{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 1.0, "class": 2 } ], "prob": 1.0, "class": 2, "models": [ { "m": "az", "prob": 0.6687533, "class": 0 }, { "m": "az/scripts", "prob": 0.7714286, "class": 0 }, { "m": "az/batch", "prob": 1.0, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961373, 0.9998425 ], "analyzed_at": "2026-05-17T07:12:06Z" }, "path": "420f8cca34a5bf9eae57ed3d02c9b6d5571a267197e51f475f9b7ace179c5f26.cmd", "raw": { "v": "4", "fs": [ { "f": "O(As)Md", "x": 41, "id": 0, "ms": { "file": { "size": 4308045.0 }, "text": { "digit_ratio": 0.08, "space_count": 58.0, "total_lines": 60960.0, "char_entropy": 5.18, "unique_chars": 82.0, "lines_over_200": 517.0, "lines_over_500": 332.0, "avg_line_length": 71.4, "high_byte_ratio": 0.06, "lines_over_1000": 332.0, "max_line_length": 1655.0, "non_ascii_ratio": 0.06, "last_line_length": 37.0, "long_token_count": 559.0, "most_common_char": "I", "whitespace_ratio": 0.03, "most_common_ratio": 0.08, "line_length_stddev": 93.47, "repeated_char_sequences": 1.0, "max_inline_whitespace_run": 49.0 } }, "ss": [ [ 0, "COMCOM" ], [ 8, "\u0026@cls\u0026@set \"_" ], [ 284027, "%LBPt%\"%_" ], [ 284201, ":~10,1%%cLRS%%_" ], [ 284395, ":~62,1%%cLRS%%_" ], [ 284555, ":~26,1%%cLRS%%_" ], [ 284881, ":~48,1%%cLRS%%_" ], [ 285187, ":~42,1%%cLRS%/%_" ], [ 285363, ":~50,1%%cLRS%%_" ], [ 285507, ":~53,1%%cLRS%%_" ], [ 285682, ":~24,1%%cLRS%%_" ], [ 285742, "%WxlVZTXwtF%%lfgvPDGJex%%BbizcDAqDu%%QzeeTrNMJQ%%MzRoCBEqOW%%ULLWnJmWqv%%efapljPeEe%%srcEcCmBJT%%QVxujMglqs%%dSVGyGOSEl%" ], [ 286352, "%WxlVZTXwtF%%lfgvPDGJex%%BbizcDAqDu%" ], [ 286676, ":~51,1%%cLRS%%_" ], [ 287310, ":~58,1%%cLRS%%_" ], [ 287480, ":~56,1%%cLRS%.%_" ], [ 287639, ":~42,1%%cLRS%%_" ], [ 287806, ":~18,1%%cLRS%%_" ], [ 288136, ":~48,1%%cLRS%\\\\%_" ], [ 288438, ":~21,1%%cLRS%%_" ], [ 288597, ":~48,1%%cLRS%/%_" ], [ 288745, ":~45,1%%cLRS%%_" ], [ 288914, ":~30,1%%cLRS%%_" ], [ 289063, ":~6,1%%cLRS%\\\\%_" ], [ 289211, ":~26,1%%cLRS%\\%_" ], [ 289555, ":~34,1%%cLRS%%_" ], [ 289725, "%%cLRS%%_" ], [ 290073, ":~15,1%%cLRS%:\\\\%_" ], [ 290368, ":~2,1%%cLRS%\\\\%_" ], [ 290516, ":~43,1%%cLRS%\\%_" ], [ 290724, "%WxlVZTXwtF%%lfgvPDGJex%%BbizcDAqDu%%QzeeTrNMJQ%%MzRoCBEqOW%%ULLWnJmWqv%%efapljPeEe%%srcEcCmBJT%%QVxujMglqs%%dSVGyGOSEl%%URXDWkB" ], [ 291646, ":~58,1%%cLRS%:\\\\%_" ], [ 292484, ":~39,1%%cLRS%%_" ], [ 292651, ":~56,1%%cLRS%\\\\%_" ], [ 293124, ":~6,1%%cLRS%:\\\\%_" ], [ 294744, ":~15,1%%cLRS%%_" ], [ 294913, ":~43,1%%cLRS%%_" ], [ 295263, ":~18,1%%cLRS%.%_" ], [ 295651, "%WxlVZTXwtF%%lfgvPDGJex%%BbizcDAqDu%%QzeeTrNMJQ%%MzRoCBEqOW%%ULLWnJmWqv%%efapljPeEe%%srcEcCmBJT%%QVxujMglqs%%dSVGyGOSEl%%URXDWkB" ], [ 296108, ":~8,1%%cLRS%.