{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 1.0,
        "class": 2,
        "threshold": 1.0
      }
    ],
    "prob": 1.0,
    "class": 2,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.9432624,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.99918854,
        "class": 0
      },
      {
        "m": "az/powershell",
        "prob": 1.0,
        "class": 2
      }
    ],
    "version": "v17.17",
    "threshold": 1.0,
    "analyzed_at": "2026-05-31T09:26:04Z"
  },
  "path": "4012b6548bacbf00a32c94afa4a800fa450abc93ebb2081a6a64e97b9039cde4.ps1",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "O₂(As₃Xe)",
        "x": 36,
        "ff": {
          "m": {
            "ast": {
              "max_depth": 199.0,
              "call_count": 24.0,
              "node_count": 17697.0,
              "identifier_count": 35.0,
              "string_literal_count": 16.0,
              "array_literal_max_length": 55.0
            },
            "file": {
              "size": 20065.0,
              "entropy": 6.01,
              "size_bytes": 20065.0
            },
            "text": {
              "tab_count": 7.0,
              "digit_ratio": 0.38,
              "space_count": 345.0,
              "total_lines": 30.0,
              "char_entropy": 6.01,
              "mixed_indent": 1.0,
              "unique_chars": 87.0,
              "lines_over_200": 12.0,
              "lines_over_500": 6.0,
              "string_density": 0.53,
              "avg_line_length": 666.83,
              "lines_over_1000": 2.0,
              "max_line_length": 11031.0,
              "empty_line_ratio": 0.13,
              "last_line_length": 11031.0,
              "long_token_count": 19.0,
              "whitespace_ratio": 0.02,
              "most_common_ratio": 0.05,
              "identifier_density": 3.93,
              "line_length_stddev": 2046.69,
              "encoded_string_ratio": 0.44,
              "normalized_string_count": 2.92,
              "repeated_char_sequences": 14.0,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 2.0,
              "trailing_whitespace_lines": 1.0,
              "most_common_char_codepoint": 48.0,
              "normalized_unique_identifiers": 7.13
            },
            "calls": {
              "count": 24.0
            },
            "source": {
              "function_count": 1.0
            },
            "strings": {
              "total": 16.0,
              "avg_length": 719.25,
              "max_length": 10748.0,
              "avg_entropy": 2.49,
              "empty_count": 8.0,
              "hex_strings": 6.0,
              "total_bytes": 11508.0,
              "entropy_stddev": 1.51,
              "base64_candidates": 1.0,
              "very_long_strings": 1.0,
              "high_entropy_count": 1.0
            },
            "functions": {
              "count": 1.0
            },
            "identifiers": {
              "count": 35.0,
              "total": 118.0,
              "avg_length": 13.34,
              "max_length": 37.0,
              "min_length": 2.0,
              "avg_entropy": 3.03,
              "reuse_ratio": 0.3,
              "unique_count": 35.0,
              "length_stddev": 8.7,
              "has_digit_ratio": 0.51,
              "high_entropy_count": 15.0,
              "high_entropy_ratio": 0.43,
              "all_lowercase_ratio": 0.09,
              "numeric_suffix_count": 2.0
            }
          },
          "s": [
            [
              70,
              "10",
              "36"
            ],
            [
              70,
              "10",
              "36"
            ],
            [
              73,
              "10",
              "17"
            ],
            [
              73,
              "10",
              "17"
            ],
            [
              78,
              "10",
              "447044"
            ],
            [
              78,
              "10",
              "447044"
            ],
            [
              86,
              "10",
              "7288"
            ],
            [
              86,
              "10",
              "7288"
            ],
            [
              91,
              "10",
              "1309"
            ],
            [
              91,
              "10",
              "1309"
            ],
            [
              99,
              "10",
              "518985"
            ],
            [
              99,
              "10",
              "518985"
            ],
            [
              106,
              "10",
              "9105"
            ],
            [
              106,
              "10",
              "9105"
            ],
            [
              114,
              "10",
              "3725"
            ],
            [
              114,
              "10",
              "3725"
            ],
            [
              120,
              "10",
              "12522"
            ],
            [
              120,
              "10",
              "12522"
            ],
            [
              127,
              "10",
              "42667866"
            ],
            [
              127,
              "10",
              "42667866"
            ],
            [
              136,
              "10",
              "4878"
            ],
            [
              136,
              "10",
              "4878"
            ],
            [
              145,
              "10",
              "703"
            ],
            [
              145,
              "10",
              "703"
            ],
            [
              150,
              "10",
              "3124"
            ],
            [
              150,
              "10",
              "3124"
            ],
            [
              155,
              "10",
              "2477"
            ],
            [
              155,
