{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 1.0, "class": 2, "threshold": 1.0 } ], "prob": 1.0, "class": 2, "level": 3, "models": [ { "m": "az", "prob": 0.9380215, "class": 0 }, { "m": "az/vbs", "prob": 1.0, "class": 2 } ], "version": "v17.17", "threshold": 1.0, "analyzed_at": "2026-05-31T11:13:34Z" }, "path": "cb2c603f556c97544e3af512a35634cea1360482efd48b9832af3648d33445d3.vbe", "raw": { "v": "5", "fs": [ { "f": "O(As)Md", "x": 35, "ff": { "m": { "file": { "size": 423439.0, "entropy": 4.69, "size_bytes": 423439.0 }, "text": { "tab_count": 68.0, "digit_ratio": 0.19, "space_count": 8498.0, "total_lines": 1.0, "char_entropy": 4.69, "unique_chars": 96.0, "escape_density": 0.0, "lines_over_200": 1.0, "lines_over_500": 1.0, "avg_line_length": 423439.0, "lines_over_1000": 1.0, "max_line_length": 423439.0, "null_byte_count": 1.0, "last_line_length": 423439.0, "long_token_count": 995.0, "whitespace_ratio": 0.02, "most_common_ratio": 0.1, "octal_escape_count": 3.0, "non_printable_ratio": 0.02, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 2.0, "most_common_char_codepoint": 33.0 } }, "s": [ [ 0, "u8", "#@~^9nUGAA==6aYrKx,26aVb^kD@#@\u0026@#@\u0026@#@\u0026@#@\u0026@#@\u0026w;x1YkKU~" ], [ 133, "u8", "2,fv2f\u0026+\u00261fF\u0026c{0WFfc2*2vfO\u0026+cc2 F0\u0026F\u0026f\u0026+\u00260fyc\u00262+GR\u0026G2{fv2,2v**f*2cfv21\u0026F\u0026+fyc\u0026f+F%fv212 *2\u0026yG%2vWq\u0026ycf\u0026yG0f+c 2+c2\u0026 F0fvW\u00262 *\u0026f+" ], [ 341, "u8", "2FfG2*2vfl\u0026Wcv2v2+\u0026+cq\u0026+\u0026Xf+\u0026\u00262{\u0026W\u0026 20f 2 2*fGfX2\u0026fv2f\u0026F\u0026+f+\u0026,f{F%fG2*2 *l\u0026l\u0026\u00262v20\u0026+\u0026X\u0026+cff+c\u00262+\u0026y\u0026 21{%WF2GfGf" ], [ 581, "u8", "W*fv2{\u0026F\u0026ffy\u0026%f+2 f 2X2GfF\u0026+\u0026,2vWX\u0026+\u0026*\u0026+\u00261fF\u0026 2+\u0026l\u0026 2+f 2,2 {%ffWFf F0\u0026+\u00261fyG%ffWcf F02 fy\u0026+\u0026,2vWX\u0026y\u0026+\u0026yG0f2cF2+GR\u0026vWqf F%2\u0026*cf+" ], [ 783, "u8", "fy\u0026 f+F%f\u0026Wq2 {R\u0026+c\u00262 F0\u00262c*\u0026yG0fy\u0026 2" ], [ 821, "u8", "\u00262\u0026vWXf 2 2 {%ffWFf F0\u0026+c*fyG%ffWcf F02\u0026{RGRcF2c2*\u0026+c" ], [ 