%_" ], [ 297272, ":~48,1%%cLRS%\\%_" ], [ 298734, ":~39,1%%cLRS%\u0026\"" ], [ 298859, ":~2,1%%cLRS%\\%_" ], [ 299174, ":~15,1%%cLRS%\\\\%_" ], [ 299332, ":~51,1%%cLRS%-%_" ], [ 299501, ":~56,1%%cLRS%%_" ], [ 299653, ":~2,1%%cLRS%\"%_" ], [ 301299, ":~52,1%%cLRS%%_" ], [ 301632, ":~34,1%%cLRS%:\\\\%_" ], [ 302074, ":~38,1%%cLRS%%_" ], [ 302752, ":~45,1%%cLRS%\\\\%_" ], [ 303509, ":~18,1%%cLRS%\\%_" ], [ 303667, ":~60,1%%cLRS%%_" ], [ 304147, ":~51,1%%cLRS%\\\\%_" ], [ 304295, ":~11,1%%cLRS%%_" ], [ 305113, ":~11,1%%cLRS%\u003e%_" ], [ 306841, "%WxlVZTXwtF%%lfgvPDGJex%%BbizcDAqDu%%QzeeTrNMJQ%%MzRoCBEqOW%%ULLWnJmWqv%%efapljPeEe%%srcEcCmBJT%%QVxujMglqs%%dSVGyGOSEl%%URXDWkB" ], [ 309032, ":~24,1%%cLRS%\\%_" ], [ 309360, ":~56,1%%cLRS%\\%_" ], [ 311153, "%WxlVZTXwtF%%lfgvPDGJex%%BbizcDAqDu%%QzeeTrNMJQ%%MzRoCBEqOW%%ULLWnJmWqv%%efapljPeEe%%srcEcCmBJT%%QVxujMglqs%%dSVGyGOSEl%%URXDWkB" ], [ 311883, ":~51,1%%cLRS%\\%_" ], [ 312511, ":~50,1%%cLRS%\"%_" ], [ 314831, "%WxlVZTXwtF%%lfgvPDGJex%%BbizcDAqDu%%QzeeTrNMJQ%%MzRoCBEqOW%%ULLWnJmWqv%%efapljPeEe%%srcEcCmBJT%%QVxujMglqs%%dSVGyGOSEl%%URXDWkB" ], [ 316620, ":~43,1%%cLRS%\"%_" ], [ 317606, ":~45,1%%cLRS%\u0026\"" ], [ 317880, ":~21,1%%cLRS%.%_" ], [ 318612, "%WxlVZTXwtF%%lfgvPDGJex%%BbizcDAqDu%%QzeeTrNMJQ%%MzRoCBEqOW%%ULLWnJmWqv%%efapljPeEe%%srcEcCmBJT%%QVxujMglqs%%dSVGyGOSEl%%URXDWkB" ], [ 319133, ":~62,1%%cLRS%\\%_" ], [ 319299, ":~10,1%%cLRS%\"%_" ], [ 319797, ":~30,1%%cLRS%\u003e%_" ], [ 320297, ":~50,1%%cLRS%/%_" ], [ 320481, ":~58,1%%cLRS%/%_" ], [ 321189, "%WxlVZTXwtF%%lfgvPDGJex%%BbizcDAqDu%%QzeeTrNMJQ%%MzRoCBEqOW%%ULLWnJmWqv%%efapljPeEe%%srcEcCmBJT%%QVxujMglqs%%dSVGyGOSEl%%URXDWkB" ], [ 321673, "%WxlVZTXwtF%%lfgvPDGJex%" ], [ 321854, "%WxlVZTXwtF% -----BEGIN NEW CERTIFICATE REQUEST-----" ], [ 321956, "MDAwMAk0ZCA1YSA1MCAwMCAwMiAwMCAwMCAwMCAgMDQgMDAgMGYgMDAgZmYgZmYg" ], [ 322022, "MDAgMDANCjAwMTAJYjggMDAgMDAgMDAgMDAgMDAgMDAgMDAgIDQwIDAwIDFhIDAw" ], [ 322088, "IDAwIDAwIDAwIDAwDQowMDIwCTAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwICAwMCAw" ], [ 322154, "MCAwMCAwMCAwMCAwMCAwMCAwMA0KMDAzMAkwMCAwMCAwMCAwMCAwMCAwMCAwMCAw" ], [ 322220, "MCAgMDAgMDAgMDAgMDAgMDAgMDEgMDAgMDANCjAwNDAJYmEgMTAgMDAgMGUgMWYg" ], [ 322286, "YjQgMDkgY2QgIDIxIGI4IDAxIDRjIGNkIDIxIDkwIDkwDQowMDUwCTU0IDY4IDY5" ], [ 322352, "IDczIDIwIDcwIDcyIDZmICA2NyA3MiA2MSA2ZCAyMCA2ZCA3NSA3Mw0KMDA2MAk3" ], [ 322418, "base64", "4 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57\r" ], [ 322484, "CjAwNzAJNjkgNmUgMzMgMzIgMGQgMGEgMjQgMzcgIDAwIDAwIDAwIDAwIDAwIDAw" ], [ 322550, "IDAwIDAwDQowMDgwCTAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwICAwMCAwMCAwMCAw" ], [ 322616, "MCAwMCAwMCAwMCAwMA0KMDA5MAkwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAgMDAg" ], [ 322682, "MDAgMDAgMDAgMDAgMDAgMDAgMDANCjAwYTAJMDAgMDAgMDAgMDAgMDAgMDAgMDAg" ], [ 322748, "MDAgIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwDQowMGIwCTAwIDAwIDAwIDAwIDAw" ], [ 322814, "IDAwIDAwIDAwICAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMA0KMDBjMAkwMCAwMCAw" ], [ 322880, "MCAwMCAwMCAwMCAwMCAwMCAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDANCjAwZDAJ" ], [ 322946, "MDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAw" ], [ 