{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9997497200965881, "class": 2 } ], "prob": 0.9997497, "class": 2, "models": [ { "m": "az", "prob": 0.96975887, "class": 0 }, { "m": "az/scripts", "prob": 0.9886092, "class": 0 }, { "m": "az/javascript", "prob": 0.9997497, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-06T17:47:25Z" }, "path": "20170117_87d0b00d7668835ed1ec91c61c5ef7ba.js", "raw": { "v": "4", "fs": [ { "f": "K₂O₆(As₈Xe₂C₂CoErS₅)H₃(DbCrPo₃)Md", "k": { "source.imports[0]": "abakxoxlakumpuvbazdufcujydetyfapuckufsysyjdy", "source.imports[1]": "acufawzexmybjyfaferomutuxypysigigunxydgysgeratybohelomsohicobkerusxudrexokcivzemu", "source.imports[2]": "adashyzojbububwymzeqsutxamtef", "source.imports[3]": "adefdobarygyccehezibydyhrugukajijikuqxekrofuvapmawixu", "source.imports[4]": "adowzenecugkiganymhycifpalbanhaztyhikrakojbupwittolgavaribcyfjazkufjozjefsugomebjybdexery", "source.imports[5]": "adxyhtapkytabtaxavpizzewivzecveriremikogabcodicgovubekmitwagomumtiwtibce", "source.imports[6]": "afenxyxgumzisimatozzefgamolmusigledqurzitixeferxulifukezkezwufimlaqkuhiruwpavufydtozamolegmuvnikbu", "source.imports[7]": "agysudkavwyvvagojypkanasfavogqamajzyfoniculecbumocsetusarigsazdinopqiczisumofqa", "source.imports[8]": "ajqiwesfirkynsufylnoqatykhumorbolozecmuxebwuqozzomadalpenoqaqzeba", "source.imports[9]": "amkehlocxitsobgizmatatoqzypg", "source.strings[0]": "ndqvznexobqxpqr|bozndrfnetnyerf`~{{veq7*7L5rv5;7://;7/'J,", "source.has_imports": true, "source.imports[10]": "amoxhibremokxaffenegahesruzjobvakwyzufysduggec", "source.imports[11]": "anabweqbyvohlarqiqhelpasokqimcopoltihcaztaqiswolywpigto", "source.imports[12]": "apbicebujlogodqulwycwixcamgagbijylcigavlubwolonmansydfyzhanelahwynicwawvatqumtyvjetuqynawrutho", "source.imports[13]": "arhecyzifojdagxobylunudluwyxy", "source.imports[14]": "asibzuhumxahawuditotsavtetehogzy", "source.imports[15]": "atsujmexososmuspognyrcovjowwagyhreluxmocux", "source.imports[16]": "atxybdiwutywifricepnuwvusqotzurziljamupvykife", "source.imports[17]": "avojgubobfatygqoxryxkupedukn", "source.imports[18]": "azhanpepquqazjomahaqciggujqatxiruvefyryxypaljyvevdoqcicedmodiblummykg", "source.imports[19]": "betoco1", "source.imports[20]": "bsoduryjoqkitjujazampopevlodolacoqjaqiqimvazutoltybjakuzzy", "source.imports[21]": "bvaqyxgomotirmumafilecedhogisihrohfehrawnysawyfikyckibahehilcyzculpysjifapopqovze", "source.imports[22]": "canpidigubikzovxudqofehlebrecotydydnolkizcojatitaxahyqakdicwemholywu", "source.imports[23]": "ckitawxenmicibtaslydytpuxybsubjitsosovehdabupimi", "source.imports[24]": "codusyrahovtilicmyvmatdehybyryzovicybwelditazfyjxyqwynbimnunukcupl", "source.imports[25]": "covygwejufuvtildysfuhjiwiteribho", "source.imports[26]": "dcexifelbamwijalsyzotawaxacgardapyzjusmomegecizmosukyrimihetygalkatzopojrivazmase", "source.imports[27]": "dewkamhyfyrewilvatsojemletehopuvifefsomicqeguncihsihadnavunlutolyr", "source.imports[28]": "dfylkoqiblodkibsaqwazitpundapojryqciqirbifmobjezsyvlose", "source.imports[29]": "dopnonugacegjykbyzniqcurkexirpy", "source.imports[30]": "dotjaby4", "source.imports[31]": "dtirorudjolijjehytmanqikwan", "source.imports[32]": "dzyczab", "source.imports[33]": "ebfepygytgizeftulxavivowvyluqokysvybqiblygiccexbasejnefabryfvusfyrywy", "source.imports[34]": "ehqefyfiwpulevolekqolozvecikpilyxkafupbaqregycdanacnumqisqagojozygujymizirzikebehu", "source.imports[35]": "ejygwexrufirfehyvlowohyqyvsaqsew", "source.imports[36]": "ekgimbewmydycgalwatderguqbynyjwazaneqangujyzfutsohoplokvychocatisgu", "source.imports[37]": "eleqymegyscagwisesixlur", "source.imports[38]": "emaggesijugyvzufohynavewfaki", "source.imports[39]": "emaswytvujzitnuzizevezilofmugpuwremriqvaflimitvibwecwuskavullobumfizcuquzuvipu", "source.imports[40]": "epvixinsapozittywdommurjarpihy", "source.imports[41]": "eskevatnylmafucxezdogynoxusynmuxefidmukuwxuhjigezfiqapluvny", "source.imports[42]": "esnilidyvovmejfywyjsidnacqycibtinfatkakwufitoxky", "source.imports[43]": "etanimesulebvisypymrywxicwikocennokduzywvarriblovxejebvelqurujomgorecuwujabditypcogyfitoxryswi", "source.imports[44]": "evlyzyxsefvotivvibzapjozmepjugofutedyxl", "source.imports[45]": "ewkibylanazabagsudhoxturfafyqcydagojebyfhofjozsyxynxobqufykjogusmuboso", "source.imports[46]": "ewnicirluvijpinikezomoznazavvazbyjirzakikbyrnuqetyqcoclaxyxaji", "source.imports[47]": "ewojkeczaricygsowwyzomtyjorxoxsecjucysvotfobaximaku", "source.imports[48]": "ezsoxowigajurarozcaqgacbomnalqyqdy", "source.imports[49]": "fabeswehyfemmumovytwudzuzyrtabzedaptylilkogefyfwiqponvyxnenjafiwudguwykwomgicaqedqyvirgamwywysno", "source.imports[50]": "fanakuqajydydotzodtinqabqozipnelhanadxywcobacqyghodgafofxaxewyxozocetilargutlynjopmulha", "source.imports[51]": "fjecegwopyqiwkukowahobujunmudacgozmythidilylqajpejryqagnolkitr", "source.imports[52]": "fkutvyxidminwijydesufojyzsudqesujjimsovtyphukagawzyjceqobe", "source.imports[53]": "fmoraltevlotiswedmeluconegjecmewvyfmitegir", "source.imports[54]": "fucybexaxodmovnujkykzedzyw", "source.imports[55]": "fuvomesimobetvoppovjuvzevzyfyrihnodesyjni", "source.imports[56]": "fyxly", "source.imports[57]": "gbozodovacnirrynucgymqirbupculojushiduxmakybk", "source.imports[58]": "gnizopbydirhanxagbohfuwxexenwygywqanryncowypunamezalihelfebydnumaflawogolxyggekpumibfojashyvjyxe", "source.imports[59]": "hanokgyffasiwcupihunmetlybohlepejrosihvupjaqocqadupydfowaqpekxihnafvywcyllipubny", "source.imports[60]": "hawsaxawpedocbenxutaruxwoqravbijovgophidwefyxwysmebbukawylusgictasyqujhyjytgycxesfeqbabezitcy", "source.imports[61]": "hbokvahidevifmoquvmagynabkowygbywjityluheqmoznuxetebhudbyvyhraxnacypunyjgimapdyzt", "source.imports[62]": "hejtuzrazuglexcascofevnyledtuwduvbyzyzubmetuhusyvropti", "source.imports[63]": "hetcojekdeletewwikywehifgupcalguqbujugepa", "source.imports[64]": "hoxekysxyromletjajybmotcyhfawuvyksexdodocrofdezadduxuxpevcorvakezse", "source.imports[65]": "hvyxyvhuqzitidxipyhynovlyjufcosovellynlursykut", "source.imports[66]": "ibaq", "source.imports[67]": "ibgoprezgahomiqobywunucsymlejfyrexsejykuhmuflyhkiqdyckihipomyhmahvyqwyholqibx", "source.imports[68]": "icaxyconbosygoqrapmumwixp", "source.imports[69]": "idetiwdy7", "source.imports[70]": "iffifpufbapekxukkefysodijunidnyxotynuxcaziqryfejtexudoplozlontyduvubajwatvumnidlyctatp", "source.imports[71]": "ignizbopgiraqriciniquxgosararqyvomexhyqivcoztemefevxytmaryzyqhijyju", "source.imports[72]": "ihakvimibpexebfamidyrazenuxalwufwyvywfajejysyfkejetatjytronu", "source.imports[73]": "ijahvysaknecixsizkotrybefubqyrsazekudadno", "source.imports[74]": "ikfikvafkanzuvlocbanwazijqezavavdevfowaxelaqakjepgobsuvbugkynerliqbukaxsurukuklo", "source.imports[75]": "imjosyztinkyzniffyjpadibxyjrireltysyfvavykzykqopahnutjijvetiwyvneltajikb", "source.imports[76]": "inmigevcalamawnyxqubunecrawiricypkogafawgajpyqnalicyfvifzecocpipafboprudecyxicimibnivymdu", "source.imports[77]": "ivtojpedwuqmerdevununowcirgynukibywodbikxumhikycfyrocdybiqzakbavudhagbobyqotot", "source.imports[78]": "izhuxevzuxgituxijzobxejapumahawahezulsekaheqhycedmynytawc", "source.imports[79]": "izitpivtenwymdycaxinuwhaszolifornybakalannokyfotygbywrizlutyfwikcyblyvsozpu", "source.imports[80]": "jihgomticafovimattibycewindaninoczibywqirisofivxyhl", "source.imports[81]": "jyfofexiguhfiwqadysokrecihnamirazergemjubjozybgotogcegkyxnuge", "source.imports[82]": "jywefurfygosuzelamzurynwixrojvobbyvlutaqolyhmexepyxqerhucedyholzuhemdusqehmisdijmyse", "source.imports[83]": "kuqekokhogowgyrmojwytudosydlirxumhuhjiwzawgorqekanladabmafjeccovijazfaguqvyvrutodvaxotyczifoke", "source.imports[84]": "lallolybpolyvapymwirebubarpajcejrunwyvyrhupyhaluzujtaduqenhuwiqtefmuwkudneplamokguqogemyxo", "source.imports[85]": "lodhisutdyztubtuxwubezendynfitesymomikectyfyxkufhanvynwemiwmykyhhawaqxuzjihhelexwitosqathytnum", "source.imports[86]": "lonehotyfostapavatatfyta", "source.imports[87]": "lqaleculqyqwufvohewibjuzukbysuksup", "source.imports[88]": "lratuqiczidyrzuvlibcovinpahasdapbuxnijhacbukqafomylol", "source.imports[89]": "lvavxekkabupzymimyddytiqomobyfhyclyskewabeccirzumakyquseryzcicibikyjuvyfuvqywdeqfyhyryfkus", "source.imports[90]": "mdeluguhizgifqusaqiqfoqutefiqserohritavutkunizafecwigablomipgibulhehlysoqd", "source.imports[91]": "mfywozbicefaxuvcivkizcogodgihyjenelciduxatbomubxebiguqjutyzzixirnezab", "source.imports[92]": "mipgawidvepilukbowgenfuriwmyvtycxekqezipgexsasrap", "source.imports[93]": "mkobjehdyrfoqkacezerzizyntubraqotgoporwydmexuvoqkicquhnicyqonqicsumyzlixapyvijmicaquhybywsofahi", "source.imports[94]": "mqegpatylmaqgytedxawuwempudvytminasbagrusalisjicaxaroxbutsyxodedublyraczoqapakxigignarurecx", "source.imports[95]": "mupru", "source.imports[96]": "newoxewukyzjotyhsebbimbuwhypfulafatnehpijkoxduzrynnawodurobdemvylsunmoliznychyrrirmyz", "source.imports[97]": "nikzykfyjedtolodlequwmuwowputodwequbefuhe", "source.imports[98]": "nipecixjuslilcemogwuznyxifuniwe", "source.imports[99]": "nopkokkuhmi4", "source.imports[100]": "novjefzoluxilpuqypanvyjkirovqebbakviqtogforijutylubbycymulibyfowzotascizivitp", "source.imports[101]": "nsegawgojdidtymtyxzilocahpapygsyfuxuloxih", "source.imports[102]": "nyjifzajajpecusaxudkopfinvuvvawolunpyqyjysohtihezcugoscipyvozyhofwocxuxwudk", "source.imports[103]": "nyluhekhabolgolkumewkewejy", "source.imports[104]": "ocivenivpufaqypecychuxhoriszatodupiwy", "source.imports[105]": "odytgaccijtyqisfywzutylzuwobloviqiguxaw", "source.imports[106]": "ogododuxrakucotqiticuqegmoxsoqhyqtikzilowvydmysje", "source.imports[107]": "ojvifamqerakacmibjotizajypapiwybjacenxunfogpywymwakajvyxdutelaqqogpa", "source.imports[108]": "onifnuhdowovhowfowignaddabetuxivdelsexutcoqr", "source.imports[109]": "oqukrahsokxuxilifsiwkibotfajucjihegqycpyznuxumoquxlitubygowoslodyximnefephisi", "source.imports[110]": "ositidewqepjapkikisymgextegguvodimkituddydpewarewnujimuzezynakyzewjapzisufazcumu", "source.imports[111]": "oxcarcilqijezcytyfmixbesduvkyhetpekejoghaqbofhixahypekykgunesolecyjgylakpazmiws", "source.imports[112]": "pnekyqohsozehekmespytpicommudowavlasof", "source.imports[113]": "pnexdehifjekvegucypywylilisufgymqyvyrjotfobim", "source.imports[114]": "pumafde0", "source.imports[115]": "pwodykfadgiwnexytidutokivpoztuxbewvusundovtiwunqihibjuqelcetuxjecsanbimowigewpi", "source.imports[116]": "pxacduplaxunufulvodefboxniqhury", "source.imports[117]": "qarqedagocvigpyglapaqsysokwazku", "source.imports[118]": "qifagwiwcytzyjugrahiwforcuqxommagufyxrytdytulemadxikuvagexfuvlarvogysywte", "source.imports[119]": "qmodadjasfikuravuhjyzradqysibotuxdovorizsysojsexyjbetbidxuptotpubmetzyxygwaqbe", "source.imports[120]": "rfavamwehjodintegiqebyrafywkifosaftaznerybvonosnexqoh", "source.imports[121]": "rgefaktifezjeswyjuputolvabgibufcokyds", "source.imports[122]": "rsutikummywakyckapmemvinahoridugulakalyxfozyncuqdihpuvigipobmurlelweqbamcawihtafsiswupfypycigehjysy", "source.imports[123]": "rtefcitwinagozumhejvajsozecuvqeffetumosvorubiclynujihonxihucpuqkikwejevbyki", "source.imports[124]": "ryqihhagonfekylewevrytocavlamgitucbilujburumfykrishetnucumegdexipzizxahwifhezsufgymasaqpokonhequ", "source.imports[125]": "sabjylbokepettugiqtozarasimybyffibde", "source.imports[126]": "somudzomlecmafciwvuvekqoxdogpebratqutvyrsipoxfodsizcadsanrilecxubeberak", "source.imports[127]": "soqvenqopokdywehigwejyborkewwalotturyxefelototfithulhocej", "source.imports[128]": "ssahovhijjybunhoxqofrujminukpedpacaxrakcabjocxehtefyxcafecagravaduguvydebucyhakepyw", "source.imports[129]": "tdabgoziwajmufpylqynxuminesyrinlaxxumoxhutqicyphafincogkycyttolebvytobnybydlutoworesrysti", "source.imports[130]": "towpaprultiwwumijolragiwdudovehbawbonawohekihkowuxpuvtuqviklibihmyzfagbixxotjezfy", "source.imports[131]": "tupvyvkojziknerarobirdaxasyphopolxadvunjarzefsutiryhewytaxymlexxosukwobjuqam", "source.imports[132]": "udbydyqowoxozuzgejfuhegediz", "source.imports[133]": "udqofecreguxuleslecjunpigbyguwactolyrodugawqihodyxlicnupfowebagadumyv", "source.imports[134]": "ufkefhihamevushybuxbejvogxegumvecnulnerelapuleqgelyxsytluvgywajewyhjupwytrypu", "source.imports[135]": "uhpomdagerbezxobfuvgiwqixcipiwsykzaxyqzarycnibfonazsiqjajjogahofdyprujtelewy", "source.imports[136]": "ujsebiqxebokuplimivuxgipfefqonsegpyd", "source.imports[137]": "ujwejugippushewytryzvoqanhycdaqqahypcozeveruhutaqfatrebnudvetmurvegogef", "source.imports[138]": "ujyhugv9", "source.imports[139]": "ullugnad2", "source.imports[140]": "umlejib09", "source.imports[141]": "unuhxi6", "source.imports[142]": "upamzeswumugacuwhicgajywakyh", "source.imports[143]": "upanqojatugeqdinkulubycibasdajwidosujhaqowqurfagtiwetqahnohykyxsukqerx", "source.imports[144]": "upmodpehkapehnunyfpeduwpidasezogewnezsiwbedyzikqojxapitdih", "source.imports[145]": "upokozyrubgocdijecxoczipyxkyjcotojo", "source.imports[146]": "uresadevilasgaksivbevkobutvuddujduvysigfukotavyqsowonygygapbaskalyrunecusbikruwv", "source.imports[147]": "utotbugmokokzitopwimynohdifalovxajarwimepsugkonzobqa", "source.imports[148]": "utsyzorumutogycehfehmybqowqohhidnopsovucz", "source.imports[149]": "uwgydgadhovqoqpinozlarfobuwyzpucisajqadricotrire", "source.imports[150]": "uworevcybotiwmeqxigqavurikqososamok", "source.imports[151]": "uzytyhabwopumofgobbumxewhefrygywipkehivavyhverokujajaqubb", "source.imports[152]": "vikogtaqqogcecrunupoqilxomlal", "source.imports[153]": "vlasuktavujitvipatevcewpohireryxewajomvojmubuqabagifloxogwajycgesjozqasfewinwilunw", "source.imports[154]": "vosqenrypxyljaloqihnecrukmefvevyrtiximixelimafimdulujucdypebkisybkupebliwefz", "source.imports[155]": "vwodwetacibbubnobfufexyvoxlefegvivawovraxfuduxewogutcojinekakqolvucojosumnysecucfupjisexginyhu", "source.imports[156]": "wavadtyzysabutjysyblarbywyzsirilmudimefegodecib", "source.imports[157]": "wewxok", "source.imports[158]": "wexitextugwijewdehzyvruxhosihhicupdebcysepugofvipvedsukunwozlyqgekigruhkifpetomdoqpihcumdyko", "source.imports[159]": "wyltexwadgymanebrymawasbatesenikimsirkemvorrerelputydga", "source.imports[160]": "xikagonodizenuvvynmicomonrawohseriggucopcafurkecizygorelnapafsytahrivlykypigsogpuspylelacmawbaw", "source.imports[161]": "xipmubnedxojypcegfituqazylsogukutcurvybfazypxywsyhmuteqzysosaxewdibixcykimehyfesiwpuguqa", "source.imports[162]": "xowiqywocorecubvafnyfgukpegdusakapmyfygutoxyqgisryvrocorcuhvanlepelverx", "source.imports[163]": "xpafaksuxpekjemfimhehugugbawiqeflutcihysfamyroxufogfekuxmyseqyrcynreqwillarf", "source.imports[164]": "xqeqytnuvaromtygonenuhultopihmowemtozydinyvevqoxaskesaqridifold", "source.imports[165]": "xzonpubynpuzahesypitdicjavsosnocicmoturacribajafubnatfahoqjobrikylytzotgyhomuseko", "source.imports[166]": "ybyqhinorimynixyrusbeboxifsyhzibwokwysemtuztoxlyqsozoprogydejhexuseqsoki", "source.imports[167]": "yckudodcamefqynyjadgikiluswibodyxfilvyfzofypkydu", "source.imports[168]": "ykobozyclirqappumjoxahcyqjomomuzgekfavwinoqarajjovguxifunx", "source.imports[169]": "ykulgirxehmifebulladxiwiqgyqnotguqaxeqybbuxavoltulezbahruqzexaz", "source.imports[170]": "ylinaxnifmurykehrikakovaxnumfajophyqcetnysehihatuhxyhpovkilogejytaclygomobunqoccimpywsewbuxaneclyfn", "source.imports[171]": "ymbancybpejxadijqikoteqyrdofigbajzadimcimbugefbopubocnonoqdyferhomt", "source.imports[172]": "ymiqcudaxojhowotzebipiwxinososohvaxwiribmabowijymrokcixmikxikava", "source.imports[173]": "ymyrkijzuzocbeluxjokfodtemz", "source.imports[174]": "yrjalsozlahuzlelivekxevfehazpizpyjysadozwotuqwafdisysizugmapropfyw", "source.imports[175]": "zelzijpazgylopyrhahjixxutedusuratigcitomyxuvoqtunfijajywcycuffu", "source.imports[176]": "znuqgocm", "source.imports[177]": "zsyrythizcicsehorahamamsulsizyxxizcukebiho", "source.imports[178]": "zybxaqlazmuvesypqobumqapunyfetepqocguvjekavsahyvtudzurefa", "source.imports[179]": "zynimubraczycovdusesqipgarelsovoviwzadxydnoxneniszepifoq" }, "x": 