{
  "ml": {
    "l": -1,
    "v": "6",
    "fs": [
      {
        "l": -1,
        "id": 0,
        "prob": 0.000012536843314592261
      }
    ],
    "prob": 0.000012536843,
    "models": [
      {
        "m": "az",
        "raw": 0.000012536843,
        "prob": 0.000012536843,
        "class": 0
      },
      {
        "m": "az/source",
        "raw": 0.000008076429,
        "prob": 0.000008076429,
        "class": 0
      },
      {
        "m": "az/c",
        "raw": 0.0000061690807,
        "prob": 0.0000061690807,
        "class": 0
      }
    ],
    "version": "v17.17",
    "analyzed_at": "2026-06-08T02:07:54Z"
  },
  "path": "ntstatus.h",
  "raw": {
    "v": "6",
    "fs": [
      {
        "f": "O(Er)H(F)",
        "x": 3,
        "ff": {
          "m": {
            "ast": {
              "op.ge": 1.0,
              "op.land": 1.0,
              "max_depth": 6.0,
              "call_count": 0.0,
              "node_count": 12421.0,
              "op_density.ge": 0.0,
              "op_density.land": 0.0,
              "identifier_count": 1109.0
            },
            "file": {
              "size": 246035.0,
              "entropy": 5.22,
              "size_bytes": 246035.0
            },
            "text": {
              "digit_ratio": 0.05,
              "space_count": 29014.0,
              "total_lines": 10243.0,
              "char_entropy": 5.22,
              "unique_chars": 88.0,
              "lines_over_200": 10.0,
              "ascii_art_lines": 12.0,
              "avg_line_length": 23.02,
              "max_line_length": 251.0,
              "empty_line_ratio": 0.11,
              "last_line_length": 20.0,
              "whitespace_ratio": 0.16,
              "most_common_ratio": 0.07,
              "identifier_density": 0.11,
              "line_length_stddev": 30.79,
              "repeated_char_sequences": 365.0,
              "most_common_char_is_null": 0.0,
              "suspicious_comment_ratio": 0.0,
              "max_inline_whitespace_run": 26.0,
              "trailing_whitespace_lines": 5.0,
              "most_common_char_codepoint": 101.0,
              "normalized_unique_identifiers": 83.24
            },
            "binary": {
              "overall_entropy": 5.22
            },
            "comments": {
              "chars": 148727.0,
              "lines": 3645.0,
              "total": 7979.0,
              "to_code_ratio": 0.55,
              "empty_comments": 4384.0,
              "base64_in_comments": 4.0,
              "high_entropy_comments": 12.0
            },
            "identifiers": {
              "count": 1109.0,
              "total": 1111.0,
              "avg_length": 26.03,
              "max_length": 50.0,
              "min_length": 8.0,
              "avg_entropy": 3.54,
              "reuse_ratio": 1.0,
              "unique_count": 1109.0,
              "length_stddev": 5.35,
              "has_digit_ratio": 0.03,
              "high_entropy_count": 695.0,
              "high_entropy_ratio": 0.63,
              "all_uppercase_ratio": 0.97,
              "numeric_suffix_count": 23.0,
              "underscore_prefix_count": 2.0
            }
          },
          "s": [
            [
              728,
              "10",
              "1020"
            ],
            [
              25613,
              "base64",
              "Ў5\"\u0012LCS"
            ],
            [
              25761,
              "base64",
              "Ў5\"\u0012LCS"
            ],
            [
              31806,
              "base64",
              "PԔ\b!\u0012HU"
            ],
            [
              31934,
              "base64",
              "PԔ\b!\u0012HU"
            ],
            [
              60838,
              "base64",
              "Ԕ\u0014R\u0002 CS"
            ],
            [
              60968,
              "base64",
              "Ԕ\u0014R\u0002 CS"
            ],
            [
              119551,
              "base64",
              "Ў5\"\u0012LCS"
            ],
            [
              119727,
              "base64",
              "Ў5\"\u0012LCS"
            ],
            [
              125290,
              "url",
              "//  The %hs system process terminated unexpectedly with a status of 0x\bx (0x\bx 0x\bx)."
