{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 1.0, "class": 2, "threshold": 0.9997464418411255 } ], "prob": 1.0, "class": 2, "level": 3, "models": [ { "m": "az", "prob": 0.8911782, "class": 0 }, { "m": "az/scripts", "prob": 1.0, "class": 2 }, { "m": "az/powershell", "prob": 1.0, "class": 2 } ], "version": "v17.17", "threshold": 0.99974644, "analyzed_at": "2026-05-31T12:11:02Z" }, "path": "ad8dbb25583372e0ecc021f60623c7805d984689750374dcc82e136af3695fe4.ps1", "raw": { "v": "5", "fs": [ { "f": "O(As)Md", "x": 35, "ff": { "m": { "file": { "size": 2180460.0, "entropy": 5.81, "size_bytes": 2180460.0 }, "text": { "digit_ratio": 0.16, "space_count": 126453.0, "total_lines": 18960.0, "char_entropy": 5.81, "unique_chars": 82.0, "lines_over_200": 2718.0, "lines_over_500": 617.0, "avg_line_length": 113.0, "lines_over_1000": 1.0, "max_line_length": 67922.0, "empty_line_ratio": 0.02, "last_line_length": 329.0, "long_token_count": 414.0, "whitespace_ratio": 0.08, "most_common_ratio": 0.05, "line_length_stddev": 517.24, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "trailing_whitespace_lines": 421.0, "most_common_char_codepoint": 93.0 } }, "s": [ [ 663, "xor", "5HO8HOmmma\"-" ], [ 1093, "xor", "(hqhmtunwwhma" ], [ 1903, "xor", "#*exesurHOa" ], [ 2096, "xor", "exetvsHOa'" ], [ 2656, "xor", "KOfmY5/*5*77777" ], [ 3262, "xor", "exeswvHOa7" ], [ 3570, "xor", " exesttHOa61" ], [ 5005, "xor", "1exervqHOa." ], [ 6644, "xor", "vMOXYxtofKj" ], [ 6757, "xor", "1nwsna?7\"*/" ], [ 6772, "xor", "XoDQ73--3/'5:uS" ], [ 6823, "xor", "exewwwHOa'," ], [ 6985, "xor", "HO8HO )6 ,#mmmma" ], [ 7190, "xor", "+$HO8HO )6 ,#mmmma" ], [ 7712, "xor", "2exewrtHOa" ], [ 8170, "xor", ".\"exersvHOa" ], [ 9373, "xor", "exerssHOa=" ], [ 9989, "xor", "HO8HO )6 ,#mmmmma" ], [ 10331, "xor", "HO8HO )6 ,#mmmma'," ], [ 10478, "xor", "2exevswHOa" ], [ 12065, "xor", ")exeqvsHOa7" ], [ 12219, "xor", "+HO'7 $.HO8HO,#mmmmma" ], [ 12383, "xor", "3exewrqHOa" ], [ 12806, "xor", ":UkGqYLyIFj" ], [ 13246, "xor", "zI5-,5*)77777777" ], [ 14139, "xor", "(-+exepsvHOa" ], [ 14374, "xor", ")=$exervtHOa)" ], [ 14500, "xor", "hrhtunmma$" ], [ 14510, "xor", "XDZW3*.5/-77566:i_U" ], [ 14530, "xor", "KOfmY5/+3*+7756,-.77" ], [ 14698, "xor", "2\".exemmtnvwhmwnvnvsllhma)" ], [ 15071, "xor", "1$nmmwunvvna5" ], [ 15073, "xor", "566,.5--5:nIHS" ], [ 15434, "xor", "*lllnma(/4" ], [ 15498, "xor", "47exemmmma" ], [ 16284, "xor", "0 $'exemmma" ], [ 16608, "xor", "=*exemmma3" ], [ 16992, "xor", "pYiy3/,3/777736/(-77" ], [ 18300, "xor", "lCEwpjC:Dho" ], [ 19344, "xor", "5HO8HOmmma\"-" ], [ 