              "10",
              "2477"
            ],
            [
              163,
              "10",
              "605"
            ],
            [
              163,
              "10",
              "605"
            ],
            [
              168,
              "10",
              "8890"
            ],
            [
              168,
              "10",
              "8890"
            ],
            [
              174,
              "10",
              "12544"
            ],
            [
              174,
              "10",
              "12544"
            ],
            [
              180,
              "10",
              "4205"
            ],
            [
              180,
              "10",
              "4205"
            ],
            [
              189,
              "10",
              "509432"
            ],
            [
              189,
              "10",
              "509432"
            ],
            [
              196,
              "10",
              "9097"
            ],
            [
              196,
              "10",
              "9097"
            ],
            [
              203,
              "10",
              "918"
            ],
            [
              203,
              "10",
              "918"
            ],
            [
              209,
              "10",
              "257"
            ],
            [
              209,
              "10",
              "257"
            ],
            [
              213,
              "10",
              "1120"
            ],
            [
              213,
              "10",
              "1120"
            ],
            [
              221,
              "10",
              "136895"
            ],
            [
              221,
              "10",
              "136895"
            ],
            [
              229,
              "10",
              "2853"
            ],
            [
              229,
              "10",
              "2853"
            ],
            [
              234,
              "10",
              "364"
            ],
            [
              234,
              "10",
              "364"
            ],
            [
              241,
              "10",
              "3217"
            ],
            [
              241,
              "10",
              "3217"
            ],
            [
              246,
              "10",
              "3167"
            ],
            [
              246,
              "10",
              "3167"
            ],
            [
              253,
              "10",
              "361144"
            ],
            [
              253,
              "10",
              "361144"
            ],
            [
              261,
              "10",
              "3437"
            ],
            [
              261,
              "10",
              "3437"
            ],
            [
              266,
              "10",
              "3012"
            ],
            [
              266,
              "10",
              "3012"
            ],
            [
              274,
              "10",
              "31104"
            ],
            [
              274,
              "10",
              "31104"
            ],
            [
              282,
              "10",
              "7616"
            ],
            [
              282,
              "10",
              "7616"
            ],
            [
              287,
              "10",
              "8264"
            ],
            [
              287,
              "10",
              "8264"
            ],
            [
              296,
              "10",
              "7287"
            ],
            [
              296,
              "10",
              "7287"
            ],
            [
              301,
              "10",
              "7336"
            ],
            [
              301,
              "10",
              "7336"
            ],
            [
              308,
              "10",
              "396275"
            ],
            [
              308,
              "10",
              "396275"
            ],
            [
              315,
              "10",
              "7205"
            ],
            [
              315,
              "10",
              "7205"
            ],
            [
              322,
              "10",
              "501072"
            ],
            [
              322,
              "10",
              "501072"
            ],
            [
              329,
              "10",
              "9636"
            ],
            [
              329,
              "10",
              "9636"
            ],
            [
              337,
              "10",
              "7638"
            ],
            [
              337,
              "10",
              "7638"
            ],
            [
              343,
              "10",
              "5793"
            ],
            [
              343,
              "10",
              "5793"
            ],
            [
              350,
              "10",
              "2981"
            ],
            [
              350,
              "10",
              "2981"
            ],
            [
              355,
              "10",
              "4882"
            ],
            [
              355,
              "10",
              "4882"
            ],
            [
              364,
              "10",
              "204228"
            ],
            [
              364,
              "10",
              "204228"
            ],
            [
              371,
              "10",
              "3782"
            ],
            [
              371,
              "10",
              "3782"
            ],
            [
              378,
              "10",
              "176680"
            ],
            [
              378,
              "10",
