{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 1.0,
        "class": 2,
        "threshold": 1.0
      }
    ],
    "prob": 1.0,
    "class": 2,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.97391856,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.98502994,
        "class": 0
      },
      {
        "m": "az/powershell",
        "prob": 1.0,
        "class": 2
      }
    ],
    "version": "v17.17",
    "threshold": 1.0,
    "analyzed_at": "2026-05-31T06:12:54Z"
  },
  "path": "dfbd92a1d1b38300aadc5aacbed6b3f106ab779293174c23df586f54743f1ebb.ps1",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "O(Er)H(F)",
        "x": 40,
        "ff": {
          "m": {
            "ast": {
              "max_depth": 9.0,
              "call_count": 36.0,
              "node_count": 485.0,
              "identifier_count": 5.0,
              "string_literal_count": 9.0,
              "array_literal_max_length": 1.0
            },
            "file": {
              "size": 1676.0,
              "entropy": 4.72,
              "size_bytes": 1676.0
            },
            "text": {
              "digit_ratio": 0.01,
              "space_count": 76.0,
              "total_lines": 36.0,
              "char_entropy": 4.72,
              "unique_chars": 54.0,
              "escape_density": 0.12,
              "string_density": 0.25,
              "avg_line_length": 45.58,
              "max_line_length": 68.0,
              "last_line_length": 43.0,
              "whitespace_ratio": 0.07,
              "most_common_ratio": 0.17,
              "identifier_density": 1.42,
              "line_length_stddev": 6.83,
              "unicode_escape_count": 2.0,
              "normalized_string_count": 1.5,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 1.0,
              "trailing_whitespace_lines": 1.0,
              "most_common_char_codepoint": 101.0,
              "normalized_unique_identifiers": 0.97
            },
            "calls": {
              "count": 36.0
            },
            "strings": {
              "total": 9.0,
              "avg_length": 7.22,
              "max_length": 15.0,
              "path_count": 3.0,
              "avg_entropy": 2.27,
              "total_bytes": 65.0,
              "entropy_stddev": 0.86
            },
            "identifiers": {
              "count": 5.0,
              "total": 51.0,
              "avg_length": 10.4,
              "max_length": 16.0,
              "min_length": 5.0,
              "avg_entropy": 2.91,
              "reuse_ratio": 0.1,
              "unique_count": 5.0,
              "length_stddev": 4.67,
              "all_lowercase_ratio": 0.2
            }
          },
          "s": [
            [
              37,
              "u8",
              ".bat"
            ],
            [
              37,
              "u8",
              ".bat"
            ],
            [
              81,
              "u8",
              ".exe"
            ],
            [
              81,
              "u8",
              ".exe"
            ],
            [
              775,
              "10",
              "2"
            ],
            [
              775,
              "10",
              "2"
            ],
            [
              915,
              "10",
              "6"
            ],
            [
              915,
              "10",
              "6"
            ],
            [
              970,
              "10",
              "6"
            ],
            [
              970,
              "10",
              "6"
            ],
            [
              1013,
              "10",
              "6"
            ],
            [
              1013,
              "10",
              "6"
            ],
            [
              1059,
              "10",
              "6"
            ],
            [
              1059,
              "10",
              "6"
            ],
            [
              1095,
              "10",
              "8"
            ],
            [
              1095,
              "10",
              "8"
            ],
            [
              1129,
              "10",
              "0"
            ],
            [
              1129,
              "10",
              "0"
            ],
            [
              1173,
              "10",
              "6"
            ],
            [
              1173,
              "10",
              "6"
            ],
            [
              1228,
              "10",
              "6"
            ],
            [
              1228,
              "10",
              "6"
            ],
            [
              1273,
              "10",
              "6"
            ],
            [
              1273,
              "10",
              "6"
            ],
            [
              1319,
              "10",
              "6"
            ],
            [
              1319,
              "10",
              "6"
            ],
            [
              1355,
              "10",
              "8"
            ],
            [
              1355,
              "10",
              "8"
            ],
            [
              1389,
              "u8",
              "C:\\"
            ],
            [
              1389,
              "u8",
              "C:\\"
            ],
            [
              1427,
              "u8",
              "C:\\update64.exe"
            ],
            [
              1427,
              "u8",
              "C:\\update64.exe"
            ],
            [
              1477,
              "u8",
              "C:\\update64.exe"
            ],
            [
              1477,
              "u8",
              "C:\\update64.exe"
            ],
            [
              1530,
              "u8",
              "update64.exe"
            ],
            [
              1530,
              "u8",
              "update64.exe"
            ],
            [
              1582,
              "u8",
              ".bat"
            ],
            [
              1582,
              "u8",
              ".bat"
            ],
            [
              1626,
              "u8",
              ".dll"
            ],
            [
              1626,
              "u8",
              ".dll"
            ],
            [
              1670,
              "u8",
              ".exe"
            ],
            [
              1670,
              "u8",
              ".exe"
            ]
          ],
          "v": {
