{ "ml": { "v": "7", "eng": "2.12.0-beta.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.23293023, "rte": "az", "prob": 0.23293023 }, { "cls": 0, "raw": 0.005258391, "rte": "az/nupkg", "prob": 0.005258391 } ], "prob": 0.23293023, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.2329302281141281, "type": "nupkg" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.000013460715308610816, "type": "powershell" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.00002872943878173828, "type": "pe" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.000015735626220703125, "type": "powershell" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.000014632940292358398, "type": "powershell" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.00003077586370636709, "type": "pe" } ], "version": "v18.18", "analyzed_at": "2026-09-19T01:41:28Z" }, "path": "AWS.Tools.RecycleBin.5.0.302.nupkg", "raw": { "files": [ { "id": 0, "mol": "K₂(LiMc)O₂(AsC)H₄(Cm₅DbOs₂Po₂)Md₅(Bi₃Pa₂Si₄)", "sha": "75eaf18d471e24cb77e6d0b4dd12c0b7d77d740520e1c5f070428558e41a793a", "path": "AWS.Tools.RecycleBin.5.0.302.nupkg", "risk": 23, "size": 123668, "type": "nupkg", "facts": { "metrics": { "file": { "size": 123668, "entropy": 8 }, "binary": { "peak_region_bytes": 122880, "peak_region_entropy": 7.83 }, "archive": { "file_count": 13, "member_count": 13, "script_count": 3, "zip_bomb_ratio": 15.23, "compressed_size": 121944, "directory_count": 0, "executable_count": 2, "extra_field_size": 0, "noise_file_count": 0, "compression.ratio": 0.28, "hidden_file_count": 1, "uncompressed_size": 429824, "crc_collision_count": 0, "entry_comment_count": 0, "max_filename_length": 81, "rtlo_filename_count": 0, "format.regular_count": 13, "nested_archive_count": 0, "path_traversal_count": 0, "symlink_escape_count": 0, "security.setgid_count": 0, "security.setuid_count": 0, "security.sticky_count": 0, "double_extension_count": 0, "duplicate_member_count": 0, "security.symlink_count": 0, "unicode_filename_count": 0, "homoglyph_filename_count": 0, "security.encrypted_count": 0, "timing.mtime_unique_count": 7, "timing.mtime_unique_ratio": 0.54, "misplaced_executable_count": 2, "timing.mtime_dominant_count": 4, "timing.mtime_spread_seconds": 5028, "timing.sentinel_mtime_count": 0, "security.world_writable_count": 0, "timing.mtime_dominant_fraction": 0.31, "compression.method_counts.deflate": 13 } } }, "ident": { "name": { "value": "AWS.Tools.RecycleBin", "source": "nupkg.title", "verified": false }, "urls": [ { "url": "https://github.com/aws/aws-tools-for-powershell", "kind": "homepage", "source": "nupkg.project_url" } ], "trust": "unsigned", "authors": [ { "name": "Amazon.com", "role": "author", "source": "nupkg.authors" }, { "name": "Inc", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "5.0.302", "source": "nupkg.version", "verified": false }, "identifier": { "value": "AWS.Tools.RecycleBin", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "well-known/malware/worm/ludbaruma::metric-section-count-3", "conf": 0.99, "crit": 3, "desc": "Exactly three sections", "from": [ { "file": 9 } ] }, { "id": "metadata/package/versioning/scheme::pe-version-file-version-value", "conf": 0.9, "crit": 3, "desc": "PE version resource carries a file version" }, { "id": "micro-behaviors/process/interpreter/eval/direct::powershell-iex-call", "atk": "T1059.001", "mbc": "E1059", "conf": 0.9, "crit": 3, "desc": "PowerShell Invoke-Expression or iex call", "from": [ { "file": 8 } ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/layout/size::small-pe", "conf": 0.6, "crit": 3, "desc": "Small PE binary (\u003c100KB)", "from": [ { "file": 4 } ] }, { "id": "metadata/package/versioning/scheme::pe-productversion-semver-git-hash", "conf": 0.9, "crit": 3, "desc": "PE ProductVersion has SemVer git hash" }, { "id": "metadata/signed/certificate/identity::pe-signature-verified", "conf": 1.0, "crit": 2, "desc": "PE Authenticode integrity check reports intact" }, { "id": "micro-behaviors/communications/http/url/path::image-file-url", "conf": 0.85, "crit": 3, "desc": "HTTP URL targets an image file", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/process/interpreter/powershell/host::sma-namespace", "atk": "T1059.001", "mbc": "E1059", "conf": 0.85, "crit": 3, "desc": "System.Management.Automation import", "from": [ { "file": 4 } ] }, { "id": "metadata/package/versioning/scheme::pe-internalname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes InternalName", "from": [ { "file": 4 } ] }, { "id": "objectives/command-and-control/dropper/execution/fileless::curl-custom-ua-piped-powershell--rx-27", "conf": 0.9, "crit": 3, "desc": "Matches 'Invoke-Expression'", "from": [ { "file": 8 } ] }, { "id": "metadata/package/versioning/scheme::pe-productname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes ProductName", "from": [ { "file": 4 } ] }, { "id": "objectives/supply-chain/credential-theft/registry::credentials-file-basename-marker", "atk": "T1552.001", "conf": 0.4, "crit": 3, "desc": "Credentials filename marker", "from": [ { "file": 4 } ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/layout/overlay::image-under-768kb", "conf": 0.9, "crit": 3, "desc": "PE mapped image under 768 KiB", "from": [ { "file": 4 } ] }, { "id": "well-known/lib/cloud/aws-sdk-dotnet::aws-sdk-dotnet-core", "conf": 1.0, "crit": 3, "desc": "AWS SDK for .NET Core assembly", "from": [ { "file": 4 } ] }, { "id": "metadata/lang/natural::lang-english--atom-4", "conf": 0.8, "crit": 1, "desc": "English function-word token \"have\"", "from": [ { "file": 5 } ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "from": [ { "file": 3 } ] }, { "id": "metadata/lang/scripted::function-blocks", "conf": 0.82, "crit": 2, "desc": "PowerShell function block syntax", "from": [ { "file": 8 } ] }, { "id": "metadata/file/naming::high-entropy-identifier-ratio", "conf": 0.85, "crit": 3, "desc": "High ratio of entropy-heavy identifiers", "from": [ { "file": 7 } ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning/scheme::pe-filedescription-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes FileDescription", "from": [ { "file": 4 } ] }, { "id": "metadata/signed/certificate/identity::powershell-signature-block", "conf": 0.95, "crit": 3, "desc": "PowerShell Authenticode signature block", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/os/group/membership::privileged-local-group-name", "atk": "T1098", "conf": 0.9, "crit": 3, "desc": "References a privileged local group", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/url/encoded::encoded-http-url", "atk": "T1027", "mbc": "B0032", "conf": 0.85, "crit": 3, "desc": "Encoded URL decoded to http(s)", "from": [ { "file": 3 } ] }, { "id": "metadata/build/reproducible::pe-reproducible-build", "conf": 1.0, "crit": 2, "desc": "Built with /Brepro (deterministic)" }, { "id": "metadata/package/versioning/scheme::pe-fileversion-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes FileVersion", "from": [ { "file": 4 } ] }, { "id": "metadata/binary/provenance/build::pe-far-future-timestamp", "conf": 0.95, "crit": 3, "desc": "PE COFF timestamp encodes a future date" }, { "id": "metadata/binary/code/entropy::code-entropy-at-most-7-5", "conf": 0.7, "crit": 2, "desc": "Code entropy is 7.5 or lower", "from": [ { "file": 4 } ] }, { "id": "metadata/encoded-payload/base64", "conf": 0.9, "crit": 3, "desc": "Encoded content decoded: base64" }, { "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url", "conf": 0.9, "crit": 3, "desc": "References a public code-forge URL", "from": [ { "file": 3 } ] }, { "id": "metadata/signed/trust-level::signer-evidence-present", "conf": 1.0, "crit": 3, "desc": "Platform or developer signing evidence", "from": [ { "file": 4 }, { "file": 9 } ], "uses": [ 6, 50 ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET metadata root signature (BSJB)", "from": [ { "file": 4 } ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/identifiers::many-high-entropy-identifiers", "atk": "T1027", "mbc": "B0032", "conf": 0.7, "crit": 3, "desc": "Many random-looking source identifier names", "from": [ { "file": 7 } ] }, { "id": "metadata/package/versioning/scheme::pe-productversion-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes ProductVersion", "from": [ { "file": 4 } ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/url/encoded::authenticode-script-signature-context", "atk": "T1027", "mbc": "B0032", "conf": 0.98, "crit": 3, "desc": "Authenticode script signature block context", "from": [ { "file": 3 } ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning/scheme::version-info-file-version-present", "conf": 0.95, "crit": 3, "desc": "PE FileVersion value is present" }, { "id": "metadata/encoded-payload/base64-base64", "conf": 0.9, "crit": 3, "desc": "Encoded content decoded: base64 → base64" }, { "id": "micro-behaviors/communications/http/client/managed::user-agent-accessor", "conf": 0.8, "crit": 3, "desc": "HttpClient UserAgent accessor", "from": [ { "file": 9 } ] }, { "id": "metadata/package/versioning/scheme::pe-companyname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes CompanyName", "from": [ { "file": 4 } ] }, { "id": "metadata/signed/leaf::amazon-web-services-inc.", "conf": 1.0, "crit": 3, "desc": "Signed by Amazon Web Services, Inc.", "from": [ { "file": 4 } ] }, { "id": "metadata/package/versioning/scheme::pe-version-resource", "conf": 0.8, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 4 } ] }, { "id": "metadata/package/versioning/scheme::pe-version-product-name-value", "conf": 0.9, "crit": 3, "desc": "PE version