19774, "xor", "(hqhmtunwwhma" ], [ 20584, "xor", "#*exesurHOa" ], [ 20777, "xor", "exetvsHOa'" ], [ 21337, "xor", "KOfmY5/*5*77777" ], [ 21943, "xor", "exeswvHOa7" ], [ 22251, "xor", " exesttHOa61" ], [ 23686, "xor", "1exervqHOa." ], [ 25325, "xor", "vMOXYxtofKj" ], [ 25438, "xor", "1nwsna?7\"*/" ], [ 25453, "xor", "XoDQ73--3/'5:uS" ], [ 25504, "xor", "exewwwHOa'," ], [ 25666, "xor", "HO8HO )6 ,#mmmma" ], [ 25871, "xor", "+$HO8HO )6 ,#mmmma" ], [ 26393, "xor", "2exewrtHOa" ], [ 26851, "xor", ".\"exersvHOa" ], [ 28054, "xor", "exerssHOa=" ], [ 28670, "xor", "HO8HO )6 ,#mmmmma" ], [ 29012, "xor", "HO8HO )6 ,#mmmma'," ], [ 29159, "xor", "2exevswHOa" ], [ 30746, "xor", ")exeqvsHOa7" ], [ 30900, "xor", "+HO'7 $.HO8HO,#mmmmma" ], [ 31064, "xor", "3exewrqHOa" ], [ 31487, "xor", ":UkGqYLyIFj" ], [ 31927, "xor", "zI5-,5*)77777777" ], [ 32820, "xor", "(-+exepsvHOa" ], [ 33055, "xor", ")=$exervtHOa)" ], [ 33181, "xor", "hrhtunmma$" ], [ 33191, "xor", "XDZW3*.5/-77566:i_U" ], [ 33211, "xor", "KOfmY5/+3*+7756,-.77" ], [ 33379, "xor", "2\".exemmtnvwhmwnvnvsllhma)" ], [ 33752, "xor", "1$nmmwunvvna5" ], [ 33754, "xor", "566,.5--5:nIHS" ], [ 34115, "xor", "*lllnma(/4" ], [ 34179, "xor", "47exemmmma" ], [ 34965, "xor", "0 $'exemmma" ], [ 35289, "xor", "=*exemmma3" ], [ 35673, "xor", "pYiy3/,3/777736/(-77" ], [ 36981, "xor", "lCEwpjC:Dho" ], [ 37389, "xor", "hmvunvshma/#\u0026" ], [ 37406, "xor", "4nvrnmqunwpnwtlhqunwpnttlllllnmwsllHOa" ], [ 37529, "xor", "nvtnqulllhmquqllHOa" ], [ 39336, "xor", "lCEwpjC:Dho" ], [ 40730, "xor", "5HO8HOmmma\"-" ], [ 41160, "xor", "(hqhmtunwwhma" ], [ 41970, "xor", "#*exesurHOa" ], [ 42163, "xor", "exetvsHOa'" ], [ 42723, "xor", "KOfmY5/*5*77777" ], [ 43329, "xor", "exeswvHOa7" ], [ 43637, "xor", " exesttHOa61" ], [ 45072, "xor", "1exervqHOa." ], [ 46711, "xor", "vMOXYxtofKj" ], [ 46824, "xor", "1nwsna?7\"*/" ], [ 46839, "xor", "XoDQ73--3/'5:uS" ], [ 46890, "xor", "exewwwHOa'," ], [ 47052, "xor", "HO8HO )6 ,#mmmma" ], [ 47257, "xor", "+$HO8HO )6 ,#mmmma" ], [ 47779, "xor", "2exewrtHOa" ], [ 48237, "xor", ".\"exersvHOa" ], [ 49440, "xor", "exerssHOa=" ], [ 50056, "xor", "HO8HO )6 ,#mmmmma" ], [ 50398, "xor", "HO8HO )6 ,#mmmma'," ], [ 50545, "xor", "2exevswHOa" ], [ 52132, "xor", ")exeqvsHOa7" ], [ 52286, "xor", "+HO'7 $.HO8HO,#mmmmma" ], [ 52450, "xor", "3exewrqHOa" ], [ 52873, "xor", ":UkGqYLyIFj" ], [ 53313, "xor", "zI5-,5*)77777777" ], [ 54206, "xor", "(-+exepsvHOa" ], [ 54441, "xor", ")=$exervtHOa)" ], [ 54567, "xor", "hrhtunmma$" ], [ 54577, "xor", "XDZW3*.5/-77566:i_U" ], [ 54597, "xor", "KOfmY5/+3*+7756,-.77" ], [ 