{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 1.0, "class": 2, "threshold": 1.0 } ], "prob": 1.0, "class": 2, "level": 3, "models": [ { "m": "az", "prob": 0.97391856, "class": 0 }, { "m": "az/scripts", "prob": 0.99918854, "class": 0 }, { "m": "az/powershell", "prob": 1.0, "class": 2 } ], "version": "v17.17", "threshold": 1.0, "analyzed_at": "2026-05-31T10:52:41Z" }, "path": "aa22e56ad395221995d53aaf258bbd8f5a08ebc86f150088e01a38b92f70da90.ps1", "raw": { "v": "5", "fs": [ { "f": "O(As₃)Md", "x": 61, "ff": { "m": { "ast": { "max_depth": 258.0, "call_count": 7.0, "node_count": 32419.0, "identifier_count": 27.0, "string_literal_count": 58.0, "array_literal_max_length": 488.0 }, "file": { "size": 28524.0, "entropy": 4.8, "size_bytes": 28524.0 }, "text": { "digit_ratio": 0.64, "space_count": 99.0, "total_lines": 1.0, "char_entropy": 4.8, "unique_chars": 82.0, "lines_over_200": 1.0, "lines_over_500": 1.0, "string_density": 58.0, "avg_line_length": 28524.0, "lines_over_1000": 1.0, "max_line_length": 28524.0, "last_line_length": 28524.0, "long_token_count": 12.0, "whitespace_ratio": 0.0, "most_common_ratio": 0.16, "identifier_density": 82.0, "encoded_string_ratio": 0.07, "normalized_string_count": 58.0, "repeated_char_sequences": 5.0, "suspicious_string_ratio": 0.9, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 44.0, "suspicious_identifier_ratio": 0.03 }, "calls": { "count": 7.0 }, "source": { "function_count": 2.0 }, "strings": { "total": 58.0, "avg_length": 36.03, "max_length": 472.0, "avg_entropy": 2.9, "total_bytes": 2090.0, "entropy_stddev": 0.82, "base64_candidates": 4.0, "high_entropy_count": 4.0, "shell_command_strings": 52.0 }, "functions": { "count": 2.0 }, "identifiers": { "count": 27.0, "total": 82.0, "avg_length": 17.15, "max_length": 47.0, "min_length": 1.0, "avg_entropy": 3.25, "reuse_ratio": 0.91, "unique_count": 75.0, "length_stddev": 7.95, "has_digit_ratio": 0.05, "sequential_names": 2.0, "single_char_count": 2.0, "single_char_ratio": 0.03, "high_entropy_count": 46.0, "high_entropy_ratio": 0.61, "all_lowercase_ratio": 0.03, "all_uppercase_ratio": 0.01, "numeric_suffix_count": 2.0 } }, "s": [ [ 147, "10", "8460" ], [ 147, "10", "8460" ], [ 157, "10", "8428" ], [ 157, "10", "8428" ], [ 167, "10", "2" ], [ 167, "10", "2" ], [ 170, "10", "8460" ], [ 170, "10", "8460" ], [ 180, "10", "8428" ], [ 180, "10", "8428" ], [ 193, "10", "8460" ], [ 193, "10", "8460" ], [ 203, "10", "8428" ], [ 203, "10", "8428" ], [ 212, "10", "2" ], [ 212, "10", "2" ], [ 215, "10", "8460" ], [ 215, "10", "8460" ], [ 225, "10", "8428" ], [ 225, "10", "8428" ], [ 240, "10", "8460" ], [ 