323012, "DQowMGUwCTAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwICAwMCAwMCAwMCAwMCAwMCAw" ], [ 323078, "MCAwMCAwMA0KMDBmMAkwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAgMDAgMDAgMDAg" ], [ 323144, "MDAgMDAgMDAgMDAgMDANCjAxMDAJNTAgNDUgMDAgMDAgNGMgMDEgMDkgMDAgIDE5" ], [ 323210, "IDVlIDQyIDJhIDAwIDAwIDAwIDAwDQowMTEwCTAwIDAwIDAwIDAwIGUwIDAwIDhl" ], [ 323276, "IDgxICAwYiAwMSAwMiAxOSAwMCAzMCAwNiAwMA0KMDEyMAkwMCA3NCAwNiAwMCAw" ], [ 323342, "MCAwMCAwMCAwMCAgYWMgNDUgMDYgMDAgMDAgMTAgMDAgMDANCjAxMzAJMDAgNTAg" ], [ 323408, "MDYgMDAgMDAgMDAgNDAgMDAgIDAwIDEwIDAwIDAwIDAwIDAyIDAwIDAwDQowMTQw" ], [ 323474, "CTA0IDAwIDAwIDAwIDAwIDAwIDAwIDAwICAwNCAwMCAwMCAwMCAwMCAwMCAwMCAw" ], [ 323540, "MA0KMDE1MAkwMCA0MCAwZCAwMCAwMCAwNCAwMCAwMCAgMDAgMDAgMDAgMDAgMDIg" ], [ 323606, "MDAgMDAgMDANCjAxNjAJMDAgMDAgMTAgMDAgMDAgNDAgMDAgMDAgIDAwIDAwIDEw" ], [ 323672, "IDAwIDAwIDEwIDAwIDAwDQowMTcwCTAwIDAwIDAwIDAwIDEwIDAwIDAwIDAwICAw" ], [ 323738, "MCAwMCAwMCAwMCAwMCAwMCAwMCAwMA0KMDE4MAkwMCBlMCAwYiAwMCA0YyAyOSAw" ], [ 323804, "MCAwMCAgMDAgYTAgMGMgMDAgMDAgOTggMDAgMDANCjAxOTAJMDAgMDAgMDAgMDAg" ], [ 323870, "MDAgMDAgMDAgMDAgIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwDQowMWEwCTAwIDMw" ], [ 323936, "IDBjIDAwIGQ0IDZlIDAwIDAwICAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMA0KMDFi" ], [ 324002, "MAkwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAgMDAgMDAgMDAgMDAgMDAgMDAgMDAg" ], [ 324068, "MDANCjAxYzAJMDAgMjAgMGMgMDAgMTggMDAgMDAgMDAgIDAwIDAwIDAwIDAwIDAw" ], [ 324134, "IDAwIDAwIDAwDQowMWQwCTAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwICBhOCBlNyAw" ], [ 324200, "base64", "b 00 68 06 00 00\r\n01e0\t00 00 00 00 00 00 00 00 " ], [ 324266, "MDAgMDAgMDAgMDAgMDAgMDAgMDAgMDANCjAxZjAJMDAgMDAgMDAgMDAgMDAgMDAg" ], [ 324332, "MDAgMDAgIDJlIDc0IDY1IDc4IDc0IDAwIDAwIDAwDQowMjAwCWI0IGY5IDA1IDAw" ], [ 324398, "base64", " 00 10 00 00 00 fa 05 00 00 04 00 00\r\n0210\t00 0" ], [ 324464, "MCAwMCAwMCAwMCAwMCAwMCAwMCAgMDAgMDAgMDAgMDAgMjAgMDAgMDAgNjANCjAy" ], [ 324530, "base64", "20\t2e 69 74 65 78 74 00 00 f4 35 00 00 00 10 06" ], [ 324596, "base64", " 00\r\n0230\t00 36 00 00 00 fe 05 00 00 00 00 00 0" ], [ 324662, "base64", "0 00 00 00\r\n0240\t00 00 00 00 20 00 00 60 2e 64 " ], [ 324728, "base64", "61 74 61 00 00 00\r\n0250\t44 3e 05 00 00 50 06 00 " ], [ 324794, "IDAwIDQwIDA1IDAwIDAwIDM0IDA2IDAwDQowMjYwCTAwIDAwIDAwIDAwIDAwIDAw" ], [ 324860, "base64", " 00 00 00 00 00 00 40 00 00 c0\r\n0270\t2e 62 73 7" ], [ 324926, "MyAwMCAwMCAwMCAwMCAgZTggNDkgMDAgMDAgMDAgOTAgMGIgMDANCjAyODAJMDAg" ], [ 324992, "MDAgMDAgMDAgMDAgNzQgMGIgMDAgIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwDQow" ], [ 325058, "base64", "290\t00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 0" ], [ 325124, "base64", "0 00\r\n02a0\t4c 29 00 00 00 e0 0b 00 00 2a 00 00 " ], [ 325190, "MDAgNzQgMGIgMDANCjAyYjAJMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgIDAwIDAw" ], [ 