{
  "ml": {
    "l": -1,
    "v": "6",
    "fs": [
      {
        "l": -1,
        "id": 0,
        "prob": 0.9313873648643494
      }
    ],
    "prob": 0.93138736,
    "models": [
      {
        "m": "az",
        "prob": 0.93138736,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.5673232,
        "class": 0
      },
      {
        "m": "az/powershell",
        "prob": 0.42857143,
        "class": 0
      }
    ],
    "version": "v17.17",
    "analyzed_at": "2026-06-02T08:05:17Z"
  },
  "path": "f2398bc33f48a7f96519a63230c2c87ff8813714f1f25f6603e642d1cc4def80.ps1",
  "raw": {
    "v": "6",
    "fs": [
      {
        "f": "H₂(CmPo₂)",
        "x": 27,
        "ff": {
          "m": {
            "ast": {
              "max_depth": 21.0,
              "call_count": 3.0,
              "node_count": 279.0,
              "identifier_count": 9.0,
              "string_literal_count": 6.0,
              "array_literal_max_length": 2.0
            },
            "file": {
              "size": 727.0,
              "entropy": 4.98,
              "size_bytes": 727.0
            },
            "text": {
              "digit_ratio": 0.02,
              "space_count": 113.0,
              "total_lines": 22.0,
              "char_entropy": 4.98,
              "unique_chars": 59.0,
              "string_density": 0.27,
              "avg_line_length": 31.05,
              "max_line_length": 106.0,
              "empty_line_ratio": 0.18,
              "last_line_length": 106.0,
              "whitespace_ratio": 0.22,
              "most_common_ratio": 0.06,
              "identifier_density": 0.91,
              "line_length_stddev": 32.55,
              "normalized_string_count": 1.28,
              "repeated_char_sequences": 2.0,
              "suspicious_string_ratio": 0.17,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 1.0,
              "most_common_char_codepoint": 116.0,
              "normalized_unique_identifiers": 2.02
            },
            "calls": {
              "count": 3.0
            },
            "binary": {
              "overall_entropy": 4.98
            },
            "source": {
              "function_count": 1.0
            },
            "strings": {
              "total": 6.0,
              "url_count": 1.0,
              "avg_length": 39.0,
              "max_length": 80.0,
              "path_count": 2.0,
              "avg_entropy": 3.82,
              "total_bytes": 234.0,
              "entropy_stddev": 0.66,
              "shell_command_strings": 1.0
            },
            "functions": {
              "count": 1.0
            },
            "identifiers": {
              "count": 9.0,
              "total": 20.0,
              "avg_length": 10.33,
              "max_length": 14.0,
              "min_length": 5.0,
              "avg_entropy": 3.05,
              "reuse_ratio": 0.45,
              "unique_count": 9.0,
              "length_stddev": 3.06,
              "has_digit_ratio": 0.22,
              "numeric_suffix_count": 2.0
            }
          },
          "s": [
            [
              15,
              "u8",
              "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
            ],
            [
              15,
              "u8",
              "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
            ],
            [
              94,
              "u8",
              "C:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe"
            ],
            [
              94,
              "u8",
              "C:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe"
            ],
            [
              166,
              "u8",
              "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd"
            ],
            [
              166,
              "u8",
              "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd"
            ],
            [
              267,
              "u8",
              "--start-fullscreen"
            ],
            [
              267,
              "u8",
              "--start-fullscreen"
            ],
            [
              547,
              "u8",
              "$firstUrl"
            ],
            [
              547,
              "u8",
              "$firstUrl"
            ],
            [
              680,
              "u8",
              "\"$firstUrl"
            ],
            [
              680,
              "u8",
              "\"$firstUrl"
            ]
          ],
          "v": {
            "file.stem": "f2398bc33f48a7f96519a63230c2c87ff8813714f1f25f6603e642d1cc4def80",
            "file.basename": "f2398bc33f48a7f96519a63230c2c87ff8813714f1f25f6603e642d1cc4def80.ps1",
            "source.language": "powershell",
            "source.strings[0]": "\"$firstUrl",
            "source.strings[1]": "$firstUrl",
            "source.strings[2]": "--start-fullscreen",
            "source.strings[3]": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