240, "10", "8460" ], [ 250, "10", "8428" ], [ 250, "10", "8428" ], [ 260, "10", "2" ], [ 260, "10", "2" ], [ 263, "10", "8460" ], [ 263, "10", "8460" ], [ 273, "10", "8428" ], [ 273, "10", "8428" ], [ 285, "10", "8460" ], [ 285, "10", "8460" ], [ 295, "10", "8428" ], [ 295, "10", "8428" ], [ 304, "10", "2" ], [ 304, "10", "2" ], [ 307, "10", "8460" ], [ 307, "10", "8460" ], [ 317, "10", "8428" ], [ 317, "10", "8428" ], [ 330, "10", "8460" ], [ 330, "10", "8460" ], [ 340, "10", "8428" ], [ 340, "10", "8428" ], [ 350, "10", "2" ], [ 350, "10", "2" ], [ 353, "10", "8460" ], [ 353, "10", "8460" ], [ 363, "10", "8428" ], [ 363, "10", "8428" ], [ 376, "10", "8460" ], [ 376, "10", "8460" ], [ 386, "10", "8428" ], [ 386, "10", "8428" ], [ 395, "10", "2" ], [ 395, "10", "2" ], [ 398, "10", "8460" ], [ 398, "10", "8460" ], [ 408, "10", "8428" ], [ 408, "10", "8428" ], [ 422, "10", "8460" ], [ 422, "10", "8460" ], [ 432, "10", "8428" ], [ 432, "10", "8428" ], [ 442, "10", "2" ], [ 442, "10", "2" ], [ 445, "10", "8460" ], [ 445, "10", "8460" ], [ 455, "10", "8428" ], [ 455, "10", "8428" ], [ 467, "10", "8460" ], [ 467, "10", "8460" ], [ 477, "10", "8428" ], [ 477, "10", "8428" ], [ 486, "10", "2" ], [ 486, "10", "2" ], [ 489, "10", "8460" ], [ 489, "10", "8460" ], [ 499, "10", "8428" ], [ 499, "10", "8428" ], [ 509, "10", "0" ], [ 509, "10", "0" ], [ 512, "10", "0" ], [ 512, "10", "0" ], [ 520, "10", "1" ], [ 520, "10", "1" ], [ 526, "10", "1" ], [ 526, "10", "1" ], [ 534, "10", "1" ], [ 534, "10", "1" ], [ 540, "10", "1" ], [ 540, "10", "1" ], [ 625, "10", "2171" ], [ 625, "10", "2171" ], [ 635, "10", "4243" ], [ 635, "10", "4243" ], [ 645, "10", "2" ], [ 645, "10", "2" ], [ 649, "10", "2171" ], [ 649, "10", "2171" ], [ 659, "10", "4243" ], [ 659, "10", "4243" ], [ 673, "10", "2171" ], [ 673, "10", "2171" ], [ 683, "10", "4243" ], [ 683, "10", "4243" ], [ 692, "10", "2" ], [ 692, "10", "2" ], [ 696, "10", "2171" ], [ 696, "10", "2171" ], [ 706, "10", "4243" ], [ 706, "10", "4243" ], [ 722, "10", "2171" ], [ 722, "10", "2171" ], [ 732, "10", "4243" ], [ 732, "10", "4243" ], [ 742, "10", "2" ], [ 742, "10", "2" ], [ 746, "10", "2171" ], [ 746, "10", "2171" ], [ 756, "10", "4243" ], [ 756, "10", "4243" ], [ 769, "10", "2171" ], [ 769, "10", "2171" ], [ 779, "10", "4243" ], [ 779, "10", "4243" ], [ 788, "10", "2" ], [ 788, "10", "2" ], [ 792, "10", "2171" ], [ 792, "10", "2171" ], [ 802, "10", "4243" ], [ 802, "10", "4243" ], [ 816, "10", "2171" ], [ 816, "10", "2171" ], [ 826, "10", "4243" ], [ 826, "10", "4243" ], [ 836, "10", "2" ], [ 836, "10", "2" ], [ 840, "10", "2171" ], [ 840, "10", "2171" ], [ 