325256, "IDAwIDAwIDQwIDAwIDAwIGMwDQowMmMwCTJlIDc0IDZjIDczIDAwIDAwIDAwIDAw" ], [ 325322, "ICAzNCAwMCAwMCAwMCAwMCAxMCAwYyAwMA0KMDJkMAkwMCAwMCAwMCAwMCAwMCA5" ], [ 325388, "ZSAwYiAwMCAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDANCjAyZTAJMDAgMDAgMDAg" ], [ 325454, "MDAgMDAgMDAgMDAgYzAgIDJlIDcyIDY0IDYxIDc0IDYxIDAwIDAwDQowMmYwCTE4" ], [ 325520, "IDAwIDAwIDAwIDAwIDIwIDBjIDAwICAwMCAwMiAwMCAwMCAwMCA5ZSAwYiAwMA0K" ], [ 325586, "MDMwMAkwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAgMDAgMDAgMDAgMDAgNDAgMDAg" ], [ 325652, "base64", "00 40\r\n0310\t2e 72 65 6c 6f 63 00 00 d4 6e 00 00" ], [ 325718, "IDAwIDMwIDBjIDAwDQowMzIwCTAwIDcwIDAwIDAwIDAwIGEwIDBiIDAwICAwMCAw" ], [ 325784, "MCAwMCAwMCAwMCAwMCAwMCAwMA0KMDMzMAkwMCAwMCAwMCAwMCA0MCAwMCAwMCA0" ], [ 325850, "MiAgMmUgNzIgNzMgNzIgNjMgMDAgMDAgMDANCjAzNDAJMDAgOTggMDAgMDAgMDAg" ], [ 325916, "YTAgMGMgMDAgIDAwIDk4IDAwIDAwIDAwIDEwIDBjIDAwDQowMzUwCTAwIDAwIDAw" ], [ 325982, "IDAwIDAwIDAwIDAwIDAwICAwMCAwMCAwMCAwMCA0MCAwMCAwMCA0MA0KMDM2MAkw" ], [ 326048, "MCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAgMDAgMDAgMDAgMDAgMDAgNDAgMGQgMDAN" ], [ 326114, "CjAzNzAJMDAgMDAgMDAgMDAgMDAgYTggMGMgMDAgIDAwIDAwIDAwIDAwIDAwIDAw" ], [ 326180, "IDAwIDAwDQowMzgwCTAwIDAwIDAwIDAwIDQwIDAwIDAwIDQwICAwMCAwMCAwMCAw" ], [ 326246, "MCAwMCAwMCAwMCAwMA0KMDM5MAkwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAgMDAg" ], [ 326312, "MDAgMDAgMDAgMDAgMDAgMDAgMDANCjAzYTAJMDAgMDAgMDAgMDAgMDAgMDAgMDAg" ], [ 326378, "MDAgIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwDQowM2IwCTAwIDAwIDAwIDAwIDAw" ], [ 326444, "IDAwIDAwIDAwICAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMA0KMDNjMAkwMCAwMCAw" ], [ 326510, "MCAwMCAwMCAwMCAwMCAwMCAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDANCjAzZDAJ" ], [ 326642, "base64", "\r\n03e0\t00 00 00 00 00 00 00 00 00 00 00 00 00 0" ], [ 326708, "MCAwMCAwMA0KMDNmMAkwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAgMDAgMDAgMDAg" ], [ 326774, "MDAgMDAgMDAgMDAgMDANCjA0MDAJMDQgMTAgNDAgMDAgMDMgMDcgNDIgNmYgIDZm" ], [ 326840, "IDZjIDY1IDYxIDZlIDAxIDAwIDAwDQowNDEwCTAwIDAwIDAxIDAwIDAwIDAwIDAw" ], [ 326906, "IDEwICA0MCAwMCAwNSA0NiA2MSA2YyA3MyA2NQ0KMDQyMAkwNCA1NCA3MiA3NSA2" ], [ 326972, "NSA4ZCA0MCAwMCAgMmMgMTAgNDAgMDAgMDIgMDQgNDMgNjgNCjA0MzAJNjEgNzIg" ], [ 327038, "MDEgMDAgMDAgMDAgMDAgZmYgIDAwIDAwIDAwIDkwIDQwIDEwIDQwIDAwDQowNDQw" ], [ 327104, "CTAxIDA3IDQ5IDZlIDc0IDY1IDY3IDY1ICA3MiAwNCAwMCAwMCAwMCA4MCBmZiBm" ], [ 327170, "Zg0KMDQ1MAlmZiA3ZiA4YiBjMCA1OCAxMCA0MCAwMCAgMDEgMDQgNDIgNzkgNzQg" ], [ 327236, "NjUgMDEgMDANCjA0NjAJMDAgMDAgMDAgZmYgMDAgMDAgMDAgOTAgIDZjIDEwIDQw" ], [ 327302, "IDAwIDAxIDA0IDU3IDZmDQowNDcwCTcyIDY0IDAzIDAwIDAwIDAwIDAwIGZmICBm" ], [ 327368, "ZiAwMCAwMCA5MCA4MCAxMCA0MCAwMA0KMDQ4MAkwMSAwOCA0MyA2MSA3MiA2NCA2" ], [ 327434, "OSA2ZSAgNjEgNmMgMDUgMDAgMDAgMDAgMDAgZmYNCjA0OTAJZmYgZmYgZmYgOTAg" ], [ 327500, "base64", "98 10 40 00 0a 06 73 74 72 69 6e 67\r\n04a0\ta4 10" ], [ 327566, "base64", " 40 00 0b 0a 57 69 64 65 