resource names a product" }, { "id": "micro-behaviors/communications/url/encoded::http-b64-protocol-fragment", "atk": "T1027", "mbc": "B0032", "conf": 0.6, "crit": 3, "desc": "Base64 HTTP protocol fragment", "from": [ { "file": 3 } ] }, { "id": "metadata/signed/trust-level::dotnet-strong-name-signed", "conf": 0.95, "crit": 3, "desc": "Managed assembly is strong-name signed", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/communications/http/message::powershell-http-url-literal", "conf": 0.75, "crit": 3, "desc": "PowerShell HTTP/HTTPS URL literal", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/version::os-version", "conf": 0.8, "crit": 3, "desc": "Queries OS version info", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/data/manipulation::dotnet-item-setter-token", "conf": 0.65, "crit": 3, "desc": ".NET set_Item method reference", "from": [ { "file": 9 } ] }, { "id": "metadata/signed/certificate/identity::pe-signature-verified-kv", "conf": 1.0, "crit": 2, "desc": "PE Authenticode signer cryptography verifies" }, { "id": "metadata/lang/scripted::type-accelerator", "conf": 0.78, "crit": 2, "desc": "PowerShell type accelerator syntax", "from": [ { "file": 8 } ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET managed assembly", "from": [ { "off": 10588, "file": 4 }, { "off": 25072, "file": 9 } ], "uses": [ 32, 53 ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR header (COM descriptor)" }, { "id": "objectives/anti-static/obfuscation/code-metrics/identifiers::identifier-obfuscation", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Identifier obfuscation (random/encoded names)", "from": [ { "file": 7 } ], "uses": [ 19, 33 ] }, { "id": "metadata/signed/unknown::amazon-web-services-inc.", "conf": 1.0, "crit": 3, "desc": "Authenticode chain CN: Amazon Web Services, Inc.", "from": [ { "file": 4 } ] }, { "id": "metadata/binary/symbols/imports::single-import-count", "conf": 0.7, "crit": 3, "desc": "PE with single import", "from": [ { "file": 4 } ] }, { "id": "metadata/package/files/nuget::nupkg-multiple-executable-members", "conf": 0.98, "crit": 3, "desc": "NuGet package has multiple executable members" }, { "id": "metadata/file/archive::archive-misplaced-executable-member", "conf": 0.9, "crit": 3, "desc": "Archive executable in atypical path" } ] }, { "ctx": [ { "b": "bmK#8awD=+B.\u003eRizddr@w[u49azbLjaz(4cB.\u003eRicQy*je(V+cy\u0026.jbwN*0}y?k}Ezyk(2bmK$?3p5}E3lQDlar@1cv@=p5BrCBswozZ1aA8oyvRGZ*A^n^Az!a0bwGUP0y?j.$B8#nfx\u003c(9{wfu8gBz8!sxLzJgzddr@w[u494gjj2arTN2z/!Y(wozZ1auZ?{l03#qrbVX\u003eB1Qv4v%IN2wKp9Ge[w^mcK*y(3lQDlar@1cB-qqrA=+(6aw=09wncd1z/fR93lQDlavy6:Aa9?", "ln": 0, "col": 1, "line": 1 }, { "b": "wEO$?arR^]z/6D4zH1#=zdK?MasxD(vr#\u003cfe[n*pefEJ4v\u003c.Y)4gjj2arR)KlVl{?A+Pf1BrCTDvru6$wO#Pjw]zYjBzbxfaz(4cB.\u003eQ#3lQDlavy6^D2^RixMLvWasxJ{AcVFrxj#xfl2y4Rz/dgqz/43FnP52\u003caA8oyx([zsvp\u003ca=y?Ws1wPGEDl2puWqFx=SBAnN5wPIB6C4ChpcK*y(3lQDlar@0%wPIv4x(Ffdz/cXow/#hewGUPczEW^5z/f01x([RyAb](ux\u003eg^=ayYQsBzbxfaz(4cB.\u003eQ#3lQDlavG^Zv@=p5BzkVhauZ?{ra]?=qE%u-v@bZyx(k5gz!a0bwGU]6avf7caxin$y\u0026Z.hz/M%%z*b=kq!P-Uy-)L9BAnNnwP?T3z/xodB0a[ewftq\u003eze0)4B98ChBz(hvaz\u003eL8vp%c]l2y4Rz/cW}wN*0}y?j.Qx(k59A=k!qBzbkdp\u0026yL?A-lT.y?$knv@=p5BzkS9az2Clx(XcfzdNQbe*9-6aA8phwPw]nzY\u0026[9zEEf?az1$\u003exDPPxqY{c)A=#ebwH[%rzGx]dy?$koxK@q@z/P(fB8V5nwnb{]az(4cB.\u003eRi", "ln": 536, "col": 38, "line": 21 }, { "b": "q.z3/z!%FEmme*Yavf7ce(V+cy\u0026.jcgCgpjdj#5pra]?=zeS%cy?j.Ps5Q.Jz/oDke\u003eG@4Byx04wPw[wxMOunB2\u003e%cCxXl-AbP@iA=U]9y\u00260-)y\u00260W6C}JPBz7/\u003cpv@2H=wPGH\u003cs5Q.Jz/oDke\u003eG@4Byx04wPxBMaz\u003eL5wPF#dBrCd6B7]iaaARJAx(n0lvqG:haA.Tlvru66vqYP#B-7]hB97\u0026by-)?kwGTouq.z3/z!%FqzeS%cy?mVu4gl6Fx(+zuwPz\u003caz/cXow/%xvqY]3", "ln": 1024, "col": 252, "line": 28 }, { "b": "arR^Hp\u0026ZF:wPI{hAZs.QxLzN1v@#\u003clwGTbUcNPug4gjj2arR)Ko(BM+y?mVgBzb98az(mxBrC47azCXiz/P@hwftP7Bz\u0026pzxK@r0y\u0026r=\u003ey-)qbC4\u003e#nzF-%5BrCKyx(w2mBz\u0026poze:AlBzkS9aARphB0bsrwozZ14gjj2arTM[ADL#owN[INwozZ1", "ln": 2236, "col": 1, "line": 50 }, { "b": "od\u003caNv%IN2wKp9Ge[w^mcK*z9arR^Q4giKKarR^HboP]{A+PGmazbt7wPF$xe]U\u003e^diJ.CvrrS2A+cwlB-5sozxK4mwGUF\u003ey\u00260W6cVZzwzGY-mz/fA6zGE1uA+PDjaARJAx(d*cA==2kxcqqfx(+zlz!a0bwEO$?arR!9v@=p5BApA1p\u0026ZF:wPI]n", "ln": 2669, "col": 15, "line": 61 }, { "b": "q.z3/z!%FEqE%u-v@bZyx(kLly?$W]wO=rrCX}mA4gjj2arS9x3jNs+arR^Kaw^8)C42G7ay[]5vixVgaAg+gB0bNyaARpdaz(4cB.\u003eRiB8UY2x\u003ez6\u003cwftP7awD=+B.\u003eR*z+$E)v}x.54gjj2arTH3x)9{bwKG%GvivYQkZJ}E4gjj2arR^HarTGVl$7gCauZ\u0026jDKQr8arR^HarR^HarR!avp%T7jS)0rcQy*jcOcw/v@c7awg5]JcS+21wn=WkcOcw/p/x![x([6czEk!yB8b(oA3)gVcS0-gwncd1z/e]Hz/PzpefDrlx(n6rcOcw/o\u003c}KcqZTascRX2VcN/GiarR^HarR^HarR^HoLF0FzGxw?A+MTVasy\u0026ABz#pZfe3:TB1Q)rvr#\u003cfe[n*pfjw*dv}YB9ga+gkcK*z9arR^HarR^HarR!6A=kY7v@$Z\u003ex=]LYcUNQzAc15[fk20vxMW=pv@DiqvrV=CvrV=ABz(8lB1I0xAXhlGCv+/oxK#0@cK*z9arR^HarR^HarR^#v@Dl+A+MTVasy\u0026ABz#pZfe4xSyB%dpAXhfuBs}0svr#\u003cfCv+l8wPz%dv}xZlv@Diqx(do\u003ewPGH\u003cs5R!hxkYHWicWeki4/e/xd1b}arR^HarR^HarR^HqE%VQvrl0Pz//MiauZ?{xMOunB2\u003e%cxk8E3BZ=$kz/4doCxkACCxkuTz/oDkeOn{wePtSLwPz\u003c9wO=fovR/%(fkUcizzavFk#6{soIXehzdC163lQDlarR^HaBKXaarR^HEglKi4giKKboP]Rm\u003c630ls\u003c!zzxK1mxkRd1B-I4ovR/%)yyHQ}awCB0B-ZF-n\u003eT8anOAoSpc?-!lVkK/B-q7.lRIF\u003elQsNrCTM\u003czpc@Pfxj#6[lrWkXml$MPmNoBeh9$}]AT-v2avoZfml$6FgEkUxmq\u003eXqCvsDpfHxz\u003cAZBzcml$6FgEkUxwLCJ{lQt]+k%W!lqaJV\u003ch^5Q^oA", "ln": 4048, "col": 12, "line": 112 }, { "b": "xluToze-T5o*HE6lSm${q+pBOl@uxtlW8J@o?fzLlWz3\u003clt64]lp1:Nl2oO3o\u0026s#nmr.)5r-8Z!4gjs5mr-#Bvol#Uq8hf$wj5WQvR[?:m]R=Rlt64]lp2V(mmZ@Bwo*4Fvol#UsU:36wj5j?vLPSZol@)ylt64]4gjs5lp1sBnO.jys#6[Zt3axJnKWris#6-6qclOtwlqDqvR[\u003eRnKVVYnK=r}vLZ\u003e]q7$B.nn8Hdo\u003e)mzo\u0026KMc4gjs5o*?o\u003eo*?o\u003es7(8so)M", "ln": 4985, "col": 7, "line": 133 }, { "b": "n(nCWo*JX/lQL]+k#ySKlu=c(o?mlllQL]+k#ySKlu+\u003c+lp:*{v]L:f4gjs5lt6}Klt5.Rlq.lpl0mt[vmToIv)\u003elUoFORyv(3z[t1ryDvoliuv@td^sU-0Vo*@?/lQL]+k#ySKlv7{+4gjs5xLGnuwjPQxpIz!isU-DYt3axJv%G}Evol#UsU:36wj5j?vLPSXqB+Lvvo36sv@tgovol#TqclOtwlqDq4gjs5vR[\u003eRqDu$1vLP}$q7$BYsU\u0026V7o*%a[k}#wInoW%2o*}S$qa\u003ch9z:X\u003evpI\u003c=0wjP0AoNeTkv@lBooL)WD4gjs5s#6]et3axJoL)KFvPboQvol#Uq8hf$wjpfJs#6+Tv(3\u003emv@jXTsU:2Er+$xKvLZ[IqbYt!v@lBlni{xD4gjs5r-gR:lpaW@ms4l\u003clt6tpxhJ\u003etl3+**lt6FtxhJ\u003etlp14:l@v8Vok!09xM^(Xk#y6AlqZ3pxj\u003cU1k$as?4gjs5Az/sYm0ID$wN/K)vq^}/h/Jy#A7%!Rl@lJ\u003cB7F(]s./W0yCxPWDh", "ln": 6293, "col": 23, "line": 152 }, { "b": "v)\u003elUoFORyv(3z[t1ryDvoliuv@td^sU-0Vo*}GvlQL]+k#ySKlv7{+xLHN^wjPQxpIz!isU-DY4gjs5t3axJv%G}Evol#UsU:36wj5j?vLPSXqB+Lvvo36sv@tgAv@ts[wjGWorC::twjo#ZoL)KIwje:Llt64]4gjs5nk.Aop^^Pco*\u0026Ydph@MNxLHdTwjPQxpIz!isU\u0026V\u003eo)FQivol#UsU:36wj5j?vLPSXqB+Lvvo36sv@tgA4gjs5v@ts[wjGWorC::twjo#ZoL)KIvNJH(lt64]nk?/ymPqVMo*JnVli", "ln": 8453, "col": 7, "line": 184 }, { "b": "vPM2SvLP=MrX^Y\u0026nK=D\u003ev@tE?sU:37oHzcsvR[?Zo\u0026tFBmP0qRr-8Z/4gjs5mrZQ*qBLXNnK(l)t0\u003eRRvLP@+v%QNTo*.ipk}#wdl3MacqcbF=wO\u003cCInK^lbs.Qi4t3axLvoliuv%Joh4gjs5q=+?\u003eoLM{Zl19uel@v8Vok!09xM^(Xk#y6qlqZ3pxj\u003c.hk$17cl0na[xj\u003c.3k$:HDw(8M8m0QT\u003eh-AQi4gjs5xeSQ@h/SZ(hb!1dy^Z]?CxL]4fMg2K", "ln": 9965, "col": 23, "line": 206 }, { "b": "lt64]nk\u0026ISl{%sllt6}Klt5.Rlq.kXl3+)+BwVger-gR-lp\u003cW?o?v\u0026{o?4]\u003erBFi\u003cxLPtvwjPQx4gjs5pIz!isU\u0026V\u003eo)FQivol#UsU:36wj5j?vLPSXqB+Lvvo36sv@tgAv@ts[wjGWoqHhkevLQ?$rwFxdvR]}74gjs5s$@SGqb*zppGgH%q:\u003cc3pEF69o*?M$q7$B-oL)KIvNJKZz:)lfr5v=NvmToIv)\u003elUoFPv*vNK7ot1ryD4gjs5voliuv@td^sU-0VoFxv-s#6[Zt3axJr.b?qv(420t18{Pq8gdEt2[yqs#4%OvR]TOrwl\u0026}o*\u0026+Lrwn8M4gjs5o)QCao\u003e($to\u0026T}Po\u0026A]:v@lBlxiFe5lQL]+k#ySKlu+\u003c+lp\u003cWro?v\u0026zo*.=FlQL]+k#ySKlv7{:xLq6$4gjs5wjPQxpIz!ivLQY8v)-a?vol#UsU:36wj5j?vLPSYsv37YolTJ9lqZ-No*IAxryZZRwjP0AoNeTksYXvm4gjs5v@tg\u003coL)WDs#6]et3axJoL)KFvPboQvol#Uq8hf$wjxExwlqOXt31P)pdm{3t1qQ)vol#Zvoks7rCUz%4gjs5pddx9phAV%qb*mDpddV$o\u003e)c=qb/#bsU\u0026V7o*JL+k}#wImr.P@o*I6?l@v8Vok!09xM^(Xk#y6AlqZ3p4gjs5xj\u003c!5k$L6yyhe0dAb5#Bfk$5\u0026D01Pcq!]MMh!(A9p?rZszfm:dA@", "ln": 10901, "col": 7, "line": 220 }, { "b": "lt64]lp1:Nl2oO3o\u0026tFBmP0qRr-8Z!mrZQTvol#Uq8hf$wj7MNq=+?\u003eoLN3-o**%hk}#wdl3M9X4gjs5qB+Lvvo36sv@tdRr.b?qv(420t0\u003eREpd4uFvokg1rwNJ^vPU%ovR]Q/rCUz%pddx9ph93]q:\u003cc2pe\u003ewe4gjs5o\u003e($tpe:FEqb/#dnn8Hdo\u003e)*PpEEG6o*?o\u003eo*?o\u003es7(8so)Qq]o\u0026Kzjo\u003e)xSpGgsKs876po\u0026k$QlS3#O4gjs5r-8Z:mr.v8rEd8oo*R\u0026Ik}#wdlUGg\u0026qB+Lvvo36sv@td+nKWDrsP", "ln": 13485, "col": 7, "line": 258 }, { "b": "t3axJoL)KFvPkW8lt6}Klt5.Rlq.lpl2P}8vmToIv)\u003elUoFPvRsU:36wjPBqt1ryDvoliuv@td^4gjs5sU-0VoFxv-s#6[Zt3axJr.b?qv(420t18{Pr.3$Ft2[xLsYWt4voks7rCUz%pddx9phAV%qb*awphivA4gjs5o\u003e)Y%qb/#bsU\u0026V7o?49jk}#wInoW%mo?5ofr.C+Tz:)8:rbDq5wjP0AoNeTkv@lBooL)WDs#6]et3axJ4gjs5oL)KFvPboQvol#Uq8hf$wjxExwlqOXt31P)pdwc2vPMPfwjGahv[guTs$@SGqb*zppGgH%q:\u003cc2pe\u003eww4gjs5o*?Mcq7$B-oL)KIvNJH{lt64]nk?