850, "10", "4243" ], [ 850, "10", "4243" ], [ 864, "10", "2171" ], [ 864, "10", "2171" ], [ 874, "10", "4243" ], [ 874, "10", "4243" ], [ 883, "10", "2" ], [ 883, "10", "2" ], [ 887, "10", "2171" ], [ 887, "10", "2171" ], [ 897, "10", "4243" ], [ 897, "10", "4243" ], [ 912, "10", "2171" ], [ 912, "10", "2171" ], [ 922, "10", "4243" ], [ 922, "10", "4243" ], [ 932, "10", "2" ], [ 932, "10", "2" ], [ 936, "10", "2171" ], [ 936, "10", "2171" ], [ 946, "10", "4243" ], [ 946, "10", "4243" ], [ 959, "10", "2171" ], [ 959, "10", "2171" ], [ 969, "10", "4243" ], [ 969, "10", "4243" ], [ 978, "10", "2" ], [ 978, "10", "2" ], [ 982, "10", "2171" ], [ 982, "10", "2171" ], [ 992, "10", "4243" ], [ 992, "10", "4243" ], [ 1005, "10", "1" ], [ 1005, "10", "1" ], [ 1011, "10", "1" ], [ 1011, "10", "1" ], [ 1023, "10", "6430" ], [ 1023, "10", "6430" ], [ 1180, "10", "14332" ], [ 1180, "10", "14332" ], [ 1191, "10", "5719" ], [ 1191, "10", "5719" ], [ 1201, "10", "2" ], [ 1201, "10", "2" ], [ 1204, "10", "14332" ], [ 1204, "10", "14332" ], [ 1215, "10", "5719" ], [ 1215, "10", "5719" ], [ 1228, "10", "14332" ], [ 1228, "10", "14332" ], [ 1239, "10", "5719" ], [ 1239, "10", "5719" ], [ 1248, "10", "2" ], [ 1248, "10", "2" ], [ 1251, "10", "14332" ], [ 1251, "10", "14332" ], [ 1262, "10", "5719" ], [ 1262, "10", "5719" ], [ 1277, "10", "14332" ], [ 1277, "10", "14332" ], [ 1288, "10", "5719" ], [ 1288, "10", "5719" ], [ 1298, "10", "2" ], [ 1298, "10", "2" ], [ 1301, "10", "14332" ], [ 1301, "10", "14332" ], [ 1312, "10", "5719" ], [ 1312, "10", "5719" ], [ 1324, "10", "14332" ], [ 1324, "10", "14332" ], [ 1335, "10", "5719" ], [ 1335, "10", "5719" ], [ 1344, "10", "2" ], [ 1344, "10", "2" ], [ 1347, "10", "14332" ], [ 1347, "10", "14332" ], [ 1358, "10", "5719" ], [ 1358, "10", "5719" ], [ 1371, "10", "14332" ], [ 1371, "10", "14332" ], [ 1382, "10", "5719" ], [ 1382, "10", "5719" ], [ 1392, "10", "2" ], [ 1392, "10", "2" ], [ 1395, "10", "14332" ], [ 1395, "10", "14332" ], [ 1406, "10", "5719" ], [ 1406, "10", "5719" ], [ 1419, "10", "14332" ], [ 1419, "10", "14332" ], [ 1430, "10", "5719" ], [ 1430, "10", "5719" ], [ 1439, "10", "2" ], [ 1439, "10", "2" ], [ 1442, "10", "14332" ], [ 1442, "10", "14332" ], [ 1453, "10", "5719" ], [ 1453, "10", "5719" ], [ 1467, "10", "14332" ], [ 1467, "10", "14332" ], [ 1478, "10", "5719" ], [ 1478, "10", "5719" ], [ 1488, "10", "2" ], [ 1488, "10", "2" ], [ 1491, "10", "14332" ], [ 1491, "10", "14332" ], [ 1502, "10", "5719" ], [ 1502, "10", "5719" ], [ 1514, "10", "14332" ], [ 1514, "10", "14332" ], [ 1525, "10", "5719" ], [ 1525, "10", "5719" ], [ 1534, "10", "2" ], [ 