54765, "xor", "2\".exemmtnvwhmwnvnvsllhma)" ], [ 55138, "xor", "1$nmmwunvvna5" ], [ 55140, "xor", "566,.5--5:nIHS" ], [ 55501, "xor", "*lllnma(/4" ], [ 55565, "xor", "47exemmmma" ], [ 56351, "xor", "0 $'exemmma" ], [ 56675, "xor", "=*exemmma3" ], [ 57059, "xor", "pYiy3/,3/777736/(-77" ], [ 58367, "xor", "lCEwpjC:Dho" ], [ 58775, "xor", "hmvunvshma/#\u0026" ], [ 58792, "xor", "4nvrnmqunwpnwtlhqunwpnttlllllnmwsllHOa" ], [ 58915, "xor", "nvtnqulllhmquqllHOa" ], [ 60722, "xor", "lCEwpjC:Dho" ], [ 61462, "xor", "2* exemmma" ], [ 61746, "xor", "53hqtnwqlnqtntthtsnmptullHOa" ], [ 62017, "xor", "3-.5:dlyqtUj\\" ], [ 62031, "xor", "XoDQ56*)3*\u00263-.77756(.77" ], [ 62701, "xor", "\"exemmmma\u0026" ], [ 62821, "xor", "0/$3'exemmma" ], [ 62892, "xor", ",nqthwulhma" ], [ 63482, "xor", "lCEwpjC:Dho" ], [ 64613, "xor", "0/$3'lHOHOa/" ], [ 65286, "xor", "5HO8HOmmma\"-" ], [ 65716, "xor", "(hqhmtunwwhma" ], [ 66526, "xor", "#*exesurHOa" ], [ 66719, "xor", "exetvsHOa'" ], [ 67279, "xor", "KOfmY5/*5*77777" ], [ 67885, "xor", "exeswvHOa7" ], [ 68193, "xor", " exesttHOa61" ], [ 69628, "xor", "1exervqHOa." ], [ 71267, "xor", "vMOXYxtofKj" ], [ 71380, "xor", "1nwsna?7\"*/" ], [ 71395, "xor", "XoDQ73--3/'5:uS" ], [ 71446, "xor", "exewwwHOa'," ], [ 71608, "xor", "HO8HO )6 ,#mmmma" ], [ 71813, "xor", "+$HO8HO )6 ,#mmmma" ], [ 72335, "xor", "2exewrtHOa" ], [ 72793, "xor", ".\"exersvHOa" ], [ 73996, "xor", "exerssHOa=" ], [ 74612, "xor", "HO8HO )6 ,#mmmmma" ], [ 74954, "xor", "HO8HO )6 ,#mmmma'," ], [ 75101, "xor", "2exevswHOa" ], [ 76688, "xor", ")exeqvsHOa7" ], [ 76842, "xor", "+HO'7 $.HO8HO,#mmmmma" ], [ 77006, "xor", "3exewrqHOa" ], [ 77429, "xor", ":UkGqYLyIFj" ], [ 77869, "xor", "zI5-,5*)77777777" ], [ 78762, "xor", "(-+exepsvHOa" ], [ 78997, "xor", ")=$exervtHOa)" ], [ 79123, "xor", "hrhtunmma$" ], [ 79133, "xor", "XDZW3*.5/-77566:i_U" ], [ 79153, "xor", "KOfmY5/+3*+7756,-.77" ], [ 79321, "xor", "2\".exemmtnvwhmwnvnvsllhma)" ], [ 79694, "xor", "1$nmmwunvvna5" ], [ 79696, "xor", "566,.5--5:nIHS" ], [ 80057, "xor", "*lllnma(/4" ], [ 80121, "xor", "47exemmmma" ], [ 80907, "xor", "0 $'exemmma" ], [ 81231, "xor", "=*exemmma3" ], [ 81615, "xor", "pYiy3/,3/777736/(-77" ], [ 82923, "xor", "lCEwpjC:Dho" ], [ 83331, "xor", "hmvunvshma/#\u0026" ], [ 83348, "xor", "4nvrnmqunwpnwtlhqunwpnttlllllnmwsllHOa" ], [ 83471, "xor", "nvtnqulllhmquqllHOa" ], [ 85278, "xor", "lCEwpjC:Dho" ], [ 86018, "xor", "2* exemmma" ], [ 86302, "xor", "53hqtnwqlnqtntthtsnmptullHOa" ], [ 86573, "xor", "3-.5:dlyqtUj\\" ], [ 86587, "xor", "XoDQ56*)3*\u00263-.77756(.77" ], [ 