              "176680"
            ],
            [
              385,
              "10",
              "3155"
            ],
            [
              385,
              "10",
              "3155"
            ],
            [
              392,
              "10",
              "3079"
            ],
            [
              392,
              "10",
              "3079"
            ],
            [
              398,
              "10",
              "5588"
            ],
            [
              398,
              "10",
              "5588"
            ],
            [
              404,
              "10",
              "5482"
            ],
            [
              404,
              "10",
              "5482"
            ],
            [
              409,
              "10",
              "2917"
            ],
            [
              409,
              "10",
              "2917"
            ],
            [
              419,
              "10",
              "8924"
            ],
            [
              419,
              "10",
              "8924"
            ],
            [
              425,
              "10",
              "1441"
            ],
            [
              425,
              "10",
              "1441"
            ],
            [
              431,
              "10",
              "1865"
            ],
            [
              431,
              "10",
              "1865"
            ],
            [
              437,
              "10",
              "3996"
            ],
            [
              437,
              "10",
              "3996"
            ],
            [
              442,
              "10",
              "1671"
            ],
            [
              442,
              "10",
              "1671"
            ],
            [
              452,
              "10",
              "477252"
            ],
            [
              452,
              "10",
              "477252"
            ],
            [
              459,
              "10",
              "8838"
            ],
            [
              459,
              "10",
              "8838"
            ],
            [
              467,
              "10",
              "9685"
            ],
            [
              467,
              "10",
              "9685"
            ],
            [
              472,
              "10",
              "9741"
            ],
            [
              472,
              "10",
              "9741"
            ],
            [
              479,
              "10",
              "6789"
            ],
            [
              479,
              "10",
              "6789"
            ],
            [
              485,
              "10",
              "64121148"
            ],
            [
              485,
              "10",
              "64121148"
            ],
            [
              495,
              "10",
              "8217486"
            ],
            [
              495,
              "10",
              "8217486"
            ],
            [
              505,
              "10",
              "9159"
            ],
            [
              505,
              "10",
              "9159"
            ],
            [
              511,
              "10",
              "46722564"
            ],
            [
              511,
              "10",
              "46722564"
            ],
            [
              521,
              "10",
              "1616"
            ],
            [
              521,
              "10",
              "1616"
            ],
            [
              527,
              "10",
              "2954620"
            ],
            [
              527,
              "10",
              "2954620"
            ],
            [
              535,
              "10",
              "970"
            ],
            [
              535,
              "10",
              "970"
            ],
            [
              548,
              "10",
              "9145"
            ],
            [
              548,
              "10",
              "9145"
            ],
            [
              553,
              "10",
              "9197"
            ],
            [
              553,
              "10",
              "9197"
            ],
            [
              560,
              "10",
              "9295"
            ],
            [
              560,
              "10",
              "9295"
            ],
            [
              565,
              "10",
              "9240"
            ],
            [
              565,
              "10",
              "9240"
            ],
            [
              573,
              "10",
              "2831"
            ],
            [
              573,
              "10",
              "2831"
            ],
            [
              579,
              "10",
              "12179"
            ],
            [
              579,
              "10",
              "12179"
            ],
            [
              585,
              "10",
              "9298"
            ],
            [
              585,
              "10",
              "9298"
            ],
            [
              594,
              "10",
              "8224"
            ],
            [
              594,
              "10",
              "8224"
            ],
            [
              599,
              "10",
              "8280"
            ],
            [
              599,
              "10",
              "8280"
            ],
            [
              606,
              "10",
              "10104"
            ],
            [
              606,
              "10",
              "10104"
            ],
            [
              613,
              "10",
              "7722"
            ],
            [
              613,
              "10",