            ],
            [
              135979,
              "base64",
              "Ԕ\u0014R\u0002 CS"
            ],
            [
              136110,
              "base64",
              "Ԕ\u0014R\u0002 CS"
            ],
            [
              141676,
              "base64",
              "Ў5\"\u0012LCS"
            ],
            [
              141823,
              "base64",
              "Ў5\"\u0012LCS"
            ],
            [
              164176,
              "base64",
              "Ԕ\u0014R\u0002 CS"
            ],
            [
              164308,
              "base64",
              "Ԕ\u0014R\u0002 CS"
            ],
            [
              239135,
              "base64",
              "Ў5\"\u0012LCS"
            ],
            [
              239275,
              "base64",
              "Ў5\"\u0012LCS"
            ],
            [
              245574,
              "base64",
              "Ў5\"\u0012LCS"
            ],
            [
              245706,
              "base64",
              "Ў5\"\u0012LCS"
            ]
          ],
          "v": {
            "file.stem": "ntstatus",
            "file.basename": "ntstatus.h",
            "source.language": "c",
            "source.strings[0]": "//  The %hs system process terminated unexpectedly with a status of 0x\bx (0x\bx 0x\bx).",
            "source.strings[1]": "PԔ\b!\u0012HU",
            "source.strings[2]": "Ў5\"\u0012LCS",
            "source.strings[3]": "Ԕ\u0014R\u0002 CS"
          },
          "id": "c"
        },
        "id": 0,
        "sz": 246035,
        "ts": [
          {
            "c": 0.44999998807907104,
            "d": "TOKEN credential label",
            "e": [
              "TOKEN"
            ],
            "i": "micro-behaviors/data/text/keywords/credential::token-upper",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "\"Microsoft Corporation\" vendor/author string",
            "e": [
              "Microsoft Corporation"
            ],
            "i": "metadata/binary/vendor::microsoft-corporation-author-string",
            "l": 1
          },
          {
            "c": 0.9700000286102295,
            "d": "Validation vocabulary string",
            "e": [
              "string"
            ],
            "i": "metadata/file/text/format::vocab-string",
            "l": 1
          },
          {
            "c": 0.9700000286102295,
            "d": "Validation vocabulary date",
            "e": [
              "date"
            ],
            "i": "metadata/file/text/format::vocab-date",
            "l": 1
          },
          {
            "c": 0.9700000286102295,
            "d": "Validation vocabulary expected",
            "e": [
              "expected"
            ],
            "i": "metadata/file/text/format::vocab-expected",
            "l": 1
          },
          {
            "c": 0.9700000286102295,
            "d": "Validation vocabulary required",
            "e": [
              "required"
            ],
            "i": "metadata/file/text/format::vocab-required",
            "l": 1
          },
          {
            "c": 0.20000000298023224,
            "d": "crypto keyword (substr, catches imports)",
            "e": [
              "crypto"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::crypto-substr",
            "l": 1
          },
          {
            "c": 0.4000000059604645,
            "d": "cmd/command/result vocabulary word",
            "e": [
              "result"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::command-result-word",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "NTSTATUS usage",
            "e": [
              "NTSTATUS"
            ],
            "i": "metadata/lang/source::ntstatus-usage",
            "l": 2
          },
          {
            "c": 0.9700000286102295,
            "d": "Validation vocabulary invalid",
            "e": [
              "Invalid"
            ],
            "i": "metadata/file/text/format::vocab-invalid",
            "l": 1
          },
          {
            "c": 0.20000000298023224,
            "d": "crypto keyword (word match)",
            "e": [
              "crypto"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::crypto-word",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Destructive delete verb",
            "e": [
              "delete"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::delete-verb",
            "l": 1
          },
          {
            "c": 0.9700000286102295,
            "d": "Validation vocabulary array",
            "e": [
              "array"
            ],
            "i": "metadata/file/text/format::vocab-array",
            "l": 1
          },
          {
            "c": 0.7200000286102295,
            "d": "LLM instruction context",
            "e": [
              "INSTRUCTION"
            ],
            "i": "micro-behaviors/data/text/llm/override::llm-instruction-context",
            "l": 1
          },
          {
            "a": "T1071.001",
            "c": 0.949999988079071,
            "d": "Reptile server list command",
            "e": [
              "server is not list"
            ],
            "i": "objectives/command-and-control/channel/irc/bot::server-list-command",
            "l": 1
          },
          {
            "c": 0.9700000286102295,
            "d": "Validation vocabulary number",
            "e": [
              "number"
            ],
            "i": "metadata/file/text/format::vocab-number",
            "l": 1
          },
          {
            "d": "password keyword",
            "e": [
              "password"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::password",
            "l": 1
          },
          {
            "c": 0.20000000298023224,
            "d": "output keyword",
            "e": [
              "output"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::output",
            "l": 1
          },
          {
            "c": 0.20000000298023224,
            "d": "pipe keyword",
            "e": [
              "pipe"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::pipe",