885, "u8", "\u0026R\u0026v21fvW\u00262vf*f+F%fvW*\u0026yG0f2c\u0026f+F%f\u00262q2\u0026{R\u00262G%2\u0026F0\u00262G0GRcqfyG%2+GR\u0026 F0f F%2cf,f" ], [ 1013, "u8", "\u0026O\u0026vWXfv2G2 f%f{2\u0026fv20\u0026ycXfl\u0026 f" ], [ 1141, "u8", "\u00268\u0026G2*fv2%2G*\u0026fXW\u0026fv21\u0026y\u0026+fy\u0026,f+2,f F02*fW\u0026+\u0026%2v2X\u0026+cXGRcqfyG%2+GR\u0026 F0f F%2 {%f+F%f F0\u0026yG0fW\u0026,f" ], [ 1237, "u8", "2vf F02Gf2\u0026+\u0026%2 WX\u0026l\u0026+\u0026+\u0026Xf+\u0026G2X\u0026y\u0026v2Xfv2F2vfcf+2%f 2+\u0026W\u00260fWc f*2\u0026f*2X2**2\u0026l\u0026\u00262vW" ], [ 1365, "u8", "2%fGWf2**2\u0026y\u0026 2 F0\u0026y\u0026" ], [ 1387, "u8", "\u0026yG0f+\u0026,2+\u0026O\u0026 F0f\u0026Wc2 {%f+2 f\u00262q\u0026y\u0026+fyG%fX2cfv202vfl\u0026+c*F%Wq\u0026yG0\u0026yG0fyG%2+GR\u0026 F0f F%2 {%f+F%f F0\u0026yG0fyG%f+F%fG2f2vfR\u0026yc*2*2+\u0026F\u0026X" ], [ 1621, "u8", "2*f*Wf2G*2\u0026FG%2v2q\u0026F\u0026*\u0026+\u00260fFc\u00262Xc2\u0026 2+f F%2 fvf+F%fvWq\u0026y\u00261fyc\u0026f+F%f\u0026F0F%*8\u0026yG%2 F0\u0026yG0\u0026yG0fyG%2+GR\u0026 F0f F%2cf*f" ], [ 1733, "u8", "W\u0026fG2f\u0026+\u0026X{RcFf+F%f F02 {R\u0026yG%2 F0\u0026yG0\u0026yG0fyG%2+GR\u0026 F0f F%2 {%f{2\u0026fv20\u0026ycXfl\u0026 f{2*fvWX2 {R\u0026F\u0026G2v21\u0026+cX\u0026W\u0026*f+\u0026,2{\u0026y\u0026 F0f 2v2 {%f+" ], [ 1979, "u8", "f\u00262F2 **ffF%f*Wf\u0026FG0f+cvf{2Gfv2X2Gfy\u0026F\u0026\u00262v20\u0026+\u0026X\u0026+cff+c\u00262+cl\u0026v2XfG2%2vf*f+2 f Wf\u0026yG0f2\u0026 {0WFf F02 {R\u0026yG%2 F0\u0026yG0\u0026yG0fyG%2+GR\u0026 F0" ], [ 2261, "u8", "W*fv2{2 {R\u0026l\u0026c2v20\u0026+\u0026X\u0026+cX{RcF2+GR\u0026 F0f F%2 {%f+F%f F0\u0026yG0fyG%f+F%f F02 {R\u0026yG%2 F0\u0026yG0\u0026yG0fyG%2X\u0026F\u0026v21fG2c2vf%f+F%fG2f\u0026+\u00260fyG%ff" ], [ 2565, "u8", "2*fv2q\u0026+\u0026*fy\u0026%f+2 fc202c*y\u0026W\u0026\u00262*2X\u0026lcf\u0026l\u0026ff+cv2" ], [ 2613, "u8", "\u0026+\u0026G2*fG2G2vfFf{2 fv2X\u0026lcffFc\u0026f{F%fv2q2GfW\u0026+\u0026%2GWf\u0026lcf\u0026y\u0026+fyG%2+\u0026+\u0026 F0fvW 2 f,{0WFf F0\u0026yG0fyG%f+F%f F02 {R\u0026yG%2 F0\u0026yG0\u0026yG0fyG%2+" ], [ 