            "file.stem": "dfbd92a1d1b38300aadc5aacbed6b3f106ab779293174c23df586f54743f1ebb",
            "file.basename": "dfbd92a1d1b38300aadc5aacbed6b3f106ab779293174c23df586f54743f1ebb.ps1",
            "source.language": "powershell",
            "source.strings[0]": "C:\\update64.exe",
            "source.strings[1]": "update64.exe"
          },
          "ct": [
            "Add-MpPreference",
            "Set-MpPreference"
          ],
          "id": "powershell"
        },
        "id": 0,
        "sz": 1676,
        "ts": [
          {
            "a": "T1562.001",
            "c": 0.949999988079071,
            "d": "Add Windows Defender exclusion",
            "e": [
              "Add-MpPreference -Exclusion"
            ],
            "i": "objectives/evasion/anti-av/platform/defender::defender-add-exclusion",
            "l": 4
          },
          {
            "a": "T1562.001",
            "c": 0.8999999761581421,
            "d": "Windows Defender process exclusion",
            "e": [
              "-ExclusionProcess"
            ],
            "i": "objectives/evasion/anti-av/platform/defender::defender-exclusion-process",
            "l": 4
          },
          {
            "a": "T1059.003",
            "c": 0.800000011920929,
            "d": "BAT file written to disk",
            "e": [
              ".bat\""
            ],
            "i": "objectives/command-and-control/dropper/staging/embedded::bat-file-write",
            "l": 1,
            "m": "B0030"
          },
          {
            "a": "T1562.001",
            "c": 0.8999999761581421,
            "d": "Disable IOAV protection",
            "e": [
              "Set-MpPreference -DisableIOAVProtection $true"
            ],
            "i": "objectives/evasion/anti-av/platform/defender::defender-disable-ioav",
            "l": 4
          },
          {
            "a": "T1562.001",
            "c": 0.949999988079071,
            "d": "Disable Windows Defender realtime",
            "e": [
              "Set-MpPreference -DisableRealtimeMonitoring $true"
            ],
            "i": "objectives/evasion/anti-av/platform/defender::defender-disable-realtime",
            "l": 4
          },
          {
            "d": ".bat extension reference",
            "e": [
              ".bat"
            ],
            "i": "micro-behaviors/fs/path/extension::bat-dup",
            "l": 1
          },
          {
            "a": "T1562.001",
            "c": 0.8999999761581421,
            "d": "Windows Defender extension exclusion",
            "e": [
              "-ExclusionExtension"
            ],
            "i": "objectives/evasion/anti-av/platform/defender::defender-exclusion-extension",
            "l": 4
          },
          {
            "a": "T1562.001",
            "c": 0.9599999785423279,
            "d": "Embedded Defender exclusion cmdlet",
            "e": [
              "Add-MpPreference -ExclusionExtension"
            ],
            "i": "objectives/evasion/anti-av/platform/defender::defender-exclusion-cmdlet-raw",
            "l": 4
          },
          {
            "a": "T1562.001",
            "c": 0.8999999761581421,
            "d": "Windows Defender path exclusion",
            "e": [
              "-ExclusionPath"
            ],
            "i": "objectives/evasion/anti-av/platform/defender::defender-exclusionpath-raw",
            "l": 4
          },
          {
            "a": "T1562.001",
            "c": 0.9800000190734863,
            "d": "Embedded Defender exclusion cmdlet",
            "e": [
              "Add-MpPreference -ExclusionExtension"
            ],
            "i": "objectives/evasion/anti-av/platform/defender::defender-exclusion-cmdlet",
            "l": 4
          },
          {
            "a": "T1204.002",
            "c": 0.800000011920929,
            "d": "Writes executable to drive root",
            "e": [
              "C:\\update64.exe"
            ],
            "i": "micro-behaviors/fs/path/location::path-suspicious-root-exe",
            "l": 3,
            "m": "F0013"
          },
          {
            "c": 0.8999999761581421,
            "d": "File has 30 or more lines",
            "e": [
              "text.total_lines = 36.00"
            ],
            "i": "metadata/file/text/metrics::file-has-30-plus-lines",
            "l": 1
          },
          {
            "c": 0.8399999737739563,
            "d": "Hidden directory path literal",
            "e": [
              ".exe",
              ".dll",
              ".bat"
            ],
            "i": "micro-behaviors/fs/path/location::hidden-dir-literal",
            "l": 1,
            "el": [
              "0x51",
              "0x65a",
              "0x25"
            ]
          },
          {
            "a": "T1562.001",
            "c": 0.949999988079071,
            "d": "Exclude entire drive from Defender",
            "e": [
              "-ExclusionPath \"C:\\\"\n"
            ],
            "i": "objectives/evasion/anti-av/platform/defender::defender-drive-exclusion",
            "l": 4
          },
          {
            "a": "T1562.001",
            "c": 0.949999988079071,
            "d": "Windows Defender path exclusion",
            "e": [
              "-ExclusionPath"
            ],
            "i": "objectives/evasion/anti-av/platform/defender::defender-exclusion-path",
            "l": 4
          },
          {
            "a": "T1562.001",
            "c": 0.949999988079071,
            "d": "Disable behavior monitoring",
            "e": [
              "Set-MpPreference -DisableBehaviorMonitoring $true"
            ],
            "i": "objectives/evasion/anti-av/platform/defender::defender-disable-behavior",
            "l": 4
          },
          {
            "c": 0.800000011920929,
            "d": "Hardcoded Windows root path (C:\\, D:\\, etc.)",
            "e": [
              "\"C:\\"
            ],
            "i": "micro-behaviors/fs/path/os::hardcoded-windows-root",
            "l": 2
          },
          {
            "d": ".exe extension reference",
            "e": [
              ".exe"
            ],
            "i": "micro-behaviors/fs/path/extension::exe-dup",
            "l": 2
          }
        ],
        "sha": "dfbd92a1d1b38300aadc5aacbed6b3f106ab779293174c23df586f54743f1ebb",
        "path": "dfbd92a1d1b38300aadc5aacbed6b3f106ab779293174c23df586f54743f1ebb.ps1",
        "type": "powershell"
      }
    ],
    "tv": "52045"
  }
}