{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 1.0,
        "class": 2,
        "threshold": 1.0
      }
    ],
    "prob": 1.0,
    "class": 2,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.9380215,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.99918854,
        "class": 0
      },
      {
        "m": "az/powershell",
        "prob": 1.0,
        "class": 2
      }
    ],
    "version": "v17.17",
    "threshold": 1.0,
    "analyzed_at": "2026-05-31T10:55:36Z"
  },
  "path": "fca7d47c39e4e5b1e375ff7497d67cfbd2bb4d2fa937c617f5a6b5c3c71ccb21.ps1",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "O₂(As₃Xe)",
        "x": 36,
        "ff": {
          "m": {
            "ast": {
              "max_depth": 164.0,
              "call_count": 28.0,
              "node_count": 14639.0,
              "identifier_count": 37.0,
              "string_literal_count": 15.0,
              "array_literal_max_length": 32.0
            },
            "file": {
              "size": 18916.0,
              "entropy": 6.01,
              "size_bytes": 18916.0
            },
            "text": {
              "tab_count": 7.0,
              "digit_ratio": 0.37,
              "space_count": 366.0,
              "total_lines": 30.0,
              "char_entropy": 6.01,
              "mixed_indent": 1.0,
              "unique_chars": 87.0,
              "lines_over_200": 12.0,
              "lines_over_500": 6.0,
              "string_density": 0.5,
              "avg_line_length": 628.53,
              "lines_over_1000": 2.0,
              "max_line_length": 10697.0,
              "empty_line_ratio": 0.13,
              "last_line_length": 10697.0,
              "long_token_count": 23.0,
              "whitespace_ratio": 0.02,
              "most_common_ratio": 0.07,
              "identifier_density": 4.23,
              "line_length_stddev": 1958.61,
              "encoded_string_ratio": 0.53,
              "normalized_string_count": 2.74,
              "repeated_char_sequences": 21.0,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 2.0,
              "trailing_whitespace_lines": 1.0,
              "most_common_char_codepoint": 48.0,
              "normalized_unique_identifiers": 7.54
            },
            "calls": {
              "count": 28.0
            },
            "source": {
              "function_count": 1.0
            },
            "strings": {
              "total": 15.0,
              "avg_length": 768.27,
              "max_length": 10296.0,
              "avg_entropy": 2.4,
              "empty_count": 6.0,
              "hex_strings": 7.0,
              "total_bytes": 11524.0,
              "entropy_stddev": 1.52,
              "base64_candidates": 1.0,
              "very_long_strings": 1.0,
              "high_entropy_count": 1.0
            },
            "functions": {
              "count": 1.0
            },
            "identifiers": {
              "count": 37.0,
              "total": 127.0,
              "avg_length": 12.51,
              "max_length": 29.0,
              "min_length": 2.0,
              "avg_entropy": 2.97,
              "reuse_ratio": 0.29,
              "unique_count": 37.0,
              "length_stddev": 7.67,
              "has_digit_ratio": 0.54,
              "high_entropy_count": 15.0,
              "high_entropy_ratio": 0.41,
              "all_lowercase_ratio": 0.08,
              "numeric_suffix_count": 1.0
            }
          },
          "s": [
            [
              99,
              "u8",
              "00000098000000970000010200000095000001010000009900000101000001000000010000000095000001010000009300000094000001000000009700000101"
            ],
            [
              99,
              "u8",
              "00000098000000970000010200000095000001010000009900000101000001000000010000000095000001010000009300000094000001000000009700000101"
            ],
            [
              571,
              "10",
              "2"
            ],
            [
              571,
              "10",
              "2"
            ],
            [
              574,
              "10",
              "2"
            ],
            [
              574,
              "10",
              "2"
            ],
            [
              578,
              "10",
              "1"
            ],
            [
              578,
              "10",
              "1"
            ],
            [
              597,
              "10",
              "2"
            ],
            [
              597,
              "10",
              "2"
            ],
            [
              600,
              "10",
              "2"
            ],
            [
              600,
              "10",
              "2"
            ],
            [
              604,
              "10",
              "1"
            ],
            [
              604,
              "10",
              "1"
            ],
            [
              611,
              "10",
              "45"
            ],
            [
              611,
              "10",
              "45"
            ],
            [
              692,
              "u8",
              "00000085000000850000009100000087000000900000009200000084000000920000009000000091000000900000008900000090000000920000009100000091"