2773, "u8", "W*fv2*2c*y\u0026+\u0026*2G21\u0026F\u0026f\u0026yG0fy\u0026 2{cy\u0026c2XfcW*2*fcf*2*f*2+\u0026Fc*fy\u0026 f+F%f\u0026Wq2 {R\u0026yc*2*2f\u0026+\u0026X\u0026+cXf+\u0026c2*cy\u0026v2XfG2,2Gf\u0026f+F%f WX\u0026l\u0026+f+\u0026*f" ], [ 3157, "u8", "2,fG2*2vfRGRcF2 F0\u0026yG0\u0026yG0fyG%2+GR\u0026 F0f F%2 {%f+F%f F0\u0026yG0fyG%f+F%f F02 {R\u0026yG%2*2{\u0026l\u0026f\u0026+\u0026ffF\u0026 2" ], [ 3253, "u8", "\u0026O\u0026GF0fG2c2 **fX2\u0026fvWf\u0026+\u0026Xf+\u0026*f{F%f F02\u0026fl\u00262G%2\u0026F0\u00262G0GRcqfyG%2+GR\u0026 F0f F%2 {%f+F%f F0\u0026yG0fyG%f+F%f F02 {R\u0026W\u0026*2vWX\u0026+\u0026*\u0026yG0fW\u0026,2" ], [ 3381, "u8", "\u0026+G%Wqf F%2 {%f+F%f F0\u0026yG0fyG%f+F%f F02cfl\u0026+c*2v2*\u0026yG0\u0026W\u00261f+\u0026vF0c8\u0026 F0f F%2 {%f+F%fc2X\u0026+cXf+\u0026cf+F%fc212vf+GRcF2 F0\u0026yG0\u0026yG0fyG%2X" ], [ 3525, "u8", "2,fGF0\u0026F\u0026*fyc*fX2\u0026fvWf2vfl\u0026+\u0026*2GF0\u0026yG0\u00262\u0026qf2G%2fGR\u0026\u0026F0f\u0026F%2 {%ffWFf F0\u0026+c*fyG%ffWcf F02v*W\u0026yG%2 W+\u0026yG0\u00262\u0026q{RcF2*c2\u0026vW" ], [ 3717, "u8", "W*fv21\u0026+cXf+\u0026Gf+2%fvWX2 fO\u0026yG%2\u0026Wq\u0026yG0\u0026W\u00261fF\u0026\u00262X\u0026y\u0026G2XfvW*2v**f" ], [ 3781, "u8", "2,fvWX\u0026+\u0026{fyG%ffWcf F02 fR\u0026W\u0026G2v2X\u0026F\u0026*\u0026Wc" ], [ 3829, "u8", "c8\u0026v2Xfv2\u00262Gfcf+2%f 2+\u0026F\u0026{f+\u0026,f" ], [ 3909, "u8", "WvfvW" ], [ 3925, "u8", "2\u0026fv212v*W\u0026F\u0026v2\u00262+\u0026y\u0026+\u0026y\u00261fyc*2*\u0026l\u0026G20fv2*2vf\u0026fX2FfG2X\u0026+\u0026XfF\u0026 f{2,f 202 fy\u0026l\u0026\u00262c2X\u0026Wcf\u0026W\u0026XfW\u0026\u00262X\u0026W\u0026 F0f WF2 {%f*2vf*2+\u0026Wc" ], [ 4047, "u8", "fWccf+F%f*2{2vfO\u0026+c*2\u00262f\u00262\u0026+\u0026lc" ], [ 4091, "u8", "fv2\u00262vf*f{2\u0026fG2f\u0026yG0fl\u0026Gf*2%fc2X2*fy\u0026W\u0026*2 F0\u0026WcX\u0026+\u0026qf+cc2" ], [ 4149, "u8", "\u0026l\u0026\u0026W*f 2G2 f f+F%f 2" ], [ 4171, "u8", "\u0026yG0f+c*f+F%f 2" ], [ 4219, "u8", "fG2*2v**f{2cf F0\u00262cXfyG%ffF%f 212 {R\u00262cF2 F0\u0026W\u0026X\u0026+cXf+\u0026c2+GR\u0026c2" ], [ 4341, "u8", "c+\u0026vWXf F%2cfGf" ], [ 4357, "u8", "2*fG2*\u0026lG0fl\u0026\u0026f+2%f 