/ym]R=Ro*JzZltZp2l{Tmgl25XVlt7aExLRlExM=aKlu+\u003exl@v8V4gjs5ok!09xM^(Xk#y6AlqZ3pxj\u003c!5k$J\u003e4pI\u0026KizDot4gC%2\u003clS(-aw=", "ln": 14845, "col": 7, "line": 278 }, { "b": "oFxv-s#6[Zt3axJr.b?qv(420t1hbcvLZ[Mpd3)Nv@td/qfMehr-gR-lpu3wpIJfLz:X2DpdXPl4gjs5vmToIv)\u003elUoFPv*vNJ}kt1ryDvoliuv@td^sU-0VoFxv-s#6[Zt3axJr.b?qv(420t1hbcvLZ[Mpd3)N4gjs5v@lBlnKlGEr-gR:lpbEimTvu(lt6FtxhJ\u003etlp1g!lW8W9sXh^*l0mUSvNjG\u003co*HE6lSm${q+pBOl@uxt4gjs5lW8J@k@qe2k#x{IDuKvhxf{[{lv7s-wnT?WC49p4C$.i(AbEs7", "ln": 17429, "col": 7, "line": 316 } ], "depth": 1, "facts": { "metrics": { "ast": { "max_depth": 69, "call_count": 0, "node_count": 1115, "max_array_len": 10 }, "file": { "size": 21684, "entropy": 6.03 }, "text": { "lines": 379, "top_char": 65, "max_ws_run": 4, "digit_ratio": 0.11, "space_count": 1185, "char_entropy": 6.03, "unique_chars": 82, "top_char_null": 0, "lines_over_200": 2, "string_density": 0.12, "top_char_ratio": 0.03, "avg_line_length": 55.21, "max_line_length": 408, "empty_line_ratio": 0.09, "last_line_length": 27, "whitespace_ratio": 0.09, "identifier_density": 0.09, "line_length_stddev": 32.58, "normalized_string_count": 2.41, "repeated_char_sequences": 8, "suspicious_string_ratio": 0.09, "suspicious_comment_ratio": 1.71, "trailing_whitespace_lines": 9, "normalized_unique_identifiers": 4.2 }, "binary": { "peak_region_bytes": 17588, "peak_region_entropy": 6.02 }, "strings": { "sql": 1, "bytes": 1675, "count": 47, "shell": 3, "url_count": 4, "avg_length": 35.64, "max_length": 841, "avg_entropy": 3.27, "empty_count": 5, "entropy_stddev": 1.01 }, "comments": { "chars": 18027, "count": 282, "empty": 2, "lines": 282, "base64": 249, "hack_count": 2, "high_entropy": 233, "to_code_ratio": 2.91 }, "identifiers": { "count": 36, "unique": 36, "avg_length": 12.67, "max_length": 22, "min_length": 4, "avg_entropy": 3.13, "reuse_ratio": 1, "length_stddev": 4.92, "high_entropy_count": 8, "high_entropy_ratio": 0.22, "all_uppercase_ratio": 0.03 } } }, "id": 3, "mol": "H₂(Cm₄Os)Md₂(Si)", "path": "AWS.Tools.RecycleBin.5.0.302.nupkg!!AWS.Tools.RecycleBin.psd1", "pid": 0, "risk": 6, "sha": "5782ed8ee721212a97d08ff9d738d6717d090ded16dfe367f055fe8d50d54e4b", "size": 21684, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 730, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 858, 0 ], [ 10013, 64 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "spans": [ [ 2284, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 21, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 118, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 123, 0 ] ] }, { "id": "metadata/signed/certificate/identity::powershell-signature-block", "conf": 0.95, "crit": 3, "desc": "PowerShell Authenticode signature block", "spans": [ [ 4676, 29 ] ] }, { "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url", "conf": 0.9, "crit": 3, "desc": "References a public code-forge URL", "spans": [ [ 4409, 19 ] ] }, { "id": "micro-behaviors/communications/http/url/path::image-file-url", "conf": 0.85, "crit": 3, "desc": "HTTP URL targets an image file", "spans": [ [ 4482, 67 ] ] }, { "id": "micro-behaviors/communications/url/encoded::authenticode-script-signature-context", "atk": "T1027", "mbc": "B0032", "conf": 0.98, "crit": 3, "desc": "Authenticode script signature block context", "spans": [ [ 4676, 29 ] ] }, { "id": "micro-behaviors/os/group/membership::privileged-local-group-name", "atk": "T1098", "conf": 0.9, "crit": 3, "desc": "References a privileged local group", "spans": [ [ 862, 14 ] ] }, { "id": "micro-behaviors/communications/http/message::powershell-http-url-literal", "conf": 0.75, "crit": 3, "desc": "PowerShell HTTP/HTTPS URL literal", "spans": [ [ 1088, 29 ], [ 4346, 18 ], [ 4409, 18 ], [ 4482, 37 ] ] }, { "id": "micro-behaviors/communications/url/encoded::encoded-http-url", "atk": "T1027", "mbc": "B0032", "conf": 0.85, "crit": 3, "desc": "Encoded URL decoded to http(s)", "spans": [ [ 6475, 54 ], [ 17493, 48 ] ] }, { "id": "micro-behaviors/communications/url/encoded::http-b64-protocol-fragment", "atk": "T1027", "mbc": "B0032", "conf": 0.6, "crit": 3, "desc": "Base64 HTTP protocol fragment", "spans": [ [ 6357, 9 ] ] }, { "id": "metadata/encoded-payload/base64", "conf": 0.9, "crit": 3, "desc": "Encoded content decoded: base64", "spans": [ [ 5049, 22 ], [ 6545, 49 ], [ 8517, 49 ], [ 10965, 49 ], [ 11101, 49 ], [ 11305, 49 ], [ 13549, 49 ], [ 15045, 49 ] ] }, { "id": "metadata/encoded-payload/base64-base64", "conf": 0.9, "crit": 3, "desc": "Encoded content decoded: base64 → base64", "spans": [ [ 14909, 29 ] ] } ], "type": "powershell" }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47aAzQxazCZol@c-7zeS@@e!5l%bME/A00000p^\u003eu:oAtj}DtNb\u00260000000000?#B@z3JR{Y0jz\u003ec00\u0026M800000m:}zr03zmw0n)", "ln": 0 }, { "b": "3\u0026*nc0003100ic20knBk000000000000000kMy^J00000000000000000000cdz[{00000nb@R\u00260SSx7tT[+]\u003e.Yuu2(\u003c@9000000000000000ma85nFb/MH00000000000000000000000000000000000000009S*V?000cKa{4\u003c{0rr95dL.5N8uo:ABRaPN0v/n{11k8*017gQ6efK?ASu7t0rr9i0W[cJ00T-31$1yh000uk1s%=Z1AbpX015=Q9SMfEc)5A?3m#?]0W]8\u0026019=\u0026000vAaPIGH0Tp4%000uc25+Z^015/jB0H.=3mb=M1%\u003clH3uEJ]019S(000uL0@-xL000vEdf6tPzZ\u003e.!3mYu-c[tn$3u4D}017ba000ucc[UG13mZGac[+M23iyngc[\u003eS33izRg000uO1POJbc\u0026%wG1$yU}c]7=53mW7#DJBfE1s+O%1apjJ00B+)0^+4I00B+}0T0\u0026N000cK9S*V(000cKa{4\u003c{1POJ9dJOUr1][SadK1]@EfGVK1s+C]DJ%JJ1s+O%1apyO00B=z0W]\u00268015^O0@@r7z.}B]3mV2Q6efK?}tZG}0SSij0W[oN00SHB0rras0W]]a019T5000uOhVJ*+3iynS5Dz!n4h5:\u003eh#\u0026{=267NY0b%tD000uT0v\u0026ff000ih0TAT8000ucA:nUBA40^F017n62lDp:000iK0rr9Ib}PYQA++TPAb]j:0c00x000vLz]qRQ1{UhT3JHehz[(tM1{cgX000iP7Y[ZU003%^i@/l/edhJ1WeZhCc{vRh3izQ+000iO5Eev=4fcwj", "ln": 464 }, { "b": "e]@#M00W$b000cK9S^+d000uQ3iI+gB2%y527RBd00B+)0W$$!017g.11BoJlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCnr5KZRbyPQ)Z+#e)l\u003e]X4bu5Y8x(mN8000001ww^}6C*-HbumUx7?iKC5c8Xgbs+:9l\u0026Wh!c$rkSZ:x9Z", "ln": 10540 }, { "b": "wPRoQA=kM7y?lvIzdJYkzdd:ezz1?fzGGPfwDlvOByd{SB8Mhwv}wR+AaG2\u003cwPRoSwPI^jA:@VWD2Nr{l03#-l}Yd1z/Py?B7GD2q!o#)x\u003e7ZLwPI*ezGxv?rafAqwPI^jA:@VUwPI*ezGxv?rC([!xhSqZz/{8gwM08XAbPSnwDkzrB97w\u0026xlcKXA-cE\u0026z/{8gwM08XAbPSnwDk.HwmoN\u003eqGV!!qE%]*z/fSc07g^rvru6UB.\u003eR!wPI*ezGxv", "ln": 26115 }, { "b": "v}xDRl2y4Rz/dg9wN*0}y?k}Ezz1U4wmYMSl03#qrbVX\u003eB1Qv4v%IN2wKp9Ge[w^m08[e:By/p?xjVf(rbVL-zu94jzEWl]y*?B1z/eJ)yH}w-xjVf(pgXV(rbVL-zua-?Byd^OCYV]6yH}w-l03#-l}YdgwN*0}y?k}Ezu8$tvr#\u003cfe(Dm\u003cD1gV4", "ln": 27713 }, { "b": "06%W+e(V+cy\u0026.jbwN*0}y?k}Ezu9l]zdd:ezC\u003e4QD1gV4ltprqA+e($z/bL/wPRoNC$z)%z!0i$x(v\u003e?q*ACawO\u003c4]vqYH^wO(0@Bs]\u003e4Bz(28BzkVh07gghy^zc3q!o#)x\u003e7ZIAaK5#BzkVh0b2\u003e+uRUJ9B-.K[By/G3BzkVh0cqZ[uRUJ9B-.K[By/G3BzkVh0b2\u003e+uRCxFyEr2Tw[+[2A::67z/bL@wPRoMz!0MIz/ff3xlwl6BzkVh08[e:By/qwqE%DRwN/*@z/bLRwNX8Mv}xR3x(v\u003e?l2y4Rz/eG+A=#ebwKQ\u0026NwPh:9z/bL/wPRoJzF\u003c3amr\u0026rNAcb/jzu8$yxlw65zGFr(v}xR3x(v\u003e?xjVf(l$HBHA+PGmx(v\u003e?B7GD2l$D", "ln": 27864 }, { "b": "By/E)e[o0wASv.4v@#Tf07/R7wN/\u003e8z/L?Oq=WsEx\u003c\u003eE!wL3=YA+PAjx\u003e8h:q*ACawO\u003c4/x\u003c\u003eT(z/Z2mv@?SGD2[7sz7X.ezGGPfwIct*ze:i9wPyZXA=#ebwPE\u0026twNY^{xk8l@o(BMNA@Y\u0026:Byd{*y?mU/xjVf(rafAX0cqZ[uSpDDA@Zn)Byd{SB8Mhwv}wRFxla5]wPN", "ln": 28438 }, { "b": "A@Yc:B97#ge(VI8wNPa-zF7O3vrlj906%W+lVM:GwO#Q7vqG#+xjVf(uQF%RA+fcglVM:GwO#Q7vqG#+v@=c\u003ewO#Q7vqG#+l2y4Rz/dg7z*b=kq!P-Uy+w.fx(4?\u003cl3mo/nPXJ:vruj4zB!tPAaK6h0b2\u003e+uQwWNzE=NLA:-/@By/Gl07gWxB97\u0026dBvf\u003eMB8}t5wPRoNvr+WYB9hqvA@Zn)Bye0Qxg(/YA@XNCzF0Q6zaOO-vpKxVs8@1%wLV=IwN//ZxjVf(q!o=Rv@}Y(wPRoTwO+{/Bo2l+B97#ge(2#108MPYzdED]Bo2@+BydQXm}DNHA::63wj7iAy?mX*B7GD2nPNykzE)\u0026%By!#IzdED]Bo2lJA=#ebwKyrBy?mX*rD8FSBy!upnLSfay?k$JwnC?008^xBz*2X\u0026", "ln": 28654 }, { "b": "qugndA@ZaUBPuBZv/Q6udf6wTqVHweyYF2Dv/QPJ07/-Zzua?Wve$9zx-IVzaolM+ve$9zBPt$Maol0NzVB!Taoi$[qVHweyYF2Dv/QPJaoluXve$rFve$cAwDl/LwDl-Je=U{6]h#6i0cFn:0at\u003eF0a=cM0b}{D0cncY0bhBJ0a#oO03?LZ0cFn", "ln": 30122 }, { "b": "BPt$Maol0NzVB!TaoluXve$rFve$cAwDl/LwDl-JaokptwDl=KzVB[WASxOHwDk0@ASx$SaolP=xAh-Dv/Qfxaol9QA@Wr.z2^#AASx\u003ePwDllvaok*IA@Wr.ASxUJAr7aYx-JeNwDllve=W0]nDrSdaok)Kve$uGwDi?MC(R:.BPrJ:vGo%tyYFeH", "ln": 30291 }, { "b": "D1gV4ltprq0d-F#00tI$wdIN8nLSe{B8Mhwv}wRFx956j0U[TRAbY-oBApw]z/](bp\u0026ZF:wPI[[r8[Ebq*ACawO\u003c4]vqYH^wO(0@Bs]\u003e4Bz(28BzkVhe\u003c\u003cL{w[=p5nO@APv@%mAq*ACawO\u003c4]vqYH^wO(0@Bs]\u003e4Bz(28BzkVhefE#8A=U@kzAP^dfFk4ifF1tlB.(exA+dyKwP-9nvqEFqp\u003c3k-x\u003e6!EC#OY$wO%T!f\u003ea-Ji5JQ5whub2wIVgMlVl\u003cOx(X5Zze-][BohBx01w@e0rr911wS(MwDhZX)/rzElT:!EB0bNrwGToQvr#\u003cfaw#=XD1gV4avo^Waxh=ZqE%]/B-H#6ave*}aA8jgA::67z/dfe08%%G2#tIKA::67z/bNQ000yavp@FHB8Mhwv}wRo5l0dRwN/*WwPS6nzD7[2wD", "ln": 39329 }, { "b": "zz1U4wmYNfrafAqwPI^jA:@VUwPI*ezGxwuavf7cq::nhqE%u-v@bZyx(kEAr+lq)x(v(Lg+HEmfFk4gavyo/BAIRnj-j?NBAg/aefE=ivR/:*oj-xFz!\u0026{4jVCzUv\u003e{24fGiP7iaU04g\u003er%O05Ew*zE\u003c@eAV^U+vr#\u003cfe(Dm\u003cD1gV4ltpr\u0026o(BMNy+wW}xhSqZz/{7", "ln": 39692 }, { "b": "AbPSnwQ{aDxLzJgv@k:)wPP59z!i#jzF%RtxjU%(A::63ayPekaA8yAAclmPra]?=B7Gxnx\u003e7Y%A+frhz/fScasItSAaHdTzdd:ezz1*#v%IN2wKp9Ge\u003e{m{wO-$#vp@FHB8Mhwv}wLHB8V5nB7D^yvR3W5wPS6nzE)u3vTf8qAaJJ[w{F9dxcnM", "ln": 39856 }, { "b": "000000000000000000000000000000000000000000000000000000000000000000000000000000315c8Xg7YTL^000000000000000000310rr91fAq960000000000000000003100000nb@R\u0026sL%eV6A!yo00000000006A*k)00341qVHe8rSCL*qufR}nDqJ^p5[S3nDqG=mGui:00000Y-^*600031000f5001RL000f5001RLkl7V-000001onA40SSi2000000000000000l\u0026Wh!0rud2ve$rFmGvc5yYF2DnDrSdw=", "ln": 47056 }, { "b": "00031qVH[tASx!NzuaqHmGvc5yYF2DnDrSdw=M-H002*$00031fAr^bfAr^bfAr{fvGn7Z002m:5c8.hlJz38z2!IPve$fBC(QOtve$cAwDhYg002p+z2^#ADh}\u003c-zu8o?v/QAEz2=9!aoj$kzuaeD002)%6-XmmmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002p+r@=e0e=X\u0026JzVBXQyYFIRe=X=HwDliuC(RsOyYF2Dli7Z1zu6Up001XM2MK(9mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001\u003eRe=WN9e=WWcfAr\u003cd002)%82%WqnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002p+r@=e0e=X\u0026JzVBXQyYFIRe=X=HwDliuC(RsOyYF2Dli7Z1zu8o?wb{ACyYBCn00620lJvb!oAnS7x8(uuyYD*5zVB.RC(R\u003c+x-I=CxAibO002v^zVB.RC(R\u003c+x-I=CxAibOaojXcz2^#ADh}\u003c-zu8o?v/QAEz2=9!aoj$kzuaeDe=W0]zVB!Taol9QBo3vZaok*Iw=MAyx-I@Hx-IMwBo2\u003eLA@W/)aojXcyYFnKaokptx-I=CxAibOA@Wr.qugndA@Y+KASym.wDllve=U\u003eK003g582%Wqpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002p+r@=e0e=X\u0026JzVBXQyYFIRe=X=HwDliuC(RsOyYF2Dli7Z1zu8o?wb{ACyYBCn002)%82%WqpYLIozVBqFBPt[KBo25ove$cAwDhYg002p+r@=e0aokvvzVBXQyYFIRaol0NzVB!TaokjrzVB$YwDl-JqVHFhwDlJDyYBCn004-Nf-RjOpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001\u003eRe=WN9e=WWcfAr\u003cdd/.v9fAr{ff-UU.gYPujgYPohf-TilgxocfgYPlgvGny*h#)K\u003cgxoulw=KQ!wDjQ*hVLYnwb[p-wb[p-hVL-ohVNm^gYQ}:ve@j^fAq7M002aY3ig8bk(+%aA@Y+Kz2!2ByYF.XaokBxwDl-JA@Y[OzVBUP001\u003eRe=WN9e=WWcfAr\u003cde=WN90000000000000000000000000", "ln": 47354 }, { "b": "0000000000000000000000000000000000000000000000000000000000000mgYC3\u0026*ncnhHqD00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", "ln": 48592 }, { "b": "000000000000000000000000000000000000000000000000000000000000S4F5I00ii4fOg{z1{(=lnqu\u003cF0s5X0F?z\u003ckF?zYT0rB[=fBXi)v1}hMwDJ5p0r\u0026DStM$J=1{1\u0026cF\u0026r-i1FwHzoFvm!3m=qY1oB9k0S-/=2)ghdPAH$\u003cFb?nTfBXi)v1}hMwDJ5p0r\u0026DaavhvYFLT[!NVOB4OUgK?tzC$3DRvJJmU]S!G/f:r^X8g9(m^![Z+yuySgTj]0rJrl57e2iD284b?aSBV3yWnnfBXi)dUZGG{ydc73K3I:y+VqK2)HGi1o]Ivrz$Q!fCsS)rrJTx3}a/xx*VDLBrBd)v\u003e!