{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 1.0,
        "class": 2,
        "threshold": 1.0
      }
    ],
    "prob": 1.0,
    "class": 2,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.9591549,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.99918854,
        "class": 0
      },
      {
        "m": "az/powershell",
        "prob": 1.0,
        "class": 2
      }
    ],
    "version": "v17.17",
    "threshold": 1.0,
    "analyzed_at": "2026-05-31T06:56:25Z"
  },
  "path": "860e9189e67ad9842b40a4459fd88cf7c2d760840913d5808db6ed8a92096831.ps1",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "O₂(As₃Xe)",
        "x": 36,
        "ff": {
          "m": {
            "ast": {
              "max_depth": 210.0,
              "call_count": 21.0,
              "node_count": 19199.0,
              "identifier_count": 34.0,
              "string_literal_count": 15.0,
              "array_literal_max_length": 55.0
            },
            "file": {
              "size": 20437.0,
              "entropy": 5.99,
              "size_bytes": 20437.0
            },
            "text": {
              "tab_count": 7.0,
              "digit_ratio": 0.39,
              "space_count": 322.0,
              "total_lines": 30.0,
              "char_entropy": 5.99,
              "mixed_indent": 1.0,
              "unique_chars": 87.0,
              "lines_over_200": 10.0,
              "lines_over_500": 4.0,
              "string_density": 0.5,
              "avg_line_length": 679.23,
              "lines_over_1000": 2.0,
              "max_line_length": 11126.0,
              "empty_line_ratio": 0.13,
              "last_line_length": 11126.0,
              "long_token_count": 23.0,
              "whitespace_ratio": 0.02,
              "most_common_ratio": 0.04,
              "identifier_density": 3.6,
              "line_length_stddev": 2095.52,
              "encoded_string_ratio": 0.33,
              "normalized_string_count": 2.74,
              "repeated_char_sequences": 14.0,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 2.0,
              "trailing_whitespace_lines": 1.0,
              "most_common_char_codepoint": 48.0,
              "normalized_unique_identifiers": 6.93
            },
            "calls": {
              "count": 21.0
            },
            "source": {
              "function_count": 1.0
            },
            "strings": {
              "total": 15.0,
              "avg_length": 744.8,
              "max_length": 10812.0,
              "avg_entropy": 2.86,
              "empty_count": 9.0,
              "hex_strings": 4.0,
              "total_bytes": 11172.0,
              "entropy_stddev": 1.6,
              "base64_candidates": 1.0,
              "very_long_strings": 1.0,
              "high_entropy_count": 1.0
            },
            "functions": {
              "count": 1.0
            },
            "identifiers": {
              "count": 34.0,
              "total": 108.0,
              "avg_length": 13.85,
              "max_length": 35.0,
              "min_length": 2.0,
              "avg_entropy": 3.11,
              "reuse_ratio": 0.31,
              "unique_count": 34.0,
              "length_stddev": 8.68,
              "has_digit_ratio": 0.5,
              "high_entropy_count": 16.0,
              "high_entropy_ratio": 0.47,
              "all_lowercase_ratio": 0.09,
              "numeric_suffix_count": 6.0
            }
          },
          "s": [
            [
              83,
              "10",
              "6272"
            ],
            [
              83,
              "10",
              "6272"
            ],
            [
              89,
              "10",
              "23617550"
            ],
            [
              89,
              "10",
              "23617550"
            ],
            [
              99,
              "10",
              "20100122"
            ],
            [
              99,
              "10",
              "20100122"
            ],
            [
              108,
              "10",
              "5383"
            ],
            [
              108,
              "10",
              "5383"
            ],
            [
              118,
              "10",
              "8974"
            ],
            [
              118,
              "10",
              "8974"
            ],
            [
              123,
              "10",
              "9026"
            ],
            [
              123,
              "10",
              "9026"
            ],
            [
              130,
              "10",
              "7624"
            ],
            [
              130,
              "10",
              "7624"
            ],
            [
              136,
              "10",
              "1861482"
            ],
            [
              136,
              "10",
              "1861482"
            ],
            [
              145,
              "10",
              "903312"
            ],
            [
              145,
              "10",
              "903312"
            ],
            [
              152,
              "10",
              "3672"
            ],
            [
              152,
              "10",
              "3672"
            ],
            [
              161,
              "10",
              "126450"
            ],
            [
              161,
              "10",
              "126450"
            ],
            [
              168,
              "10",
              "2529"
            ],
            [
              168,
              "10",
              "2529"
            ],
            [
              175,
              "10",
              "7499"
            ],
            [
              175,
              "10",
              "7499"
            ],
            [
              181,
              "10",
              "16315"