212 {R\u00262cF2 F0\u0026W\u0026*\u0026+\u00261f+cc2+GR\u0026GF0f F%2\u0026*Ff+F%fc2" ], [ 4431, "u8", "fF\u0026 f+F%fc2X2vf8\u0026+\u0026\u00262v20\u0026yG0\u0026FG0fyG%2*\u0026O\u0026vWXf F%2cfGf" ], [ 4661, "u8", "\u00262\u0026v2XfG2\u00262Gf\u0026f+2 f 21\u0026yG0f2cFf+F%fc212vf+\u0026yG%2cWf\u0026W\u0026f\u0026+\u0026qfF\u0026\u00262" ], [ 4789, "u8", "\u0026l\u0026G2+fG2\u00262vf%f" ], [ 4853, "u8", "cl\u0026 F0f\u0026WF2 {%fX2\u0026fv2X\u0026F\u0026*fyG%f*2Gfv2X2GfW\u0026lG%2*2f\u0026yG0\u00262c*fyG%2{GR\u0026 F0f\u0026WF2 {%f*2*fG20\u0026+\u00261fF\u0026cf+F%fc2" ], [ 4981, "u8", "cl\u0026 F0f\u0026WF2 {%f*2*fvWX\u0026+\u0026*fyG%f*2,fv2" ], [ 5019, "u8", "2 {R\u00262cF2 F0\u0026WcX\u0026+\u0026XfF\u0026%2{\u0026W\u0026 F0f\u0026WF2 {%fX2\u0026fv2X\u0026F\u0026*fyG%f*2Gfv2X2GfW\u0026lG%2*2f\u0026yG0\u00262c*fyG%2*cl\u0026vW" ], [ 5125, "u8", "2,fvWX\u0026+\u0026{fyG%ffWFf F02cfl\u0026+c*2v2*\u0026yG0\u0026W\u0026" ], [ 5173, "u8", "cl\u0026v2ffG2c2vf,f" ], [ 5189, "u8", "WvfvWXJ@#@\u0026~~,P" ], [ 5792, "u8", "6O@#@\u0026,PP,@#@\u0026~P,P\\S;qJ ;VWkn@#@\u00262x9~jE(@#@\u0026@#@\u0026@#@\u0026@#@\u0026@#@\u0026?!8PV?e\\j`#@#@\u0026,P~PGrsP)~AV5@#@\u0026P,~P,P~P@#@\u0026~~,Pb~$MIP',]nw^l1+c?O.\"" ], [ 5961, "u8", "oF \u0026zfblfGO" ], [ 6287, "u8", "F+sc;+3vAvOvqv9" ], [ 6357, "u8", "qvGvGvocf+G TvA" ], [ 6739, "u8", "jmMraY Ut" ], [ 7046, "u8", "\u00262\u0026+\u0026XJbbBPm@#@\u0026~P,P~~,PKFHg" ], [ 7649, "u8", "cKFHg" ], [ 7984, "u8", "cPn11\tcr\u0026X\u00262fWc" ], [ 9169, "u8", "\u00262\u0026qf2\u0026v2f\u0026W\u0026\u00262{fc2 2\u0026f ff2%f\u00262{\u0026W\u0026*f2\u0026Gf*2 f\u00262X2cfy\u00262\u0026G2c2*\u00262\u0026*\u00262\u0026ff2\u0026v2*\u0026+\u0026\u00262" ], [ 9249, "u8", "fc2*2\u0026fGff2vf\u00262" ], [ 9441, "u8", "fc2*2\u0026fvff2Gf\u00262{\u0026W\u0026+f2\u0026 ff2%f\u00262{2cfW\u00262\u0026G2c2+\u00262\u0026+\u00262\u00260f2\u0026G2*\u0026W\u0026\u00262+fc2c2\u0026fvf*2Ff\u00262" ], [ 9745, "u8", "\u00262\u00260f2\u0026 2f\u0026Z\u0026\u00262+f\u00262G2\u0026fcff2%f\u00262*\u0026W\u0026+f2\u0026cff2\u0026f\u00262X2\u0026fl\u00262\u0026\u00262c2q\u00262\u0026X\u0026W\u0026ff2\u0026*2f\u00262\u0026\u00262" ], [ 