            ],
            [
              692,
              "u8",
              "00000085000000850000009100000087000000900000009200000084000000920000009000000091000000900000008900000090000000920000009100000091"
            ],
            [
              1116,
              "10",
              "2"
            ],
            [
              1116,
              "10",
              "2"
            ],
            [
              1119,
              "10",
              "1"
            ],
            [
              1119,
              "10",
              "1"
            ],
            [
              1123,
              "10",
              "2"
            ],
            [
              1123,
              "10",
              "2"
            ],
            [
              1142,
              "10",
              "2"
            ],
            [
              1142,
              "10",
              "2"
            ],
            [
              1145,
              "10",
              "1"
            ],
            [
              1145,
              "10",
              "1"
            ],
            [
              1149,
              "10",
              "2"
            ],
            [
              1149,
              "10",
              "2"
            ],
            [
              1156,
              "10",
              "36"
            ],
            [
              1156,
              "10",
              "36"
            ],
            [
              1202,
              "10",
              "0"
            ],
            [
              1202,
              "10",
              "0"
            ],
            [
              1205,
              "10",
              "5601687"
            ],
            [
              1205,
              "10",
              "5601687"
            ],
            [
              1213,
              "10",
              "1491"
            ],
            [
              1213,
              "10",
              "1491"
            ],
            [
              1223,
              "10",
              "2479"
            ],
            [
              1223,
              "10",
              "2479"
            ],
            [
              1229,
              "10",
              "10065"
            ],
            [
              1229,
              "10",
              "10065"
            ],
            [
              1236,
              "10",
              "38560292"
            ],
            [
              1236,
              "10",
              "38560292"
            ],
            [
              1245,
              "10",
              "5108"
            ],
            [
              1245,
              "10",
              "5108"
            ],
            [
              1284,
              "10",
              "194851"
            ],
            [
              1284,
              "10",
              "194851"
            ],
            [
              1292,
              "10",
              "45689200"
            ],
            [
              1292,
              "10",
              "45689200"
            ],
            [
              1301,
              "10",
              "6800"
            ],
            [
              1301,
              "10",
              "6800"
            ],
            [
              1413,
              "u8",
              "00000000000001190000000000000153000000000000013400000000000001510000000000000152000000000000015000000000000001410000000000000146"
            ],
            [
              1413,
              "u8",
              "00000000000001190000000000000153000000000000013400000000000001510000000000000152000000000000015000000000000001410000000000000146"
            ],
            [
              1589,
              "10",
              "2"
            ],
            [
              1589,
              "10",
              "2"
            ],
            [
              1592,
              "10",
              "2"
            ],
            [
              1592,
              "10",
              "2"
            ],
            [
              1596,
              "10",
              "2"
            ],
            [
              1596,
              "10",
              "2"
            ],
            [
              1615,
              "10",
              "2"
            ],
            [
              1615,
              "10",
              "2"
            ],
            [
              1618,
              "10",
              "2"
            ],
            [
              1618,
              "10",
              "2"
            ],
            [
              1622,
              "10",
              "2"
            ],
            [
              1622,
              "10",
              "2"
            ],
            [
              1629,
              "10",
              "36"
            ],
            [
              1629,
              "10",
              "36"
            ],
            [
              1644,
              "10",
              "4017"
            ],
            [
              1644,
              "10",
              "4017"
            ],
            [
              1649,
              "10",
              "4019"
            ],
            [
              1649,
              "10",
              "4019"
            ],
            [
