [
              939,
              "10",
              "415"
            ],
            [
              939,
              "10",
              "415"
            ],
            [
              945,
              "10",
              "7199"
            ],
            [
              945,
              "10",
              "7199"
            ],
            [
              951,
              "10",
              "10965"
            ],
            [
              951,
              "10",
              "10965"
            ],
            [
              958,
              "10",
              "36029994"
            ],
            [
              958,
              "10",
              "36029994"
            ],
            [
              967,
              "10",
              "9427"
            ],
            [
              967,
              "10",
              "9427"
            ],
            [
              977,
              "10",
              "354"
            ],
            [
              977,
              "10",
              "354"
            ]
          ],
          "v": {
            "file.stem": "1baafac42896587ee5ad0fcd8ab29d8366d166bde6d8c5732af7105a719b239d",
            "file.basename": "1baafac42896587ee5ad0fcd8ab29d8366d166bde6d8c5732af7105a719b239d.ps1",
            "source.language": "powershell",
            "source.strings[0]": "000000000000011200000000000001460000000000000127000000000000014400000000000001450000000000000143000000000000013400000000000001390000000000000132",
            "source.strings[1]": "00000087000001170000013200000100000001370000012800000117",
            "source.strings[2]": "0000010100000119000001340000010400000115000001260000013500000119",
            "source.strings[3]": "01530183019801520187018301900182",
            "source.strings[4]": "10022518",
            "source.strings[5]": "1009800",
            "source.strings[6]": "10379125",
            "source.strings[7]": "10496673",
            "source.strings[8]": "1054688",
            "source.strings[9]": "1062622",
            "source.strings[10]": "107184",
            "source.strings[11]": "10732770",
            "source.strings[12]": "1085528",
            "source.strings[13]": "10916463",
            "source.strings[14]": "109450",
            "source.strings[15]": "11023188",
            "source.strings[16]": "1114531",
            "source.strings[17]": "1121076",
            "source.strings[18]": "1155554",
            "source.strings[19]": "1170904",
            "source.strings[20]": "11776770",
            "source.strings[21]": "11853600",
            "source.strings[22]": "124812",
            "source.strings[23]": "12712788",
            "source.strings[24]": "128040",
            "source.strings[25]": "12858769",
            "source.strings[26]": "12936281",
            "source.strings[27]": "13656370",
            "source.strings[28]": "1509189",
            "source.strings[29]": "153698",
            "source.strings[30]": "1542608",
            "source.strings[31]": "156517",
            "source.strings[32]": "157648",
            "source.strings[33]": "164257",
            "source.strings[34]": "16578580",
            "source.strings[35]": "16803990",
            "source.strings[36]": "17255964",
            "source.strings[37]": "177100",
            "source.strings[38]": "17816240",
            "source.strings[39]": "18381864",
            "source.strings[40]": "18718720",
            "source.strings[41]": "1910582",
            "source.strings[42]": "192556",
            "source.strings[43]": "19327440",
            "source.strings[44]": "196745",
            "source.strings[45]": "202059",
            "source.strings[46]": "20246016",
            "source.strings[47]": "20322464",
            "source.strings[48]": "20387558",
            "source.strings[49]": "204853",
            "source.strings[50]": "204929",
            "source.strings[51]": "2066475",
            "source.strings[52]": "209440",
            "source.strings[53]": "21360037",
            "source.strings[54]": "213895",
            "source.strings[55]": "21409960",
            "source.strings[56]": "2144934",
            "source.strings[57]": "215550",
            "source.strings[58]": "22135506",
            "source.strings[59]": "2286394",
            "source.strings[60]": "22920100",
            "source.strings[61]": "235008",
            "source.strings[62]": "24016608",
            "source.strings[63]": "241336",
            "source.strings[64]": "241450",
            "source.strings[65]": "242008",
            "source.strings[66]": "247104",
            "source.strings[67]": "24775280",
            "source.strings[68]": "25122124",
            "source.strings[69]": "258267",
            "source.strings[70]": "259350",
            "source.strings[71]": "25958889",
            "source.strings[72]": "274699",
            "source.strings[73]": "27569880",
            "source.strings[74]": "27577420",
            "source.strings[75]": "278502",
            "source.strings[76]": "28191054",
            "source.strings[77]": "28358044",
            "source.strings[78]": "286235",
            "source.strings[79]": "288964",
            "source.strings[80]": "29003180",
            "source.strings[81]": "29054013",
            "source.strings[82]": "29130321",
            "source.strings[83]": "292445",
            "source.strings[84]": "296892",
            "source.strings[85]": "29868063",
            "source.strings[86]": "29975751",
            "source.strings[87]": "300930",
            "source.strings[88]": "301767",