            ],
            [
              181,
              "10",
              "16315"
            ],
            [
              187,
              "10",
              "8872"
            ],
            [
              187,
              "10",
              "8872"
            ],
            [
              195,
              "10",
              "6244"
            ],
            [
              195,
              "10",
              "6244"
            ],
            [
              201,
              "10",
              "7302"
            ],
            [
              201,
              "10",
              "7302"
            ],
            [
              207,
              "10",
              "2175072"
            ],
            [
              207,
              "10",
              "2175072"
            ],
            [
              217,
              "10",
              "287"
            ],
            [
              217,
              "10",
              "287"
            ],
            [
              221,
              "10",
              "2243"
            ],
            [
              221,
              "10",
              "2243"
            ],
            [
              232,
              "10",
              "6426"
            ],
            [
              232,
              "10",
              "6426"
            ],
            [
              238,
              "10",
              "24197306"
            ],
            [
              238,
              "10",
              "24197306"
            ],
            [
              247,
              "10",
              "3733"
            ],
            [
              247,
              "10",
              "3733"
            ],
            [
              255,
              "10",
              "300905"
            ],
            [
              255,
              "10",
              "300905"
            ],
            [
              263,
              "10",
              "2453"
            ],
            [
              263,
              "10",
              "2453"
            ],
            [
              268,
              "10",
              "3018"
            ],
            [
              268,
              "10",
              "3018"
            ],
            [
              277,
              "10",
              "7614"
            ],
            [
              277,
              "10",
              "7614"
            ],
            [
              283,
              "10",
              "7870"
            ],
            [
              283,
              "10",
              "7870"
            ],
            [
              288,
              "10",
              "201"
            ],
            [
              288,
              "10",
              "201"
            ],
            [
              295,
              "10",
              "2093"
            ],
            [
              295,
              "10",
              "2093"
            ],
            [
              300,
              "10",
              "2043"
            ],
            [
              300,
              "10",
              "2043"
            ],
            [
              307,
              "10",
              "247296"
            ],
            [
              307,
              "10",
              "247296"
            ],
            [
              314,
              "10",
              "4416"
            ],
            [
              314,
              "10",
              "4416"
            ],
            [
              322,
              "10",
              "3748"
            ],
            [
              322,
              "10",
              "3748"
            ],
            [
              327,
              "10",
              "3796"
            ],
            [
              327,
              "10",
              "3796"
            ],
            [
              334,
              "10",
              "188846"
            ],
            [
              334,
              "10",
              "188846"
            ],
            [
              342,
              "10",
              "21994778"
            ],
            [
              342,
              "10",
              "21994778"
            ],
            [
              352,
              "10",
              "55169569"
            ],
            [
              352,
              "10",
              "55169569"
            ],
            [
              362,
              "10",
              "50945090"
            ],
            [
              362,
              "10",
              "50945090"
            ],
            [
              371,
              "10",
              "5270"
            ],
            [
              371,
              "10",
              "5270"
            ],
            [
              381,
              "10",
              "281435"
            ],
            [
              381,
              "10",
              "281435"
            ],
            [
              388,
              "10",
              "5117"
            ],
            [
              388,
              "10",
              "5117"
            ],
            [
              395,
              "10",
              "4046"
            ],
            [
              395,
              "10",
              "4046"
            ],
            [
              400,
              "10",
              "3994"
            ],
            [
              400,
              "10",
              "3994"
            ],
            [
              407,
              "10",
              "2859"
            ],
            [
              407,
              "10",
              "2859"
            ],
            [
              413,
              "10",
              "24495417"
            ],
            [
              413,
              "10",
              "24495417"
            ],
            [
              423,
