{ "ml": { "l": -1, "v": "6", "fs": [ { "l": -1, "id": 0, "prob": 0.946899950504303 } ], "prob": 0.94689995, "models": [ { "m": "az", "raw": 0.45513287, "prob": 0.94689995, "class": 0 }, { "m": "az/source", "raw": 0.45490634, "prob": 0.91582, "class": 0 }, { "m": "az/csharp", "raw": 0.9898875, "prob": 0.8965517, "class": 0 } ], "version": "v17.17", "analyzed_at": "2026-06-07T16:21:59Z" }, "path": "Camera.cs", "raw": { "v": "6", "fs": [ { "f": "O(As)H(Db)", "x": 37, "ff": { "i": [ [ "", "FindDevices" ], [ "", "GetFiltes" ], [ "", "EnumMonikers" ], [ "", "func" ], [ "", "System" ], [ "", "System.Collections.Generic" ], [ "", "System.Drawing" ], [ "", "System.Linq" ], [ "", "System.Runtime.InteropServices" ], [ "", "System.Runtime.InteropServices.ComTypes" ], [ "", "System.Text" ] ], "m": { "ast": { "op.eq": 4.0, "op.ne": 3.0, "max_depth": 19.0, "bind_count": 1.0, "call_count": 20.0, "node_count": 894.0, "member_count": 14.0, "op_density.eq": 0.0, "op_density.ne": 0.0, "identifier_count": 72.0, "member_depth_max": 2.0, "string_literal_count": 6.0, "array_literal_max_length": 1.0 }, "file": { "size": 3661.0, "entropy": 4.46, "size_bytes": 3661.0 }, "text": { "digit_ratio": 0.06, "space_count": 1247.0, "total_lines": 101.0, "char_entropy": 4.46, "unique_chars": 77.0, "string_density": 0.06, "avg_line_length": 35.25, "high_byte_ratio": 0.0, "max_line_length": 138.0, "non_ascii_ratio": 0.0, "empty_line_ratio": 0.09, "last_line_length": 1.0, "whitespace_ratio": 0.37, "most_common_ratio": 0.06, "identifier_density": 1.57, "line_length_stddev": 32.85, "normalized_string_count": 0.6, "repeated_char_sequences": 56.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 101.0, "normalized_unique_identifiers": 10.81 }, "binds": { "count": 1.0 }, "calls": { "count": 20.0 }, "binary": { "overall_entropy": 4.46 }, "source": { "class_count": 3.0, "function_count": 7.0 }, "imports": { "count": 7.0, "unique_modules": 7.0, "third_party_count": 7.0, "third_party_ratio": 1.0 }, "members": { "count": 14.0 }, "strings": { "total": 6.0, "avg_length": 33.0, "max_length": 38.0, "avg_entropy": 3.62, "total_bytes": 198.0, "entropy_stddev": 0.12 }, "functions": { "count": 10.0 }, "identifiers": { "count": 72.0, "total": 159.0, "avg_length": 8.61, "max_length": 30.0, "min_length": 2.0, "avg_entropy": 2.65, "reuse_ratio": 0.45, "unique_count": 72.0, "length_stddev": 5.18, "high_entropy_count": 6.0, "high_entropy_ratio": 0.08, "all_lowercase_ratio": 0.21 } }, "s": [ [ 376, "10", "0" ], [ 600, "u8", "{860BB310-5D01-11d0-BD3B-00A0C911CE86}" ], [ 601, "u8", "{860BB310-5D01-11d0-BD3B-00A0C911CE86}" ], [ 713, "u8", "{62BE5D10-60EB-11d0-BD3B-00A0C911CE86}" ], [ 714, "u8", "{62BE5D10-60EB-11d0-BD3B-00A0C911CE86}" ], [ 820, "u8", "{55272A00-42CB-11CE-8135-00AA004BB851}" ], [ 821, "u8", "{55272A00-42CB-11CE-8135-00AA004BB851}" ], [ 1247, "u8", "FriendlyName" ], [ 1248, "u8", "FriendlyName" ], [ 1274, "10", "0" ], [ 1853, "10", "0" ], [ 1949, "10", "1" ], [ 2075, "10", "0" ], [ 2139, "10", "0" ], [ 3022, "u8", "29840822-5B84-11D0-BD3B-00A0C911CE86" ], [ 3023, "u8", "29840822-5B84-11D0-BD3B-00A0C911CE86" ], [ 3342, "u8", "55272A00-42CB-11CE-8135-00AA004BB851" ], [ 