              1658,
              "10",
              "3485"
            ],
            [
              1658,
              "10",
              "3485"
            ],
            [
              1664,
              "10",
              "17989695"
            ],
            [
              1664,
              "10",
              "17989695"
            ],
            [
              1674,
              "10",
              "40844820"
            ],
            [
              1674,
              "10",
              "40844820"
            ],
            [
              1684,
              "10",
              "15677"
            ],
            [
              1684,
              "10",
              "15677"
            ],
            [
              1691,
              "10",
              "3192"
            ],
            [
              1691,
              "10",
              "3192"
            ],
            [
              1696,
              "10",
              "4577"
            ],
            [
              1696,
              "10",
              "4577"
            ],
            [
              1744,
              "10",
              "3758"
            ],
            [
              1744,
              "10",
              "3758"
            ],
            [
              1749,
              "10",
              "3720"
            ],
            [
              1749,
              "10",
              "3720"
            ],
            [
              1757,
              "10",
              "474912"
            ],
            [
              1757,
              "10",
              "474912"
            ],
            [
              1765,
              "10",
              "43477728"
            ],
            [
              1765,
              "10",
              "43477728"
            ],
            [
              1774,
              "10",
              "4669"
            ],
            [
              1774,
              "10",
              "4669"
            ],
            [
              1812,
              "10",
              "281155"
            ],
            [
              1812,
              "10",
              "281155"
            ],
            [
              1820,
              "10",
              "54292000"
            ],
            [
              1820,
              "10",
              "54292000"
            ],
            [
              1831,
              "10",
              "4349"
            ],
            [
              1831,
              "10",
              "4349"
            ],
            [
              1837,
              "10",
              "18421"
            ],
            [
              1837,
              "10",
              "18421"
            ],
            [
              1844,
              "10",
              "37200552"
            ],
            [
              1844,
              "10",
              "37200552"
            ],
            [
              1855,
              "10",
              "563"
            ],
            [
              1855,
              "10",
              "563"
            ],
            [
              1859,
              "10",
              "4954"
            ],
            [
              1859,
              "10",
              "4954"
            ],
            [
              1944,
              "10",
              "6097"
            ],
            [
              1944,
              "10",
              "6097"
            ],
            [
              1950,
              "10",
              "715666"
            ],
            [
              1950,
              "10",
              "715666"
            ],
            [
              1957,
              "10",
              "119"
            ],
            [
              1957,
              "10",
              "119"
            ],
            [
              1965,
              "10",
              "2263"
            ],
            [
              1965,
              "10",
              "2263"
            ],
            [
              1970,
              "10",
              "2380"
            ],
            [
              1970,
              "10",
              "2380"
            ],
            [
              1977,
              "10",
              "9887"
            ],
            [
              1977,
              "10",
              "9887"
            ],
            [
              1982,
              "10",
              "9789"
            ],
            [
              1982,
              "10",
              "9789"
            ],
            [
              1990,
              "10",
              "1142"
            ],
            [
              1990,
              "10",
              "1142"
            ],
            [
              1995,
              "10",
              "1257"
            ],
            [
              1995,
              "10",
              "1257"
            ],
            [
              2003,
              "10",
              "7000"
            ],
            [
              2003,
              "10",
              "7000"
            ],
            [
              2008,
              "10",
              "7116"
            ],
            [
              2008,
              "10",
              "7116"
            ],
            [
              2015,
              "10",