              "10",
              "12907"
            ],
            [
              423,
              "10",
              "12907"
            ],
            [
              429,
              "10",
              "4168"
            ],
            [
              429,
              "10",
              "4168"
            ],
            [
              438,
              "10",
              "343332"
            ],
            [
              438,
              "10",
              "343332"
            ],
            [
              446,
              "10",
              "1580"
            ],
            [
              446,
              "10",
              "1580"
            ],
            [
              451,
              "10",
              "4778"
            ],
            [
              451,
              "10",
              "4778"
            ],
            [
              460,
              "10",
              "7430"
            ],
            [
              460,
              "10",
              "7430"
            ],
            [
              466,
              "10",
              "332"
            ],
            [
              466,
              "10",
              "332"
            ],
            [
              470,
              "10",
              "7154"
            ],
            [
              470,
              "10",
              "7154"
            ],
            [
              479,
              "10",
              "505"
            ],
            [
              479,
              "10",
              "505"
            ],
            [
              484,
              "10",
              "3596571"
            ],
            [
              484,
              "10",
              "3596571"
            ],
            [
              492,
              "10",
              "6411"
            ],
            [
              492,
              "10",
              "6411"
            ],
            [
              500,
              "10",
              "1047"
            ],
            [
              500,
              "10",
              "1047"
            ],
            [
              505,
              "10",
              "998"
            ],
            [
              505,
              "10",
              "998"
            ],
            [
              511,
              "10",
              "2827"
            ],
            [
              511,
              "10",
              "2827"
            ],
            [
              516,
              "10",
              "2773"
            ],
            [
              516,
              "10",
              "2773"
            ],
            [
              523,
              "10",
              "11872"
            ],
            [
              523,
              "10",
              "11872"
            ],
            [
              531,
              "10",
              "9433"
            ],
            [
              531,
              "10",
              "9433"
            ],
            [
              537,
              "10",
              "15133"
            ],
            [
              537,
              "10",
              "15133"
            ],
            [
              543,
              "10",
              "5488"
            ],
            [
              543,
              "10",
              "5488"
            ],
            [
              552,
              "10",
              "387145"
            ],
            [
              552,
              "10",
              "387145"
            ],
            [
              560,
              "10",
              "9940"
            ],
            [
              560,
              "10",
              "9940"
            ],
            [
              565,
              "10",
              "2901"
            ],
            [
              565,
              "10",
              "2901"
            ],
            [
              574,
              "10",
              "7126"
            ],
            [
              574,
              "10",
              "7126"
            ],
            [
              580,
              "10",
              "11457"
            ],
            [
              580,
              "10",
              "11457"
            ],
            [
              586,
              "10",
              "4279"
            ],
            [
              586,
              "10",
              "4279"
            ],
            [
              594,
              "10",
              "8985"
            ],
            [
              594,
              "10",
              "8985"
            ],
            [
              599,
              "10",
              "8930"
            ],
            [
              599,
              "10",
              "8930"
            ],
            [
              607,
              "10",
              "6060"
            ],
            [
              607,
              "10",
              "6060"
            ],
            [
              613,
              "10",
              "13428"
            ],
            [
              613,
              "10",
              "13428"
            ],
            [
              620,
              "10",
              "36450958"
            ],
            [
              620,
              "10",
              "36450958"
            ],
            [
              631,
              "10",
              "2298"
            ],
            [
              631,
              "10",
              "2298"
            ],
            [
              637,
              "10",
              "73044765"
            ],
            [
              637,
              "10",
              "73044765"
            ],
            [
              647,
              "10",
              "8643"
            ],
            [
              647,
              "10",
              "8643"
            ],
            [