10225, "u8", "\u00262\u0026Xf2\u0026vff2\u0026f\u00262{2\u0026fW\u00262\u0026 2\u00262T\u00262\u0026{\u0026W\u0026+f2\u0026G2*\u0026y\u0026\u00262{fc2c2\u0026f ff2!f\u00262+\u00262\u0026*f2\u0026*f*2vf\u00262X2cfy\u00262\u0026 2c2*\u00262\u0026f\u00262\u0026qf2\u0026 2*\u0026l\u0026\u00262+fc2*2\u0026f f*2cf\u00262{" ], [ 10637, "u8", "\u00262\u0026{\u00262\u00261f2\u0026 2*\u0026l\u0026\u00262{f\u00262 2\u0026fvf*2vf\u00262{\u00262\u00261f2\u0026*f*2cf\u00262f2cf8\u00262\u0026\u00262c2q\u00262\u0026{\u00262\u0026+f2\u0026v2*\u0026+\u0026\u00262{f\u00262,2\u0026fGf*2 f\u00262+\u00262\u00260f2\u0026Gf*2cf\u00262+2\u0026fF\u00262\u0026G2c2f" ], [ 11815, "u8", "rO4Pi?gFCcK.rTo+.dcZ.+mO" ], [ 12129, "u8", "DKm/09+6kUkDkGU,fb\\\\9BPrqP(}BP+~S~f@#@\u00262UN,jE(@#@\u0026@#@\u0026@#@\u0026@#@\u0026@#@\u0026@#@\u0026@#@\u0026@#@\u0026j!4,?5VCUcSh" ], [ 14045, "u8", "2vfFb22vyGl{ yff\u0026F2" ], [ 14353, "u8", "fF GX" ], [ 14449, "u8", "Ty 8fvF2 G" ], [ 14493, "u8", "G fFF+fvlvR" ], [ 14525, "u8", "/vGvRGT 1{;v+vG" ], [ 14541, "u8", "*+\u0026{fFFv/fz!9!zTG!32s2 2Gl" ], [ 19933, "u8", "yFqZF+ FlFZ" ], [ 22342, "u8", "TR!+F8TZ8 qX8v!/TyFq!;qyFX8vZf2Z%8qFZFT!yvTTZ!!yXslGvw" ], [ 22397, "u8", "/vWvyGov{{2GfG8" ], [ 22647, "u8", "cFFvy{XvAvlv{cX" ], [ 22781, "u8", "fGwvyGfv1" ], [ 22903, "u8", "s+svWX3 2Glvfv+{lGov2{*+ X3yfvX" ], [ 23255, "u8", "WGqvl" ], [ 23261, "u8", "yGfW 8fvyGw" ], [ 23812, "u8", "v1fG T\u00262" ], [ 23901, "u8", "yG1F!Fsv2cyq!ZFTG8!TTZ!!ZTFZ*!ZTT!2Glvfv1" ], [ 26775, "u8", "Z!+GZTOvTZ +!!yGZT*+!Tc+!T3+!!l{!Z%vZT**Z!Z T!q" ], [ 27159, "u8", "Z!TGZTZGTZFW!!z!ZTfZs" ], [ 27479, "u8", "Z!/vZTZGTZ!F!!8cZTbZ!TfZf" ], [ 28119, "u8", "Z!TGZTZGTZFW!!z!ZTfZ," ], [ 28615, "u8", "l%T%ZT!Z!+TZb!TTG!T!GfZ!92!Zf\u0026Z!Gf!Zff!ZffTZf\u0026ZTf2!!GfT!G\u0026Z!9\u0026TTG\u0026T!Gf!ZffTZf\u0026TTG\u0026T!GfZ!92!Zf\u0026Z!Gf!Zff!ZffTZf\u0026ZTf2!!GfT!z!Z!9!9f" ], [ 29757, "u8", "T!lGZ!1vTTGvT!w" ], [ 29773, "u8", "!Z {TZ%vTT2cT!Z+Z!X+!ZGvZ!W" ], [ 30205, "u8", "T!WGZ!qvTT2vT!O" ], [ 30285, "u8", "!ZZ*TZZ*TTWGT!;" ], [ 30513, "u8", "TZcGZT*+!!G" ], [ 30609, "u8", "TZccTTZ T!A" ], [ 30660, "u8", "vTTlvT!W*!ZZXTZFvTTWGT!8" ], [ 30717, "u8", "T!WGZ!XvTTGvT!w" ], [ 31037, "u8", "T!WcZ!T TTyGT!l" ], [ 31437, "u8", "!Z {TZ%vTT2vT!O" ], [ 31613, "u8", "T!wvZ!1vTTWGT!8" ], [ 31677, "u8", "T!WcZ!T TTAvT!O" ], [ 32557, "u8", "!Z%fTZF\u0026ZT,+!!wXT!8vZ!