\u0026P7x%$w1pC\u003eOCxXl-wnbW\u003cv}xX5e[n*pf!j}b1{m\u003cd0$#\u003eDx\u003eIcEwPz(nnnhZIavg6\u0026B-H]dv}u=KrV\u003epUz/^9?k}\u003ct@4kGW)f!\u003eErfFCgmfJ]n4gCHQsfGy)Ah90JOs$\u003czu3OR\u003e\u003e162Ed69qfjf+(wQ1{m\u003cd3ki?ox\u003eIcEwPz(nnP52)888\u003ch162Ei6a/wiCp)Auxk7\u003c!A=-{zz/4iLfDQG3rrJyq7^@7Jx*VDLBrBL6B-RUowfs=*z/^9(g+:H.a$%Dg2}yW2Hw8bT0rAu71a*N+05f0a3iC!X0rx)%KAk9(Yx0l\u0026jtm%kx/2a)RZi$qaWbyN/JD8Idw]shT9f@RU6Rav4A6}x]bBF+7vb2vMU^+zVu=2-5Z]-E!=!fl4]KH?O!X8JZmRxa7fKTTUv%bs.M{:}Nqc^#L*H4g5h8\u003c(]9o%hBustV\u0026W\u003eMT)Jy64ars@veZAY?prnT]aZ{\u0026%", "ln": 49104 }, { "b": "1{m\u003cd3kjpyzdd:ezxJ1(vJXPXA=#ebwPGyBnP52\u003cf=8IU1{m\u003cd3LK1Gl}.OzvqYP#rbVX\u003eB1[\u003c)ao?{F1oPqPl2y4Rz/cX0wNV=XwPz%dv}xZjaw3DXe??\u003eTQa^2X2}yW2Hw8bT0rAu71a*Mm05f09IunwgFDhtWEd-Hge(}CPxm)00)Y30ycOHX", "ln": 52834 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 46592, 5.81, "r-x" ], [ ".rsrc", 47104, 1536, 2.66, "r--" ], [ ".reloc", 48640, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 69226, "timestamp": 2825022842, "image_size": 73728, "headers_size": 512, "checksum_valid": 1, "clr.is_il_only": 1, "file_alignment": 512, "resource_count": 1, "cert_table_size": 11944, "has_version_info": 1, "computed_checksum": 69226, "headers_size_ratio": 0.01, "prose_section_count": 0, "reloc_overhang_bytes": 500, "reloc_overhang_ratio": 0.98, "clr.is_32bit_required": 0, "bss_like_section_count": 0, "clr.is_32bit_preferred": 0, "clr.strong_name_signed": 1, "section_overflow_count": 0, "signature_expired_days": -205.93, "clr.is_native_entrypoint": 0, "clr.strong_name_sig_size": 128, "misaligned_section_count": 0, "version.identity_entropy": 4.38, "base_relocation_block_count": 1, "base_relocation_entry_count": 1, "declared_data_directory_count": 7, "version.identity_symbol_ratio": 0.07, "executable_prose_section_count": 0, "directory_section_mismatch_count": 0 }, "file": { "size": 61096, "entropy": 6.24 }, "binary": { "is_pie": 1, "has_overlay": 1, "code_entropy": 5.81, "overlay_size": 11944, "string_count": 489, "overlay_ratio": 0.2, "overlay_entropy": 7.61, "entropy_variance": 5.49, "avg_string_length": 31.15, "max_string_length": 274, "peak_region_bytes": 11944, "code_to_data_ratio": 1, "peak_region_entropy": 7.62, "string_length_stddev": 42.39, "largest_section_ratio": 0.76, "sentence_string_count": 66, "sentence_string_ratio": 0.13, "high_entropy_string_count": 0 }, "imports": { "count": 1 }, "sections": { "count": 3, "code_size": 46592, "entropy_max": 5.81, "entropy_mean": 2.85, "name_entropy": 3.03, "writable_count": 0, "executable_count": 1, "nonstandard_count": 0, "executable_writable_count": 0 }, "consistency": { "internal_name_original_filename_mismatch": 0 }, "dependencies": { "count": 1 } } }, "id": 4, "ident": { "name": { "value": "AWS.Tools.RecycleBin.dll", "source": "pe.version.original_filename", "verified": false }, "title": { "value": "AWS.Tools.RecycleBin", "source": "pe.version.description", "verified": false }, "trust": "ca_signed", "signer": { "issuer": "CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\\, Inc.,C=US", "source": "pe.signatures[0]", "subject": "CN=Amazon Web Services\\, Inc.,OU=SDKs and Tools,O=Amazon Web Services\\, Inc.,L=Seattle,ST=Washington,C=US,SERIALNUMBER=4152954,BUSINESSCATEGORY=Private Organization,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553", "signed_at": "2026-09-18 20:11:05 UTC", "common_name": "Amazon Web Services, Inc.", "organization": "Amazon Web Services, Inc." }, "project": { "value": "AWS Tools for PowerShell", "source": "pe.version.product_name", "verified": false }, "version": { "value": "5.0.302", "source": "pe.version.file_version", "verified": false }, "build_path": { "value": "/codebuild/output/src1381/src/s3/00/aws-tools-for-powershell/modules/AWSPowerShell/Cmdlets/RecycleBin/obj/Release/netstandard2.0/AWS.Tools.RecycleBin.pdb", "source": "pe.debug.pdb.path", "verified": false }, "unique_ids": { "authenticode_thumbprint_sha256": "0e560c4aa37521a6a7ada5b846b3456e996bced7a0be5ccce65efae9346c2a49" }, "organization": { "value": "Amazon Web Services, Inc.", "source": "pe.signatures[0]", "verified": true } }, "mol": "K(Li)H(Po)Md₃(Bi₃PaSi₃)", "path": "AWS.Tools.RecycleBin.5.0.302.nupkg!!AWS.Tools.RecycleBin.dll", "pid": 0, "risk": 10, "sha": "4823f41decdbc3d189c5460e603ee090e6b1a6637cdb1497436bbc366a636d05", "size": 61096, "traits": [ { "id": "metadata/signed/unknown::amazon-web-services-inc.", "conf": 1.0, "crit": 3, "desc": "Authenticode chain CN: Amazon Web Services, Inc." }, { "id": "metadata/signed/leaf::amazon-web-services-inc.", "conf": 1.0, "crit": 3, "desc": "Signed by Amazon Web Services, Inc." }, { "id": "metadata/binary/code/entropy::code-entropy-at-most-7-5", "conf": 0.7, "crit": 2, "desc": "Code entropy is 7.5 or lower", "spans": [ [ 512, 46592 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR header (COM descriptor)" }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET metadata root signature (BSJB)", "spans": [ [ 10588, 0 ] ] }, { "id": "metadata/binary/layout/overlay::image-under-768kb", "conf": 0.9, "crit": 3, "desc": "PE mapped image under 768 KiB" }, { "id": "metadata/binary/layout/size::small-pe", "conf": 0.6, "crit": 3, "desc": "Small PE binary (\u003c100KB)" }, { "id": "metadata/build/reproducible::pe-reproducible-build", "conf": 1.0, "crit": 2, "desc": "Built with /Brepro (deterministic)" }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 39575, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 52882, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 30170, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 78, 0 ] ] }, { "id": "metadata/package/versioning/scheme::pe-companyname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes CompanyName", "spans": [ [ 47418, 11 ] ] }, { "id": "metadata/package/versioning/scheme::pe-filedescription-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes FileDescription", "spans": [ [ 47482, 15 ] ] }, { "id": "metadata/package/versioning/scheme::pe-fileversion-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes FileVersion", "spans": [ [ 47566, 11 ] ] }, { "id": "metadata/package/versioning/scheme::pe-internalname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes InternalName", "spans": [ [ 47614, 12 ] ] }, { "id": "metadata/package/versioning/scheme::pe-productversion-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes ProductVersion", "spans": [ [ 48046, 14 ] ] }, { "id": "metadata/package/versioning/scheme::pe-productversion-semver-git-hash", "conf": 0.9, "crit": 3, "desc": "PE ProductVersion has SemVer git hash", "spans": [ [ 48076, 48 ] ] }, { "id": "metadata/package/versioning/scheme::pe-version-file-version-value", "conf": 0.9, "crit": 3, "desc": "PE version resource carries a file version", "spans": [ [ 47592, 7 ] ] }, { "id": "metadata/package/versioning/scheme::pe-version-product-name-value", "conf": 0.9, "crit": 3, "desc": "PE version resource names a product", "spans": [ [ 47988, 24 ] ] }, { "id": "metadata/package/versioning/scheme::pe-version-resource", "conf": 0.8, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 47198, 0 ] ] }, { "id": "metadata/package/versioning/scheme::version-info-file-version-present", "conf": 0.95, "crit": 3, "desc": "PE FileVersion value is present", "spans": [ [ 47592, 7 ] ] }, { "id": "metadata/signed/certificate/identity::pe-signature-verified", "conf": 1.0, "crit": 2, "desc": "PE Authenticode integrity check reports intact" }, { "id": "metadata/signed/certificate/identity::pe-signature-verified-kv", "conf": 1.0, "crit": 2, "desc": "PE Authenticode signer cryptography verifies" }, { "id": "metadata/signed/trust-level::dotnet-strong-name-signed", "conf": 0.95, "crit": 3, "desc": "Managed assembly is strong-name signed" }, { "id": "micro-behaviors/process/interpreter/powershell/host::sma-namespace", "atk": "T1059.001", "mbc": "E1059", "conf": 0.85, "crit": 3, "desc": "System.Management.Automation import", "spans": [ [ 27928, 28 ], [ 39393, 128 ] ] }, { "id": "well-known/lib/cloud/aws-sdk-dotnet::aws-sdk-dotnet-core", "conf": 1.0, "crit": 3, "desc": "AWS SDK for .NET Core assembly", "spans": [ [ 26179, 11 ] ] }, { "id": "metadata/binary/provenance/build::pe-far-future-timestamp", "conf": 0.95, "crit": 3, "desc": "PE COFF timestamp encodes a future date" }, { "id": "metadata/binary/symbols/imports::single-import-count", "conf": 0.7, "crit": 3, "desc": "PE with single import" }, { "id": "metadata/package/versioning/scheme::pe-productname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes ProductName", "spans": [ [ 47962, 11 ] ] }, { "id": "objectives/supply-chain/credential-theft/registry::credentials-file-basename-marker", "atk": "T1552.001", "conf": 0.4, "crit": 3, "desc": "Credentials filename marker", "spans": [ [ 28718, 11 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET managed assembly", "uses": [ 3, 4 ], "spans": [ [ 10588, 0 ] ] }, { "id": "metadata/signed/trust-level::signer-evidence-present", "conf": 1.0, "crit": 3, "desc": "Platform or developer signing evidence", "uses": [ 22, 23 ] } ], "type": "pe" }, { "ctx": [ { "b": "[4lsVaw#=XD1gV4ltprD3jNthCYmOwBs*j9wozZ1o\u003ewfJwPw[Bl2pmzB08}w3l{V(nK\u003c)FavoTLx(k5mx\u003eIr(BAIRnayYe9v}#IXboPYLnP/bvsXqt9t1JyJv[]r!v)+fanP!