              "7722"
            ],
            [
              619,
              "10",
              "7229"
            ],
            [
              619,
              "10",
              "7229"
            ],
            [
              626,
              "10",
              "3044"
            ],
            [
              626,
              "10",
              "3044"
            ],
            [
              632,
              "10",
              "12883"
            ],
            [
              632,
              "10",
              "12883"
            ],
            [
              639,
              "10",
              "8063664"
            ],
            [
              639,
              "10",
              "8063664"
            ],
            [
              647,
              "10",
              "1631"
            ],
            [
              647,
              "10",
              "1631"
            ],
            [
              660,
              "10",
              "1824"
            ],
            [
              660,
              "10",
              "1824"
            ],
            [
              666,
              "10",
              "5215"
            ],
            [
              666,
              "10",
              "5215"
            ],
            [
              671,
              "10",
              "3336"
            ],
            [
              671,
              "10",
              "3336"
            ],
            [
              680,
              "10",
              "4360"
            ],
            [
              680,
              "10",
              "4360"
            ],
            [
              686,
              "10",
              "6688"
            ],
            [
              686,
              "10",
              "6688"
            ],
            [
              692,
              "10",
              "5902"
            ],
            [
              692,
              "10",
              "5902"
            ],
            [
              697,
              "10",
              "3624"
            ],
            [
              697,
              "10",
              "3624"
            ],
            [
              706,
              "10",
              "2505"
            ],
            [
              706,
              "10",
              "2505"
            ],
            [
              711,
              "10",
              "2449"
            ],
            [
              711,
              "10",
              "2449"
            ],
            [
              718,
              "10",
              "352457"
            ],
            [
              718,
              "10",
              "352457"
            ],
            [
              725,
              "10",
              "7193"
            ],
            [
              725,
              "10",
              "7193"
            ],
            [
              733,
              "10",
              "7778"
            ],
            [
              733,
              "10",
              "7778"
            ],
            [
              739,
              "10",
              "29189484"
            ],
            [
              739,
              "10",
              "29189484"
            ],
            [
              749,
              "10",
              "3633"
            ],
            [
              749,
              "10",
              "3633"
            ],
            [
              754,
              "10",
              "93"
            ],
            [
              754,
              "10",
              "93"
            ],
            [
              761,
              "10",
              "1913"
            ],
            [
              761,
              "10",
              "1913"
            ],
            [
              768,
              "10",
              "5359"
            ],
            [
              768,
              "10",
              "5359"
            ],
            [
              774,
              "10",
              "67269657"
            ],
            [
              774,
              "10",
              "67269657"
            ],
            [
              783,
              "10",
              "9321"
            ],
            [
              783,
              "10",
              "9321"
            ],
            [
              793,
              "10",
              "7440"
            ],
            [
              793,
              "10",
              "7440"
            ],
            [
              799,
              "10",
              "11893"
            ],
            [
              799,
              "10",
              "11893"
            ],
            [
              805,
              "10",
              "4404"
            ],
            [
              805,
              "10",
              "4404"
            ],
            [
              814,
              "10",
              "8945"
            ],
            [
              814,
              "10",
              "8945"
            ],
            [
              819,
              "10",
              "9000"
            ],
            [
              819,
              "10",
              "9000"
            ],
            [
              826,
              "10",
              "8500"
            ],
            [
              826,
              "10",
              "8500"
            ],
            [
              832,
              "10",
              "17810"
            ],
            [
              832,
              "10",
              "17810"
            ],
            [
              838,
              "10",
              "9361"
            ],
            [
              838,
              "10",
              "9361"
            ],
            [
              846,
              "10",
              "3240"
            ],
            [
              846,
              "10",