*GTT8vT!W*!Z!+TZ GTTlvT!2{Z!Xl!ZZ*Z!y{!Z*" ], [ 32817, "u8", "TZcGZTF+!!2" ], [ 32941, "u8", "!Zc{TZFvZTcW!!Z+T!yGZ!XvTT2GT!lX!ZZXTZ%vTT2vT!y{Z!o+!Zc*Z!;XGW!T!Z!+TZb!ZTfZ!!GfT!G\u0026Z!9\u0026TTG\u0026T!Gf!ZffTZf\u0026TTG\u0026T!GfZ!92!Zf\u0026Z!Gf!Zff" ], [ 33393, "u8", "TZGGZTcF!!+" ], [ 37053, "u8", "T!;cZ!/*TTWGT!;" ], [ 37501, "u8", "T!lGZ!1vTTWvT!O" ], [ 38993, "u8", "TZ\u0026GTTFGT!w" ], [ 39181, "u8", "!Z {TZ%vTT2cT!Z+Z!X+!ZZvZ!F" ], [ 39613, "u8", "T!GvZ!ovTTyGT!R" ], [ 39849, "u8", "!Z\u0026*!ZZXTZ*vZTZ+!!F" ], [ 40017, "u8", "TZ GTTWGT!O" ], [ 40765, "u8", "T!OcZ!T TTyGT!O" ], [ 43207, "u8", "Z!XGZTZ+!Tq+!!" ], [ 44567, "u8", "Z!XvZTZGTZs+!!;*ZTZ+!TZ+!TX+!!R" ], [ 47729, "u8", "TZ! ZT\u0026F!!l{T!WGZ!qvTTWGT!2{!Z!+TZ%vTTWGT!O" ], [ 47985, "u8", "TZGGZT!y!!W" ], [ 47997, "u8", "T!lvZ!/vTTOvT!8" ], [ 48471, "u8", "Z!{GZTZ TZc+!!lvZTZ+!T,+!Tq+!!+" ], [ 49105, "u8", "TZ! TT2GT!l{Z!*F!ZFvZ!W{!Z\u0026{!Z!+TZ%vZTcF!!O" ], [ 49149, "u8", "T!FGZ!T TTWvT!l" ], [ 49533, "u8", "T!OvZ!qvTTRvT!2*,8!TTZ%vTTWGT!F" ], [ 50557, "u8", "T!WGZ!XGTT2vT!l" ], [ 50685, "u8", "T!WGZ!TGTT8vT!2" ], [ 51313, "u8", "TZ GZTsy!!w+T!z\u0026Z!fGTTZGT!W{!Zc{TZ%vq*Z!T!Z+Z!)2!Z\u0026GZ!2{!Z*" ], [ 51537, "u8", "TZ%vTTw T!;fZ!32!Z*vZ!;" ], [ 51793, "u8", "TZ%vTT2vT!w+Z!oy!Zb\u0026Z!Z{!Zc{!Zc{TZ%vlf!Z!!O+T!~\u0026Z!X\u0026TTZ\u0026T!Ff!Z\u0026fTZ2 TTZ\u0026T!A+Z!q2!Z *Z!;*!Z\u0026*!Z!+TZc*ZT*W!!A*T!A Z!T TT~\u0026T!yf!Z2+" ], [ 52733, "u8", "T!WGZ!/vTTlGT!G" ], [ 52925, "u8", "T!GvZ!XvTTFvT!A" ], [ 52945, "u8", "TZ GTTwvT!O" ], [ 52989, "u8", "T!WGw T!TTGvT!w" ], [ 53009, "u8", "TZ2 TTAvT!8" ], [ 53821, "u8", "T!yGZ!T*TTW f ZT!Zc{TZ2vTTlvT!G" ], [ 56710, "u8", "{Z!+GZT*+!Tfl!!