74, "id": 0, "is": [ "fabeswehyfemmumovytwudzuzyrtabzedaptylilkogefyfwiqponvyxnenjafiwudguwykwomgicaqedqyvirgamwywysno", "tdabgoziwajmufpylqynxuminesyrinlaxxumoxhutqicyphafincogkycyttolebvytobnybydlutoworesrysti", "abakxoxlakumpuvbazdufcujydetyfapuckufsysyjdy", "ibgoprezgahomiqobywunucsymlejfyrexsejykuhmuflyhkiqdyckihipomyhmahvyqwyholqibx", "ewojkeczaricygsowwyzomtyjorxoxsecjucysvotfobaximaku", "uworevcybotiwmeqxigqavurikqososamok", "vikogtaqqogcecrunupoqilxomlal", "ikfikvafkanzuvlocbanwazijqezavavdevfowaxelaqakjepgobsuvbugkynerliqbukaxsurukuklo", "emaggesijugyvzufohynavewfaki", "ckitawxenmicibtaslydytpuxybsubjitsosovehdabupimi", "xipmubnedxojypcegfituqazylsogukutcurvybfazypxywsyhmuteqzysosaxewdibixcykimehyfesiwpuguqa", "acufawzexmybjyfaferomutuxypysigigunxydgysgeratybohelomsohicobkerusxudrexokcivzemu", "atxybdiwutywifricepnuwvusqotzurziljamupvykife", "hejtuzrazuglexcascofevnyledtuwduvbyzyzubmetuhusyvropti", "oxcarcilqijezcytyfmixbesduvkyhetpekejoghaqbofhixahypekykgunesolecyjgylakpazmiws", "ryqihhagonfekylewevrytocavlamgitucbilujburumfykrishetnucumegdexipzizxahwifhezsufgymasaqpokonhequ", "zelzijpazgylopyrhahjixxutedusuratigcitomyxuvoqtunfijajywcycuffu", "xqeqytnuvaromtygonenuhultopihmowemtozydinyvevqoxaskesaqridifold", "uwgydgadhovqoqpinozlarfobuwyzpucisajqadricotrire", "dopnonugacegjykbyzniqcurkexirpy", "apbicebujlogodqulwycwixcamgagbijylcigavlubwolonmansydfyzhanelahwynicwawvatqumtyvjetuqynawrutho", "izhuxevzuxgituxijzobxejapumahawahezulsekaheqhycedmynytawc", "hetcojekdeletewwikywehifgupcalguqbujugepa", "agysudkavwyvvagojypkanasfavogqamajzyfoniculecbumocsetusarigsazdinopqiczisumofqa", "xpafaksuxpekjemfimhehugugbawiqeflutcihysfamyroxufogfekuxmyseqyrcynreqwillarf", "ejygwexrufirfehyvlowohyqyvsaqsew", "upanqojatugeqdinkulubycibasdajwidosujhaqowqurfagtiwetqahnohykyxsukqerx", "zybxaqlazmuvesypqobumqapunyfetepqocguvjekavsahyvtudzurefa", "ujsebiqxebokuplimivuxgipfefqonsegpyd", "ymbancybpejxadijqikoteqyrdofigbajzadimcimbugefbopubocnonoqdyferhomt", "anabweqbyvohlarqiqhelpasokqimcopoltihcaztaqiswolywpigto", "ymyrkijzuzocbeluxjokfodtemz", "hanokgyffasiwcupihunmetlybohlepejrosihvupjaqocqadupydfowaqpekxihnafvywcyllipubny", "ewnicirluvijpinikezomoznazavvazbyjirzakikbyrnuqetyqcoclaxyxaji", "nipecixjuslilcemogwuznyxifuniwe", "ylinaxnifmurykehrikakovaxnumfajophyqcetnysehihatuhxyhpovkilogejytaclygomobunqoccimpywsewbuxaneclyfn", "newoxewukyzjotyhsebbimbuwhypfulafatnehpijkoxduzrynnawodurobdemvylsunmoliznychyrrirmyz", "ykobozyclirqappumjoxahcyqjomomuzgekfavwinoqarajjovguxifunx", "ihakvimibpexebfamidyrazenuxalwufwyvywfajejysyfkejetatjytronu", "adowzenecugkiganymhycifpalbanhaztyhikrakojbupwittolgavaribcyfjazkufjozjefsugomebjybdexery", "jyfofexiguhfiwqadysokrecihnamirazergemjubjozybgotogcegkyxnuge", "adashyzojbububwymzeqsutxamtef", "oqukrahsokxuxilifsiwkibotfajucjihegqycpyznuxumoquxlitubygowoslodyximnefephisi", "ujwejugippushewytryzvoqanhycdaqqahypcozeveruhutaqfatrebnudvetmurvegogef", "qifagwiwcytzyjugrahiwforcuqxommagufyxrytdytulemadxikuvagexfuvlarvogysywte", "lratuqiczidyrzuvlibcovinpahasdapbuxnijhacbukqafomylol", "fanakuqajydydotzodtinqabqozipnelhanadxywcobacqyghodgafofxaxewyxozocetilargutlynjopmulha", "utotbugmokokzitopwimynohdifalovxajarwimepsugkonzobqa", "udbydyqowoxozuzgejfuhegediz", "ijahvysaknecixsizkotrybefubqyrsazekudadno", "ajqiwesfirkynsufylnoqatykhumorbolozecmuxebwuqozzomadalpenoqaqzeba", "mipgawidvepilukbowgenfuriwmyvtycxekqezipgexsasrap", "esnilidyvovmejfywyjsidnacqycibtinfatkakwufitoxky", "xowiqywocorecubvafnyfgukpegdusakapmyfygutoxyqgisryvrocorcuhvanlepelverx", "lodhisutdyztubtuxwubezendynfitesymomikectyfyxkufhanvynwemiwmykyhhawaqxuzjihhelexwitosqathytnum", "ybyqhinorimynixyrusbeboxifsyhzibwokwysemtuztoxlyqsozoprogydejhexuseqsoki", "hawsaxawpedocbenxutaruxwoqravbijovgophidwefyxwysmebbukawylusgictasyqujhyjytgycxesfeqbabezitcy", "pwodykfadgiwnexytidutokivpoztuxbewvusundovtiwunqihibjuqelcetuxjecsanbimowigewpi", "lqaleculqyqwufvohewibjuzukbysuksup", "utsyzorumutogycehfehmybqowqohhidnopsovucz", "wyltexwadgymanebrymawasbatesenikimsirkemvorrerelputydga", "sabjylbokepettugiqtozarasimybyffibde", "lallolybpolyvapymwirebubarpajcejrunwyvyrhupyhaluzujtaduqenhuwiqtefmuwkudneplamokguqogemyxo", "pxacduplaxunufulvodefboxniqhury", "etanimesulebvisypymrywxicwikocennokduzywvarriblovxejebvelqurujomgorecuwujabditypcogyfitoxryswi", "mkobjehdyrfoqkacezerzizyntubraqotgoporwydmexuvoqkicquhnicyqonqicsumyzlixapyvijmicaquhybywsofahi", "ivtojpedwuqmerdevununowcirgynukibywodbikxumhikycfyrocdybiqzakbavudhagbobyqotot", "rfavamwehjodintegiqebyrafywkifosaftaznerybvonosnexqoh", "imjosyztinkyzniffyjpadibxyjrireltysyfvavykzykqopahnutjijvetiwyvneltajikb", "wavadtyzysabutjysyblarbywyzsirilmudimefegodecib", "canpidigubikzovxudqofehlebrecotydydnolkizcojatitaxahyqakdicwemholywu", "udqofecreguxuleslecjunpigbyguwactolyrodugawqihodyxlicnupfowebagadumyv", "upmodpehkapehnunyfpeduwpidasezogewnezsiwbedyzikqojxapitdih", "fkutvyxidminwijydesufojyzsudqesujjimsovtyphukagawzyjceqobe", "epvixinsapozittywdommurjarpihy", "mqegpatylmaqgytedxawuwempudvytminasbagrusalisjicaxaroxbutsyxodedublyraczoqapakxigignarurecx", "afenxyxgumzisimatozzefgamolmusigledqurzitixeferxulifukezkezwufimlaqkuhiruwpavufydtozamolegmuvnikbu", "ignizbopgiraqriciniquxgosararqyvomexhyqivcoztemefevxytmaryzyqhijyju", "soqvenqopokdywehigwejyborkewwalotturyxefelototfithulhocej", "ewkibylanazabagsudhoxturfafyqcydagojebyfhofjozsyxynxobqufykjogusmuboso", "upamzeswumugacuwhicgajywakyh", "adxyhtapkytabtaxavpizzewivzecveriremikogabcodicgovubekmitwagomumtiwtibce", "jihgomticafovimattibycewindaninoczibywqirisofivxyhl", "ymiqcudaxojhowotzebipiwxinososohvaxwiribmabowijymrokcixmikxikava", "iffifpufbapekxukkefysodijunidnyxotynuxcaziqryfejtexudoplozlontyduvubajwatvumnidlyctatp", "ssahovhijjybunhoxqofrujminukpedpacaxrakcabjocxehtefyxcafecagravaduguvydebucyhakepyw", "fjecegwopyqiwkukowahobujunmudacgozmythidilylqajpejryqagnolkitr", "asibzuhumxahawuditotsavtetehogzy", "gbozodovacnirrynucgymqirbupculojushiduxmakybk", "vosqenrypxyljaloqihnecrukmefvevyrtiximixelimafimdulujucdypebkisybkupebliwefz", "ykulgirxehmifebulladxiwiqgyqnotguqaxeqybbuxavoltulezbahruqzexaz", "nsegawgojdidtymtyxzilocahpapygsyfuxuloxih", "fucybexaxodmovnujkykzedzyw", "novjefzoluxilpuqypanvyjkirovqebbakviqtogforijutylubbycymulibyfowzotascizivitp", "xzonpubynpuzahesypitdicjavsosnocicmoturacribajafubnatfahoqjobrikylytzotgyhomuseko", "icaxyconbosygoqrapmumwixp", "mfywozbicefaxuvcivkizcogodgihyjenelciduxatbomubxebiguqjutyzzixirnezab", "eskevatnylmafucxezdogynoxusynmuxefidmukuwxuhjigezfiqapluvny", "ositidewqepjapkikisymgextegguvodimkituddydpewarewnujimuzezynakyzewjapzisufazcumu", "dfylkoqiblodkibsaqwazitpundapojryqciqirbifmobjezsyvlose", "dewkamhyfyrewilvatsojemletehopuvifefsomicqeguncihsihadnavunlutolyr", "yckudodcamefqynyjadgikiluswibodyxfilvyfzofypkydu", "fmoraltevlotiswedmeluconegjecmewvyfmitegir", "kuqekokhogowgyrmojwytudosydlirxumhuhjiwzawgorqekanladabmafjeccovijazfaguqvyvrutodvaxotyczifoke", "ogododuxrakucotqiticuqegmoxsoqhyqtikzilowvydmysje", "hoxekysxyromletjajybmotcyhfawuvyksexdodocrofdezadduxuxpevcorvakezse", "inmigevcalamawnyxqubunecrawiricypkogafawgajpyqnalicyfvifzecocpipafboprudecyxicimibnivymdu", "uresadevilasgaksivbevkobutvuddujduvysigfukotavyqsowonygygapbaskalyrunecusbikruwv", "atsujmexososmuspognyrcovjowwagyhreluxmocux", "avojgubobfatygqoxryxkupedukn", "ocivenivpufaqypecychuxhoriszatodupiwy", "rtefcitwinagozumhejvajsozecuvqeffetumosvorubiclynujihonxihucpuqkikwejevbyki", "ekgimbewmydycgalwatderguqbynyjwazaneqangujyzfutsohoplokvychocatisgu", "dcexifelbamwijalsyzotawaxacgardapyzjusmomegecizmosukyrimihetygalkatzopojrivazmase", "zynimubraczycovdusesqipgarelsovoviwzadxydnoxneniszepifoq", "amoxhibremokxaffenegahesruzjobvakwyzufysduggec", "odytgaccijtyqisfywzutylzuwobloviqiguxaw", "towpaprultiwwumijolragiwdudovehbawbonawohekihkowuxpuvtuqviklibihmyzfagbixxotjezfy", "jywefurfygosuzelamzurynwixrojvobbyvlutaqolyhmexepyxqerhucedyholzuhemdusqehmisdijmyse", "arhecyzifojdagxobylunudluwyxy", "zsyrythizcicsehorahamamsulsizyxxizcukebiho", "hbokvahidevifmoquvmagynabkowygbywjityluheqmoznuxetebhudbyvyhraxnacypunyjgimapdyzt", "bsoduryjoqkitjujazampopevlodolacoqjaqiqimvazutoltybjakuzzy", "ezsoxowigajurarozcaqgacbomnalqyqdy", "eleqymegyscagwisesixlur", "nyjifzajajpecusaxudkopfinvuvvawolunpyqyjysohtihezcugoscipyvozyhofwocxuxwudk", "onifnuhdowovhowfowignaddabetuxivdelsexutcoqr", "somudzomlecmafciwvuvekqoxdogpebratqutvyrsipoxfodsizcadsanrilecxubeberak", "nyluhekhabolgolkumewkewejy", "lvavxekkabupzymimyddytiqomobyfhyclyskewabeccirzumakyquseryzcicibikyjuvyfuvqywdeqfyhyryfkus", "upokozyrubgocdijecxoczipyxkyjcotojo", "qarqedagocvigpyglapaqsysokwazku", "ebfepygytgizeftulxavivowvyluqokysvybqiblygiccexbasejnefabryfvusfyrywy", "vwodwetacibbubnobfufexyvoxlefegvivawovraxfuduxewogutcojinekakqolvucojosumnysecucfupjisexginyhu", "covygwejufuvtildysfuhjiwiteribho", "wexitextugwijewdehzyvruxhosihhicupdebcysepugofvipvedsukunwozlyqgekigruhkifpetomdoqpihcumdyko", "gnizopbydirhanxagbohfuwxexenwygywqanryncowypunamezalihelfebydnumaflawogolxyggekpumibfojashyvjyxe", "xikagonodizenuvvynmicomonrawohseriggucopcafurkecizygorelnapafsytahrivlykypigsogpuspylelacmawbaw", "bvaqyxgomotirmumafilecedhogisihrohfehrawnysawyfikyckibahehilcyzculpysjifapopqovze", "izitpivtenwymdycaxinuwhaszolifornybakalannokyfotygbywrizlutyfwikcyblyvsozpu", "rsutikummywakyckapmemvinahoridugulakalyxfozyncuqdihpuvigipobmurlelweqbamcawihtafsiswupfypycigehjysy", "emaswytvujzitnuzizevezilofmugpuwremriqvaflimitvibwecwuskavullobumfizcuquzuvipu", "azhanpepquqazjomahaqciggujqatxiruvefyryxypaljyvevdoqcicedmodiblummykg", "nikzykfyjedtolodlequwmuwowputodwequbefuhe", "uzytyhabwopumofgobbumxewhefrygywipkehivavyhverokujajaqubb", "pnekyqohsozehekmespytpicommudowavlasof", "fuvomesimobetvoppovjuvzevzyfyrihnodesyjni", "dzyczab", "qmodadjasfikuravuhjyzradqysibotuxdovorizsysojsexyjbetbidxuptotpubmetzyxygwaqbe", "ufkefhihamevushybuxbejvogxegumvecnulnerelapuleqgelyxsytluvgywajewyhjupwytrypu", "pnexdehifjekvegucypywylilisufgymqyvyrjotfobim", "mdeluguhizgifqusaqiqfoqutefiqserohritavutkunizafecwigablomipgibulhehlysoqd", "evlyzyxsefvotivvibzapjozmepjugofutedyxl", "adefdobarygyccehezibydyhrugukajijikuqxekrofuvapmawixu", "yrjalsozlahuzlelivekxevfehazpizpyjysadozwotuqwafdisysizugmapropfyw", "dtirorudjolijjehytmanqikwan", "uhpomdagerbezxobfuvgiwqixcipiwsykzaxyqzarycnibfonazsiqjajjogahofdyprujtelewy", "amkehlocxitsobgizmatatoqzypg", "rgefaktifezjeswyjuputolvabgibufcokyds", "ojvifamqerakacmibjotizajypapiwybjacenxunfogpywymwakajvyxdutelaqqogpa", "tupvyvkojziknerarobirdaxasyphopolxadvunjarzefsutiryhewytaxymlexxosukwobjuqam", "vlasuktavujitvipatevcewpohireryxewajomvojmubuqabagifloxogwajycgesjozqasfewinwilunw", "lonehotyfostapavatatfyta", "codusyrahovtilicmyvmatdehybyryzovicybwelditazfyjxyqwynbimnunukcupl", "hvyxyvhuqzitidxipyhynovlyjufcosovellynlursykut", "ehqefyfiwpulevolekqolozvecikpilyxkafupbaqregycdanacnumqisqagojozygujymizirzikebehu", "idetiwdy7", "umlejib09", "unuhxi6", "wewxok", "pumafde0", "betoco1", "ibaq", "ujyhugv9", "mupru", "fyxly", "ullugnad2", "nopkokkuhmi4", "znuqgocm", "dotjaby4" ], "ms": { "file": { "size": 26066.0 }, "text": { "tab_count": 29.0, "digit_ratio": 0.03, "space_count": 1056.0, "total_lines": 200.0, "char_entropy": 5.1, "unique_chars": 73.0, "import_density": 90.0, "lines_over_200": 16.0, "lines_over_500": 6.0, "string_density": 1.7, "avg_line_length": 129.34, "lines_over_1000": 3.0, "max_line_length": 1777.0, "last_line_length": 3.0, "long_token_count": 17.0, "most_common_char": "a", "whitespace_ratio": 0.05, "most_common_ratio": 0.06, "identifier_density": 1.76, "line_length_stddev": 204.2, "normalized_import_count": 12.73, "normalized_string_count": 23.97, "suspicious_comment_ratio": 0.67, "max_inline_whitespace_run": 1.0, "suspicious_identifier_ratio": 0.01, "normalized_unique_identifiers": 24.46 }, "imports": { "total": 180.0, "unique_modules": 180.0, "third_party_count": 180.0, "third_party_ratio": 1.0 }, "strings": { "total": 339.0, "avg_length": 2.13, "max_length": 4.0, "path_count": 10.0, "avg_entropy": 1.02, "total_bytes": 722.0, "entropy_stddev": 0.41 }, "comments": { "chars": 1947.0, "lines": 3.0, "total": 3.0, "to_code_ratio": 0.02, "high_entropy_comments": 2.0 }, "functions": {}, "identifiers": { "total": 352.0, "avg_length": 57.42, "max_length": 104.0, "min_length": 4.0, "avg_entropy": 4.08, "reuse_ratio": 0.53, "unique_count": 187.0, "length_stddev": 26.4, "has_digit_ratio": 0.05, "high_entropy_count": 169.0, "high_entropy_ratio": 0.9, "all_lowercase_ratio": 0.94, "numeric_suffix_count": 9.0, "keyboard_pattern_names": 2.0 } }, "ss": [ [ 104, "\\\\W" ], [ 107, "W" ], [ 215, "ht" ], [ 216, "ht" ], [ 278, "ru" ], [ 279, "ru" ], [ 370, "tF" ], [ 371, "tF" ], [ 445, "Sy" ], [ 446, "Sy" ], [ 505, "e" ], [ 506, "e" ], [ 558, "At" ], [ 559, "At" ], [ 657, "Ful" ], [ 658, "Ful" ], [ 710, "Ge" ], [ 711, "Ge" ], [ 773, "ex" ], [ 774, "ex" ], [ 876, "Sc" ], [ 877, "Sc" ], [ 972, "le" ], [ 973, "le" ], [ 1040, "eX" ], [ 1041, "eX" ], [ 1109, "/l" ], [ 1110, "/l" ], [ 1203, "lNa" ], [ 1204, "lNa" ], [ 1325, "ws" ], [ 1326, "ws" ], [ 1403, "MSX" ], [ 1404, "MSX" ], [ 1485, "le" ], [ 1486, "le" ], [ 1557, "ope" ], [ 1558, "ope" ], [ 1604, "bje" ], [ 1605, "bje" ], [ 1724, "OD" ], [ 1725, "OD" ], [ 1801, "at" ], [ 1802, "at" ], [ 1862, "e " ], [ 1863, "e " ], [ 1961, "ct" ], [ 1962, "ct" ], [ 2061, "ea" ], [ 2062, "ea" ], [ 2125, "m3" ], [ 2126, "m3" ], [ 2215, "ipt" ], [ 2216, "ipt" ], [ 2293, "ti" ], [ 2294, "ti" ], [ 2344, "ss" ], [ 2345, "ss" ], [ 2438, "pN" ], [ 2439, "pN" ], [ 2515, "pt" ], [ 2516, "pt" ], [ 2560, "lde" ], [ 2561, "lde" ], [ 2656, "me" ], [ 2657, "me" ], [ 2750, "Scr" ], [ 2751, "Scr" ], [ 2801, "fa" ], [ 2802, "fa" ], [ 2925, "am" ], [ 2926, "am" ], [ 3025, "ct" ], [ 3026, "ct" ], [ 3111, "ut" ], [ 3112, "ut" ], [ 3195, "ipt" ], [ 3196, "ipt" ], [ 3300, "ir" ], [ 3301, "ir" ], [ 3429, "re" ], [ 3430, "re" ], [ 3509, " " ], [ 3510, " " ], [ 3552, "AD" ], [ 3553, "AD" ], [ 3644, "n" ], [ 3645, "n" ], [ 3734, "TP" ], [ 3735, "TP" ], [ 3826, ".c" ], [ 3827, ".c" ], [ 3904, "rn" ], [ 3905, "rn" ], [ 4015, "on" ], [ 4016, "on" ], [ 4082, "/e" ], [ 4083, "/e" ], [ 4132, "emO" ], [ 4133, "emO" ], [ 4189, "iv" ], [ 4190, "iv" ], [ 4278, "x." ], [ 4279, "x." ], [ 4350, "ber" ], [ 4351, "ber" ], [ 4419, "la" ], [ 4420, "la" ], [ 4515, "ib" ], [ 4516, "ib" ], [ 4632, "ML2" ], [ 4633, "ML2" ], [ 4729, "ct" ], [ 4730, "ct" ], [ 4837, "yst" ], [ 4838, "yst" ], [ 4932, "je" ], [ 4933, "je" ], [ 4985, "ao" ], [ 4986, "ao" ], [ 5041, "t.S" ], [ 5042, "t.S" ], [ 5112, "le" ], [ 5113, "le" ], [ 5167, " A" ], [ 5168, " A" ], [ 5280, "es" ], [ 5281, "es" ], [ 5326, "ex" ], [ 5327, "ex" ], [ 