#KlQKK!mmfvrmr?jDk#6:Vy?EA%xf]^0o*}uXmmGNhln.8xz/Mo]boPr=mmxHBnI-UBmmzb+B9z4(k}\u003eSrz/OfSmmxHBnI-UBmp/gXsWLG0ml%j9qbG\u003ezCq\u0026U]y!Nh+hzW%2oH/K0boPSYh*OF3nKtZenKtZenKtZenKtZenKtZhl3M9\u0026fH[GilQ$6vmR\u003ewmqa0SDry5@sl1\u0026XUf\u003e0)CpIA\u003cBw]Xs/boRg@zb1XMh+#t2CwR2ozFAW3Dt+JdB-Id#A8[/7lQKo)z*b\u0026bsv2UMnKWR(k$11KmmfvOk#omAC1VyFC32gXboOHif?(q6mn4Gps:iUbfH[GeAyS@0vLZzHmm6v=ry6tHCx=G3k$TERpf6XEsYvX6r-z^\u003erD*(QsWVp/qa?u9boPB0CTV4xwn\u003ey3r^wjylp$Z7o)xfcl0cD^pf6XEB5UO0whv+wheuS4wn\u003eWbr^wjyhelOQfNclpl2Ye6pf4/hboPrso\u0026KY1qGb!{y^.Den?-?9xMdcgxj\u003e7zpi{CMn[.WJphAG\u003cr-.\u003cZn{jV1qd\u0026-Wmr.pov[]:knQ0)dms2yIboPYGl3D3\u003el3Dyzv[]:Amr?Kak@zwKo!/Byrw^\u0026)ltod\u003eB9x#GsWVp/qaB60n(!@r", "ln": 0, "col": 1, "line": 1 }, { "b": "n(nCWo*JX/lQL]+k#ySKlu=c(o?mlllQL]+k#ySKlu+\u003c+lp:*{v]L:f4gjs5lt6}Klt5.Rlq.lpl0mt[vmToIv)\u003elUoFORyv(3z[t1ryDvoliuv@td^sU-0Vo*@?/lQL]+k#ySKlv7{+4gjs5xLGnuwjPQxpIz!isU-DYt3axJv%G}Evol#UsU:36wj5j?vLPSXqB+Lvvo36sv@tgovol#TqclOtwlqDq4gjs5vR[\u003eRqDu$1vLP}$q7$BYsU\u0026V7o*%a[k}#wInoW%2o*}S$qa\u003ch9z:X\u003evpI\u003c=0wjP0AoNeTkv@lBooL)WD4gjs5s#6]et3axJoL)KFvPboQvol#Uq8hf$wjpfJs#6+Tv(3\u003emv@jXTsU:2Er+$xKvLZ[IqbYt!v@lBlni{xD4gjs5r-gR:lpaW@ms4l\u003clt6tpxhJ\u003etl3+**lt6FtxhJ\u003etlp14:l@v8Vok!09xM^(Xk#y6AlqZ3pxj\u003cU1k$as?4gjs5Az/sYm0ID$wN/K)vq^}/h/Jy#A7%!Rl@lJ\u003cB7F(]s./W0yCxPWDh", "ln": 1666, "col": 23, "line": 28 }, { "b": "v)\u003elUoFORyv(3z[t1ryDvoliuv@td^sU-0Vo*}GvlQL]+k#ySKlv7{+xLHN^wjPQxpIz!isU-DY4gjs5t3axJv%G}Evol#UsU:36wj5j?vLPSXqB+Lvvo36sv@tgAv@ts[wjGWorC::twjo#ZoL)KIwje:Llt64]4gjs5nk.Aop^^Pco*\u0026Ydph@MNxLHdTwjPQxpIz!isU\u0026V\u003eo)FQivol#UsU:36wj5j?vLPSXqB+Lvvo36sv@tgA4gjs5v@ts[wjGWorC::twjo#ZoL)KIvNJH(lt64]nk?/ymPqVMo*JnVli", "ln": 3826, "col": 7, "line": 60 }, { "b": "v@tE?sU:37oHzcsvR[?Zo\u0026tFBmP0qRr-8Z/4gjs5mrZQ*qBLXNnK(l)t0\u003eRRvLP@+v%QNTo*.ipk}#wdl3MacqcbF=wO\u003cCInK^lbs.Qi4t3axLvoliuv%Joh4gjs5q=+?\u003eoLM{Zl19uel@v8Vok!09xM^(Xk#y6qlqZ3pxj\u003c.hk$17cl0na[xj\u003c.3k$:HDw(8M8m0QT\u003e", "ln": 5354, "col": 39, "line": 82 }, { "b": "lt64]nk\u0026ISl{%sllt6}Klt5.Rlq.kXl3+)+BwVger-gR-lp\u003cW?o?v\u0026{o?4]\u003erBFi\u003cxLPtvwjPQx4gjs5pIz!isU\u0026V\u003eo)FQivol#UsU:36wj5j?vLPSXqB+Lvvo36sv@tgAv@ts[wjGWoqHhkevLQ?$rwFxdvR]}74gjs5s$@SGqb*zppGgH%q:\u003cc3pEF69o*?M$q7$B-oL)KIvNJKZz:)lfr5v=NvmToIv)\u003elUoFPv*vNK7ot1ryD4gjs5voliuv@td^sU-0VoFxv-s#6[Zt3axJr.b?qv(420t18{Pq8gdEt2[yqs#4%OvR]TOrwl\u0026}o*\u0026+Lrwn8M4gjs5o)QCao\u003e($to\u0026T}Po\u0026A]:v@lBlxiFe5lQL]+k#ySKlu+\u003c+lp\u003cWro?v\u0026zo*.=FlQL]+k#ySKlv7{:xLq6$4gjs5wjPQxpIz!ivLQY8v)-a?vol#UsU:36wj5j?vLPSYsv37YolTJ9lqZ-No*IAxryZZRwjP0AoNeTksYXvm4gjs5v@tg\u003coL)WDs#6]et3axJoL)KFvPboQvol#Uq8hf$wjxExwlqOXt31P)pdm{3t1qQ)vol#Zvoks7rCUz%4gjs5pddx9phAV%qb*mDpddV$o\u003e)c=qb/#bsU\u0026V7o*JL+k}#wImr.P@o*I6?l@v8Vok!09xM^(Xk#y6AlqZ3p4gjs5xj\u003c!5k$L6yyhe0dAb5#Bfk$5\u0026D01Pcq!]MMh!(A9p?rZszfm:dA@", "ln": 6274, "col": 7, "line": 96 }, { "b": "k}#wdltf7Xr-R}tmTvv3lt64]lp2J?l#bXts#6[Zt3axJoHzcsvR[?Zo\u0026TSap\u003cl5gr-8ZZms5So4gjs5vol#Uq8hf$wj5W-v@ts[wjGWonKWbynK=P%vPMPfwjGahv[guTt6SCkrwl\u0026}o*\u0026+LnK=DDqb*awph91t4gjs5o*?McnKVxvo\u0026Kz\u0026mT3Liphi6Ko*\u002609o*?o\u003eo*?rRmT3Ljpi]uNo*?\u003c7o)P!%pe(4ro?d{5lWz3\u003clt64]4gjs5lp1:Nl2oO3o\u0026tFBmP0qRr-8Z!mrZQTvol#Uq8hf$wj7MNq=+?\u003eoA", "ln": 8858, "col": 7, "line": 134 }, { "b": "v@td^sU-0Vo?3*blQL]+k#ySKlv7{+xLZdRwjPQxpIz!isU-DYt3axJv%G}Evol#UsU:36wj5j?4gjs5vLPSXqB+Lvvo36sv@tgAv@ts[wjGWoqHhkvvokg1rwNJ^vPU%ovR]TOrwl\u0026}o*\u0026+Lrwn8Mo\u003e)V-o\u003e($t4gjs5pe$4Qo\u0026A]:v@td/sA^[or-gR-lpLQir+:%3z:)xjry{v\u0026vmToIv)\u003elUoFPv*vNJ}kt1ryDvoliuv@td^4gjs5sU-0VoFxv-s#6[Zt3axJr.b?qv/", "ln": 10218, "col": 7, "line": 154 }, { "b": "qB+Lvvo36sv@tgAv@ts[wjGWorC::twjo#ZoL)KIwje:Llt64]nk.Aop^^Pco*\u0026Ydph@MNxLHdT4gjs5wjPQxpIz!isU\u0026V\u003eo)FQivol#UsU:36wj5j?vLPSXqB+Lvvo36sv@tgAv@ts[wjGWorC::twjo#ZoL)KI4gjs5vNJH{lt64]nk?/ym]R=Ro*JzZltZp2l{Tmgl25XVlt7aExLRlExM=aKlu+\u003exl@v8Vok!09xM^(Xk#y6A4gjs5lqZ3pxj\u003c!5k%/fVd%LF*nkIclp/o+rv]L/QC4U$\u0026Bw#gQw\u0026IOzxA", "ln": 12802, "col": 7, "line": 192 }, { "b": "heuS4wn\u003eWbr^wjyhelOQfM{t:y\u0026iVYphBATqBj\u003eHpbcl}r+\u003eSlqD43Wiwsq:mrI-?n?-$dryYtfrB=KCboPK3q7CveCxV\u00265k@rHFvmK6.xFr%/k@IzZiCJ5vCx#@1qGb!{y?^cQn?-}QpiH8BiyNvTwn\u003ey3r^wjAmTtHJboQFLr^v\u003eIqC6?Rn{jV1qBBwXhelSrCxVFMsWVp*fLrZrz*aMpk$smOqDus!k%XjhfH[GeAyS@0vLZzHmm4B\u003cboPxury5]cnKtZulu^uwiyD$ssz*]7d}-=RqdrvhsYWshwIm8dwJsQED1W", "ln": 15180, "col": 5, "line": 227 } ], "depth": 1, "facts": { "imp": [ [ "", "Export-ModuleMember" ] ], "tgt": [ "Export-ModuleMember" ], "metrics": { "ast": { "max_depth": 7, "call_count": 1, "node_count": 266 }, "file": { "size": 17057, "entropy": 6.01 }, "text": { "lines": 255, "top_char": 65, "max_ws_run": 1, "digit_ratio": 0.12, "space_count": 263, "char_entropy": 6.01, "unique_chars": 74, "top_char_null": 0, "top_char_ratio": 0.04, "avg_line_length": 64.89, "max_line_length": 66, "non_ascii_ratio": 0, "empty_line_ratio": 0, "last_line_length": 27, "whitespace_ratio": 0.05, "identifier_density": 0.01, "line_length_stddev": 7.32, "suspicious_comment_ratio": 1.9, "normalized_unique_identifiers": 0.25 }, "binary": { "peak_region_bytes": 17057, "peak_region_entropy": 6.01 }, "comments": { "chars": 16516, "count": 253, "lines": 253, "base64": 249, "hack_count": 2, "high_entropy": 231, "to_code_ratio": 126.5 }, "identifiers": { "count": 2, "unique": 2, "avg_length": 10, "max_length": 19, "min_length": 1, "avg_entropy": 1.84, "reuse_ratio": 1, "length_stddev": 9, "single_char_count": 1, "single_char_ratio": 0.5, "high_entropy_count": 1, "high_entropy_ratio": 0.5 } } }, "id": 7, "mol": "O(As)H(Cm)Md₃(Si)", "path": "AWS.Tools.RecycleBin.5.0.302.nupkg!!AWS.Tools.RecycleBin.Aliases.psm1", "pid": 0, "risk": 6, "sha": "2bd8be8820fbcb76c09700f5dd49cdb7bb53821d3b718c6cd1cadae80c2be576", "size": 17057, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 5386, 64 ] ] }, { "id": "metadata/signed/certificate/identity::powershell-signature-block", "conf": 0.95, "crit": 3, "desc": "PowerShell Authenticode signature block", "spans": [ [ 49, 29 ] ] }, { "id": "micro-behaviors/communications/url/encoded::authenticode-script-signature-context", "atk": "T1027", "mbc": "B0032", "conf": 0.98, "crit": 3, "desc": "Authenticode script signature block context", "spans": [ [ 49, 29 ] ] }, { "id": "metadata/file/naming::high-entropy-identifier-ratio", "conf": 0.85, "crit": 3, "desc": "High ratio of entropy-heavy identifiers" }, { "id": "micro-behaviors/communications/url/encoded::encoded-http-url", "atk": "T1027", "mbc": "B0032", "conf": 0.85, "crit": 3, "desc": "Encoded URL decoded to http(s)", "spans": [ [ 1848, 54 ], [ 15244, 54 ] ] }, { "id": "micro-behaviors/communications/url/encoded::http-b64-protocol-fragment", "atk": "T1027", "mbc": "B0032", "conf": 0.6, "crit": 3, "desc": "Base64 HTTP protocol fragment", "spans": [ [ 1730, 9 ] ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/identifiers::many-high-entropy-identifiers", "atk": "T1027", "mbc": "B0032", "conf": 0.7, "crit": 3, "desc": "Many random-looking source identifier names" }, { "id": "objectives/anti-static/obfuscation/code-metrics/identifiers::identifier-obfuscation", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Identifier obfuscation (random/encoded names)", "uses": [ 3, 6 ] }, { "id": "metadata/encoded-payload/base64", "conf": 0.9, "crit": 3, "desc": "Encoded content decoded: base64", "spans": [ [ 422, 22 ], [ 1918, 49 ], [ 3890, 49 ], [ 6338, 49 ], [ 6474, 49 ], [ 6678, 49 ], [ 8922, 49 ], [ 12866, 49 ] ] }, { "id": "metadata/encoded-payload/base64-base64", "conf": 0.9, "crit": 3, "desc": "Encoded content decoded: base64 → base64", "spans": [ [ 10282, 29 ] ] } ], "type": "powershell" }, { "ctx": [ { "b": "boPo{Bz\u0026:zwO#71vru6\u003eayPq6B.$YcBrC7ize:r5By/GlazbLjaAg+fvqPN$wPz\u0026mz!pa\u003cl}XT\u0026z/fSrvqZfOy*?yaeO5Bkx)a5#aAR)FwGVbpwN(]$zxJCawnC?0B1N[eboPx)az#ataz(4cx\u003ezSkBzbxfazbt7wJI2GBrCBeC{3NcaA8BmA^8LrBAz8iay]Rnx(mMaC4CYnx(v(iB-p#lvpS}\u003ce!5c%3m6Oio\u003c}^PA-M:(B7]MgauZ?)p/yzaA=U@kzD74Ny?kj}q=WEIB7]Mge\u003e]+?z/Mo]x\u003ewFobYE*0vqo.3r+lq)x(v(ieOe]AgassP3vr)83jf^Ox()]rr+lqXz/YFjb1cY]vqPZ*ayPq6B.$YcBrC7ize:r5BzkVhaz#ataAIWAAbP=swN(]$zxI+]Cv+![xK#0@aA?spB7]MgatM23B8bGe", "ln": 0, "col": 1, "line": 1 }, { "b": "h7*N9z/M$lx\u003eI9\u003cAXnF7z/M$pz*b=k4gjs5C4CYnx(v(uaA}xtv{%l$B-RapBzbkdC4CYnx(v(ix(k5nxK@q=vpzVIAa9T9x(v(td\u003ceXEwozZ1azCBgx(n0lvqG:\u003ewg!q#bYWEex(!xpvruj4zBnnKy?mYOC4293vpB4:auZ?}bYE*0vqo.3r+lq)x(v(ieOwSqh7oU1pJvN3c[4O%Bs/\u003c#zeAZ0wfs=Yxk8BewPxv*A+xJiwO#PSz/6DfwPRH7at4ekaw3i-z/Pzrat4eAas7\u0026Ey?$Kf3jNs!azC.nwPzV%yY", "ln": 453, "col": 74, "line": 11 }, { "b": "v@k:)wPP5kAV/jczFs6jy*?B1z/c0\u003eboQ]paARpdaA8jvx(v)gaAR43y?j4.w{503BzkVhaywM3B3T?VB.