              "729600"
            ],
            [
              2015,
              "10",
              "729600"
            ],
            [
              2023,
              "10",
              "2830"
            ],
            [
              2023,
              "10",
              "2830"
            ],
            [
              2029,
              "10",
              "8133"
            ],
            [
              2029,
              "10",
              "8133"
            ],
            [
              2034,
              "10",
              "4563"
            ],
            [
              2034,
              "10",
              "4563"
            ],
            [
              2043,
              "10",
              "103215"
            ],
            [
              2043,
              "10",
              "103215"
            ],
            [
              2050,
              "10",
              "983"
            ],
            [
              2050,
              "10",
              "983"
            ],
            [
              2057,
              "10",
              "6252"
            ],
            [
              2057,
              "10",
              "6252"
            ],
            [
              2062,
              "10",
              "6362"
            ],
            [
              2062,
              "10",
              "6362"
            ],
            [
              2069,
              "10",
              "4736"
            ],
            [
              2069,
              "10",
              "4736"
            ],
            [
              2074,
              "10",
              "4633"
            ],
            [
              2074,
              "10",
              "4633"
            ],
            [
              2120,
              "10",
              "10986"
            ],
            [
              2120,
              "10",
              "10986"
            ],
            [
              2126,
              "10",
              "5493"
            ],
            [
              2126,
              "10",
              "5493"
            ],
            [
              2135,
              "10",
              "7552"
            ],
            [
              2135,
              "10",
              "7552"
            ],
            [
              2140,
              "10",
              "3776"
            ],
            [
              2140,
              "10",
              "3776"
            ],
            [
              2199,
              "u8",
              "00780128012801140122011101210134"
            ],
            [
              2199,
              "u8",
              "00780128012801140122011101210134"
            ],
            [
              2263,
              "10",
              "2"
            ],
            [
              2263,
              "10",
              "2"
            ],
            [
              2266,
              "10",
              "1"
            ],
            [
              2266,
              "10",
              "1"
            ],
            [
              2270,
              "10",
              "1"
            ],
            [
              2270,
              "10",
              "1"
            ],
            [
              2289,
              "10",
              "2"
            ],
            [
              2289,
              "10",
              "2"
            ],
            [
              2292,
              "10",
              "1"
            ],
            [
              2292,
              "10",
              "1"
            ],
            [
              2296,
              "10",
              "1"
            ],
            [
              2296,
              "10",
              "1"
            ],
            [
              2303,
              "10",
              "13"
            ],
            [
              2303,
              "10",
              "13"
            ],
            [
              2353,
              "u8",
              "0000000000000095000000000000012500000000000001400000000000000108000000000000014500000000000001360000000000000125"
            ],
            [
              2353,
              "u8",
              "0000000000000095000000000000012500000000000001400000000000000108000000000000014500000000000001360000000000000125"
            ],
            [
              2497,
              "10",
              "2"
            ],
            [
              2497,
              "10",
              "2"
            ],
            [
              2500,
              "10",
              "2"
            ],
            [
              2500,
              "10",
              "2"
            ],
            [
              2504,
              "10",
              "2"
            ],
            [
              2504,
              "10",
              "2"
            ],
            [
              2523,
              "10",
              "2"
            ],
            [
              2523,
              "10",
              "2"
            ],
            [
              2526,
              "10",
              "2"
            ],
            [
              2526,
              "10",
              "2"
            ],
            [
              2530,
              "10",
              "2"
            ],
            [
              2530,