3343, "u8", "55272A00-42CB-11CE-8135-00AA004BB851" ] ], "v": { "file.stem": "Camera", "file.basename": "Camera.cs", "source.language": "csharp", "source.imports[0]": "EnumMonikers", "source.imports[1]": "FindDevices", "source.imports[2]": "GetFiltes", "source.imports[3]": "System", "source.imports[4]": "System.Collections.Generic", "source.imports[5]": "System.Drawing", "source.imports[6]": "System.Linq", "source.imports[7]": "System.Runtime.InteropServices", "source.imports[8]": "System.Runtime.InteropServices.ComTypes", "source.imports[9]": "System.Text", "source.strings[0]": "29840822-5B84-11D0-BD3B-00A0C911CE86", "source.strings[1]": "55272A00-42CB-11CE-8135-00AA004BB851", "source.strings[2]": "FriendlyName", "source.strings[3]": "{55272A00-42CB-11CE-8135-00AA004BB851}", "source.strings[4]": "{62BE5D10-60EB-11d0-BD3B-00A0C911CE86}", "source.strings[5]": "{860BB310-5D01-11d0-BD3B-00A0C911CE86}", "source.has_imports": true, "source.imports[10]": "func", "source.functions[0]": "CreateClassEnumerator", "source.functions[1]": "EnumMonikers", "source.functions[2]": "FindDevices", "source.functions[3]": "GetFiltes", "source.functions[4]": "Read", "source.functions[5]": "Write", "source.functions[6]": "havecamera" }, "ct": [ "Activator.CreateInstance", "EnumMonikers", "FindDevices", "GetFiltes", "GetFiltes().ToArray", "Guid", "Marshal.ReleaseComObject", "Type.GetTypeFromCLSID", "device.CreateClassEnumerator", "enumerator.Next", "func", "moniker.BindToStorage", "prop.Read", "result.Add" ], "id": "csharp", "mc": [ "Activator.CreateInstance", "ComInterfaceType.InterfaceIsIUnknown", "GetFiltes().ToArray", "IntPtr.Zero", "Marshal.ReleaseComObject", "Type.GetTypeFromCLSID", "UnmanagedType.LPWStr", "device.CreateClassEnumerator", "devices.Length", "enumerator.Next", "moniker.BindToStorage", "monikers.Length", "prop.Read", "result.Add" ] }, "id": 0, "sz": 3661, "ts": [ { "c": 0.699999988079071, "d": "LINQ query operations", "e": [ "System.Linq" ], "i": "micro-behaviors/data/db/linq::linq-queries", "l": 3 }, { "c": 0.9700000286102295, "d": "Validation vocabulary object", "e": [ "object" ], "i": "metadata/file/text/format::vocab-object", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "Dynamic object creation via reflection", "e": [ "Activator.CreateInstance" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::activator-create", "l": 4, "m": "F0004", "el": [ "6a9" ] }, { "c": 0.8600000143051147, "d": "Media capture device term keyword", "e": [ "Camera" ], "i": "micro-behaviors/data/text/keywords/media-permission::capture-device-term", "l": 1 }, { "a": "T1071.001", "c": 0.8600000143051147, "d": "UUID formatted route segment", "e": [ "860BB310-5D01-11d0-BD3B-00A0C911CE86" ], "i": "objectives/command-and-control/channel/http/stego::uuid-format-route-segment", "l": 1, "m": "B0030" }, { "c": 0.9700000286102295, "d": "Validation vocabulary string", "e": [ "string" ], "i": "metadata/file/text/format::vocab-string", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "String" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 0.800000011920929, "d": "Dynamic object instantiation via Activator", "e": [ "Activator" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::activator", "l": 1 }, { "c": 0.4000000059604645, "d": "cmd/command/result vocabulary word", "e": [ "result" ], "i": "micro-behaviors/data/text/keywords/lexicon::command-result-word", "l": 1 }, { "c": 1.0, "d": ".NET Activator.CreateInstance", "e": [ "Activator.CreateInstance" ], "i": "objectives/anti-static/obfuscation/reflection/class::dotnet-activator-createinstance", "l": 1 }, { "c": 1.0, "d": ".NET Type.GetType", "e": [ "Type.GetType" ], "i": "objectives/anti-static/obfuscation/reflection/class::dotnet-type-gettype", "l": 1 }, { "a": "T1140", "c": 0.8399999737739563, "d": "CreateInstance activation token", "e": [ "CreateInstance" ], "i": "objectives/command-and-control/dropper/staging/embedded::createinstance-token", "l": 1, "m": "B0030" } ], "sha": "686dc38b8ad81ee668475181a44a9896f97e1e8c38814a2087c01ef4eb5f8bb3", "path": "Camera.cs", "type": "csharp" } ], "tv": "318d5" } }