87257, "xor", "\"exemmmma\u0026" ], [ 87377, "xor", "0/$3'exemmma" ], [ 87448, "xor", ",nqthwulhma" ], [ 88038, "xor", "lCEwpjC:Dho" ], [ 89169, "xor", "0/$3'lHOHOa=" ], [ 89206, "xor", "iLzpR5-,3+77736:i_U" ], [ 89373, "xor", "5 ntvhma+13" ], [ 89976, "xor", "lCEwpjC:Dho" ], [ 91873, "xor", "5HO8HOmmma\"-" ], [ 92303, "xor", "(hqhmtunwwhma" ], [ 93113, "xor", "#*exesurHOa" ], [ 93306, "xor", "exetvsHOa'" ], [ 93866, "xor", "KOfmY5/*5*77777" ], [ 94472, "xor", "exeswvHOa7" ], [ 94780, "xor", " exesttHOa61" ], [ 96215, "xor", "1exervqHOa." ], [ 97854, "xor", "vMOXYxtofKj" ], [ 97967, "xor", "1nwsna?7\"*/" ], [ 97982, "xor", "XoDQ73--3/'5:uS" ], [ 98033, "xor", "exewwwHOa'," ], [ 98195, "xor", "HO8HO )6 ,#mmmma" ], [ 98400, "xor", "+$HO8HO )6 ,#mmmma" ], [ 98922, "xor", "2exewrtHOa" ], [ 99380, "xor", ".\"exersvHOa" ], [ 100583, "xor", "exerssHOa=" ], [ 101199, "xor", "HO8HO )6 ,#mmmmma" ], [ 101541, "xor", "HO8HO )6 ,#mmmma'," ], [ 101688, "xor", "2exevswHOa" ], [ 103275, "xor", ")exeqvsHOa7" ], [ 103429, "xor", "+HO'7 $.HO8HO,#mmmmma" ], [ 103593, "xor", "3exewrqHOa" ], [ 104016, "xor", ":UkGqYLyIFj" ], [ 104456, "xor", "zI5-,5*)77777777" ], [ 105349, "xor", "(-+exepsvHOa" ], [ 105584, "xor", ")=$exervtHOa)" ], [ 105710, "xor", "hrhtunmma$" ], [ 105720, "xor", "XDZW3*.5/-77566:i_U" ], [ 105740, "xor", "KOfmY5/+3*+7756,-.77" ], [ 105908, "xor", "2\".exemmtnvwhmwnvnvsllhma)" ], [ 106281, "xor", "1$nmmwunvvna5" ], [ 106283, "xor", "566,.5--5:nIHS" ], [ 106644, "xor", "*lllnma(/4" ], [ 106708, "xor", "47exemmmma" ], [ 107494, "xor", "0 $'exemmma" ], [ 107818, "xor", "=*exemmma3" ], [ 108202, "xor", "pYiy3/,3/777736/(-77" ], [ 109510, "xor", "lCEwpjC:Dho" ], [ 109918, "xor", "hmvunvshma/#\u0026" ], [ 109935, "xor", "4nvrnmqunwpnwtlhqunwpnttlllllnmwsllHOa" ], [ 110058, "xor", "nvtnqulllhmquqllHOa" ], [ 111865, "xor", "lCEwpjC:Dho" ], [ 112605, "xor", "2* exemmma" ], [ 112889, "xor", "53hqtnwqlnqtntthtsnmptullHOa" ], [ 113160, "xor", "3-.5:dlyqtUj\\" ], [ 113174, "xor", "XoDQ56*)3*\u00263-.77756(.77" ], [ 113844, "xor", "\"exemmmma\u0026" ], [ 113964, "xor", "0/$3'exemmma" ], [ 114035, "xor", ",nqthwulhma" ], [ 114625, "xor", "lCEwpjC:Dho" ], [ 115756, "xor", "0/$3'lHOHOa=" ], [ 115793, "xor", "iLzpR5-,3+77736:i_U" ], [ 115960, "xor", "5 ntvhma+13" ], [ 116563, "xor", "lCEwpjC:Dho" ], [ 118099, "xor", ":FU\\HmMJdY" ], [ 118997, "xor", "lCEwpjC:Dho" ], [ 120349, "xor", "lCEwpjC:FU\\HmMJdY" ], [ 121110, "xor", "5HO8HOmmma\"-" ], [ 121540, "xor", "(hqhmtunwwhma" ], [ 122350, "xor", "#*exesurHOa" ], [ 