              "10",
              "2"
            ],
            [
              2537,
              "10",
              "24"
            ],
            [
              2537,
              "10",
              "24"
            ],
            [
              2618,
              "u8",
              "01510181019601500185018101880180"
            ],
            [
              2618,
              "u8",
              "01510181019601500185018101880180"
            ],
            [
              2682,
              "10",
              "2"
            ],
            [
              2682,
              "10",
              "2"
            ],
            [
              2685,
              "10",
              "1"
            ],
            [
              2685,
              "10",
              "1"
            ],
            [
              2689,
              "10",
              "1"
            ],
            [
              2689,
              "10",
              "1"
            ],
            [
              2708,
              "10",
              "2"
            ],
            [
              2708,
              "10",
              "2"
            ],
            [
              2711,
              "10",
              "1"
            ],
            [
              2711,
              "10",
              "1"
            ],
            [
              2715,
              "10",
              "1"
            ],
            [
              2715,
              "10",
              "1"
            ],
            [
              2722,
              "10",
              "80"
            ],
            [
              2722,
              "10",
              "80"
            ],
            [
              2797,
              "u8",
              "0157019001890159019601770187018401780123016201950176019501840178"
            ],
            [
              2797,
              "u8",
              "0157019001890159019601770187018401780123016201950176019501840178"
            ],
            [
              2893,
              "10",
              "2"
            ],
            [
              2893,
              "10",
              "2"
            ],
            [
              2896,
              "10",
              "1"
            ],
            [
              2896,
              "10",
              "1"
            ],
            [
              2900,
              "10",
              "1"
            ],
            [
              2900,
              "10",
              "1"
            ],
            [
              2919,
              "10",
              "2"
            ],
            [
              2919,
              "10",
              "2"
            ],
            [
              2922,
              "10",
              "1"
            ],
            [
              2922,
              "10",
              "1"
            ],
            [
              2926,
              "10",
              "1"
            ],
            [
              2926,
              "10",
              "1"
            ],
            [
              2933,
              "10",
              "79"
            ],
            [
              2933,
              "10",
              "79"
            ],
            [
              2954,
              "10",
              "1319"
            ],
            [
              2954,
              "10",
              "1319"
            ],
            [
              2960,
              "10",
              "1609"
            ],
            [
              2960,
              "10",
              "1609"
            ],
            [
              2965,
              "10",
              "207"
            ],
            [
              2965,
              "10",
              "207"
            ],
            [
              2973,
              "10",
              "8016"
            ],
            [
              2973,
              "10",
              "8016"
            ],
            [
              2978,
              "10",
              "8117"
            ],
            [
              2978,
              "10",
              "8117"
            ],
            [
              2986,
              "10",
              "747"
            ],
            [
              2986,
              "10",
              "747"
            ],
            [
              2990,
              "10",
              "863"
            ],
            [
              2990,
              "10",
              "863"
            ],
            [
              2997,
              "10",
              "420"
            ],
            [
              2997,
              "10",
              "420"
            ],
            [
              3002,
              "10",
              "538"
            ],
            [
              3002,
              "10",
              "538"
            ],
            [
              3008,
              "10",
              "4913"
            ],
            [
              3008,
              "10",
              "4913"
            ],
            [
              3014,
              "10",
              "1929"
            ],
            [
              3014,
              "10",
              "1929"
            ],
            [
              3020,
              "10",
              "515"
            ],
            [
              3020,