1534, "10", "2" ], [ 1537, "10", "14332" ], [ 1537, "10", "14332" ] ], "v": { "file.stem": "aa22e56ad395221995d53aaf258bbd8f5a08ebc86f150088e01a38b92f70da90", "file.basename": "aa22e56ad395221995d53aaf258bbd8f5a08ebc86f150088e01a38b92f70da90.ps1", "source.language": "powershell", "source.strings[0]": "2t6NQXpjkcSwRq5H2SiP1XCL1N08Dn5WXLmEjXcjl1gfCiFxG3EOvELH7quAXEIZgqc835d+7YIj6khbcU48d7ZIikkooT8dIz/ll8RLoaQTmae6OjFhCZPb+8CqyAMnnw+Ng6xkrjgTgJ1UIvEFSAbgHhLd5BTC1HDQIC/5LUyBFBZ/U5SzWXak7sw/vi3/muIXLA3Xsv55072vS+5WP2C5NRkoa/K+j4XQ/iLq2kp1FcL3q53MrLToKd1uHjSCoiZufOelfL70PYpB9xv8WcXUkQA4Uv8c8AB/WpmaLjXLpkNCIL7CxTZFZivjLapbbSHQhr7TSzHjyySYiU+p3PbbaYWlgzDp", "source.strings[1]": "4294967295", "source.strings[2]": "C`R`Eat`E", "source.strings[3]": "F`R`O`M`Ba`S`E64`St`Rin`G", "source.strings[4]": "F`R`O`Mb`Ase64`St`Ri`N`G", "source.strings[5]": "Fr`O`M`Ba`S`E64`String", "source.strings[6]": "Fr`Om`B`A`S`E64`S`Tr`I`Ng", "source.strings[7]": "Fr`Om`B`Ase64`St`Ri`Ng", "source.strings[8]": "G`E`Ts`Tring", "source.strings[9]": "G`E`Tst`R`I`Ng", "source.strings[10]": "G`Et`S`T`R`I`N`G", "source.strings[11]": "G`Et`Stri`N`G", "source.strings[12]": "G`Ets`T`Ring", "source.strings[13]": "G`Ets`Tri`N`G", "source.strings[14]": "G`Etstr`I`Ng", "source.strings[15]": "Ge`T`S`Tr`I`N`G", "source.strings[16]": "Ge`T`Str`I`N`G", "source.strings[17]": "Ge`Tby`Te`S", "source.strings[18]": "Ge`Tstr`Ing", "source.strings[19]": "Gets`T`Ring", "source.strings[20]": "Leng`Th", "source.strings[21]": "MnQ2TlFYcGprY1N3UnE1SDJTaVAxWENMMU4wOERuNVdYTG1FalhjamwxZ2ZDaUZ4RzNFT3ZFTEg3cXVBWEVJWmdxYzgzNWQrN1lJajZraGJjVTQ4ZDdaSWlra29vVDhkSXovbGw4UkxvYVFUbWFlNk9qRmhDWlBiKzhDcXlBTW5udytOZzZ4a3JqZ1RnSjFVSXZFRlNBYmdIaExkNUJUQzFIRFFJQy81TFV5QkZCWi9VNVN6V1hhazdzdy92aTMvbXVJWExBM1hzdjU1MDcydlMrNVdQMkM1TlJrb2EvSytqNFhRL2lMcTJrcDFGY0wzcTUzTXJMVG9LZDF1SGpTQ29pWnVmT2VsZkw3MFBZcEI5eHY4V2NYVWtRQTRVdjhjOEFCL1dwbWFMalhMcGtOQ0lMN0N4VFpGWml2akxhcGJiU0hRaHI3VFN6SGp5eVNZaVUrcDNQYmJhWVdsZ3pEcA==", "source.strings[22]": "Q29ZQVBnaFRHUTlHYnNpcWNxZExaV0IxVXZCcmhqbHVibWNkYWdhcy9KNGx1dFZEMDk1bGZtSm84c2VtckFGYnpkbUhqZXYrd1V2bEtOL2lwTmdRWjIxdlVqcnJIQ2pTeUNBZThncEVjVVVEaDNsVWY1eUgrWjdkeVo3STN2dlBldUF2d2ZBMHRTc3dYUjl0eFBlNGdmeGZUOUxFWkdJcUtlNmwvYUxnbk12b05MTTMxOWhyWFJZcmM2VE9PUXUzaTl4R0o5VHNtU2kvdGhFQ2ltNThkUzFuTmhkTkV1YU1yQ3dOeTFCL05GelAyMEhFd1RVZWFaSW5UN0EwMFQ4Sm90WldzcHJKbFVsUVcxdFduZ2hsWitLWg==", "source.strings[23]": "QXBGcjJIbHpvYUlNTGFVbkJHVEVLR2VYUy9DOXBweDVCNS95ZFluS3l4cDF2cEJvM3J5ZXhjMnJ5dVNZWlRrcFhQUlNXdFRSdzNMcVhZKzBlVy83ZUdBN1B1d1NZdHpLNys=", "source.strings[24]": "R2FkVCtDQS90NG9FSklxeitlUmdlWkFTWURkcyt3WmNSYjB0L2xkVmdoSmJzeGU0VENwQWJiL3dvRFhNZC9XUmlwcjJBbDVLcVY3enRzNDJ3T1lWbnFpZDhpOVBqNkhta3hadDUxVk9ob01qdGd2aVBoTmpvTnRKVGU2cUYyTndnZEFIT3c0YjJKK1IwSUpwL2RqMk5OUzFXL0tZWmFjUWljSE1XcWtJN1B3YnRjS0VkQ2VyTUNFQTVUR3pod0FhOHNLSGg3c054SEcyMVJnVHpPNW81a2tLL21zaUNmbVRtcmg2d2JmajdXM1JBZk9oTjdCMm5ZOG4rMk9jT2lkakQyMlV1RXYzL0xURnJlT3IwNzlHUGFwSXZvMXU3c3Y4UVlSR1hZckxwZWM2SHJFMFh3c3NPZDBvRlZRUThiaUhOeU8vZDdsei9qV3lvd1ZQNg==", "source.strings[25]": "R`E`Ver`Se", "source.strings[26]": "T`Oc`Har`Ar`R`A`Y", "source.strings[27]": "To`C`Ha`R`A`R`Ray", "source.strings[28]": "c`Reat`Ed`Ec`Ry`P`T`O`R", "source.strings[29]": "f`Ro`Mbase64`S`T`R`I`Ng", "source.strings[30]": "g`E`T`Str`I`Ng", "source.strings[31]": "g`E`T`Str`Ing", "source.strings[32]": "g`E`Ts`Trin`G", "source.strings[33]": "g`E`Tst`R`I`N`G", "source.strings[34]": "g`Ets`Tri`Ng", "source.strings[35]": "ge`T`Str`Ing", "source.strings[36]": "ge`Ts`Tri`Ng", "source.strings[37]": "get`By`Te`S", "source.strings[38]": "r`Eve`Rse", "source.strings[39]": "t`R`A`Ns`Fo`Rm`F`In`A`L`Blo`C`K", "source.strings[40]": "u`T`F8", "source.functions[0]": "anonymous" }, "ct": [ "New-Alias", "New-Object", "pWN", "v`Nj`S`Un`U`Z`E`Sy", "z`X6sp`L`Z`B0`Y`M" ], "id": "powershell" }, "id": 0, "sz": 28524, "ts": [ { "a": "T1027", "c": 0.8600000143051147, "d": "Multiple embedded base64 literals", "e": [ "Q29ZQVBnaFRHUTlHYnNpcWNxZExaV0IxVXZCcmhqbHVibWNkYWdhcy9KNGx1dFZEMDk1bGZtSm84c2VtckFGYnpkbUhqZXYrd1V2bEtOL2lwTmdRWjIxdlVqcnJIQ2pT", "MnQ2TlFYcGprY1N3UnE1SDJTaVAxWENMMU4wOERuNVdYTG1FalhjamwxZ2ZDaUZ4RzNFT3ZFTEg3cXVBWEVJWmdxYzgzNWQrN1lJajZraGJjVTQ4ZDdaSWlra29vVDhk", "R2FkVCtDQS90NG9FSklxeitlUmdlWkFTWURkcyt3WmNSYjB0L2xkVmdoSmJzeGU0VENwQWJiL3dvRFhNZC9XUmlwcjJBbDVLcVY3enRzNDJ3T1lWbnFpZDhpOVBqNkht", "QXBGcjJIbHpvYUlNTGFVbkJHVEVLR2VYUy9DOXBweDVCNS95ZFluS3l4cDF2cEJvM3J5ZXhjMnJ5dVNZWlRrcFhQUlNXdFRSdzNMcVhZKzBlVy83ZUdBN1B1d1NZdHpL" ], "i": "objectives/command-and-control/dropper/staging/encrypted::multiple-base64-literals", "l": 1, "m": "C0025", "el": [ "0x5252", "0x61d1", "0x37ec", "0x6c1d" ] }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 28524.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Last line is over 1000 chars", "e": [ "text.last_line_length = 28524.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Exactly one line exceeds 1000 chars", "e": [ "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "File is a one-liner", "e": [ "text.total_lines = 1.00" ], "i": "metadata/file/text/metrics::file-one-liner", "l": 1 }, { "a": "T1070.004", "c": 0.6000000238418579, "d": "Remove-Item cmdlet", "e": [ "Ri" ], "i": "objectives/evasion/self-delete/file/script::remove-item", "l": 4, "m": "F0007", "el": [ "0x6c03" ] }, { "a": "T1027", "c": 