122543, "xor", "exetvsHOa'" ], [ 123103, "xor", "KOfmY5/*5*77777" ], [ 123709, "xor", "exeswvHOa7" ], [ 124017, "xor", " exesttHOa61" ], [ 125452, "xor", "1exervqHOa." ], [ 127091, "xor", "vMOXYxtofKj" ] ], "v": { "file.stem": "ad8dbb25583372e0ecc021f60623c7805d984689750374dcc82e136af3695fe4", "file.basename": "ad8dbb25583372e0ecc021f60623c7805d984689750374dcc82e136af3695fe4.ps1", "source.strings[0]": " exesttHOa61", "source.strings[1]": "!.#(exemma", "source.strings[2]": "\"exemmmma\u0026", "source.strings[3]": "#*?exemmmma", "source.strings[4]": "#*exesurHOa", "source.strings[5]": "#,exemmma)", "source.strings[6]": "$7exemmmma2'", "source.strings[7]": "$exemmmma\"0", "source.strings[8]": "\u0026'1\"exemma3", "source.strings[9]": "\u0026'1\"lHOHOa/", "source.strings[10]": "'0exemma)21", "source.strings[11]": "(-+exepsvHOa", "source.strings[12]": "(hqhmtunwwhma", "source.strings[13]": ")17'(-exemmmma", "source.strings[14]": ")=$exervtHOa)", "source.strings[15]": ")exeqvsHOa7", "source.strings[16]": "*lllnma(/4", "source.strings[17]": "+$HO8HO )6 ,#mmmma", "source.strings[18]": "+'$exemmmma", "source.strings[19]": "+HO'7 $.HO8HO,#mmmmma", "source.strings[20]": ",lHOHOaq\u0026$v6p3s!!s'exema", "source.strings[21]": ",lma+0))im", "source.strings[22]": ",nqthwulhma", "source.strings[23]": ".\"exersvHOa", "source.strings[24]": ".=#0 exemmma", "source.strings[25]": ".exemmma)21", "source.strings[26]": ".exemmmma7", "source.strings[27]": "0 $'exemmma", "source.strings[28]": "0/$3'exemmma", "source.strings[29]": "0/$3'lHOHOa/", "source.strings[30]": "0/$3'lHOHOa=", "source.strings[31]": "03(exemmma", "source.strings[32]": "1$nmmwunvvna5", "source.strings[33]": "1eh'*7ema7", "source.strings[34]": "1exemmmma!4", "source.strings[35]": "1exervqHOa.", "source.strings[36]": "1nwsna?7\"*/", "source.strings[37]": "2\".exemmtnvwhmwnvnvsllhma)", "source.strings[38]": "2* exemmma", "source.strings[39]": "20exemma/!$", "source.strings[40]": "20lHOHOa2/", "source.strings[41]": "2exevswHOa", "source.strings[42]": "2exewrtHOa", "source.strings[43]": "3,(3:DfioNQS7736:UnTs", "source.strings[44]": "3-.5:dlyqtUj\\", "source.strings[45]": "3exewrqHOa", "source.strings[46]": "3ntnqullnmtrvllHOa", "source.strings[47]": "3ntrnvvllhmwstllHOa", "source.strings[48]": "4\u0026exemmmma.7=", "source.strings[49]": "47exemmmma", "source.strings[50]": "4htrhqulllllnmtprllHOa1", "source.strings[51]": "4hvwhtwlnmprpllHOa", "source.strings[52]": "4nvrnmqunwpnwtlhqunwpnttlllllnmwsllHOa", "source.strings[53]": "5 ntvhma+13", "source.strings[54]": "5*,5/)7777756))/77", "source.strings[55]": "5-.3*77736,*/77", "source.strings[56]": "5/)5,\u0026777777756/.