              "10",
              "515"
            ],
            [
              3026,
              "10",
              "834"
            ],
            [
              3026,
              "10",
              "834"
            ],
            [
              3031,
              "10",
              "32769710"
            ],
            [
              3031,
              "10",
              "32769710"
            ],
            [
              3040,
              "10",
              "9826"
            ],
            [
              3040,
              "10",
              "9826"
            ],
            [
              3054,
              "10",
              "5154"
            ],
            [
              3054,
              "10",
              "5154"
            ],
            [
              3060,
              "10",
              "2010"
            ],
            [
              3060,
              "10",
              "2010"
            ]
          ],
          "v": {
            "file.stem": "fca7d47c39e4e5b1e375ff7497d67cfbd2bb4d2fa937c617f5a6b5c3c71ccb21",
            "file.basename": "fca7d47c39e4e5b1e375ff7497d67cfbd2bb4d2fa937c617f5a6b5c3c71ccb21.ps1",
            "source.language": "powershell",
            "source.strings[0]": "0000000000000095000000000000012500000000000001400000000000000108000000000000014500000000000001360000000000000125",
            "source.strings[1]": "000000000000011900000000000001530000000000000134000000000000015100000000000001520000000000000150000000000000014100000000000001460000000000000139",
            "source.strings[2]": "00000085000000850000009100000087000000900000009200000084000000920000009000000091000000900000008900000090000000920000009100000091000000900000009100000093000000920000009000000090000000920000009200000084000000920000009000000091000000900000008800000088000000920000008500000091000000900000009200000091000000880000008500000090000000920000009100000090000000910000009300000091000000860000009100000085",
            "source.strings[3]": "00000098000000970000010200000095000001010000009900000101000001000000010000000095000001010000009300000094000001000000009700000101000000990000010100000101000000940000009900000101000001000000009700000100000000950000010100000093000001000000009500000101000000940000010100000100000000940000010000000096000000990000010100000101000001010000010000000101000000950000010100000093000000990000010100000101000001000000010000000099000001010000009500000101",
            "source.strings[4]": "00780128012801140122011101210134",
            "source.strings[5]": "01510181019601500185018101880180",
            "source.strings[6]": "0157019001890159019601770187018401780123016201950176019501840178",
            "source.strings[7]": "1018134",
            "source.strings[8]": "102776",
            "source.strings[9]": "103215",
            "source.strings[10]": "1033129",
            "source.strings[11]": "1041448",
            "source.strings[12]": "10481712",
            "source.strings[13]": "1070280",
            "source.strings[14]": "1074591",
            "source.strings[15]": "1081230",
            "source.strings[16]": "1085616",
            "source.strings[17]": "1090202",
            "source.strings[18]": "11121003",
            "source.strings[19]": "11242924",
            "source.strings[20]": "1195525",
            "source.strings[21]": "12038417",
            "source.strings[22]": "1408569",
            "source.strings[23]": "14164458",
            "source.strings[24]": "14245966",
            "source.strings[25]": "14520864",
            "source.strings[26]": "15087126",
            "source.strings[27]": "152273",
            "source.strings[28]": "166361",
            "source.strings[29]": "16640791",
            "source.strings[30]": "168150",
            "source.strings[31]": "1695123",
            "source.strings[32]": "17200508",
            "source.strings[33]": "17255680",
            "source.strings[34]": "17325282",
            "source.strings[35]": "17939116",
            "source.strings[36]": "17989695",
            "source.strings[37]": "1857360",
            "source.strings[38]": "193578",
            "source.strings[39]": "194851",
            "source.strings[40]": "19597120",
            "source.strings[41]": "196075",
            "source.strings[42]": "20432310",
            "source.strings[43]": "207209",
            "source.strings[44]": "212016",
            "source.strings[45]": "21895526",
            "source.strings[46]": "21905430",
            "source.strings[47]": "22038243",
            "source.strings[48]": "232000",
            "source.strings[49]": "237510",
            "source.strings[50]": "237917",
            "source.strings[51]": "24452064",
            "source.strings[52]": "24735776",
            "source.strings[53]": "25233500",
            "source.strings[54]": "268410",
            "source.strings[55]": "26852130",
            "source.strings[56]": "27313124",
            "source.strings[57]": "27443344",
            "source.strings[58]": "27900705",
            "source.strings[59]": "281155",
            "source.strings[60]": "284335",
            "source.strings[61]": "30033488",
            "source.strings[62]": "3034528",
            "source.strings[63]": "30916925",
            "source.strings[64]": "311448",