0.8799999952316284, "d": "Dense backtick escapes (keyword breaking)", "e": [ "`X" ], "i": "objectives/anti-static/obfuscation/string/concat::dense-backtick-escapes", "l": 4, "m": "B0032" }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "Value" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047" }, { "c": 0.7799999713897705, "d": "PowerShell type accelerator syntax", "e": [ "[sySTEm.sEcURItY.CRYptOGRapHY.hAsHAlGoRItHmnAme]::" ], "i": "metadata/lang/scripted::type-accelerator", "l": 2 }, { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 1.00" ], "i": "metadata/file/text/metrics::file-under-12-lines", "l": 1 }, { "c": 1.0, "d": "Valid PowerShell code", "e": [ "param (" ], "i": "metadata/lang/scripted::ps-valid", "l": 2 }, { "c": 0.8500000238418579, "d": "PowerShell or VBScript line bloat", "e": [ "text.avg_line_length = 28524.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::script-host-line-bloat", "l": 4 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Suspicious long PowerShell line", "e": [ "text.max_line_length = 28524.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::ps-suspicious-single-line", "l": 4, "m": "B0032" }, { "a": "T1140", "c": 0.6000000238418579, "d": "Very long base64 strings present", "e": [ "Q29ZQVBnaFRHUTlHYnNpcWNxZExaV0IxVXZCcmhqbHVibWNkYWdhcy9KNGx1dFZEMDk1bGZtSm84c2VtckFGYnpkbUhqZXYrd1V2bEtOL2lwTmdRWjIxdlVqcnJIQ2pT", "MnQ2TlFYcGprY1N3UnE1SDJTaVAxWENMMU4wOERuNVdYTG1FalhjamwxZ2ZDaUZ4RzNFT3ZFTEg3cXVBWEVJWmdxYzgzNWQrN1lJajZraGJjVTQ4ZDdaSWlra29vVDhk", "R2FkVCtDQS90NG9FSklxeitlUmdlWkFTWURkcyt3WmNSYjB0L2xkVmdoSmJzeGU0VENwQWJiL3dvRFhNZC9XUmlwcjJBbDVLcVY3enRzNDJ3T1lWbnFpZDhpOVBqNkht" ], "i": "micro-behaviors/data/encode/payload::large-base64-string-literals", "l": 3, "m": "C0043", "el": [ "0x5252", "0x61d1", "0x37ec" ] }, { "a": "T1027", "c": 0.699999988079071, "d": "Very low whitespace ratio (minified/compressed)", "e": [ "text.whitespace_ratio = 0.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.699999988079071, "d": "Many random-looking source identifier names", "e": [ "identifiers.high_entropy_ratio = 0.61" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::many-high-entropy-identifiers", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Encoded payload detected: base64 → base64", "e": [ "\u003cbinary data\u003e \u003cbase64+base64\u003e" ], "i": "metadata/encoded-payload/base64-base64", "l": 3, "el": [ "offset:0" ] } ], "sha": "aa22e56ad395221995d53aaf258bbd8f5a08ebc86f150088e01a38b92f70da90", "path": "aa22e56ad395221995d53aaf258bbd8f5a08ebc86f150088e01a38b92f70da90.ps1", "type": "powershell" } ], "tv": "52045" } }