              "3240"
            ],
            [
              851,
              "10",
              "60"
            ],
            [
              851,
              "10",
              "60"
            ],
            [
              856,
              "10",
              "7204"
            ],
            [
              856,
              "10",
              "7204"
            ],
            [
              862,
              "10",
              "1927"
            ],
            [
              862,
              "10",
              "1927"
            ],
            [
              867,
              "10",
              "5221"
            ],
            [
              867,
              "10",
              "5221"
            ],
            [
              875,
              "10",
              "38416"
            ],
            [
              875,
              "10",
              "38416"
            ],
            [
              881,
              "10",
              "686"
            ],
            [
              881,
              "10",
              "686"
            ],
            [
              887,
              "10",
              "36"
            ],
            [
              887,
              "10",
              "36"
            ],
            [
              892,
              "10",
              "4211"
            ],
            [
              892,
              "10",
              "4211"
            ],
            [
              897,
              "10",
              "4231"
            ],
            [
              897,
              "10",
              "4231"
            ],
            [
              905,
              "10",
              "127710"
            ],
            [
              905,
              "10",
              "127710"
            ],
            [
              914,
              "10",
              "6925"
            ],
            [
              914,
              "10",
              "6925"
            ],
            [
              919,
              "10",
              "9247"
            ],
            [
              919,
              "10",
              "9247"
            ],
            [
              928,
              "10",
              "8261"
            ],
            [
              928,
              "10",
              "8261"
            ],
            [
              933,
              "10",
              "8317"
            ],
            [
              933,
              "10",
              "8317"
            ],
            [
              940,
              "10",
              "9176"
            ],
            [
              940,
              "10",
              "9176"
            ]
          ],
          "v": {
            "file.stem": "4012b6548bacbf00a32c94afa4a800fa450abc93ebb2081a6a64e97b9039cde4",
            "file.basename": "4012b6548bacbf00a32c94afa4a800fa450abc93ebb2081a6a64e97b9039cde4.ps1",
            "source.language": "powershell",
            "source.strings[0]": "00000000000001690000000000000187000000000000020200000000000001720000000000000183000000000000019400000000000002030000000000000187",
            "source.strings[1]": "0000009000000140000001400000012600000134000001230000013300000146",
            "source.strings[2]": "00000097000000970000010300000099000001020000010400000096000001040000010200000103000001020000010100000102000001040000010300000103000001020000010300000105000001040000010200000102000001040000010400000096000001040000010200000103000001020000010000000100000001040000009700000103000001020000010400000103000001000000009700000102000001040000010300000102000001030000010500000103000000980000010300000097",
            "source.strings[3]": "0000012500000155000001700000012400000159000001550000016200000154",
            "source.strings[4]": "000001530000018700000168000001850000018600000184000001750000018000000173",
            "source.strings[5]": "0092012201370105014201330122",
            "source.strings[6]": "1000758",
            "source.strings[7]": "10187315",
            "source.strings[8]": "1044696",
            "source.strings[9]": "10465322",
            "source.strings[10]": "106110",
            "source.strings[11]": "108528",
            "source.strings[12]": "10888110",
            "source.strings[13]": "1095504",
            "source.strings[14]": "1101420",
            "source.strings[15]": "12293850",
            "source.strings[16]": "127710",
            "source.strings[17]": "12957792",
            "source.strings[18]": "131424",
            "source.strings[19]": "132720",
            "source.strings[20]": "135300",
            "source.strings[21]": "1367058",
            "source.strings[22]": "136895",
            "source.strings[23]": "13998516",
            "source.strings[24]": "140724",
            "source.strings[25]": "150793",
            "source.strings[26]": "15364566",
            "source.strings[27]": "1545918",
            "source.strings[28]": "16622928",
            "source.strings[29]": "1693461",
            "source.strings[30]": "176088",
            "source.strings[31]": "176680",
            "source.strings[32]": "17758506",
            "source.strings[33]": "17870550",
            "source.strings[34]": "18168325",
            "source.strings[35]": "18288138",
            "source.strings[36]": "1836472",
            "source.strings[37]": "194139",
            "source.strings[38]": "19539232",
            "source.strings[39]": "1990632",
            "source.strings[40]": "19914720",
            "source.strings[41]": "199430",
            "source.strings[42]": "20315008",
            "source.strings[43]": "204228",
            "source.strings[44]": "207280",
            "source.strings[45]": "22484816",
            "source.strings[46]": "225968",
            "source.strings[47]": "227659",
            "source.strings[48]": "2276656",
            "source.strings[49]": "2287782",
