Precomputed with scripts/build_demo.py. Synthetic samples are inert and scored by the linear demo model; System32 entries are real benign Windows files scored by the EMBER-trained XGBoost model. Run vitrine serve locally to analyze your own files.
Verdict
Why: top drivers
Contributions in log-odds; red pushes toward malicious, green toward benign.
Capabilities (ATT&CK)
Notes
Candidate YARA rule (review before use)