53 74 72 69 6e 67\r\n04b" ], [ 327632, "MAlmYyAxMCA0MCAwMCAwMCAwMCAwMCAwMCAgMDAgMDAgMDAgMDAgMDAgMDAgMDAg" ], [ 327698, "MDANCjA0YzAJMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgIDAwIDAwIDAwIDAwIDAw" ], [ 327764, "IDAwIDAwIDAwDQowNGQwCWZjIDEwIDQwIDAwIDA0IDAwIDAwIDAwICAwMCAwMCAw" ], [ 327830, "base64", "0 00 8c 3e 40 00\r\n04e0\t98 3e 40 00 9c 3e 40 00 " ], [ 327896, "YTAgM2UgNDAgMDAgOTQgM2UgNDAgMDANCjA0ZjAJZGMgM2IgNDAgMDAgZjggM2Ig" ], [ 327962, "NDAgMDAgIDM0IDNjIDQwIDAwIDA3IDU0IDRmIDYyDQowNTAwCTZhIDY1IDYzIDc0" ], [ 328028, "IDA4IDExIDQwIDAwICAwNyAwNyA1NCA0ZiA2MiA2YSA2NSA2Mw0KMDUxMAk3NCBm" ], [ 328094, "YyAxMCA0MCAwMCAwMCAwMCAwMCAgMDAgMDAgMDAgMDYgNTMgNzkgNzMgNzQNCjA1" ], [ 328160, "base64", "20\t65 6d 00 00 28 11 40 00 0f 0a 49 49 6e 74 65" ], [ 328226, "IDcyDQowNTMwCTY2IDYxIDYzIDY1IDAwIDAwIDAwIDAwICAwMSAwMCAwMCAwMCAw" ], [ 328292, "MCAwMCAwMCAwMA0KMDU0MAkwMCBjMCAwMCAwMCAwMCAwMCAwMCAwMCAgNDYgMDYg" ], [ 328358, "NTMgNzkgNzMgNzQgNjUgNmQNCjA1NTAJMDMgMDAgZmYgZmYgY2MgODMgNDQgMjQg" ], [ 328424, "IDA0IGY4IGU5IDJkIDU1IDAwIDAwIDgzDQowNTYwCTQ0IDI0IDA0IGY4IGU5IDRi" ], [ 328490, "IDU1IDAwICAwMCA4MyA0NCAyNCAwNCBmOCBlOSA1NQ0KMDU3MAk1NSAwMCAwMCBj" ], [ 328556, "YyBjYyA1NSAxMSA0MCAgMDAgNWYgMTEgNDAgMDAgNjkgMTEgNDANCjA1ODAJMDAg" ], [ 328622, "MDEgMDAgMDAgMDAgMDAgMDAgMDAgIDAwIDAwIDAwIDAwIDAwIGMwIDAwIDAwDQow" ], [ 328688, "NTkwCTAwIDAwIDAwIDAwIDQ2IDc1IDExIDQwICAwMCAwOCAwMCAwMCAwMCAwMCAw" ], [ 328754, "MCAwMA0KMDVhMAkwMCA4ZCA0MCAwMCBmMCAxMSA0MCAwMCAgODEgMTEgNDAgMDAg" ], [ 328820, "MDAgMDAgMDAgMDANCjA1YjAJMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgIDAwIDAw" ], [ 328886, "IDAwIDAwIDAwIDAwIDAwIDAwDQowNWMwCTAwIDAwIDAwIDAwIGYwIDExIDQwIDAw" ], [ 328952, "ICAwYyAwMCAwMCAwMCBiMCAxMCA0MCAwMA0KMDVkMAk4YyAzZSA0MCAwMCA2MCA2" ], [ 329018, "base64", "6 40 00 6c 66 40 00 a0 3e 40 00\r\n05e0\t94 3e 40 " ], [ 329084, "MDAgN2MgNjYgNDAgMDAgIGY4IDNiIDQwIDAwIDM0IDNjIDQwIDAwDQowNWYwCTEx" ], [ 329150, "base64", " 54 49 6e 74 65 72 66 61 63 65 64 4f 62 6a 65\r\n" ], [ 329216, "MDYwMAk2MyA3NCA4YiBjMCBmZiAyNSA2OCBlOCAgNGIgMDAgOGIgYzAgZmYgMjUg" ], [ 329282, "NjQgZTgNCjA2MTAJNGIgMDAgOGIgYzAgZmYgMjUgNjAgZTggIDRiIDAwIDhiIGMw" ], [ 329348, "IGZmIDI1IDVjIGU4DQowNjIwCTRiIDAwIDhiIGMwIGZmIDI1IDU4IGU4ICA0YiAw" ], [ 329414, "MCA4YiBjMCBmZiAyNSA1NCBlOA0KMDYzMAk0YiAwMCA4YiBjMCBmZiAyNSA1MCBl" ], [ 329480, "OCAgNGIgMDAgOGIgYzAgZmYgMjUgZDggZTcNCjA2NDAJNGIgMDAgOGIgYzAgZmYg" ], [ 329546, "MjUgNGMgZTggIDRiIDAwIDhiIGMwIGZmIDI1IDQ4IGU4DQowNjUwCTRiIDAwIDhi" ], [ 329612, "IGMwIGZmIDI1IGQ0IGU3ICA0YiAwMCA4YiBjMCBmZiAyNSA0NCBlOA0KMDY2MAk0" ], [ 329678, "YiAwMCA4YiBjMCBmZiAyNSA0MCBlOCAgNGIgMDAgOGIgYzAgZmYgMjUgM2MgZTgN" ], [ 329744, "CjA2NzAJNGIgMDAgOGIgYzAgZmYgMjUgMzggZTggIDRiIDAwIDhiIGMwIGZmIDI1" ], [ 329810, "IDM0IGU4DQowNjgwCTRiIDAwIDhiIGMwIGZmIDI1IDMwIGU4ICA0YiAwMCA4YiBj" ], [ 329876, "MCBmZiAyNSAyYyBlOA0KMDY5MAk0YiAwMCA4YiBjMCBmZiAyNSAyOCBlOCAgNGIg" ], [ 329942, "MDAgOGIgYzAgZmYgMjUgMjQgZTgNCjA2YTAJNGIgMDAgOGIgYzAgZmYgMjUgMjAg" ], [ 