            "source.strings[50]": "2338248",
            "source.strings[51]": "23669783",
            "source.strings[52]": "239455",
            "source.strings[53]": "241452",
            "source.strings[54]": "245976",
            "source.strings[55]": "250560",
            "source.strings[56]": "260928",
            "source.strings[57]": "27448200",
            "source.strings[58]": "27464550",
            "source.strings[59]": "27548200",
            "source.strings[60]": "27651834",
            "source.strings[61]": "285956",
            "source.strings[62]": "28803740",
            "source.strings[63]": "29189484",
            "source.strings[64]": "2954620",
            "source.strings[65]": "299364",
            "source.strings[66]": "30200613",
            "source.strings[67]": "30482622",
            "source.strings[68]": "309075",
            "source.strings[69]": "31016498",
            "source.strings[70]": "321930",
            "source.strings[71]": "33257601",
            "source.strings[72]": "33832800",
            "source.strings[73]": "340808",
            "source.strings[74]": "341885",
            "source.strings[75]": "3444057",
            "source.strings[76]": "346834",
            "source.strings[77]": "350427",
            "source.strings[78]": "35235018",
            "source.strings[79]": "352457",
            "source.strings[80]": "361144",
            "source.strings[81]": "3674264",
            "source.strings[82]": "38500076",
            "source.strings[83]": "388873",
            "source.strings[84]": "396275",
            "source.strings[85]": "411730",
            "source.strings[86]": "41709176",
            "source.strings[87]": "41739354",
            "source.strings[88]": "417973",
            "source.strings[89]": "42667866",
            "source.strings[90]": "42838851",
            "source.strings[91]": "428960",
            "source.strings[92]": "435580",
            "source.strings[93]": "447044",
            "source.strings[94]": "448200",
            "source.strings[95]": "448238",
            "source.strings[96]": "45778689",
            "source.strings[97]": "45885366",
            "source.strings[98]": "463772",
            "source.strings[99]": "46722564",
            "source.functions[0]": "anonymous",
            "source.strings[100]": "467871",
            "source.strings[101]": "46859748",
            "source.strings[102]": "471357",
            "source.strings[103]": "473084",
            "source.strings[104]": "477252",
            "source.strings[105]": "480356",
            "source.strings[106]": "482872",
            "source.strings[107]": "4911374",
            "source.strings[108]": "495672",
            "source.strings[109]": "50072088",
            "source.strings[110]": "501072",
            "source.strings[111]": "50257510",
            "source.strings[112]": "509432",
            "source.strings[113]": "518985",
            "source.strings[114]": "520724",
            "source.strings[115]": "52279470",
            "source.strings[116]": "52474706",
            "source.strings[117]": "534240",
            "source.strings[118]": "538430",
            "source.strings[119]": "543976",
            "source.strings[120]": "5786752",
            "source.strings[121]": "5816008",
            "source.strings[122]": "58842819",
            "source.strings[123]": "589896",
            "source.strings[124]": "592460",
            "source.strings[125]": "59490545",
            "source.strings[126]": "613346",
            "source.strings[127]": "6177950",
            "source.strings[128]": "61779564",
            "source.strings[129]": "64121148",
            "source.strings[130]": "642262",
            "source.strings[131]": "647168",
            "source.strings[132]": "64813644",
            "source.strings[133]": "664818",
            "source.strings[134]": "669191",
            "source.strings[135]": "67269657",
            "source.strings[136]": "680814",
            "source.strings[137]": "689655",
            "source.strings[138]": "70673148",
            "source.strings[139]": "711100",
            "source.strings[140]": "727226",
            "source.strings[141]": "735570",
            "source.strings[142]": "76486332",
            "source.strings[143]": "77045836",
            "source.strings[144]": "77559570",
            "source.strings[145]": "78346275",
            "source.strings[146]": "789376",
            "source.strings[147]": "8063664",
            "source.strings[148]": "816988",
            "source.strings[149]": "818736",
            "source.strings[150]": "8217486",
            "source.strings[151]": "83918430",
            "source.strings[152]": "849332",
            "source.strings[153]": "8609446",
            "source.strings[154]": "8610100",
            "source.strings[155]": "863388",
            "source.strings[156]": "86708444",
            "source.strings[157]": "889200",
            "source.strings[158]": "921726",
            "source.strings[159]": "9431590",
            "source.strings[160]": "972835",
            "source.strings[161]": "9847930",
            "source.strings[162]": "bczyfpiog21r"
          },
          "ct": [
            "0..48",
            "0..6",
            "0..7",
            "0..8",
            "ForEach-Object",
            "New-Object",
            "iex",
            "sr3v7m12508dbo96ywthkueljgx"
          ],
          "id": "powershell"
        },
        "id": 0,
        "sz": 20065,
        "ts": [
          {
            "a": "T1027",
            "c": 0.8600000143051147,
            "d": "Multiple embedded base64 literals",
            "e": [
              "0000009000000140000001400000012600000134000001230000013300000146",
              "0000012500000155000001700000012400000159000001550000016200000154",
              "00000097000000970000010300000099000001020000010400000096000001040000010200000103000001020000010100000102000001040000010300000103",