            "source.strings[65]": "313243",
            "source.strings[66]": "316564",
            "source.strings[67]": "32769710",
            "source.strings[68]": "32927418",
            "source.strings[69]": "353051",
            "source.strings[70]": "364124",
            "source.strings[71]": "368300",
            "source.strings[72]": "3695013",
            "source.strings[73]": "37177140",
            "source.strings[74]": "37200552",
            "source.strings[75]": "37988456",
            "source.strings[76]": "384171",
            "source.strings[77]": "385113",
            "source.strings[78]": "38560292",
            "source.strings[79]": "387074",
            "source.strings[80]": "387672",
            "source.strings[81]": "39389328",
            "source.strings[82]": "39468016",
            "source.strings[83]": "408320",
            "source.strings[84]": "40844820",
            "source.strings[85]": "43477728",
            "source.strings[86]": "44422047",
            "source.strings[87]": "44627025",
            "source.strings[88]": "44946324",
            "source.strings[89]": "45437218",
            "source.strings[90]": "456192",
            "source.strings[91]": "45689200",
            "source.strings[92]": "462882",
            "source.strings[93]": "471973",
            "source.strings[94]": "474912",
            "source.strings[95]": "477480",
            "source.strings[96]": "491400",
            "source.strings[97]": "493988",
            "source.strings[98]": "50342304",
            "source.strings[99]": "52416900",
            "source.functions[0]": "anonymous",
            "source.strings[100]": "52602184",
            "source.strings[101]": "534160",
            "source.strings[102]": "53448942",
            "source.strings[103]": "53705815",
            "source.strings[104]": "54292000",
            "source.strings[105]": "543279",
            "source.strings[106]": "5601687",
            "source.strings[107]": "5778805",
            "source.strings[108]": "5828064",
            "source.strings[109]": "60855232",
            "source.strings[110]": "611655",
            "source.strings[111]": "617918",
            "source.strings[112]": "621084",
            "source.strings[113]": "64833087",
            "source.strings[114]": "6951106",
            "source.strings[115]": "69650082",
            "source.strings[116]": "7107536",
            "source.strings[117]": "711360",
            "source.strings[118]": "715666",
            "source.strings[119]": "720434",
            "source.strings[120]": "722810",
            "source.strings[121]": "729600",
            "source.strings[122]": "752229",
            "source.strings[123]": "771672",
            "source.strings[124]": "779686",
            "source.strings[125]": "78499785",
            "source.strings[126]": "805769",
            "source.strings[127]": "821340",
            "source.strings[128]": "8291195",
            "source.strings[129]": "84360978",
            "source.strings[130]": "850420",
            "source.strings[131]": "856710",
            "source.strings[132]": "866052",
            "source.strings[133]": "8879860",
            "source.strings[134]": "91588220",
            "source.strings[135]": "9313200",
            "source.strings[136]": "955320",
            "source.strings[137]": "95570680",
            "source.strings[138]": "977985",
            "source.strings[139]": "982002",
            "source.strings[140]": "9943668",
            "source.strings[141]": "996558",
            "source.strings[142]": "gqa5xwi4bnl7"
          },
          "ct": [
            "0..15",
            "0..48",
            "0..54",
            "0..6",
            "0..7",
            "0..8",
            "ForEach-Object",
            "New-Object",
            "iex",
            "o1kytfw9q8rhup2gsci3j65vdmx"
          ],
          "id": "powershell"
        },
        "id": 0,
        "sz": 18916,
        "ts": [
          {
            "a": "T1027",
            "c": 0.8600000143051147,
            "d": "Multiple embedded base64 literals",
            "e": [
              "00000098000000970000010200000095000001010000009900000101000001000000010000000095000001010000009300000094000001000000009700000101",
              "01510181019601500185018101880180",
              "0157019001890159019601770187018401780123016201950176019501840178",
              "00000085000000850000009100000087000000900000009200000084000000920000009000000091000000900000008900000090000000920000009100000091",
              "00780128012801140122011101210134",
              "0000000000000095000000000000012500000000000001400000000000000108000000000000014500000000000001360000000000000125",
              "00000000000001190000000000000153000000000000013400000000000001510000000000000152000000000000015000000000000001410000000000000146"
            ],
            "i": "objectives/command-and-control/dropper/staging/encrypted::multiple-base64-literals",
            "l": 1,
            "m": "C0025",
            "el": [
              "0x63",
              "0xa3a",
              "0xaed",
              "0x2b4",
              "0x897",
              "0x931",
              "0x585"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Very long line",