330008, "ZTggIDRiIDAwIDhiIGMwIGZmIDI1IDFjIGU4DQowNmIwCTRiIDAwIDhiIGMwIGZm" ], [ 330074, "IDI1IDE4IGU4ICA0YiAwMCA4YiBjMCBmZiAyNSBkMCBlNw0KMDZjMAk0YiAwMCA4" ], [ 330140, "YiBjMCBmZiAyNSAxNCBlOCAgNGIgMDAgOGIgYzAgZmYgMjUgMTAgZTgNCjA2ZDAJ" ], [ 330206, "NGIgMDAgOGIgYzAgZmYgMjUgMGMgZTggIDRiIDAwIDhiIGMwIGZmIDI1IGMwIGU3" ], [ 330272, "DQowNmUwCTRiIDAwIDhiIGMwIGZmIDI1IGJjIGU3ICA0YiAwMCA4YiBjMCBmZiAy" ], [ 330338, "NSBiOCBlNw0KMDZmMAk0YiAwMCA4YiBjMCBmZiAyNSAwOCBlOCAgNGIgMDAgOGIg" ], [ 330404, "YzAgZmYgMjUgMDQgZTgNCjA3MDAJNGIgMDAgOGIgYzAgZmYgMjUgYjAgZTcgIDRi" ], [ 330470, "IDAwIDhiIGMwIGZmIDI1IGFjIGU3DQowNzEwCTRiIDAwIDhiIGMwIGZmIDI1IGE4" ], [ 330536, "IGU3ICA0YiAwMCA4YiBjMCBmZiAyNSAwMCBlOA0KMDcyMAk0YiAwMCA4YiBjMCBm" ], [ 330602, "ZiAyNSBmYyBlNyAgNGIgMDAgOGIgYzAgZmYgMjUgZjggZTcNCjA3MzAJNGIgMDAg" ], [ 330668, "OGIgYzAgZmYgMjUgZjQgZTcgIDRiIDAwIDhiIGMwIGZmIDI1IGYwIGU3DQowNzQw" ], [ 330734, "CTRiIDAwIDhiIGMwIDUzIDgzIGM0IGJjICBiYiAwYSAwMCAwMCAwMCA1NCBlOCA1" ], [ 330800, "MQ0KMDc1MAlmZiBmZiBmZiBmNiA0NCAyNCAyYyAwMSAgNzQgMDUgMGYgYjcgNWMg" ], [ 330866, "MjQgMzAgOGINCjA3NjAJYzMgODMgYzQgNDQgNWIgYzMgOGIgYzAgIGZmIDI1IGVj" ], [ 330932, "IGU3IDRiIDAwIDhiIGMwDQowNzcwCWZmIDI1IGU4IGU3IDRiIDAwIDhiIGMwICBm" ], [ 330998, "ZiAyNSBlNCBlNyA0YiAwMCA4YiBjMA0KMDc4MAlmZiAyNSBjYyBlNyA0YiAwMCA4" ], [ 331064, "YiBjMCAgZmYgZmYgZmYgZmYgNTcgMDAgMDAgMDANCjA3OTAJNDYgNjEgNzMgNzQg" ], [ 331130, "NGQgNGQgMjAgNDIgIDZmIDcyIDZjIDYxIDZlIDY0IDIwIDQ1DQowN2EwCTY0IDY5" ], [ 331196, "IDc0IDY5IDZmIDZlIDIwIGE5ICAyMCAzMiAzMCAzMCAzNCAyYyAyMCAzMg0KMDdi" ], [ 331262, "MAkzMCAzMCAzNSAyMCA1MCA2OSA2NSA3MiAgNzIgNjUgMjAgNmMgNjUgMjAgNTIg" ], [ 331328, "NjkNCjA3YzAJNjMgNjggNjUgMjAgMmYgMjAgNTAgNzIgIDZmIDY2IDY1IDczIDcz" ], [ 331394, "IDY5IDZmIDZlDQowN2QwCTYxIDZjIDIwIDUzIDZmIDY2IDc0IDc3ICA2MSA3MiA2" ], [ 331460, "NSAyMCA0NCA2NSA3NiA2NQ0KMDdlMAk2YyA2ZiA3MCA2ZCA2NSA2ZSA3NCAwMCAg" ], [ 331526, "ZjAgMGYgYjAgMTEgYzMgOGQgNDAgMDANCjA3ZjAJOGIgMDggODkgMGEgOGIgNDgg" ], [ 331592, "MDQgOGIgIDQwIDA4IDg5IDRhIDA0IDg5IDQyIDA4DQowODAwCWMzIDhkIDQwIDAw" ], [ 331658, "IDhiIDA4IDg5IDBhICA4YiA0OCAwNCA4OSA0YSAwNCA4YiA0OA0KMDgxMAkwOCA4" ], [ 331724, "OSA0YSAwOCA4YiA0OCAwYyA4YiAgNDAgMTAgODkgNGEgMGMgODkgNDIgMTANCjA4" ], [ 331790, "MjAJYzMgOGQgNDAgMDAgOGIgMDggODkgMGEgIDhiIDQ4IDA0IDg5IDRhIDA0IDhi" ], [ 331856, "IDQ4DQowODMwCTA4IDg5IDRhIDA4IDhiIDQ4IDBjIDg5ICA0YSAwYyA4YiA0OCAx" ], [ 331922, "MCA4OSA0YSAxMA0KMDg0MAk4YiA0OCAxNCA4YiA0MCAxOCA4OSA0YSAgMTQgODkg" ], [ 331988, "NDIgMTggYzMgOGQgNDAgMDANCjA4NTAJZGYgMjggZGYgNjggMDggZGYgNjggMTAg" ], [ 332054, "IGRmIDY4IDE4IDhiIDQ4IDIwIDg5IDRhDQowODYwCTIwIGRmIDdhIDE4IGRmIDdh" ], [ 332120, "IDEwIGRmICA3YSAwOCBkZiAzYSBjMyA4ZCA0MCAwMA0KMDg3MAlkZiAyOCBkZiA2" ], [ 332186, "OCAwOCBkZiA2OCAxMCAgZGYgNjggMTggZGYgNjggMjAgOGIgNDgNCjA4ODAJMjgg" ], [ 332252, "base64", "89 4a 28 df 7a 20 df 7a 18 df 7a 10 df 7a 08\r\n0" ], [ 332318, "ODkwCWRmIDNhIGMzIDkwIGRmIDI4IGRmIDY4ICAwOCBkZiA2OCAxMCBkZiA2OCAx" ], [ 