              654,
              "10",
              "4494"
            ],
            [
              654,
              "10",
              "4494"
            ],
            [
              659,
              "10",
              "5886"
            ],
            [
              659,
              "10",
              "5886"
            ],
            [
              672,
              "10",
              "7576"
            ],
            [
              672,
              "10",
              "7576"
            ],
            [
              678,
              "10",
              "73996800"
            ],
            [
              678,
              "10",
              "73996800"
            ],
            [
              687,
              "10",
              "9840"
            ],
            [
              687,
              "10",
              "9840"
            ],
            [
              695,
              "10",
              "436416"
            ],
            [
              695,
              "10",
              "436416"
            ],
            [
              702,
              "10",
              "9092"
            ],
            [
              702,
              "10",
              "9092"
            ],
            [
              710,
              "10",
              "9552"
            ],
            [
              710,
              "10",
              "9552"
            ],
            [
              715,
              "10",
              "9607"
            ],
            [
              715,
              "10",
              "9607"
            ],
            [
              723,
              "10",
              "716"
            ],
            [
              723,
              "10",
              "716"
            ],
            [
              727,
              "10",
              "766"
            ],
            [
              727,
              "10",
              "766"
            ],
            [
              734,
              "10",
              "9153"
            ],
            [
              734,
              "10",
              "9153"
            ],
            [
              740,
              "10",
              "3534"
            ],
            [
              740,
              "10",
              "3534"
            ],
            [
              746,
              "10",
              "3785225"
            ],
            [
              746,
              "10",
              "3785225"
            ],
            [
              754,
              "10",
              "667"
            ],
            [
              754,
              "10",
              "667"
            ],
            [
              762,
              "10",
              "2366"
            ],
            [
              762,
              "10",
              "2366"
            ],
            [
              768,
              "10",
              "13385309"
            ],
            [
              768,
              "10",
              "13385309"
            ],
            [
              778,
              "10",
              "10957"
            ],
            [
              778,
              "10",
              "10957"
            ],
            [
              785,
              "10",
              "10942"
            ],
            [
              785,
              "10",
              "10942"
            ],
            [
              791,
              "10",
              "5762"
            ],
            [
              791,
              "10",
              "5762"
            ],
            [
              802,
              "10",
              "4057"
            ],
            [
              802,
              "10",
              "4057"
            ],
            [
              807,
              "10",
              "4113"
            ],
            [
              807,
              "10",
              "4113"
            ],
            [
              815,
              "10",
              "6292"
            ],
            [
              815,
              "10",
              "6292"
            ],
            [
              821,
              "10",
              "2970396"
            ],
            [
              821,
              "10",
              "2970396"
            ],
            [
              831,
              "10",
              "9113"
            ],
            [
              831,
              "10",
              "9113"
            ],
            [
              836,
              "10",
              "9581"
            ],
            [
              836,
              "10",
              "9581"
            ],
            [
              846,
              "10",
              "10123"
            ],
            [
              846,
              "10",
              "10123"
            ],
            [
              853,
              "10",
              "81843912"
            ],
            [
              853,
              "10",
              "81843912"
            ],
            [
              863,
              "10",
              "57786372"
            ],
            [
              863,
              "10",
              "57786372"
            ],
            [
              872,
              "10",
              "7182"
            ],
            [
              872,
              "10",
              "7182"
            ],
            [
              881,
              "10",
              "3012"
            ],
            [
              881,
              "10",
              "3012"
            ],
            [
              888,
              "10",
              "4767"
            ],
            [
              888,
              "10",
              "4767"
            ],
            [
              893,
              "10",
              "7724"
            ],
            [
              893,
              "10",
              "7724"