$YcBvf$-Abo9cwPyWWxk8BeA::67z/c%L4gmB\u003e3lQDlaAg+fvqMCXarR^Hc\u003ecIaarR^HarR!hB7ol8AcbM9z!0M*bY^Eox(FeXy\u0026r*0edz}earR^HarR!hxKL%}BywS{wNcN2vrb^[gdb[?y?mZfo\u003c}#I3lQDlasN:b4gjj2arUxgasFHQwD", "ln": 745, "col": 62, "line": 15 }, { "b": "B4{7Zto[e@A:-/WvqPNY4gjj2arR^HarR^HarUxgasFHBzdED]BwumYwPF$Cl2HiQbX7X4y?mY-vqPN%e\u003e/?]xlm/feOxeFfEWCrarR^HarR^HarR^HDKQr8arR^HarR^HarR^HarR^Lvrc14toVBMzeAZ0wfLq4jS(1WzdED]BwumYwPFp/arR^", "ln": 1226, "col": 41, "line": 34 }, { "b": "3lQDlarR^HarR^HarR^HaBsL8arR^HarR^HarR^HarR^HarR^HbXz4lauZ?\u0026txs[bx(mM?iYYSDzEW9%c)SquefDb$a$K\u0026ZAa9=}zbaIRwHO5}arR^HarR^HarR^HarR^HarR^HbXH}ivQT7lz/x/jz/fS2cQS2$Bz(1ZA+xJiwO#PSz/6DfwPRH7B0\u003el$bXv", "ln": 1847, "col": 47, "line": 53 }, { "b": "wPw]9B-7Yhx(v(iv}YB-yJyRpzxJCczeAZ0wft+#zdK\u00261z/f5[By/t#By!#9CwhejaAg+fvqPN$wPw]hvqPNd4gjs5l1BIuBzkVhvqG+9efG4FwGV5ovqYQ:A+3q5z!9A4Aa9\u003cgwPzVhw]zYjv@Dj6y?mZ1A=SvqB0bNyaAh4lwGV8dA=l8kxDN-\u003e", "ln": 2486, "col": 15, "line": 70 }, { "b": "z/6DfwPRGmas7DnzeAZ0wi\u003eoUefDiIvqxBvz/]@dp*[xMzdN*2AW.C84gjj2arR}tzdED]Bx0K8wGTbUnP5Y\u0026yH]7^CYmXmB8#5lzxHccl2y4Rz/dg7z*b=kq!P-Uy+w7(wnC?0B1QuSnLQ(-c)SqvzeAZ0wklMIwIc\u003e(Abn@)wHF]TcOcw/cN*GizdED]Bx{713lQDlazCBgc[PsPBrz\u0026szdED]Bx0K8wHO:G4gjj2arR^HarUYoBAIRw4gjj2arV7w3i", "ln": 4662, "col": 49, "line": 139 }, { "b": "ze:r5By/F\u003cwOkZ#BAg/ix(v(ibVl%2pg3}hy?m9#lVl*Xy?mZ1A=SuGqBi@IuSgJLwN/*Rvq(U.4giKKboP]Rm\u003c630ls\u003c!zzxK1mxkRd1B-I4ovR/%)yyHQ}awCB0B-Y]Ln\u003eT8anOAoSpc?-!lVkK/B-pqElRIF*lQsNrCTM\u003czpc@Pfxj#6[lrWkXml$MPmNoBeh9$}]AT-v2avoZfml$6FgEkUxmq\u003eXqCvsDpfHxz\u003cAZBzcml$6FgEkUxwLCJ{lQt]+k%W!lqaJV\u003ch^5Q^oHzlbgFgzom?2!Iawk/}Dr0*llp0[elp0[elp0[elp0[elp119CUHETm)*uBm]IYyy^AnxlQsNHk%^}9l[Zn$sxdd#pdX(uvHSU?az$:UlSwnjm)RkIl]F1voK@Abt24)!l3cNjz7x3ZlQ-IzCv$L\u003ck$%{xmr7%^l{UDOlQtxKp+Vv4oj.gFspCPZas*hwo\u003eOPqokOSJCUHETm)*i{m]I#*gEL8elpk@%k$%\u003c[CTD^yn\u003cWe=rZG8Pr6+t3r83m\u003cCsuZUl@)eZoaqjMavQH0mpxndA8ww\u003eD1ooen[8TiCT\u003e.0svcT}rZG8[r7ft*gH$+*yHHpPA9j}%D1oo1ygn}LCUruGA6!hjrT/xXavnv*r7Q\u003e6A9t2kl%rX+fIaYDA9t2fxhI=aDsQbIxKU*Ny!m5@s4L\u003eNC49m8xhHuKCsVySpebE{Cth49DjpiaawCl\u0026CtgE\u003eCunD/pec46CUId6hbd*Wf\u00267+GhcjJVx?.DCCsbkgl@)eZm[4R]r-KDmr.U[Pm)O\u003efmmg-.o:}BOaw$ZCzEDKuy?4uWxh.\u003e?ye4PwCsD^Vl@)eZoHTg)gH@pKBY}pKzEDQwy?4uWBY*EWBwkX5CsV{Xl@)eZl\u003e6FFavQJ*mpxndA8ww\u003eD1ooerBY]EDsPJDyE{#/C49m8xhT4MCv$LWx?Z(Em)*i{m]I#*gEL8elp1EGk%Wt0lK:wEavHAtCv$LW", "ln": 6992, "col": 15, "line": 198 }, { "b": "n(nCWo*JX/lQL]+k#ySKlu=c(o?mlllQL]+k#ySKlu+\u003c+lp:*{v]L:f4gjs5lt6}Klt5.Rlq.lpl0mt[vmToIv)\u003elUoFORyv(3z[t1ryDvoliuv@td^sU-0Vo*@?/lQL]+k#ySKlv7{+4gjs5xLGnuwjPQxpIz!isU-DYt3axJv%G}Evol#UsU:36wj5j?vLPSXqB+Lvvo36sv@tgovol#TqclOtwlqDq4gjs5vR[\u003eRqDu$1vLP}$q7$BYsU\u0026V7o*%a[k}#wInoW%2o*}S$qa\u003ch9z:X\u003evpI\u003c=0wjP0AoNeTkv@lBooL)WD4gjs5s#6]et3axJoL)KFvPboQvol#Uq8hf$wjpfJs#6+Tv(3\u003emv@jXTsU:2Er+$xKvLZ[IqbYt!v@lBlni{xD4gjs5r-gR:lpaW@ms4l\u003clt6tpxhJ\u003etl3+**lt6FtxhJ\u003etlp14:l@v8Vok!09xM^(Xk#y6AlqZ3pxj\u003cU1k$as?4gjs5Az/sYm0ID$wN/K)vq^}/h/Jy#A7%!Rl@lJ\u003cB7F(]s./W0yCxPWDh", "ln": 8673, "col": 23, "line": 225 }, { "b": "v)\u003elUoFORyv(3z[t1ryDvoliuv@td^sU-0Vo*}GvlQL]+k#ySKlv7{+xLHN^wjPQxpIz!isU-DY4gjs5t3axJv%G}Evol#UsU:36wj5j?vLPSXqB+Lvvo36sv@tgAv@ts[wjGWorC::twjo#ZoL)KIwje:Llt64]4gjs5nk.Aop^^Pco*\u0026Ydph@MNxLHdTwjPQxpIz!isU\u0026V\u003eo)FQivol#UsU:36wj5j?vLPSXqB+Lvvo36sv@tgA4gjs5v@ts[wjGWorC::twjo#ZoL)KIvNJH(lt64]nk?/ymPqVMo*JnVli", "ln": 10833, "col": 7, "line": 257 }, { "b": "vPM2SvLP=MrX^Y\u0026nK=D\u003ev@tE?sU:37oHzcsvR[?Zo\u0026tFBmP0qRr-8Z/4gjs5mrZQ*qBLXNnK(l)t0\u003eRRvLP@+v%QNTo*.ipk}#wdl3MacqcbF=wO\u003cCInK^lbs.Qi4t3axLvoliuv%Joh4gjs5q=+?\u003eoLM{Zl19uel@v8Vok!09xM^(Xk#y6qlqZ3pxj\u003c.hk$17cl0na[xj\u003c.3k$:HDw(8M8m0QT\u003eh-AQi4gjs5xeSQ@h/SZ(hb!1dy^Z]?CxL]4fMg2K", "ln": 12345, "col": 23, "line": 279 }, { "b": "lt64]nk\u0026ISl{%sllt6}Klt5.Rlq.kXl3+)+BwVger-gR-lp\u003cW?o?v\u0026{o?4]\u003erBFi\u003cxLPtvwjPQx4gjs5pIz!isU\u0026V\u003eo)FQivol#UsU:36wj5j?vLPSXqB+Lvvo36sv@tgAv@ts[wjGWoqHhkevLQ?$rwFxdvR]}74gjs5s$@SGqb*zppGgH%q:\u003cc3pEF69o*?M$q7$B-oL)KIvNJKZz:)lfr5v=NvmToIv)\u003elUoFPv*vNK7ot1ryD4gjs5voliuv@td^sU-0VoFxv-s#6[Zt3axJr.b?qv(420t18{Pq8gdEt2[yqs#4%OvR]TOrwl\u0026}o*\u0026+Lrwn8M4gjs5o)QCao\u003e($to\u0026T}Po\u0026A]:v@lBlxiFe5lQL]+k#ySKlu+\u003c+lp\u003cWro?v\u0026zo*.=FlQL]+k#ySKlv7{:xLq6$4gjs5wjPQxpIz!ivLQY8v)-a?vol#UsU:36wj5j?vLPSYsv37YolTJ9lqZ-No*IAxryZZRwjP0AoNeTksYXvm4gjs5v@tg\u003coL)WDs#6]et3axJoL)KFvPboQvol#Uq8hf$wjxExwlqOXt31P)pdm{3t1qQ)vol#Zvoks7rCUz%4gjs5pddx9phAV%qb*mDpddV$o\u003e)c=qb/#bsU\u0026V7o*JL+k}#wImr.P@o*I6?l@v8Vok!09xM^(Xk#y6AlqZ3p4gjs5xj\u003c!5k$L6yyhe0dAb5#Bfk$5\u0026D01Pcq!]MMh!(A9p?rZszfm:dA@", "ln": 13281, "col": 7, "line": 293 }, { "b": "k}#wdltf7Xr-R}tmTvv3lt64]lp2J?l#bXts#6[Zt3axJoHzcsvR[?Zo\u0026TSap\u003cl5gr-8ZZms5So4gjs5vol#Uq8hf$wj5W-v@ts[wjGWonKWbynK=P%vPMPfwjGahv[guTt6SCkrwl\u0026}o*\u0026+LnK=DDqb*awph91t4gjs5o*?McnKVxvo\u0026Kz\u0026mT3Liphi6Ko*\u002609o*?o\u003eo*?rRmT3Ljpi]uNo*?\u003c7o)P!%pe(4ro?d{5lWz3\u003clt64]4gjs5lp1:Nl2oO3o\u0026tFBmP0qRr-8Z!mrZQTvol#Uq8hf$wj7MNq=+?\u003eoA", "ln": 15865, "col": 7, "line": 331 }, { "b": "v@td^sU-0Vo?3*blQL]+k#ySKlv7{+xLZdRwjPQxpIz!isU-DYt3axJv%G}Evol#UsU:36wj5j?4gjs5vLPSXqB+Lvvo36sv@tgAv@ts[wjGWoqHhkvvokg1rwNJ^vPU%ovR]TOrwl\u0026}o*\u0026+Lrwn8Mo\u003e)V-o\u003e($t4gjs5pe$4Qo\u0026A]:v@td/sA^[or-gR-lpLQir+:%3z:)xjry{v\u0026vmToIv)\u003elUoFPv*vNJ}kt1ryDvoliuv@td^4gjs5sU-0VoFxv-s#6[Zt3axJr.b?qv/", "ln": 17225, "col": 7, "line": 351 }, { "b": "qB+Lvvo36sv@tgAv@ts[wjGWorC::twjo#ZoL)KIwje:Llt64]nk.Aop^^Pco*\u0026Ydph@MNxLHdT4gjs5wjPQxpIz!isU\u0026V\u003eo)FQivol#UsU:36wj5j?vLPSXqB+Lvvo36sv@tgAv@ts[wjGWorC::twjo#ZoL)KI4gjs5vNJH{lt64]nk?/ym]R=Ro*JzZltZp2l{Tmgl25XVlt7aExLRlExM=aKlu+\u003exl@v8Vok!09xM^(Xk#y6A4gjs5lqZ3pxj\u003c!5k%/fVd%LF*nkIclp/o+rv]L/QC4U$\u0026Bw#gQw\u0026IOzxA", "ln": 19809, "col": 7, "line": 389 }, { "b": "heuS4wn\u003eWbr^wjyhelOQfM{t:y\u0026iVYphBATqBj\u003eHpbcl}r+\u003eSlqD43Wiwsq:mrI-?n?-$dryYtfrB=KCboPK3q7CveCxV\u00265k@rHFvmK6.xFr%/k@IzZiCJ5vCx#@1qGb!{y?^cQn?-}QpiH8BiyNvTwn\u003ey3r^wjAmTtHJboQFLr^v\u003eIqC6?Rn{jV1qBBwXhelSrCxVFMsWVp*fLrZrz*aMpk$smOqDus!k%XjhfH[GeAyS@0vLZzHmm4B\u003cboPxury5]cnKtZulu^uwiyD$ssz*]7d}-=RqdrvhsYWshwIm8dwJsQED1W", "ln": 22187, "col": 5, "line": 424 } ], "depth": 1, "facts": { "imp": [ [ "", "Write-Verbose" ], [ "", "Get-Command" ], [ "", "Register-ArgumentCompleter" ], [ "", "Where-Object" ], [ "", "ForEach-Object" ], [ "", "New-Object" ], [ "", "_awsArgumentCompleterRegistration" ], [ "", "Invoke-Expression" ], [ "", "Select-Object" ], [ "", "ForEach-Object" ], [ "", "Where-Object" ], [ "", "Sort-Object" ], [ "", "ForEach-Object" ], [ "", "Where-Object" ], [ "", "Select-Object" ], [ "", "Sort-Object" ], [ "", "ForEach-Object" ], [ "", "Where-Object" ], [ "", "ForEach-Object" ], [ "", "New-Object" ], [ "", "_awsArgumentCompleterRegistration" ] ], "tgt": [ "ForEach-Object", "Get-Command", "Invoke-Expression", "New-Object", "Register-ArgumentCompleter", "Select-Object", "Sort-Object", "Where-Object", "Write-Verbose", "_awsArgumentCompleterRegistration" ], "funcs": [ [ "anonymous", 793 ] ], "metrics": { "ast": { "max_depth": 67, "call_count": 21, "node_count": 3523, "max_array_len": 10 }, "file": { "size": 24064, "entropy": 6.04 }, "text": { "lines": 452, "top_char": 101, "tab_count": 2, "max_ws_run": 2, "digit_ratio": 0.1, "space_count": 1871, "char_entropy": 6.04, "mixed_indent": 1, "unique_chars": 92, "top_char_null": 0, "lines_over_200": 1, "string_density": 0.15, "top_char_ratio": 0.03, "avg_line_length": 51.24, "max_line_length": 218, "empty_line_ratio": 0.07, "last_line_length": 27, "whitespace_ratio": 0.12, "identifier_density": 0.41, "line_length_stddev": 29.1, "encoded_string_ratio": 0.03, "normalized_string_count": 3.1, "repeated_char_sequences": 49, "suspicious_string_ratio": 0.11, "suspicious_comment_ratio": 1.82, "trailing_whitespace_lines": 6, "normalized_unique_identifiers": 7.26 }, "binary": { "peak_region_bytes": 16896, "peak_region_entropy": 6.01 }, "source": { "function_count": 1 }, "strings": { "bytes": 1287, "count": 66, "shell": 5, "avg_length": 19.5, "max_length": 94, "avg_entropy": 3.19, "entropy_stddev": 0.89, "base64_candidates": 2, "embedded_code_candidates": 2 }, "comments": { "chars": 17487, "count": 268, "lines": 268, "base64": 256, "hack_count": 2, "high_entropy": 231, "to_code_ratio": 1.46 }, "functions": { "count": 1 }, "identifiers": { "count": 185, "unique": 64, "avg_length": 12.81, "max_length": 45, "min_length": 2, "avg_entropy": 3.04, "reuse_ratio": 0.35, "length_stddev": 7.74, "has_digit_ratio": 0.03, "high_entropy_count": 18, "high_entropy_ratio": 0.28, "numeric_suffix_count": 1, "underscore_prefix_count": 1 } } }, "id": 8, "mol": "O(C)H₃(CmOsPo)Md₂(Si)", "path": "AWS.Tools.RecycleBin.5.0.302.nupkg!!AWS.Tools.RecycleBin.Completers.psm1", "pid": 0, "risk": 7, "sha": "f560122f4c8a35761340d6b988038acc951129cb1279a6eb12717817682b3094", "size": 24064, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 501, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 1274, 0 ], [ 12393, 64 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 37, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 2534, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 120, 0 ] ] }, { "id": "metadata/lang/scripted::function-blocks", "conf": 0.82, "crit": 2, "desc": "PowerShell function block syntax", "spans": [ [ 793, 0 ] ] }, { "id": "metadata/lang/scripted::type-accelerator", "conf": 0.78, "crit": 2, "desc": "PowerShell