332384, "OCBkZg0KMDhhMAk2OCAyMCBkZiA2OCAyOCA4YiA0OCAzMCAgODkgNGEgMzAgZGYg" ], [ 332450, "base64", "7a 28 df 7a\r\n08b0\t20 df 7a 18 df 7a 10 df 7a 08" ], [ 332516, "IGRmIDNhIGMzIDhkIDQwIDAwDQowOGMwCWRmIDI4IGRmIDY4IDA4IGRmIDY4IDEw" ], [ 332582, "ICBkZiA2OCAxOCBkZiA2OCAyMCBkZiA2OA0KMDhkMAkyOCBkZiA2OCAzMCA4YiA0" ], [ 332648, "base64", "8 38 89 4a 38 df 7a 30 df 7a 28\r\n08e0\tdf 7a 20 " ], [ 332714, "ZGYgN2EgMTggZGYgN2EgIDEwIGRmIDdhIDA4IGRmIDNhIGMzIDkwDQowOGYwCWRm" ], [ 332780, "IDI4IGRmIDY4IDA4IGRmIDY4IDEwICBkZiA2OCAxOCBkZiA2OCAyMCBkZiA2OA0K" ], [ 332846, "MDkwMAkyOCBkZiA2OCAzMCBkZiA2OCAzOCA4YiAgNDggNDAgODkgNGEgNDAgZGYg" ], [ 332912, "base64", "7a 38\r\n0910\tdf 7a 30 df 7a 28 df 7a 20 df 7a 18" ], [ 332978, "IGRmIDdhIDEwIGRmDQowOTIwCTdhIDA4IGRmIDNhIGMzIDhkIDQwIDAwICA4MyBl" ], [ 333044, "OSAwYyAwMSBjOCAwMSBjYSBmNw0KMDkzMAlkOSA3OSAxMyBkZiAyYyAwMSBkZiA2" ], [ 333110, "YyAgMDEgMDggZGYgN2MgMTEgMDggZGYgM2MNCjA5NDAJMTEgODMgYzEgMTAgNzgg" ], [ 333176, "ZWQgZGYgMmMgIDAxIGRmIDNjIDExIDhiIDQ0IDAxIDA4DQowOTUwCTg5IDQ0IDEx" ], [ 333242, "IDA4IGMzIDhkIDQwIDAwICA4MyBlOSAwNCAwMSBjOCAwMSBjYSBmNw0KMDk2MAlk" ], [ 333308, "OSBkZiAyYyAwMSBkZiAzYyAxMSA4MyAgYzEgMDggNzggZjUgOGIgMDQgMDEgODkN" ], [ 333374, "CjA5NzAJMDQgMTEgYzMgOTAgOGIgNDggMDQgOGIgIDEwIDM5IGQxIDg5IDExIDg5" ], [ 333440, "base64", " 4a 04\r\n0980\t74 02 c3 90 81 e9 a8 97 4b 00 89 c" ], [ 333506, "YSBjMSBlOSAwMyAwZg0KMDk5MAliNiBkNiBiOCBmZSBmZiBmZiBmZiBkMyAgYzAg" ], [ 333572, "MjEgMDQgOTUgMjggOTcgNGIgMDANCjA5YTAJNzUgZTAgYjggZmUgZmYgZmYgZmYg" ], [ 333638, "ODkgIGQxIGQzIGMwIDIxIDA1IDI0IDk3IDRiDQowOWIwCTAwIGMzIDhiIGMwIDgx" ], [ 333704, "base64", " ea 30 0b 00 00 c1 ea 08 81 ea ff\r\n09c0\t03 00 0" ], [ 333770, "MCAxOSBjOSAyMSBjYSA4MSAgYzIgZmYgMDMgMDAgMDAgOGQgMGMgZDUNCjA5ZDAJ" ], [ 333836, "base64", "a8 97 4b 00 8b 51 04 39 ca 89 08 89 50 04 89 02" ], [ 333902, "base64", "\r\n09e0\t89 41 04 74 03 c3 90 90 81 e9 a8 97 4b 0" ] ], "sz": 4308045, "ts": [ { "c": 0.9200000166893005, "d": "Batch saturated with long tokens", "e": [ "text.long_token_count = 559.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::batch-long-token-saturation", "l": 4 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 60960.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "c": 0.800000011920929, "d": "Batch self path reference", "e": [ "\"%~f0\"" ], "i": "micro-behaviors/process/info/selfpath::self-path-fragment", "l": 1 }, { "c": 0.699999988079071, "d": "HTTP REQUEST method", "e": [ "REQUEST" ], "i": "micro-behaviors/communications/http/request/client::request", "l": 2 }, { "c": 0.699999988079071, "d": "PEM end marker", "e": [ "-----END" ], "i": "micro-behaviors/crypto/certificate/usage::pem-end", "l": 2 }, { "c": 0.699999988079071, "d": "PEM begin marker", "e": [ "-----BEGIN" ], "i": "micro-behaviors/crypto/certificate/usage::pem-begin", "l": 2 }, { "d": "certificate string reference", "e": [ "CERTIFICATE" ], "i": "micro-behaviors/crypto/certificate/usage::certificate-ref", "l": 2 }, { "a": "T1027,T1112,T1059.001", "c": 0.8999999761581421, "d": "Batch has long encoded token", "e": [ "text.long_token_count = 559.00" ], "i": "objectives/command-and-control/dropper/staging/embedded::batch-has-long-token", "l": 1 }, { "c": 0.9599999785423279, "d": "Batch saturated with long lines", "e": [ "text.lines_over_200 = 517.