            "source.strings[89]": "313776",
            "source.strings[90]": "319010",
            "source.strings[91]": "32239515",
            "source.strings[92]": "324445",
            "source.strings[93]": "328914",
            "source.strings[94]": "331744",
            "source.strings[95]": "3377349",
            "source.strings[96]": "338624",
            "source.strings[97]": "342470",
            "source.strings[98]": "342768",
            "source.strings[99]": "350448",
            "source.functions[0]": "anonymous",
            "source.strings[100]": "359520",
            "source.strings[101]": "36029994",
            "source.strings[102]": "360666",
            "source.strings[103]": "36093811",
            "source.strings[104]": "36206750",
            "source.strings[105]": "36535569",
            "source.strings[106]": "3661856",
            "source.strings[107]": "37179466",
            "source.strings[108]": "372008",
            "source.strings[109]": "37545552",
            "source.strings[110]": "38232237",
            "source.strings[111]": "3837920",
            "source.strings[112]": "386860",
            "source.strings[113]": "38886650",
            "source.strings[114]": "389256",
            "source.strings[115]": "39062528",
            "source.strings[116]": "40038674",
            "source.strings[117]": "401856",
            "source.strings[118]": "40411584",
            "source.strings[119]": "404169",
            "source.strings[120]": "410616",
            "source.strings[121]": "41160825",
            "source.strings[122]": "41447235",
            "source.strings[123]": "41466920",
            "source.strings[124]": "419813",
            "source.strings[125]": "420056",
            "source.strings[126]": "42471920",
            "source.strings[127]": "424881",
            "source.strings[128]": "425700",
            "source.strings[129]": "42645336",
            "source.strings[130]": "4273500",
            "source.strings[131]": "42976359",
            "source.strings[132]": "435325",
            "source.strings[133]": "439774",
            "source.strings[134]": "45850560",
            "source.strings[135]": "461205",
            "source.strings[136]": "466792",
            "source.strings[137]": "467775",
            "source.strings[138]": "46835456",
            "source.strings[139]": "471165",
            "source.strings[140]": "47361930",
            "source.strings[141]": "489825",
            "source.strings[142]": "490280",
            "source.strings[143]": "4947150",
            "source.strings[144]": "49803540",
            "source.strings[145]": "501536",
            "source.strings[146]": "505512",
            "source.strings[147]": "5062326",
            "source.strings[148]": "507195",
            "source.strings[149]": "516150",
            "source.strings[150]": "52264212",
            "source.strings[151]": "523206",
            "source.strings[152]": "52365360",
            "source.strings[153]": "52848816",
            "source.strings[154]": "543222",
            "source.strings[155]": "5443513",
            "source.strings[156]": "553616",
            "source.strings[157]": "557924",
            "source.strings[158]": "564186",
            "source.strings[159]": "57455856",
            "source.strings[160]": "581356",
            "source.strings[161]": "5818527",
            "source.strings[162]": "5844608",
            "source.strings[163]": "5870439",
            "source.strings[164]": "5899680",
            "source.strings[165]": "59728692",
            "source.strings[166]": "6020754",
            "source.strings[167]": "6093276",
            "source.strings[168]": "6286448",
            "source.strings[169]": "638768",
            "source.strings[170]": "6391815",
            "source.strings[171]": "640548",
            "source.strings[172]": "65267811",
            "source.strings[173]": "657346",
            "source.strings[174]": "662230",
            "source.strings[175]": "664278",
            "source.strings[176]": "66634254",
            "source.strings[177]": "670557",
            "source.strings[178]": "6839052",
            "source.strings[179]": "689988",
            "source.strings[180]": "69573228",
            "source.strings[181]": "7082663",
            "source.strings[182]": "713064",
            "source.strings[183]": "732024",
            "source.strings[184]": "736362",
            "source.strings[185]": "75272688",
            "source.strings[186]": "77125804",
            "source.strings[187]": "797771",
            "source.strings[188]": "799260",
            "source.strings[189]": "801020",
            "source.strings[190]": "803758",
            "source.strings[191]": "810610",
            "source.strings[192]": "81381600",
            "source.strings[193]": "815177",
            "source.strings[194]": "815724",
            "source.strings[195]": "827640",
            "source.strings[196]": "8449142",
            "source.strings[197]": "847014",
            "source.strings[198]": "849420",
            "source.strings[199]": "85505340",
            "source.strings[200]": "8635770",
            "source.strings[201]": "8683892",
            "source.strings[202]": "8771274",
            "source.strings[203]": "8807301",
            "source.strings[204]": "89853568",
            "source.strings[205]": "908010",
            "source.strings[206]": "927079",
            "source.strings[207]": "93849420",
            "source.strings[208]": "9392943",
            "source.strings[209]": "9726815",
            "source.strings[210]": "972731",