*" ], [ 56983, "u8", "yGT*2{lv1+ FsvWG2" ], [ 57533, "u8", "/v8G2GT!1{yG*GA" ], [ 57597, "u8", "/clvlv+G" ], [ 57681, "u8", "/+ cTTOG/vZ{Ov*FZ+*GGcZT,FZ" ], [ 58039, "u8", "AWZv8" ], [ 58045, "u8", "XGWGyG1v" ], [ 58071, "u8", "WG1vFXWGTF,F G2vl" ], [ 58301, "u8", "XGwv;vfcTTRGov+**+ {1+vcTTRGXv;" ], [ 58385, "u8", "*F\u0026GTTRGXvW" ], [ 58397, "u8", "Av1Wc+2vlvZT%F\u0026" ], [ 58423, "u8", "s+%cW{0GlvAc/v/" ], [ 58439, "u8", "8vfcZT%F**$+svo" ], [ 58493, "u8", "ov2vOv3vXXwv**ZTGFG{/WvcTTFGovW" ], [ 58551, "u8", "GlcGA" ], [ 58557, "u8", "XvyGyGXGf*w**Gl" ], [ 58583, "u8", "Av1vFXWv3+*FsvyGF" ], [ 59095, "u8", "WvXvy{2c1W!ZcG2GO" ], [ 59262, "u8", "GAvwvfcTTWG+G8" ], [ 59287, "u8", "yG0vWXZ!*F FFvZGO" ], [ 59501, "u8", "!Zc{o+%v2{2+*vl" ], [ 59569, "u8", "XFsv2" ], [ 59581, "u8", "ovOvWGqvf" ], [ 59719, "u8", "WG3vw" ], [ 59735, "u8", "yG+Gl{2colcF*vFvZTcF2" ], [ 59793, "u8", "TZcG3" ], [ 59927, "u8", "Av1cF{WvTZcF2vlvG" ], [ 60029, "u8", "3vOG2GqcX" ], [ 60039, "u8", "WGqvF" ], [ 60273, "u8", "TZcGO" ], [ 60471, "u8", "s+ GZX1GGcZ!*Gf" ], [ 60625, "u8", "TZcGf" ], [ 60695, "u8", "WvqcZTWGf+*+bvyvw*c+c" ], [ 60733, "u8", "fGyG8vT*TTWGfv8" ], [ 60849, "u8", "0Wcvl" ], [ 60935, "u8", "GvXG2" ], [ 60941, "u8", "s+c*1FfcoXWGXvF" ], [ 61079, "u8", "wv+GZXWGX+GW!!2G2{*+\u0026" ], [ 61101, "u8", "s+ {Tl%vZT\u0026F\u0026Gl" ], [ 61117, "u8", "fv2vlGf*oXWGXvF" ], [ 61143, "u8", "2vqcA" ], [ 61383, "u8", "Wvqvl" ], [ 61649, "u8", "olcGX" ], [ 61847, "u8", "WG3vl" ], [ 62129, "u8", "q+Zv+*GFcvZTfGFv8v/v" ], [ 62353, "u8", "fl2 9" ], [ 62462, "u8", "cWGwv0vf{AvXvl" ], [ 62481, "u8", "fl Gq" ], [ 62551, "u8", "GvT!2{lv1+ FsvWG2" ], [ 62653, "u8", "ovGcFv3v1" ], [ 62935, "u8", "Gv1vW{AvXF l2 Gvl" ], [ 62999, "u8", "OvfG8" ], [ 63050, "u8", "Gy{*+\u0026XTFsv+{lv*GA" ], [ 63223, "u8", "vF Gl" ], [ 63319, "u8", "wvfGw" ], [ 63511, "u8", "WGfv2" ], [ 63517, "u8", "A TZ FsvWG2" ], [ 63623, "u8", "yG+Gl{\u0026WsXTZ Go" ], [ 63697, "u8", "/+\u0026cTTyGovy{yGXWcF\u0026vlvz" ], [ 63799, "u8", "bW!!y{XvFGwv/co" ], [ 64113, "u8", "{l%vZT F*vG" ], [ 64189, "u8", "qvRcWG3vX" ], [ 64381, "u8", "/vycOG*GT{GvXcZT F*" ], [ 64455, "u8", "WG3vO*s+cX*F GX" ], [ 64477, "u8", "2cTZ F*vFv8" ], [ 64599, "u8", "lvfGZTyGX+c+2vlv2XcFs" ], [ 64695, "u8", "Z+\u0026cZT+GlvWv3vX" ], [ 