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::batch-long-line-saturation", "l": 4 }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 1655.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "c": 0.8999999761581421, "d": "Batch unusually low whitespace density", "e": [ "text.whitespace_ratio = 0.03" ], "i": "objectives/anti-static/obfuscation/string/anomaly::batch-low-whitespace-density", "l": 4 }, { "a": "T1027", "c": 0.699999988079071, "d": "Very low whitespace ratio (minified/compressed)", "e": [ "text.whitespace_ratio = 0.03" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace", "l": 2, "m": "B0032" }, { "c": 0.9700000286102295, "d": "Batch fragmentation and junk-padding profile", "e": [ "text.long_token_count = 559.00", "text.whitespace_ratio = 0.03", "text.lines_over_200 = 517.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::batch-fragmentation-metrics", "l": 4 }, { "c": 0.800000011920929, "d": "X.509 certificate handling (legitimate)", "e": [ "-----BEGIN", "CERTIFICATE", "-----END" ], "i": "micro-behaviors/crypto/certificate/usage::certificate-handling", "l": 2 }, { "c": 1.0, "d": "File contains a PEM-encoded certificate.", "e": [ "-----END", "-----BEGIN" ], "i": "micro-behaviors/crypto/certificate/usage::has-pem-certificate", "l": 2 }, { "c": 0.8999999761581421, "d": "Encoded payload detected: base64", "e": [ "b6 70 27 13 a2 28 2a 2a 3a e1 a1d00\teb \u003cbase64\u003e", "a3520\tb6 78 33 b6 f1 13 16 00 2a 2a b6 \u003cbase64\u003e", " 7b 3b bf730\ta3 3b ea 3c e5 3d 16 3e 2 \u003cbase64\u003e", " 2a 2a 13 28 63 29 2a b6 b0 cf 25 2a 2a \u003cbase64\u003e", "3 b6 ff b6 ee 13 bf e1 2a 2a b4 31 ae \u003cbase64\u003e", " 44 00 4da90\t20 20 45 00 e4 85 41 00 0 \u003cbase64\u003e", "7 95 2b 7e 81 5e eb 80 93 e0 d4 6b 2b \u003cbase64\u003e", "d e9 3d d6 3e 69 3f 7b 3f e6 3f 00 00 \u003cbase64\u003e", "9ee40\tee 7e 81 82 ae ef 17 b6 25 b6 1b \u003cbase64\u003e", "387e0\te4 ff e3 ff e2 ff e1 ff e0 ff df \u003cbase64\u003e", " f4 3a a9f50\taf 87 28 2a 2a 66 3b 9f 8 \u003cbase64\u003e", "4d180\t80 00 00 00 00 00 00 0a 42 75 74 \u003cbase64\u003e", "3 87 a9 29 2a b6 b0 ff 914f0\t27 2a 2a 1 \u003cbase64\u003e", "b8 b0 23 27 2a 8ec60\t2a 13 1a 76 29 2a \u003cbase64\u003e", "6 6d 2b 13 f1 3d 2a 2a e5 97 b6 6d 2b \u003cbase64\u003e", " 70 33 7ef90\t16 6c 3a e2 6e 3d 2e ee b \u003cbase64\u003e" ], "i": "metadata/encoded-payload/base64", "l": 3 } ], "sha": "420f8cca34a5bf9eae57ed3d02c9b6d5571a267197e51f475f9b7ace179c5f26", "path": "420f8cca34a5bf9eae57ed3d02c9b6d5571a267197e51f475f9b7ace179c5f26.cmd", "type": "batch" } ], "tv": "529a0" } }