            "source.strings[4]": "C:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe",
            "source.strings[5]": "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd",
            "source.functions[0]": "anonymous"
          },
          "ct": [
            "Start-Browser",
            "Start-Process",
            "Test-Path"
          ],
          "id": "powershell"
        },
        "id": 0,
        "sz": 727,
        "ts": [
          {
            "c": 0.20000000298023224,
            "d": "pwd keyword",
            "e": [
              "pwd"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::pwd",
            "l": 1
          },
          {
            "a": "T1071.001",
            "c": 0.75,
            "d": "HTTP/HTTPS URL literal (raw)",
            "e": [
              "https://youtube.com"
            ],
            "i": "micro-behaviors/communications/http/lib/invoke-webrequest::uri-literal-raw",
            "l": 2,
            "m": "C0002"
          },
          {
            "c": 0.8999999761581421,
            "d": "Uses Start-Process cmdlet",
            "e": [
              "Start-Process"
            ],
            "i": "micro-behaviors/process/create/exec::start-process-dup",
            "l": 3
          },
          {
            "c": 0.8799999952316284,
            "d": "Source or test deletion target",
            "e": [
              "Test"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::target-source-test",
            "l": 1
          },
          {
            "a": "T1204.002",
            "c": 0.8999999761581421,
            "d": "PowerShell executes archive payload command",
            "e": [
              "Start-Process"
            ],
            "i": "objectives/command-and-control/dropper/staging/archive::powershell-archive-execute",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Start-Process FilePath parameter",
            "e": [
              "Start-Process -FilePath"
            ],
            "i": "micro-behaviors/process/create/start-process::start-process-filepath",
            "l": 3
          },
          {
            "a": "T1057",
            "d": "Browser app msedge",
            "e": [
              "msedge"
            ],
            "i": "micro-behaviors/process/enumerate/apps::browser-apps-msedge-safari",
            "l": 2,
            "m": "E1592"
          },
          {
            "c": 0.6000000238418579,
            "d": "Google Accounts domain marker",
            "e": [
              "accounts.google.com"
            ],
            "i": "micro-behaviors/communications/http/oauth::google-accounts",
            "l": 3
          },
          {
            "a": "T1071.001",
            "c": 0.75,
            "d": "HTTP/HTTPS URL literal",
            "e": [
              "https://youtube.com"
            ],
            "i": "micro-behaviors/communications/http/lib/invoke-webrequest::uri-literal",
            "l": 3,
            "m": "C0002",
            "el": [
              "a6"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "Start-Process"
            ],
            "i": "objectives/command-and-control/dropper/execution/fileless::hidden-powershell-getcontent-iex--rx-22",
            "l": 1
          },
          {
            "a": "T1036",
            "c": 0.6000000238418579,
            "d": "Chromium browser executable",
            "e": [
              "msedge.exe"
            ],
            "i": "objectives/evasion/masquerade/file/name::chromium-browser-exe-name",
            "l": 4
          },
          {
            "c": 0.800000011920929,
            "d": "Start-Process call",
            "e": [
              "Start-Process"
            ],
            "i": "micro-behaviors/process/create/start-process::start-process-dup",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "Valid PowerShell code",
            "e": [
              "param ("
            ],
            "i": "metadata/lang/scripted::ps-valid",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "HTTPS protocol prefix",
            "e": [
              "https://"
            ],
            "i": "micro-behaviors/communications/http/message::https-prefix",
            "l": 2,
            "el": [
              "a6"
            ]
          },
          {
            "d": ".exe extension reference",
            "e": [
              ".exe"
            ],
            "i": "micro-behaviors/fs/path/extension::exe-dup",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "Hardcoded Windows root path (C:\\, D:\\, etc.)",
            "e": [
              "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
            ],
            "i": "micro-behaviors/fs/path/os::hardcoded-windows-root",
            "l": 2
          }
        ],
        "sha": "f2398bc33f48a7f96519a63230c2c87ff8813714f1f25f6603e642d1cc4def80",
        "path": "f2398bc33f48a7f96519a63230c2c87ff8813714f1f25f6603e642d1cc4def80.ps1",
        "type": "powershell"
      }
    ],
    "tv": "ed903"
  }
}