type accelerator syntax", "spans": [ [ 1895, 0 ] ] }, { "id": "metadata/signed/certificate/identity::powershell-signature-block", "conf": 0.95, "crit": 3, "desc": "PowerShell Authenticode signature block", "spans": [ [ 7056, 29 ] ] }, { "id": "micro-behaviors/communications/url/encoded::authenticode-script-signature-context", "atk": "T1027", "mbc": "B0032", "conf": 0.98, "crit": 3, "desc": "Authenticode script signature block context", "spans": [ [ 7056, 29 ] ] }, { "id": "micro-behaviors/os/sysinfo/platform/version::os-version", "conf": 0.8, "crit": 3, "desc": "Queries OS version info", "spans": [ [ 199, 25 ] ] }, { "id": "micro-behaviors/process/interpreter/eval/direct::powershell-iex-call", "atk": "T1059.001", "mbc": "E1059", "conf": 0.9, "crit": 3, "desc": "PowerShell Invoke-Expression or iex call", "spans": [ [ 4726, 17 ] ] }, { "id": "objectives/command-and-control/dropper/execution/fileless::curl-custom-ua-piped-powershell--rx-27", "conf": 0.9, "crit": 3, "desc": "Matches 'Invoke-Expression'", "spans": [ [ 4726, 17 ] ] }, { "id": "micro-behaviors/communications/url/encoded::encoded-http-url", "atk": "T1027", "mbc": "B0032", "conf": 0.85, "crit": 3, "desc": "Encoded URL decoded to http(s)", "spans": [ [ 8855, 54 ], [ 22251, 54 ] ] }, { "id": "micro-behaviors/communications/url/encoded::http-b64-protocol-fragment", "atk": "T1027", "mbc": "B0032", "conf": 0.6, "crit": 3, "desc": "Base64 HTTP protocol fragment", "spans": [ [ 8737, 9 ] ] }, { "id": "metadata/encoded-payload/base64", "conf": 0.9, "crit": 3, "desc": "Encoded content decoded: base64", "spans": [ [ 7429, 22 ], [ 8925, 49 ], [ 10897, 49 ], [ 13345, 49 ], [ 13481, 49 ], [ 13685, 49 ], [ 15929, 49 ], [ 19873, 49 ] ] }, { "id": "metadata/encoded-payload/base64-base64", "conf": 0.9, "crit": 3, "desc": "Encoded content decoded: base64 → base64", "spans": [ [ 17289, 29 ] ] } ], "type": "powershell" }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47aAzQxazCZol@c-7zeS@@e!5l%bME/A00000p^\u003eu:oAtj}k-?FF0000000000?#B@z3JR{Y01Yeh00\u0026M800000WK}NX03zmw06*", "ln": 0 }, { "b": "3\u0026*nc0ak*c00ic202L.p000000000000000kMy^J00000000000000000000L}A7q00000nb@R\u00260SSx7[p7Ar[t(P\u00262(\u003c@9000000000000000\u00264a)eFb/MH00000000000000000000000000000000000000009S^-n000uQiSZYP000uc1apgI00B+\u0026ASDduA4pL.EGxGH1BQyM00AuK3ig5gB0Q!^3mEk3015^F0rrasc)[#{3iCkG003%^c\u0026:kO0=$pw00T\u00262000uQ8GC\u0026U0b%zaATI\u003cEA4h[gDJTrG1s:xK6efN\u0026p5\u003em]0rr9i7ip@90171NzZ$!/3mb^)ec2USz.g}?3mb^)ec2USc\u003c6CH26hx%0171Oz.z7\u003c3u4P#019T0000uuB20Z}3jqj:000caz.?v[3mZHB0rrasAV\u003ez.A40Ky01akT000dyS@-n9Fcb=K1s:xK6efH*li3#=00000B2r{$3md8d000jwhuiZ:b}6f400Wv1000uLc\u003ecdR25=y1017224GDFkz-dN}3md8h000jwhuiZ:B2K703mV%y1POJ9dJi:u000cK8H.[\u003e00B+\u0026EH2]N1s+ss2(\u003c@ddGxCG6efH*eck!K0SSijB2Td13mcEairf3^b]gzW000uL7Jhwn0171%00000063]xc{dFf3uFug019Td000uLbldYz0020SkQX.{019^g000vAkl7V\u003cb[ZjS6^AXU8WpjC000uL5=?[CbldY.25=^c01akW000dyh#\u0026{=b]pFW000uL7h(kl0171*z-W}03mc[%00000fP!QGjobu*B3fH63u59d", "ln": 464 }, { "b": "00AvJU(B+bddmco3iyLoE6rOJ1qgX.aPIG)0S)+O000cI[C\u0026K@Bnb.n3mV2Qlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCnXk-IebyPQ)bVT)B\u003csQAjbu5Y8x(mN8000002.-lUGBX4.bumUxJfBqx5c8Xgbs+:9l\u0026Wh!OrK0Nr2tPn", "ln": 25024 }, { "b": "qBa2Cr7fX(rZxzVmf3$iByd%TA=#ebwMqS407/{^k$\u003c\u003cruR\u003c3Umpf1\u0026ogqOQq*ACawO\u003c4\u003epxk3sBye3?wKYl/qVH(IBye3?wKYl/qVGiKsYkq?lq}k\u0026pc?YPnkAg+xjVf(qE%]*z/fScl$7gC07*m6vP3=UAbPSnwKG%Gve@\u003e$wPz%dv}wwCBywY*ByteZwD", "ln": 47849 }, { "b": "B-H#6rc-B]07}rJzD7K\u0026wO$E)AaG2ZwPRoDB-IIlzGF\u0026@yH}x.D2Nr{mriA!A-vs6wDlpZA=k$$D2Nr{l03#-l}Yd1z/Py?uUKNTvp%p(vruBdnP4KHwDkqtC5IecpJgz\u0026z/fR.vrk#Wl2y4Rz/eS/vPc\u0026UC4\u003eC$qE%]*z/fSc090xtqE%]/B-H#6qE%]*z/fSc099]Uvp@FHB8Mhwv}wLHB8V5nB7CtBx(!w}vp%TJz/O-!B8Mhwv}wLHB8V3", "ln": 50063 }, { "b": "zdd:ezz1}hx(0=zvrcB5vqG-WrC(UZA=U]5y?%8qs5S3=od\u003caNv%IN2wKp9Ge[w^m0b2\u003e+uSh5!wNPAQxjVf(lVl\u003c:wO#P*BAg@3z2!S*BydyNzGGDcBw)p4wNPAQp\u0026yn*wN[eDzGGDcBw)p4wNPAQo\u003ewfWA^pP9A+eV@0b2\u003e+uRbuJz2!S*BydQYwO?ACD2[7sz2=\u003esvr#\u003cfe(D?fBzkP6e\u003eG@5wPzV%y+wXcvqZc#z/PW{mS5h)z/oD6vqV6Ax(dAWAa9R:xjVf(rbVL-zua9?B5MT\u003eB7]MgrbVL-zu94jzEWl]y*?B1z/eJ)yH}w-ju+MduT)IZv}xE)vruj4zD7K\u0026wO}", "ln": 52236 }, { "b": "vr#\u003cfqE%u-v@bZyx(lsIw)]*#Bvf$:w[+[2A::67z/bL+z/fVhzGPxfx(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zuarXByd\u003cMA:-/@By/FWz!%l3v@#B6zu9HwA==2qx(v\u003e?nKmGvxJ5zOwO(0OAcb/jzu9QDA=#ebwL)O*ByvQ.v}xjZwN[kOv}xR3x(v\u003e?ph+kMB-qqrA=+(6mf", "ln": 52912 }, { "b": "zua-?BydBEB7ol8Acb/jzu9mHq!p5swPIv4x(Ffdz/bLZwmY*(A+PGmx(v\u003e?q*ACawO\u003c50wQ5qHn][]*07?6IwPz:dy*?A%n][]*0b2\u003e+uS7DzB8L{@B7GD2qE%oTz/bLNwPz%dv}wIWz//zRCW\u003eq@wmYpuCW\u003er7BzkVhqE%oTz/bLMwPI^jA:@VQz/!D!B-7.UCW\u003er7", "ln": 53389 }, { "b": "zEVaMB.$YgvruBd07QQxmq^l+wPzj3z/L?gv@#Tf04}+\u003eBz(g1m}D^dBAzK6q*ACawO\u003c4/x\u003c\u003eT(z/Z2mv@?StA=k!?x(4Q1B7F\u003c1zE^!*o\u003e!9Tz/Y\u0026eBs])\u0026y+w1{D2va-zGGDgw)]gXA@Yc:B97#ge(D?fBzkP6e\u003eG@5wPzZdq!o#)x\u003e7Z}08[e:By/qwqGV(0x(dAllVl*Xx(4v3q!o#)x\u003e7Z}08[e:By/qwra{q-vpT7\u0026xd^d(B8b?Hq/u/0v}xYYl$G?Ixj\u003e{@xh9qPwPE\u0026:wPRoSB.\u003eSg0cqZ[uS82.", "ln": 55598 }, { "b": "x(:nGx\u003e8g4B8LVje\u003c\u003cL/wKgixy\u003cy8oA@Yc:B97#ge(VI8wNPa-zF7O3vrlj906%W+lVM:GwO#Q7vqG#+v@=c\u003ewO#Q7vqG#+mr9DUy\u0026YOxs5S3=oi37Fy\u0026YOFzGGDgzEEuWl}ZK4x(4?\u003cq/)4]zF8%\u003ex(4?\u003cp*[0JzEET9A-Ei}y\u0026YOsk6QBwv@Di[x(mG)rbVL-zGt!RD2[7sz7X!3A+eV\u0026x(mMoraf\u0026-B1P[aBy/uhx(v)g06$EgDt^WNqE%t", "ln": 56154 }, { "b": "A@YoZx()]PzE=KLygQ)%09shPBy!x)vrcD=vRPE:Bo3t)ADL\u0026lBwDvXwN//Zq*ACawO\u003c4{wPN]zB5MT(08^xHwPN]tz/ff3xlwlal3D:KBo3k#uRb9Ny?Wx[Bo2@+Byd{SBy/uix(v(=wPzH6wl0IYBo3w[Byd{SBy/uix(v(=wPzH6wl0IYBo1)Nq!p5GwPN", "ln": 57149 }, { "b": "wO\u003c50xMvV)wnb{]e(Vn2yJzabz/{8gwPGE}r://!wMi8VyG2d]A:@Vkm}D^uwPJ0gBo2lJBw=W\u003eB.(d1xjVf(rDz.(l1:+DBo2V\u003cB7GwTxjU$506$EgDt^X1wPz%dv}w2zx\u003eqg706$EgDt^X0wN*0}y?k}EzBnkOwO#O\u0026uT)[^wO#O\u0026mq^o.A=k\u0026jwO#O\u0026q*ACawO\u003c4!z!%l3v@#B6zGvB2wO#71x\u003e5+!l34r?v)$oTzdN-@Bz(gZl2y4Rz/dg9wD", "ln": 57515 }, { "b": "wDh-Ove$lDz#:XOx-ISyve$xHx-J5Kzu8r\u0026y5\u0026qPzVBUP03=Z*eDxhVz2!\u003eZeDxhVz#:OLeDx}]wDl-JA@Y[OzVBUP0sqN5pxjq[q#=[cf931)BPujTwDl=K02F36wDl=Kv/QJHx-J8LBo31PzVBUP04ghnCMqjNyYFOTwb{fvqugndA@ZaUBPuBZv/Q6uq#*tbx8(#M03+eqzVBnEyxcZ4zVx", "ln": 59632 }, { "b": "Bo31PzVBUP01zr@mf30Ymf3o!mf0sgqugndAr7aYwDl=KBo0A-zVBkDy5?/Bv/QPJaok{LzVBtGA@Wr.zuaOPBo0A-xAhDvB]V7NaolAZwDlYIBPuaQASxUJwb).Lw=MJBwDlJDwb).LnDro3wDlPFBo31Pw=MJBwDl-JaolD.wDl/L02Za-x-IVz", "ln": 60134 }, { "b": "08\u0026(t0at\u003eq0bzMmBYwA.0a=c#0cFoI0bITl0cwiH0aM1A03znX0at\u003eF0at\u003eA0a=dL0a=dJ03znU0cFo.0cwh-0aC}t03zn.0a=dL03znN0b?\u003cT03znM0b.^E0b}{R0bhBJ0cwh-0ce6J0cncU0bITT0cwiP0b?\u003cP000Kf0cncK07D@W08JU]003^", "ln": 61263 }, { "b": "5K=Xq0aV7G0b?\u003cK0b.^U004L4nDrSdB]U}JyYFeHwb).LlJz38zuanGx-I=CBPuBZve$xHx-J5Kzu8Y$aoj\u003ehnDqM!qVE{uve$fBwb).Lv/QSKA@ZpZzVBROaok%MzuahEz#:!Rx-J2JBo0A-ve$rFwDi?MzuaOPBo0A-A@Zs.z#:?SzVB!TBo2\u003e", "ln": 61531 }, { "b": "0a(jB0c!G(00dRxmGu0WpYKz]aok*IzuahEaoj!fBPt?IyYExlBo2.Hv/QoAaok*IASxUJaok%Mzua8BvGpiAwDllvec3^)vGpJJBo0A-Bo2$Ox-JhOaoluXve$rFBo31PBo31PzVBUPaok{LzVBtGA@Wr.zuaOPBo0A-A@Zs.z#:?SzVB!TBo0A-", "ln": 62039 }, { "b": "Acb/jzD7p\u0026z*cm62MT]b0000002tOn5KxF%q::nhqE%u-v@bZyx(i[JD\u0026Tj\u003era]?=l2y4Rz/cX0wNV=XwPz%dv}xZ7q::n3w]zYje(1\u0026masG#@Bw)o\u0026zE^f@wfrSWfEXa@avf\u003cMDt^WzqE%u-v@bZ0ltpr\u0026axi2*B0bHmy?m3@wGUz(woe(mB-qp", "ln": 68167 }, { "b": "000000000000000000000000000000000000000000000000000000000000000000000000000000315c8Xg7YTL^000000000000000000310rr91fAq960000000000000000003100000nb@R\u0026su((!kM}b/0000000000kM@$A00341qVHe8rSCL*qufR}nDqJ^p5[S3nDqG=mGui:00000Y-^*600031000c44GH2t0003100000kl7V-000001onA40SSi2000000000000000l\u0026Wh!0rud2ve$rFmGvc5yYF2DnDrSdw=", "ln": 70096 }, { "b": "004xH00031fAr^bfAr^bfAr{fvGn7Z000o9CMm:AlJz38z2!zMwDlPFBo3vZ002%#xAhPzaojXcz2^#ADh}\u003c-zu7^Vr@=!ivGmIJqVHweASym.x-ISywDl=Kaoksul\u0026Y\u003cWaol0NzVB!Taoj1]p5)Y.q#!3v", "ln": 70426 }, { "b": "wb{cuA@Wr.A@Zs.z#:?SzVB!TBo0A-w=M-HASviZqugndv/Q=Ov/QrBwDi?Mli7Z1zu8o?002m:5c8.hlJz38z2!IPve$fBC(QOtve$cAwDhYg002p+z2^#ADh}\u003c-zu8o?v/QAEz2=9!aoj$kzuaeD002W)5=.}jmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002p+r@=e0qVGh=o8{NAqugndv/Q=Ov/QrBwDk3%x-J2J001[S3JHhcmGvc5yYF2DrSDXhASydXx-J5Kzu6Up001?Qe=WN9e=WQafAr^be=WQagYNHQ002W)761vnnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002p+r@=e0qVGh=o8{NAqugndv/Q=Ov/QrBwDk3%x-J2Je=YzZyYFnK00620lJvb!oAnS7x8(uuyYD*5zVB.RC(R\u003c+x-I=CxAibO002v^zVB.RC(R\u003c+x-I=CxAibOaojXcz2^#ADh}\u003c-zu8o?v/QAEz2=9!aoj$kzuaeDe=W0]zVB!Taol9QBo3vZaok*Iw=MAyx-I@Hx-IMwBo2\u003eLA@W/)aojXcyYFnKaokptx-I=", "ln": 70658 }, { "b": "0rrc2oAnS7x8(uuyYEAmASxIFwb{fvz2^#AASx\u003ePA@Vgu00000002%#761vnpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002p+r@=e0qVGh=o8{NAqugndv/Q=Ov/QrBwDk3%x-J2Je=YzZyYFnK003EdaPIJypYLIozVBqFBPt[KBo25ove$cAwDhYg002p+z2^#ADh}\u003c-zu7^Vr@=!ivGmIJqVHweASym.x-ISywDl=Kaoksul\u0026Y\u003cWaol0NzVB!Taoj1]p5)Y.q#=)#004PJf8#1MpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001.Ne=WN9e=WN9d/:bXg5$\u003e=hums?h#\u003e@sv/OH?h2]AjvGng:fAr{fgxq1!hVNp!iriH*v/OH?v/Op+g5%rmf-URZf-Tilh#\u003e=nvGnv/gYPGnve@m!gxmyP001$U2MK(9k(+%aA@Y+Kz2!2ByYF.XaokBxwDl-JA@Y[OzVBUP001?Qe=WN9e=WN9e=WN9000000000000000000000000000000", "ln": 71162 }, { "b": "00000000000000000000000000000000000000000000000000000000000003zpx3\u0026*ncXio()00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", "ln": 71632 }, { "b": "3iC!X0rx)%KAk9(Yx0l\u0026jtm%kx/2a)RZi$qaWbyN/JD8Idw]shT9f@RU6Rav4A6}x]bBF+7vb2vMU^+zVu=2-5Z]-E!