            ],
            [
              901,
              "10",
              "467517"
            ],
            [
              901,
              "10",
              "467517"
            ],
            [
              908,
              "10",
              "9167"
            ],
            [
              908,
              "10",
              "9167"
            ],
            [
              916,
              "10",
              "2128"
            ],
            [
              916,
              "10",
              "2128"
            ],
            [
              922,
              "10",
              "15116896"
            ],
            [
              922,
              "10",
              "15116896"
            ],
            [
              931,
              "10",
              "6928"
            ],
            [
              931,
              "10",
              "6928"
            ],
            [
              939,
              "10",
              "1261"
            ],
            [
              939,
              "10",
              "1261"
            ],
            [
              945,
              "10",
              "2616"
            ],
            [
              945,
              "10",
              "2616"
            ],
            [
              950,
              "10",
              "1411"
            ],
            [
              950,
              "10",
              "1411"
            ],
            [
              959,
              "10",
              "7597"
            ],
            [
              959,
              "10",
              "7597"
            ],
            [
              965,
              "10",
              "8561"
            ],
            [
              965,
              "10",
              "8561"
            ],
            [
              972,
              "10",
              "6861"
            ],
            [
              972,
              "10",
              "6861"
            ],
            [
              978,
              "10",
              "17332"
            ],
            [
              978,
              "10",
              "17332"
            ],
            [
              985,
              "10",
              "95352673"
            ],
            [
              985,
              "10",
              "95352673"
            ],
            [
              994,
              "10",
              "9971"
            ],
            [
              994,
              "10",
              "9971"
            ],
            [
              1006,
              "10",
              "8203"
            ],
            [
              1006,
              "10",
              "8203"
            ],
            [
              1012,
              "10",
              "71679861"
            ],
            [
              1012,
              "10",
              "71679861"
            ]
          ],
          "v": {
            "file.stem": "860e9189e67ad9842b40a4459fd88cf7c2d760840913d5808db6ed8a92096831",
            "file.basename": "860e9189e67ad9842b40a4459fd88cf7c2d760840913d5808db6ed8a92096831.ps1",
            "source.language": "powershell",
            "source.strings[0]": "00000000000001590000000000000189000000000000020400000000000001580000000000000193000000000000018900000000000001960000000000000188",
            "source.strings[1]": "00000160000001930000019200000162000001990000018000000190000001870000018100000126000001650000019800000179000001980000018700000181",
            "source.strings[2]": "0000016100000179000001940000016400000175000001860000019500000179",
            "source.strings[3]": "0139016901840152018901800169",
            "source.strings[4]": "1004748",
            "source.strings[5]": "1005984",
            "source.strings[6]": "1049364",
            "source.strings[7]": "1075140",
            "source.strings[8]": "107555",
            "source.strings[9]": "108240",
            "source.strings[10]": "1139699",
            "source.strings[11]": "121136",
            "source.strings[12]": "12411904",
            "source.strings[13]": "12602695",
            "source.strings[14]": "126450",
            "source.strings[15]": "12759056",
            "source.strings[16]": "13020672",
            "source.strings[17]": "13201716",
            "source.strings[18]": "13385309",
            "source.strings[19]": "14067534",
            "source.strings[20]": "14301600",
            "source.strings[21]": "1434120",
            "source.strings[22]": "14356224",
            "source.strings[23]": "14399424",
            "source.strings[24]": "14623098",
            "source.strings[25]": "149184",
            "source.strings[26]": "15116896",
            "source.strings[27]": "15263699",
            "source.strings[28]": "15444733",
            "source.strings[29]": "155272",
            "source.strings[30]": "15596296",
            "source.strings[31]": "16270849",
            "source.strings[32]": "16340607",
            "source.strings[33]": "16809310",
            "source.strings[34]": "168264",
            "source.strings[35]": "170072",
            "source.strings[36]": "17323050",
            "source.strings[37]": "176385",
            "source.strings[38]": "18068022",
            "source.strings[39]": "181665",
            "source.strings[40]": "1861482",
            "source.strings[41]": "188846",
            "source.strings[42]": "194873",
            "source.strings[43]": "20100122",
            "source.strings[44]": "207000",
            "source.strings[45]": "209836",
            "source.strings[46]": "2175072",
            "source.strings[47]": "218889",
            "source.strings[48]": "218904",
            "source.strings[49]": "21994778",
            "source.strings[50]": "220225",
            "source.strings[51]": "22901268",
            "source.strings[52]": "23617550",