5435, "Res" ], [ 5436, "Res" ], [ 5553, "Wri" ], [ 5554, "Wri" ], [ 5655, "ct" ], [ 5656, "ct" ], [ 5732, "nd" ], [ 5733, "nd" ], [ 5827, "sp" ], [ 5828, "sp" ], [ 5889, ";" ], [ 5890, ";" ], [ 5971, "WSc" ], [ 5972, "WSc" ], [ 6059, "Fi" ], [ 6060, "Fi" ], [ 6132, "er" ], [ 6133, "er" ], [ 6213, "je" ], [ 6214, "je" ], [ 6263, "st" ], [ 6264, "st" ], [ 6374, "Get" ], [ 6375, "Get" ], [ 6491, "re" ], [ 6492, "re" ], [ 6609, "et" ], [ 6610, "et" ], [ 6695, "tr" ], [ 6696, "tr" ], [ 6780, "os" ], [ 6781, "os" ], [ 6865, "/" ], [ 6866, "/" ], [ 6908, ".XM" ], [ 6909, ".XM" ], [ 7014, "ho" ], [ 7015, "ho" ], [ 7084, "B." ], [ 7085, "B." ], [ 7163, "Scr" ], [ 7164, "Scr" ], [ 7269, "tu" ], [ 7270, "tu" ], [ 7376, "iv" ], [ 7377, "iv" ], [ 7457, "e" ], [ 7458, "e" ], [ 7513, "ri" ], [ 7514, "ri" ], [ 7578, "l" ], [ 7579, "l" ], [ 7692, "er" ], [ 7693, "er" ], [ 7788, "rip" ], [ 7789, "rip" ], [ 7876, ".Fi" ], [ 7877, ".Fi" ], [ 7941, "Cr" ], [ 7942, "Cr" ], [ 7987, "Fi" ], [ 7988, "Fi" ], [ 8084, "lFo" ], [ 8085, "lFo" ], [ 8181, "/c" ], [ 8182, "/c" ], [ 8229, "s" ], [ 8230, "s" ], [ 8312, "cia" ], [ 8313, "cia" ], [ 8394, "Ob" ], [ 8395, "Ob" ], [ 8494, "ve" ], [ 8495, "ve" ], [ 8568, "ing" ], [ 8569, "ing" ], [ 8650, "ct" ], [ 8651, "ct" ], [ 8718, "To" ], [ 8719, "To" ], [ 8786, "Po" ], [ 8787, "Po" ], [ 8895, "il" ], [ 8896, "il" ], [ 8959, "n" ], [ 8960, "n" ], [ 9044, "Ob" ], [ 9045, "Ob" ], [ 9148, "st" ], [ 9149, "st" ], [ 9243, "te" ], [ 9244, "te" ], [ 9304, "T" ], [ 9305, "T" ], [ 9351, "St" ], [ 9352, "St" ], [ 9408, "Cl" ], [ 9409, "Cl" ], [ 9507, "C:" ], [ 9508, "C:" ], [ 9598, "us" ], [ 9599, "us" ], [ 9699, "Ope" ], [ 9700, "Ope" ], [ 9776, "g." ], [ 9777, "g." ], [ 9837, "e" ], [ 9838, "e" ], [ 9898, "am" ], [ 9899, "am" ], [ 10008, "le" ], [ 10009, "le" ], [ 10116, "num" ], [ 10117, "num" ], [ 10165, "dr" ], [ 10166, "dr" ], [ 10231, "\\\\S" ], [ 10234, "S" ], [ 10328, "si" ], [ 10329, "si" ], [ 10411, "Sa" ], [ 10412, "Sa" ], [ 10460, "ys" ], [ 10461, "ys" ], [ 10502, "om" ], [ 10503, "om" ] ], "sz": 26066, "ts": [ { "c": 0.8500000238418579, "d": "Quoted JSON IV field", "e": [ "\"iv\"" ], "i": "micro-behaviors/crypto/symmetric/aes/payload::quoted-iv-field", "l": 1, "m": "C0021.001" }, { "c": 0.800000011920929, "d": "JScript file type (WScript host)", "e": [ "WScript" ], "i": "micro-behaviors/process/interpreter/jscript::is-jscript", "l": 1 }, { "a": "T1027.003", "c": 1.0, "d": "JavaScript or TypeScript source file extension", "e": [ "20170117_87d0b00d7668835ed1ec91c61c5ef7ba.js" ], "i": "objectives/anti-static/obfuscation/payload/container::js-source-extension", "l": 1, "m": "B0032" }, { "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "crip" ], "i": "objectives/execution/interpreter/scripting/host::wscript-shell-split-join--rx-2", "l": 1 }, { "a": "T1195.002", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "node" ], "i": "objectives/supply-chain/hidden-payload/trojan::computed-child-process-destructure-text--rx-3", "l": 1 }, { "a": "T1195.002, T1059.007", "c": 0.9599999785423279, "d": "Regex component marker", "e": [ "new Function(" ], "i": "objectives/supply-chain/hidden-payload/runtime::fetched-text-function-param--rx-5", "l": 1 }, { "c": 1.0, "d": "JavaScript file basename", "e": [ "20170117_87d0b00d7668835ed1ec91c61c5ef7ba.js" ], "i": "metadata/lang/encoded/unicode-escape::javascript-or-dll-basename", "l": 2 }, { "a": "T1048.003", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "live" ], "i": "objectives/supply-chain/recon-exfil/dns::dns-lookup-with-canary-domain--rx-6", "l": 1, "m": "E1041" }, { "a": "T1027", "c": 1.0, "d": "Many unique import modules", "e": [ "imports.unique_modules = 180.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::imports-unique-modules-50", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "JavaScript many imported modules", "e": [ "imports.unique_modules = 180.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::js-many-import-modules", "l": 1 }, { "c": 0.8399999737739563, "d": "Hidden directory literal", "e": [ "\".c" ], "i": "objectives/supply-chain/install-hook/module-backdoor::hidden-dir-literal", "l": 1 }, { "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "node" ], "i": "objectives/command-and-control/dropper/node-bootstrap::direct-temp-exec--rx-7", "l": 1 }, { "a": "T1539", "c": 0.800000011920929, "d": "Filters vwo/vis_opt cookies to evade analytics", "e": [ "vwo" ], "i": "objectives/collection/stealer/browser::cookie-filter-vwo-vis-opt", "l": 1 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Public IPv4 first octet list", "e": [ "[44," ], "i": "objectives/anti-static/obfuscation/encoding/ip-notation::int-octet-list", "l": 1, "m": "B0032" }, { "a": "T1036.008", "c": 0.949999988079071, "d": "Filename has .js extension", "e": [ "20170117_87d0b00d7668835ed1ec91c61c5ef7ba.js" ], "i": "objectives/evasion/masquerade/extension/shebang::js-extension-name", "l": 1, "m": "F0008" }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "node" ], "i": "micro-behaviors/process/interpreter/vm::vm-runInNewContext--rx-10", "l": 1 }, { "a": "T1105", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "body" ], "i": "objectives/command-and-control/dropper/delivery/fetch-eval::new-function-variable-body--rx-7", "l": 1 }, { "c": 0.949999988079071, "d": "eval/Function call inside flatted-shaped file", "e": [ "new Function(" ], "i": "well-known/lib/flatted::flatted-tamper-eval", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "identifiers.avg_length = 57.42" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::identifier-obfuscation-cond-0--inline-23810", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 200.