              "0092012201370105014201330122",
              "00000000000001690000000000000187000000000000020200000000000001720000000000000183000000000000019400000000000002030000000000000187",
              "000001530000018700000168000001850000018600000184000001750000018000000173"
            ],
            "i": "objectives/command-and-control/dropper/staging/encrypted::multiple-base64-literals",
            "l": 1,
            "m": "C0025",
            "el": [
              "0xab1",
              "0xc24",
              "0x52a",
              "0xb6b",
              "0xe36",
              "0x9c5"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Very long line",
            "e": [
              "text.max_line_length = 11031.00"
            ],
            "i": "metadata/file/text/metrics::single-long-line",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Last line is over 1000 chars",
            "e": [
              "text.last_line_length = 11031.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1204.002",
            "c": 0.8999999761581421,
            "d": "PowerShell archive extraction command marker",
            "e": [
              "7z"
            ],
            "i": "objectives/command-and-control/dropper/staging/archive::powershell-archive-extract",
            "l": 1
          },
          {
            "a": "T1614",
            "c": 0.6000000238418579,
            "d": "Country code AZ token",
            "e": [
              "+AZ/"
            ],
            "i": "objectives/anti-analysis/geofencing/region/country-code-a::country-code-az",
            "l": 1,
            "m": "B0007.003"
          },
          {
            "c": 0.8999999761581421,
            "d": "File has 30 or more lines",
            "e": [
              "text.total_lines = 30.00"
            ],
            "i": "metadata/file/text/metrics::file-has-30-plus-lines",
            "l": 1
          },
          {
            "c": 0.7799999713897705,
            "d": "PowerShell type accelerator syntax",
            "e": [
              "[math]::"
            ],
            "i": "metadata/lang/scripted::type-accelerator",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Valid PowerShell code",
            "e": [
              "param("
            ],
            "i": "metadata/lang/scripted::ps-valid",
            "l": 2
          },
          {
            "a": "T1059.001",
            "c": 0.75,
            "d": "Invoke-Expression cmdlet",
            "e": [
              "iex"
            ],
            "i": "objectives/execution/interpreter/eval/invoke::iex",
            "l": 3,
            "m": "E1059"
          },
          {
            "a": "T1204.002",
            "d": "PowerShell bitwise XOR operator",
            "e": [
              "-bxor"
            ],
            "i": "objectives/command-and-control/dropper/lnk/remcos::powershell-bxor-op",
            "l": 2
          },
          {
            "c": 0.8500000238418579,
            "d": "PowerShell or VBScript line bloat",
            "e": [
              "text.avg_line_length = 666.83"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::script-host-line-bloat",
            "l": 4
          },
          {
            "a": "T1027",
            "c": 0.8500000238418579,
            "d": "Suspicious long PowerShell line",
            "e": [
              "text.max_line_length = 11031.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::ps-suspicious-single-line",
            "l": 4,
            "m": "B0032"
          },
          {
            "a": "T1140",
            "c": 0.6000000238418579,
            "d": "Very long base64 strings present",
            "e": [
              "00000097000000970000010300000099000001020000010400000096000001040000010200000103000001020000010100000102000001040000010300000103"
            ],
            "i": "micro-behaviors/data/encode/payload::large-base64-string-literals",
            "l": 3,
            "m": "C0043",
            "el": [
              "0x52a"
            ]
          },
          {
            "a": "T1027",
            "c": 0.8500000238418579,
            "d": "Multiple long lines (\u003e1000 chars)",
            "e": [
              "text.lines_over_1000 = 2.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::very-long-lines",
            "l": 2,
            "m": "B0032"
          },
          {
            "c": 0.8500000238418579,
            "d": "High ratio of entropy-heavy identifiers",
            "e": [
              "identifiers.high_entropy_ratio = 0.43"
            ],
            "i": "metadata/file/text/metrics::high-entropy-identifier-ratio",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Very low whitespace ratio (minified/compressed)",
            "e": [
              "text.whitespace_ratio = 0.02"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "High overall text entropy (encoded",
            "e": [
              "text.char_entropy = 6.01"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::high-text-entropy",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Many random-looking source identifier names",
            "e": [
              "identifiers.high_entropy_ratio = 0.43"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::many-high-entropy-identifiers",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Identifier obfuscation (random/encoded names)",
            "e": [
              "identifiers.high_entropy_ratio = 0.43"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::identifier-obfuscation",
            "l": 3,
            "m": "B0032"
          }
        ],
        "sha": "4012b6548bacbf00a32c94afa4a800fa450abc93ebb2081a6a64e97b9039cde4",
        "path": "4012b6548bacbf00a32c94afa4a800fa450abc93ebb2081a6a64e97b9039cde4.ps1",
        "type": "powershell"
      }
    ],
    "tv": "52045"
  }
}