            "l": 1
          },
          {
            "c": 0.9700000286102295,
            "d": "Validation vocabulary object",
            "e": [
              "object"
            ],
            "i": "metadata/file/text/format::vocab-object",
            "l": 1
          },
          {
            "c": 0.8600000143051147,
            "d": "Permission-grant action verb keyword",
            "e": [
              "allow"
            ],
            "i": "micro-behaviors/data/text/keywords/media-permission::permission-grant-verb",
            "l": 1
          },
          {
            "c": 0.8600000143051147,
            "d": "notify/sender vocabulary word",
            "e": [
              "notify"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::notification-config-word",
            "l": 1
          },
          {
            "c": 0.8799999952316284,
            "d": "Source or test deletion target",
            "e": [
              "Source Code"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::target-source-test",
            "l": 1
          },
          {
            "c": 0.8799999952316284,
            "d": "Codebase deletion target",
            "e": [
              "code"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::target-codebase",
            "l": 1
          },
          {
            "c": 0.30000001192092896,
            "d": "secret keyword",
            "e": [
              "secret"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::secret",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "Code mentions corruption/corrupting",
            "e": [
              "//  This error indicates that the requested operation cannot be completed due to a catastrophic medi...",
              "//  was corrupted and it has been recovered. Some data might have been lost.",
              "// MessageId: STATUS_REGISTRY_CORRUPT",
              "// MessageId: STATUS_EVENTLOG_FILE_CORRUPT",
              "//  {Corrupt File}",
              "//  The file system structure on the disk is corrupt and unusable.",
              "//  The file or directory %hs is corrupt and unreadable.",
              "// MessageId: STATUS_DISK_CORRUPT_ERROR",
              "//  {Corrupt Disk}",
              "//  The EA is corrupt and non-readable.",
              "// MessageId: STATUS_EA_CORRUPT_ERROR",
              "//  The structure of one of the files that contains Registry data is corrupt, or the image of the fi...",
              "// MessageId: STATUS_INTERNAL_DB_CORRUPTION",
              "//  Please make sure that all required file system drivers are loaded and that the volume is not cor...",
              "//  {The Registry Is Corrupt}",
              "// MessageId: STATUS_FILE_CORRUPT_ERROR"
            ],
            "i": "objectives/evasion/kernel-hide/lkm/hiding::corruption-mention-comment",
            "l": 3,
            "el": [
              "@76393",
              "@29817",
              "@101280",
              "@116495",
              "@83792",
              "@40416",
              "@83811",
              "@40335",
              "@40397",
              "@47105",
              "@47045",
              "@101370",
              "@76327",
              "@102412",
              "@101340",
              "@83730"
            ]
          },
          {
            "c": 0.44999998807907104,
            "d": "CRED credential label",
            "e": [
              "CRED"
            ],
            "i": "micro-behaviors/data/text/keywords/credential::cred-upper",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "notification or alert vocabulary word",
            "e": [
              "Notification"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::notification-alert-word",
            "l": 1
          },
          {
            "c": 0.20000000298023224,
            "d": "command keyword",
            "e": [
              "command"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::command-dup",
            "l": 1
          },
          {
            "d": "overflow keyword",
            "e": [
              "overflow"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::overflow",
            "l": 1
          },
          {
            "c": 0.44999998807907104,
            "d": "SECRET credential label",
            "e": [
              "SECRET"
            ],
            "i": "micro-behaviors/data/text/keywords/credential::secret-upper",
            "l": 1
          },
          {
            "c": 0.30000001192092896,
            "d": "credential keyword",
            "e": [
              "credential"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::credential",
            "l": 1
          },
          {
            "c": 0.30000001192092896,
            "d": "token keyword",
            "e": [
              "token"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::token",
            "l": 1
          },
          {
            "c": 0.8399999737739563,
            "d": "password/token/api_key field keyword",
            "e": [
              "password"
            ],
            "i": "micro-behaviors/data/text/keywords/credential::credential-field",
            "l": 1
          },
          {
            "c": 0.9200000166893005,
            "d": "Partition table copy operation",
            "e": [
              "partition info"
            ],
            "i": "micro-behaviors/fs/disk/partition::partition-table-copy",
            "l": 3
          },
          {
            "c": 0.9700000286102295,
            "d": "Form-validation vocabulary in dense non-ASCII file",
            "e": [
              "Invalid",
              "array",
              "string",
              "expected",
              "object",
              "required",
              "date",
              "number"
            ],
            "i": "metadata/file/text/format::i18n-validation-vocab",
            "l": 1
          }
        ],
        "sha": "e486e7daf1a564e9146a1db13e09084e594484775e18172566ac0f06d78c1980",
        "path": "ntstatus.h",
        "type": "c"
      }
    ],
    "tv": "8e9ac"
  }
}