            "source.strings[53]": "23718618",
            "source.strings[54]": "241148",
            "source.strings[55]": "24166518",
            "source.strings[56]": "24197306",
            "source.strings[57]": "24279893",
            "source.strings[58]": "24495417",
            "source.strings[59]": "247296",
            "source.strings[60]": "250344",
            "source.strings[61]": "25379114",
            "source.strings[62]": "26064192",
            "source.strings[63]": "261738",
            "source.strings[64]": "26900510",
            "source.strings[65]": "27486936",
            "source.strings[66]": "27583267",
            "source.strings[67]": "276900",
            "source.strings[68]": "27732068",
            "source.strings[69]": "280800",
            "source.strings[70]": "281435",
            "source.strings[71]": "28259322",
            "source.strings[72]": "283745",
            "source.strings[73]": "2970396",
            "source.strings[74]": "29878790",
            "source.strings[75]": "30055377",
            "source.strings[76]": "300905",
            "source.strings[77]": "304945",
            "source.strings[78]": "30601380",
            "source.strings[79]": "306106",
            "source.strings[80]": "3077436",
            "source.strings[81]": "30946400",
            "source.strings[82]": "312687",
            "source.strings[83]": "313664",
            "source.strings[84]": "3139186",
            "source.strings[85]": "31513365",
            "source.strings[86]": "32269335",
            "source.strings[87]": "3318848",
            "source.strings[88]": "33345258",
            "source.strings[89]": "33876240",
            "source.strings[90]": "342324",
            "source.strings[91]": "343112",
            "source.strings[92]": "343332",
            "source.strings[93]": "344848",
            "source.strings[94]": "345016",
            "source.strings[95]": "34615614",
            "source.strings[96]": "346566",
            "source.strings[97]": "347939",
            "source.strings[98]": "35025678",
            "source.strings[99]": "35432952",
            "source.functions[0]": "anonymous",
            "source.strings[100]": "3596571",
            "source.strings[101]": "36450958",
            "source.strings[102]": "37191360",
            "source.strings[103]": "3785225",
            "source.strings[104]": "387145",
            "source.strings[105]": "38825240",
            "source.strings[106]": "39071004",
            "source.strings[107]": "40712805",
            "source.strings[108]": "415150",
            "source.strings[109]": "419925",
            "source.strings[110]": "421629",
            "source.strings[111]": "435411",
            "source.strings[112]": "436416",
            "source.strings[113]": "443386",
            "source.strings[114]": "45492000",
            "source.strings[115]": "4552558",
            "source.strings[116]": "45614295",
            "source.strings[117]": "45773190",
            "source.strings[118]": "4609792",
            "source.strings[119]": "465905",
            "source.strings[120]": "467517",
            "source.strings[121]": "470092",
            "source.strings[122]": "48011308",
            "source.strings[123]": "493696",
            "source.strings[124]": "49425920",
            "source.strings[125]": "506506",
            "source.strings[126]": "50945090",
            "source.strings[127]": "51498512",
            "source.strings[128]": "515476",
            "source.strings[129]": "516514",
            "source.strings[130]": "519342",
            "source.strings[131]": "5297240",
            "source.strings[132]": "54001728",
            "source.strings[133]": "541632",
            "source.strings[134]": "542493",
            "source.strings[135]": "549560",
            "source.strings[136]": "55169569",
            "source.strings[137]": "553592",
            "source.strings[138]": "570472",
            "source.strings[139]": "57299011",
            "source.strings[140]": "57786372",
            "source.strings[141]": "585550",
            "source.strings[142]": "5911724",
            "source.strings[143]": "5940072",
            "source.strings[144]": "611054",
            "source.strings[145]": "619036",
            "source.strings[146]": "624988",
            "source.strings[147]": "633472",
            "source.strings[148]": "6540783",
            "source.strings[149]": "67400424",
            "source.strings[150]": "692456",
            "source.strings[151]": "697102",
            "source.strings[152]": "711949",
            "source.strings[153]": "71449313",
            "source.strings[154]": "71679861",
            "source.strings[155]": "73044765",
            "source.strings[156]": "7372780",
            "source.strings[157]": "73996800",
            "source.strings[158]": "740664",
            "source.strings[159]": "745660",
            "source.strings[160]": "748780",
            "source.strings[161]": "750120",
            "source.strings[162]": "757790",
            "source.strings[163]": "76712619",
            "source.strings[164]": "7810684",
            "source.strings[165]": "78803025",
            "source.strings[166]": "795366",
            "source.strings[167]": "795981",
            "source.strings[168]": "81843912",
            "source.strings[169]": "8400630",
            "source.strings[170]": "860217",
            "source.strings[171]": "864479",
            "source.strings[172]": "866985",
            "source.strings[173]": "881790",
            "source.strings[174]": "8859723",
            "source.strings[175]": "9026610",
            "source.strings[176]": "903312",
            "source.strings[177]": "9110652",
            "source.strings[178]": "913836",
            "source.strings[179]": "9297945",
            "source.strings[180]": "934452",
            "source.strings[181]": "937422",