(77", "source.strings[57]": "5/,5-)75:tVTDZo_l", "source.strings[58]": "53hqtnwqlnqtntthtsnmptullHOa", "source.strings[59]": "566,.5--5:nIHS", "source.strings[60]": "56exemmmma", "source.strings[61]": "57/,exemmma'", "source.strings[62]": "57/,lHOHOa/", "source.strings[63]": "5HO8HOmmma\"-", "source.strings[64]": "6\"exemmma/", "source.strings[65]": "6exemmma!4", "source.strings[66]": "6htphma?7\"*/", "source.strings[67]": ":FU\\HmMJdY", "source.strings[68]": ":UkGqYLyIFj", "source.strings[69]": ":\\xYMFIqkuS\u003e#\u003e6666,(3--3:tI\\pX775:HIx{QNWyprznS3,/3-'5:NjX\\kKhZ5,-5-.756/,*77", "source.strings[70]": "=(!exemmmma", "source.strings[71]": "=*exemmma3", "source.strings[72]": "=5exemmmma=", "source.strings[73]": "?(exemmmma", "source.strings[74]": "?25lHOHOa.", "source.strings[75]": "?25lHOHOa/", "source.strings[76]": "HO8HO )6 ,#mmmma", "source.strings[77]": "HO8HO )6 ,#mmmma',", "source.strings[78]": "HO8HO )6 ,#mmmmma", "source.strings[79]": "JV773:j\\ygUJ_3,.3,+56'(*77", "source.strings[80]": "KOfmY5/*5*77777", "source.strings[81]": "KOfmY5/+3*+7756,-.77", "source.strings[82]": "XDZW3*.5/-77566:i_U", "source.strings[83]": "XDZW36:JqR_IHxnTDi5/.5'7756\u0026*77", "source.strings[84]": "XoDQ5*'5/+756/)/77", "source.strings[85]": "XoDQ5-'56--3,+3,/77777736/'\u002677", "source.strings[86]": "XoDQ56*)3*\u00263-.77756(.77", "source.strings[87]": "XoDQ73--3/'5:uS", "source.strings[88]": "XoDQ773*)3-+5,.756//(77", "source.strings[89]": "exemmma54'", "source.strings[90]": "exemmmma+13", "source.strings[91]": "exemmmma-!#", "source.strings[92]": "exemmmquhwrna", "source.strings[93]": "exemmpnquha*", "source.strings[94]": "exerssHOa=", "source.strings[95]": "exeswvHOa7", "source.strings[96]": "exetvsHOa'", "source.strings[97]": "exewwwHOa',", "source.strings[98]": "hmvunvshma/#\u0026", "source.strings[99]": "hqvhmquhqrhma24", "source.strings[100]": "hrhtunmma$", "source.strings[101]": "htrVFyi3,-36*.3,.3,.77756**-77", "source.strings[102]": "htrVFyi5*3:", "source.strings[103]": "htrVFyi7566-\u00263)5-/7736/'-)77", "source.strings[104]": "htrVFyi756:j\\ygUJ_5,*5/(756\u0026)\u002677", "source.strings[105]": "htunplnma'", "source.strings[106]": "hwuhrlnmwuqllHOa", "source.strings[107]": "iLzpR5-,3+77736:i_U", "source.strings[108]": "lCEwpjC:D_YmI", "source.strings[109]": "lCEwpjC:Dho", "source.strings[110]": "lCEwpjC:FU\\HmMJdY", "source.strings[111]": "lCEwpjC:GUJ", "source.strings[112]": "lCEwpjC:M_", "source.strings[113]": "lCEwpjC:VL\\xYmD\u003