=!fl4]KH?O!X8JZmRxa7fKTTUv%bs.M{:}Nqc^#L*H4g5h8\u003c(]9o%hBustV\u0026W\u003eMT)Jy64ars@veZAY?prnT]aZ{\u0026%(JLpm(@$yv(=EF$TtAgHV3H3ICGrsNw(\u00266ar9kd?e4nrLfXGH{+6NBOT\u0026TvB\u003cU=iQ+I5d^*(vCC*p0chk-*oeC/Nm$-i\u003cs%i0f.K/WI\u003cQe^lVV][2vsK-mv3F\u003czfz*xqNEzJK%EaXZy#T@vE=u3G#miX:3\u003egEeXX/ig+w.SE?\u003cxwGvhYReaYWgMHS{AT0kK7w13x]3@1C0e#lluXcvMUy+p[zH2N8!LKX+hb=j\u003emh18\u003eg5\u003c.K#/f$*Ylz7c5G70l(vI7Z)8jOvqUr^/#q\u0026w1ouU]9f[B5{Au\u0026F5X2x4]3@Xrej0WzV11RsL]s*PE!Fq@}@?N/gTR3:\u0026K#..l.\u003eNeRGS7150NFC9KnS[c5DE14Pld]BIo96WN25)DApFkkGQN!k[K-l\u003cQ+nOf#.pQ79T7xD}XVEw9+vC-2}])z)uu$I+?jvmphPd@gLgJZ(Lj{EHmA\u0026{2G*uM(N^K/@qm$\u003cR[m60rrd}F=PEqF=Psm4*Abo9tnCO@@-GV0%5D5fDyu1ruhLL76Cur/w?FhAB09G?.5La\u003eEN4-91L?09%I*E9u$X7fCYfMU%c6t1nGS30O0F-8vcAkv}macfB!o?ruhOJ0SJo90%eHTfCsS)ruiv*3[@1)2Rc8W1Qbbk12bie2Rc8W", "ln": 72656 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 69632, 5.86, "r-x" ], [ ".rsrc", 70144, 1536, 3.27, "r--" ], [ ".reloc", 71680, 512, 0.1, "r--" ] ], "metrics": { "pe": { "checksum": 134945, "timestamp": 3164311616, "image_size": 98304, "headers_size": 512, "checksum_valid": 1, "clr.is_il_only": 1, "file_alignment": 512, "resource_count": 1, "cert_table_size": 11944, "has_version_info": 1, "computed_checksum": 134945, "headers_size_ratio": 0.01, "prose_section_count": 0, "reloc_overhang_bytes": 500, "reloc_overhang_ratio": 0.98, "clr.is_32bit_required": 0, "bss_like_section_count": 0, "clr.is_32bit_preferred": 0, "clr.strong_name_signed": 1, "section_overflow_count": 0, "signature_expired_days": -205.93, "clr.is_native_entrypoint": 0, "clr.strong_name_sig_size": 128, "misaligned_section_count": 0, "version.identity_entropy": 4.58, "base_relocation_block_count": 1, "base_relocation_entry_count": 1, "declared_data_directory_count": 7, "version.identity_symbol_ratio": 0.06, "executable_prose_section_count": 0, "directory_section_mismatch_count": 0 }, "file": { "size": 84136, "entropy": 6.17 }, "binary": { "is_pie": 1, "has_overlay": 1, "code_entropy": 5.86, "overlay_size": 11944, "string_count": 807, "overlay_ratio": 0.14, "overlay_entropy": 7.61, "entropy_variance": 5.55, "avg_string_length": 19.98, "max_string_length": 131, "peak_region_bytes": 11264, "code_to_data_ratio": 1, "peak_region_entropy": 7.6, "string_length_stddev": 16.05, "largest_section_ratio": 0.83, "sentence_string_count": 31, "sentence_string_ratio": 0.04, "high_entropy_string_count": 0 }, "imports": { "count": 1 }, "sections": { "count": 3, "code_size": 69632, "entropy_max": 5.86, "entropy_mean": 3.08, "name_entropy": 3.03, "writable_count": 0, "executable_count": 1, "nonstandard_count": 0, "executable_writable_count": 0 }, "consistency": { "internal_name_original_filename_mismatch": 0 }, "dependencies": { "count": 1 } } }, "id": 9, "ident": { "name": { "value": "AWSSDK.RecycleBin.dll", "source": "pe.version.original_filename", "verified": false }, "title": { "value": "AWSSDK.RecycleBin", "source": "pe.version.description", "verified": false }, "trust": "ca_signed", "signer": { "issuer": "CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\\, Inc.,C=US", "source": "pe.signatures[0]", "subject": "CN=Amazon Web Services\\, Inc.,OU=SDKs and Tools,O=Amazon Web Services\\, Inc.,L=Seattle,ST=Washington,C=US,SERIALNUMBER=4152954,BUSINESSCATEGORY=Private Organization,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553", "signed_at": "2026-09-18 19:14:57 UTC", "common_name": "Amazon Web Services, Inc.", "organization": "Amazon Web Services, Inc." }, "project": { "value": "Amazon Web Services SDK for .NET", "source": "pe.version.product_name", "verified": false }, "version": { "value": "4.0.100.14", "source": "pe.version.file_version", "verified": false }, "build_path": { "value": "/_/sdk/src/Services/RecycleBin/obj/AWSSDK.RecycleBin.NetStandard/Release/netstandard2.0/AWSSDK.RecycleBin.pdb", "source": "pe.debug.pdb.path", "verified": false }, "unique_ids": { "authenticode_thumbprint_sha256": "0e560c4aa37521a6a7ada5b846b3456e996bced7a0be5ccce65efae9346c2a49" }, "organization": { "value": "Amazon Web Services, Inc.", "source": "pe.signatures[0]", "verified": true } }, "mol": "K₂(LiMc)H₂(CmDb)Md₃(Bi₃PaSi₃)", "path": "AWS.Tools.RecycleBin.5.0.302.nupkg!!AWSSDK.RecycleBin.dll", "pid": 0, "risk": 12, "sha": "5e80260bc5dee4c6d72c5aa8a903e70150724e2f10d284db853ef36f7e872c88", "size": 84136, "traits": [ { "id": "metadata/signed/unknown::amazon-web-services-inc.", "conf": 1.0, "crit": 3, "desc": "Authenticode chain CN: Amazon Web Services, Inc." }, { "id": "metadata/signed/leaf::amazon-web-services-inc.", "conf": 1.0, "crit": 3, "desc": "Signed by Amazon Web Services, Inc." }, { "id": "metadata/binary/code/entropy::code-entropy-at-most-7-5", "conf": 0.7, "crit": 2, "desc": "Code entropy is 7.5 or lower", "spans": [ [ 512, 69632 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR header (COM descriptor)" }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET metadata root signature (BSJB)", "spans": [ [ 25072, 0 ] ] }, { "id": "metadata/binary/layout/overlay::image-under-768kb", "conf": 0.9, "crit": 3, "desc": "PE mapped image under 768 KiB" }, { "id": "metadata/binary/layout/size::small-pe", "conf": 0.6, "crit": 3, "desc": "Small PE binary (\u003c100KB)" }, { "id": "metadata/build/reproducible::pe-reproducible-build", "conf": 1.0, "crit": 2, "desc": "Built with /Brepro (deterministic)" }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 68215, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 61579, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-4", "conf": 0.8, "crit": 1, "desc": "English function-word token \"have\"", "spans": [ [ 60182, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 61311, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 78, 0 ] ] }, { "id": "metadata/package/versioning/scheme::pe-companyname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes CompanyName", "spans": [ [ 70722, 11 ] ] }, { "id": "metadata/package/versioning/scheme::pe-filedescription-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes FileDescription", "spans": [ [ 70786, 15 ] ] }, { "id": "metadata/package/versioning/scheme::pe-fileversion-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes FileVersion", "spans": [ [ 70862, 11 ] ] }, { "id": "metadata/package/versioning/scheme::pe-internalname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes InternalName", "spans": [ [ 70918, 12 ] ] }, { "id": "metadata/package/versioning/scheme::pe-productversion-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes ProductVersion", "spans": [ [ 71394, 14 ] ] }, { "id": "metadata/package/versioning/scheme::pe-productversion-semver-git-hash", "conf": 0.9, "crit": 3, "desc": "PE ProductVersion has SemVer git hash", "spans": [ [ 71424, 46 ] ] }, { "id": "metadata/package/versioning/scheme::pe-version-file-version-value", "conf": 0.9, "crit": 3, "desc": "PE version resource carries a file version", "spans": [ [ 70888, 10 ] ] }, { "id": "metadata/package/versioning/scheme::pe-version-product-name-value", "conf": 0.9, "crit": 3, "desc": "PE version resource names a product", "spans": [ [ 71320, 32 ] ] }, { "id": "metadata/package/versioning/scheme::pe-version-resource", "conf": 0.8, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 70238, 0 ] ] }, { "id": "metadata/package/versioning/scheme::version-info-file-version-present", "conf": 0.95, "crit": 3, "desc": "PE FileVersion value is present", "spans": [ [ 70888, 10 ] ] }, { "id": "metadata/signed/certificate/identity::pe-signature-verified", "conf": 1.0, "crit": 2, "desc": "PE Authenticode integrity check reports intact" }, { "id": "metadata/signed/certificate/identity::pe-signature-verified-kv", "conf": 1.0, "crit": 2, "desc": "PE Authenticode signer cryptography verifies" }, { "id": "metadata/signed/trust-level::dotnet-strong-name-signed", "conf": 0.95, "crit": 3, "desc": "Managed assembly is strong-name signed" }, { "id": "micro-behaviors/communications/http/client/managed::user-agent-accessor", "conf": 0.8, "crit": 3, "desc": "HttpClient UserAgent accessor", "spans": [ [ 57579, 13 ] ] }, { "id": "micro-behaviors/data/manipulation::dotnet-item-setter-token", "conf": 0.65, "crit": 3, "desc": ".NET set_Item method reference", "spans": [ [ 52378, 8 ] ] }, { "id": "well-known/lib/cloud/aws-sdk-dotnet::aws-sdk-dotnet-core", "conf": 1.0, "crit": 3, "desc": "AWS SDK for .NET Core assembly", "spans": [ [ 50127, 11 ] ] }, { "id": "well-known/malware/worm/ludbaruma::metric-section-count-3", "conf": 0.99, "crit": 3, "desc": "Exactly three sections" }, { "id": "metadata/binary/provenance/build::pe-far-future-timestamp", "conf": 0.95, "crit": 3, "desc": "PE COFF timestamp encodes a future date" }, { "id": "metadata/binary/symbols/imports::single-import-count", "conf": 0.7, "crit": 3, "desc": "PE with single import" }, { "id": "metadata/package/versioning/scheme::pe-productname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes ProductName", "spans": [ [ 71294, 11 ] ] }, { "id": "objectives/supply-chain/credential-theft/registry::credentials-file-basename-marker", "atk": "T1552.001", "conf": 0.4, "crit": 3, "desc": "Credentials filename marker", "spans": [ [ 56218, 11 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET managed assembly", "uses": [ 3, 4 ], "spans": [ [ 25072, 0 ] ] }, { "id": "metadata/signed/trust-level::signer-evidence-present", "conf": 1.0, "crit": 3, "desc": "Platform or developer signing evidence", "uses": [ 23, 24 ] } ], "type": "pe" } ], "rev": "e86a6", "v": "8" } }