            "e": [
              "text.max_line_length = 10697.00"
            ],
            "i": "metadata/file/text/metrics::single-long-line",
            "l": 1
          },
          {
            "a": "T1562.001",
            "c": 0.8500000238418579,
            "d": "Regex component marker",
            "e": [
              "eGuI"
            ],
            "i": "objectives/impact/degrade/edr/autostart::av-runkey-name-list--rx-4",
            "l": 1,
            "m": "F0004"
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Last line is over 1000 chars",
            "e": [
              "text.last_line_length = 10697.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1204.002",
            "c": 0.8999999761581421,
            "d": "PowerShell archive extraction command marker",
            "e": [
              "7z"
            ],
            "i": "objectives/command-and-control/dropper/staging/archive::powershell-archive-extract",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "File has 30 or more lines",
            "e": [
              "text.total_lines = 30.00"
            ],
            "i": "metadata/file/text/metrics::file-has-30-plus-lines",
            "l": 1
          },
          {
            "c": 0.7799999713897705,
            "d": "PowerShell type accelerator syntax",
            "e": [
              "[math]::"
            ],
            "i": "metadata/lang/scripted::type-accelerator",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Valid PowerShell code",
            "e": [
              "param("
            ],
            "i": "metadata/lang/scripted::ps-valid",
            "l": 2
          },
          {
            "a": "T1059.001",
            "c": 0.75,
            "d": "Invoke-Expression cmdlet",
            "e": [
              "iex"
            ],
            "i": "objectives/execution/interpreter/eval/invoke::iex",
            "l": 3,
            "m": "E1059"
          },
          {
            "a": "T1204.002",
            "d": "PowerShell bitwise XOR operator",
            "e": [
              "-bxor"
            ],
            "i": "objectives/command-and-control/dropper/lnk/remcos::powershell-bxor-op",
            "l": 2
          },
          {
            "c": 0.8500000238418579,
            "d": "PowerShell or VBScript line bloat",
            "e": [
              "text.avg_line_length = 628.53"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::script-host-line-bloat",
            "l": 4
          },
          {
            "a": "T1027",
            "c": 0.8500000238418579,
            "d": "Suspicious long PowerShell line",
            "e": [
              "text.max_line_length = 10697.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::ps-suspicious-single-line",
            "l": 4,
            "m": "B0032"
          },
          {
            "a": "T1140",
            "c": 0.6000000238418579,
            "d": "Very long base64 strings present",
            "e": [
              "00000098000000970000010200000095000001010000009900000101000001000000010000000095000001010000009300000094000001000000009700000101",
              "00000085000000850000009100000087000000900000009200000084000000920000009000000091000000900000008900000090000000920000009100000091"
            ],
            "i": "micro-behaviors/data/encode/payload::large-base64-string-literals",
            "l": 3,
            "m": "C0043",
            "el": [
              "0x63",
              "0x2b4"
            ]
          },
          {
            "a": "T1027",
            "c": 0.8500000238418579,
            "d": "Multiple long lines (\u003e1000 chars)",
            "e": [
              "text.lines_over_1000 = 2.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::very-long-lines",
            "l": 2,
            "m": "B0032"
          },
          {
            "c": 0.8500000238418579,
            "d": "High ratio of entropy-heavy identifiers",
            "e": [
              "identifiers.high_entropy_ratio = 0.41"
            ],
            "i": "metadata/file/text/metrics::high-entropy-identifier-ratio",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Very low whitespace ratio (minified/compressed)",
            "e": [
              "text.whitespace_ratio = 0.02"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "High overall text entropy (encoded",
            "e": [
              "text.char_entropy = 6.01"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::high-text-entropy",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Many random-looking source identifier names",
            "e": [
              "identifiers.high_entropy_ratio = 0.41"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::many-high-entropy-identifiers",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Identifier obfuscation (random/encoded names)",
            "e": [
              "identifiers.high_entropy_ratio = 0.41"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::identifier-obfuscation",
            "l": 3,
            "m": "B0032"
          }
        ],
        "sha": "fca7d47c39e4e5b1e375ff7497d67cfbd2bb4d2fa937c617f5a6b5c3c71ccb21",
        "path": "fca7d47c39e4e5b1e375ff7497d67cfbd2bb4d2fa937c617f5a6b5c3c71ccb21.ps1",
        "type": "powershell"
      }
    ],
    "tv": "52045"
  }
}