            "source.strings[182]": "941215",
            "source.strings[183]": "95352673",
            "source.strings[184]": "967048",
            "source.strings[185]": "970310",
            "source.strings[186]": "9786816",
            "source.strings[187]": "996084",
            "source.strings[188]": "iketnwfua9bj"
          },
          "ct": [
            "0..15",
            "0..6",
            "0..7",
            "ForEach-Object",
            "New-Object",
            "iex",
            "xn8yfzwcth4qb7p3g90lo6dvma2"
          ],
          "id": "powershell"
        },
        "id": 0,
        "sz": 20437,
        "ts": [
          {
            "a": "T1027",
            "c": 0.8600000143051147,
            "d": "Multiple embedded base64 literals",
            "e": [
              "0000016100000179000001940000016400000175000001860000019500000179",
              "00000000000001590000000000000189000000000000020400000000000001580000000000000193000000000000018900000000000001960000000000000188",
              "00000160000001930000019200000162000001990000018000000190000001870000018100000126000001650000019800000179000001980000018700000181",
              "0139016901840152018901800169"
            ],
            "i": "objectives/command-and-control/dropper/staging/encrypted::multiple-base64-literals",
            "l": 1,
            "m": "C0025",
            "el": [
              "0x10a1",
              "0xe8a",
              "0xfa7",
              "0xdd1"
            ]
          },
          {
            "a": "T1204.002",
            "d": "PowerShell bitwise XOR operator",
            "e": [
              "-bxor"
            ],
            "i": "objectives/command-and-control/dropper/lnk/remcos::powershell-bxor-op",
            "l": 2
          },
          {
            "a": "T1204.002",
            "c": 0.8999999761581421,
            "d": "PowerShell archive extraction command marker",
            "e": [
              "7z"
            ],
            "i": "objectives/command-and-control/dropper/staging/archive::powershell-archive-extract",
            "l": 1
          },
          {
            "c": 0.7799999713897705,
            "d": "PowerShell type accelerator syntax",
            "e": [
              "[math]::"
            ],
            "i": "metadata/lang/scripted::type-accelerator",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "Very long line",
            "e": [
              "text.max_line_length = 11126.00"
            ],
            "i": "metadata/file/text/metrics::single-long-line",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Valid PowerShell code",
            "e": [
              "param("
            ],
            "i": "metadata/lang/scripted::ps-valid",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Last line is over 1000 chars",
            "e": [
              "text.last_line_length = 11126.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1059.001",
            "c": 0.75,
            "d": "Invoke-Expression cmdlet",
            "e": [
              "iex"
            ],
            "i": "objectives/execution/interpreter/eval/invoke::iex",
            "l": 3,
            "m": "E1059"
          },
          {
            "c": 0.8999999761581421,
            "d": "File has 30 or more lines",
            "e": [
              "text.total_lines = 30.00"
            ],
            "i": "metadata/file/text/metrics::file-has-30-plus-lines",
            "l": 1
          },
          {
            "c": 0.8500000238418579,
            "d": "PowerShell or VBScript line bloat",
            "e": [
              "text.avg_line_length = 679.23"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::script-host-line-bloat",
            "l": 4
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Very low whitespace ratio (minified/compressed)",
            "e": [
              "text.whitespace_ratio = 0.02"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "High overall text entropy (encoded",
            "e": [
              "text.char_entropy = 5.99"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::high-text-entropy",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Many random-looking source identifier names",
            "e": [
              "identifiers.high_entropy_ratio = 0.47"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::many-high-entropy-identifiers",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8500000238418579,
            "d": "Multiple long lines (\u003e1000 chars)",
            "e": [
              "text.lines_over_1000 = 2.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::very-long-lines",
            "l": 2,
            "m": "B0032"
          },
          {
            "c": 0.8500000238418579,
            "d": "High ratio of entropy-heavy identifiers",
            "e": [
              "identifiers.high_entropy_ratio = 0.47"
            ],
            "i": "metadata/file/text/metrics::high-entropy-identifier-ratio",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.8500000238418579,
            "d": "Suspicious long PowerShell line",
            "e": [
              "text.max_line_length = 11126.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::ps-suspicious-single-line",
            "l": 4,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Identifier obfuscation (random/encoded names)",
            "e": [
              "identifiers.high_entropy_ratio = 0.47"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::identifier-obfuscation",
            "l": 3,
            "m": "B0032"
          }
        ],
        "sha": "860e9189e67ad9842b40a4459fd88cf7c2d760840913d5808db6ed8a92096831",
        "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2024-12/860e9189e67ad9842b40a4459fd88cf7c2d760840913d5808db6ed8a92096831.ps1",
        "type": "powershell"
      }
    ],
    "tv": "52045"
  }
}