Binaries, archives, scripts and documents. We decompile with Ghidra and cross-reference with VirusTotal and MalwareBazaar.