e5\u003eE}v", "source.strings[114]": "lCEwpjC:\\xYMFIqkuS\u003e5\u003eE}v", "source.strings[115]": "lCEwpjC:_JxU", "source.strings[116]": "lCEwpjC:gXstKik7", "source.strings[117]": "lCEwpjC:jJgGOfn7", "source.strings[118]": "lCEwpjC:no", "source.strings[119]": "lCEwpjC:ro_hIUxpnmOZ7", "source.strings[120]": "lCEwpjC:roy", "source.strings[121]": "lCEwpjC:zy\\LInfToYmpOF7", "source.strings[122]": "lnmtuntphma", "source.strings[123]": "nvtnqulllhmquqllHOa", "source.strings[124]": "pYiy3/,3/777736/(-77", "source.strings[125]": "pzFP3+5:uS", "source.strings[126]": "vMOXYxtofKj", "source.strings[127]": "vMOXYxtofKj7775/)3-\u00265/'75:OS", "source.strings[128]": "zI5-,5*)77777777" }, "id": "powershell" }, "id": 0, "sz": 2180460, "ts": [ { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 67922.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Exactly one line exceeds 1000 chars", "e": [ "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "l": 1, "m": "B0032" }, { "a": "T1562.001", "c": 0.8199999928474426, "d": "PowerShell char arithmetic", "e": [ "iLzpR5-,3+77736:i_U", "pYiy3/,3/777736/(-77", "KOfmY5/*5*77777" ], "i": "objectives/evasion/anti-av/amsi::powershell-char-arithmetic", "l": 1, "m": "E1562", "el": [ "0x15c76", "0x4260", "0xa60" ] }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 18960.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "a": "T1204.002", "d": "PowerShell bitwise XOR operator", "e": [ "-bxor" ], "i": "objectives/command-and-control/dropper/lnk/remcos::powershell-bxor-op", "l": 2 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Suspicious long PowerShell line", "e": [ "text.max_line_length = 67922.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::ps-suspicious-single-line", "l": 4, "m": "B0032" }, { "a": "T1027", "c": 0.699999988079071, "d": "Very low whitespace ratio (minified/compressed)", "e": [ "text.whitespace_ratio = 0.08" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.800000011920929, "d": "High overall text entropy (encoded", "e": [ "text.char_entropy = 5.81" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::high-text-entropy", "l": 2, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Encoded payload detected: xor → base64", "e": [ "\u003cbinary data\u003e \u003cxor+base64\u003e" ], "i": "metadata/encoded-payload/xor-base64", "l": 3, "el": [ "offset:61746" ] } ], "sha": "ad8dbb25583372e0ecc021f60623c7805d984689750374dcc82e136af3695fe4", "path": "ad8dbb25583372e0ecc021f60623c7805d984689750374dcc82e136af3695fe4.ps1", "type": "powershell" } ], "tv": "52045" } }