            "source.strings[211]": "983290",
            "source.strings[212]": "9878872",
            "source.strings[213]": "988818",
            "source.strings[214]": "uwngxpykoqcj"
          },
          "ct": [
            "0..6",
            "0..7",
            "0..8",
            "ForEach-Object",
            "New-Object",
            "iba14p5rqz90c3wvoyethgl28kj",
            "iex"
          ],
          "id": "powershell"
        },
        "id": 0,
        "sz": 20542,
        "ts": [
          {
            "a": "T1027",
            "c": 0.8600000143051147,
            "d": "Multiple embedded base64 literals",
            "e": [
              "01530183019801520187018301900182",
              "00000000000001120000000000000146000000000000012700000000000001440000000000000145000000000000014300000000000001340000000000000139",
              "00000087000001170000013200000100000001370000012800000117",
              "0000010100000119000001340000010400000115000001260000013500000119"
            ],
            "i": "objectives/command-and-control/dropper/staging/encrypted::multiple-base64-literals",
            "l": 1,
            "m": "C0025",
            "el": [
              "0xf70",
              "0xacd",
              "0xea1",
              "0x11a0"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Very long line",
            "e": [
              "text.max_line_length = 10732.00"
            ],
            "i": "metadata/file/text/metrics::single-long-line",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Last line is over 1000 chars",
            "e": [
              "text.last_line_length = 10732.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1204.002",
            "c": 0.8999999761581421,
            "d": "PowerShell archive extraction command marker",
            "e": [
              "7z"
            ],
            "i": "objectives/command-and-control/dropper/staging/archive::powershell-archive-extract",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "File has 30 or more lines",
            "e": [
              "text.total_lines = 30.00"
            ],
            "i": "metadata/file/text/metrics::file-has-30-plus-lines",
            "l": 1
          },
          {
            "c": 0.7799999713897705,
            "d": "PowerShell type accelerator syntax",
            "e": [
              "[math]::"
            ],
            "i": "metadata/lang/scripted::type-accelerator",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Valid PowerShell code",
            "e": [
              "param("
            ],
            "i": "metadata/lang/scripted::ps-valid",
            "l": 2
          },
          {
            "a": "T1059.001",
            "c": 0.75,
            "d": "Invoke-Expression cmdlet",
            "e": [
              "iex"
            ],
            "i": "objectives/execution/interpreter/eval/invoke::iex",
            "l": 3,
            "m": "E1059"
          },
          {
            "a": "T1204.002",
            "d": "PowerShell bitwise XOR operator",
            "e": [
              "-bxor"
            ],
            "i": "objectives/command-and-control/dropper/lnk/remcos::powershell-bxor-op",
            "l": 2
          },
          {
            "c": 0.8500000238418579,
            "d": "PowerShell or VBScript line bloat",
            "e": [
              "text.avg_line_length = 682.73"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::script-host-line-bloat",
            "l": 4
          },
          {
            "a": "T1027",
            "c": 0.8500000238418579,
            "d": "Suspicious long PowerShell line",
            "e": [
              "text.max_line_length = 10732.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::ps-suspicious-single-line",
            "l": 4,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8500000238418579,
            "d": "Multiple long lines (\u003e1000 chars)",
            "e": [
              "text.lines_over_1000 = 2.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::very-long-lines",
            "l": 2,
            "m": "B0032"
          },
          {
            "c": 0.8500000238418579,
            "d": "High ratio of entropy-heavy identifiers",
            "e": [
              "identifiers.high_entropy_ratio = 0.47"
            ],
            "i": "metadata/file/text/metrics::high-entropy-identifier-ratio",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Very low whitespace ratio (minified/compressed)",
            "e": [
              "text.whitespace_ratio = 0.02"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "High overall text entropy (encoded",
            "e": [
              "text.char_entropy = 5.96"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::high-text-entropy",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Many random-looking source identifier names",
            "e": [
              "identifiers.high_entropy_ratio = 0.47"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::many-high-entropy-identifiers",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Identifier obfuscation (random/encoded names)",
            "e": [
              "identifiers.high_entropy_ratio = 0.47"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::identifier-obfuscation",
            "l": 3,
            "m": "B0032"
          }
        ],
        "sha": "1baafac42896587ee5ad0fcd8ab29d8366d166bde6d8c5732af7105a719b239d",
        "path": "1baafac42896587ee5ad0fcd8ab29d8366d166bde6d8c5732af7105a719b239d.ps1",
        "type": "powershell"
      }
    ],
    "tv": "52045"
  }
}