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "node" ], "i": "micro-behaviors/process/interpreter/vm::vm-runInContext--rx-5", "l": 1 }, { "c": 0.8799999952316284, "d": "Indirect bracketed WScript command invocation", "e": [ "ogododuxrakucotqiticuqegmoxsoqhyqtikzilowvydmysje[0]](dotjaby4, 0)" ], "i": "micro-behaviors/process/create/shell/wsh::wscript-shell-run-indirect", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Large import graph base64 context", "e": [ "imports.unique_modules = 180.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/string-blob::js-base64-candidate-large-import-graph", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "Function constructor keyword", "e": [ "Function" ], "i": "micro-behaviors/data/source/syntax/keyword::js-keyword-function-constructor", "l": 2 }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 1777.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "c": 0.800000011920929, "d": "JavaScript strings capped at five", "e": [ "strings.max_length = 4.00" ], "i": "objectives/anti-static/obfuscation/string/reconstruct::js-max-string-length-short", "l": 1 }, { "a": "T1027", "c": 0.8399999737739563, "d": "Decoded property function alias", "e": [ "var unuhxi6 = zelzijpazgylopyrhahjixxutedusuratigcitomyxuvoqtunfijajywcycuffu[0]" ], "i": "objectives/supply-chain/hidden-payload/trojan::decoded-property-function-alias", "l": 1, "m": "B0032" }, { "a": "T1105", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "new Function(" ], "i": "objectives/command-and-control/dropper/delivery/fetch-eval::new-function-variable-body--rx-1", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Immediate new Function invocation pattern", "e": [ "Function" ], "i": "micro-behaviors/data/source/dynamic/eval::new-function-iife", "l": 3, "m": "B0032" }, { "a": "T1027", "c": 0.8399999737739563, "d": "High ratio of entropy-heavy identifiers", "e": [ "identifiers.high_entropy_ratio = 0.90" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::js-high-entropy-identifier-ratio", "l": 4, "m": "B0032" }, { "c": 1.0, "d": "Tiny WScript.Shell fragment (variant 2a)", "e": [ "WScri" ], "i": "objectives/execution/interpreter/script/wsh-fragments::wscript-shell-fragment-tiny-2a", "l": 1 }, { "c": 0.800000011920929, "d": "WScript.Shell string fragment (WScrip/WScr)", "e": [ "WScr" ], "i": "objectives/execution/interpreter/script/wsh-fragments::wscript-shell-fragment-1", "l": 1 }, { "c": 0.8999999761581421, "d": "Exact tiny ADODB fragments (AD, OD, DB,", "e": [ "AD", "OD" ], "i": "objectives/execution/interpreter/script/wsh-fragments::adodb-fragment-tiny-exact", "l": 1 }, { "c": 0.8600000143051147, "d": "Hardcoded extension ID map or list", "e": [ "ejygwexrufirfehyvlowohyqyvsaqsew" ], "i": "objectives/supply-chain/metadata-anomaly/manifest/browser-ext::extension-id-map", "l": 1 }, { "c": 0.75, "d": "JScript array index concatenation (URL obfuscation)", "e": [ "nsegawgojdidtymtyxzilocahpapygsyfuxuloxih[1] + xpafaksuxpekjemfimhehugugbawiqeflutcihysfamyroxufogfekuxmyseqyrcynreqwillarf[0]" ], "i": "objectives/anti-static/obfuscation/syntax::js-array-index-concatenation", "l": 4 }, { "c": 0.8999999761581421, "d": "Tiny ResponseBody fragments (spon, seB, ody);)", "e": [ "seB" ], "i": "objectives/execution/interpreter/script/wsh-fragments::response-body-fragment-tiny-exact", "l": 4 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Multiple long lines (\u003e1000 chars)", "e": [ "text.lines_over_1000 = 3.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::very-long-lines", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Many random-looking source identifier names", "e": [ "identifiers.high_entropy_ratio = 0.90" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::many-high-entropy-identifiers", "l": 2, "m": "B0032" }, { "c": 0.9300000071525574, "d": "Nemucod short token cap", "e": [ "strings.max_length = 4.00" ], "i": "well-known/malware/dropper/nemucod::short-token-array-cap", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Immediate invocation of new Function", "e": [ "Function" ], "i": "objectives/anti-static/obfuscation/eval/function::suspicious-new-function-iife", "l": 4, "m": "B0032" } ], "sha": "9e176c60af5f6405c6ae4fa044c7c5a55fa5d8f73eb0fad7fe542f16b21dd7d6", "path": "20170117_87d0b00d7668835ed1ec91c61c5ef7ba.js", "type": "javascript" } ], "tv": "db300" } }