64823, "u8", "vFsvy{TGZ!yGXv*" ], [ 65117, "u8", "yGTlf+%vWGO" ], [ 65137, "u8", "qW2vl" ], [ 65399, "u8", "lcvy{qvwvyvTG1" ], [ 65553, "u8", "o+%vTTZGX*O{lv$Wsl*v+Gw" ], [ 65649, "u8", "1Wfvl" ], [ 65769, "u8", "G+!T2+G{o+cvW{*F%v2Xo*2*2*3cTTAv{Gw" ], [ 65943, "u8", "WGTGl" ], [ 65949, "u8", "2v0F*W GlvA" ], [ 66007, "u8", "ZGocW" ], [ 66199, "u8", "Gv1vWXyGX+c+2vlv2XcFZ" ], [ 66226, "u8", "lcvy{s+GG2{fG8vZ*Xv0" ], [ 66711, "u8", "wvfcA+GvX+cF\u0026GOG2X!Z2" ], [ 66749, "u8", "3vOc2GfGX" ], [ 66775, "u8", "WGqvW" ], [ 66877, "u8", "1v2GyGXv" ], [ 67063, "u8", "2+svZ{9vwv2c3 9" ], [ 67095, "u8", "ZGocl" ], [ 67217, "u8", "XF2voXWGovw" ], [ 67255, "u8", "F+ GWXovWGZG1G+{2c1cZTf+ {o+vcTTGvovy{+colcF*v2GZTf+s" ], [ 67351, "u8", "8vXvy{ZG*FcF%vw*W{*+G" ], [ 67399, "u8", "Fv/v8*%+\u0026{q+%cTTGv0vW{Ov+Fs+Gv;v8*%+!{!Zf" ], [ 67453, "u8", "/v8c2v1v+{WGXvG" ], [ 67505, "u8", "TZfvl" ], [ 67511, "u8", "cF,cwX*GlvFvT!9" ], [ 67646, "u8", "cZ!;vfGfXlv/vy" ], [ 68183, "u8", "Ovfvl" ], [ 68285, "u8", "ov;v;vqcTT~vovw" ], [ 68349, "u8", "ovwvRc3vXXZ!$v2" ], [ 68593, "u8", "fW Gl" ], [ 68733, "u8", "/v;v8vfcX" ], [ 68765, "u8", "yv/+Z+Fv2c2" ], [ 68893, "u8", "lv/W2+svOvW{F+f" ], [ 68925, "u8", "fvwvyGTGTTRv*GF" ], [ 68945, "u8", "/W2v1" ], [ 68983, "u8", "cFFvZX+GlvWv/vo" ], [ 69024, "u8", "WZ+ZvWvZT%+c{F+f*TZ%v2{F+%cZ{T!Rv2Gqv0*lv*Gl{!Ff" ], [ 69298, "u8", "l2 l" ], [ 69341, "u8", "wv/W2+svOvW{!FF" ], [ 69463, "u8", "ycXvW{8v/WGF*vAcZTG+2" ], [ 69693, "u8", "T!lvzG1vf{w*XvF" ], [ 69757, "u8", "qvOvWG1v3" ], [ 69885, "u8", "1v+GyGXvfXWvXGw" ], [ 69949, "u8", "TGRGlco**{lvfGZT*+*{/+Fv" ], [ 70033, "u8", "XFZvq" ], [ 70102, "u8", "XFv3vO" ], [ 70135, "u8", "FcG2Xo*WGlv{vTTlvXG;" ], [ 70193, "u8", "XFZv8" ], [ 70263, "u8", "F%vWX*vlv2GfGX" ], [ 70445, "u8", ",+ {*FcG8*cF%vF" ], [ 70461, "u8", "1vyGOGTGo" ], [ 70513, "u8", "XFcvw" ], [ 70519, "u8", "F!*O{/vyvGvXvf{2GqcZT*+c{XF v1" ], [ 70599, "u8", "wvfcZT*+c{XF v1" ], [ 70727, "u8", "WGTGO" ], [ 70769, "u8", "1+ GW{cFFcA" ], [ 70781, "u8", "ovOvWGfvX" ], [ 70999, "u8", "Wvqvy{W*1FZ+ vGvl" ], [ 71191, "u8", "OvfGO" ], [ 71431, "u8", "wvfcW" ], [ 71569, "u8", "TFfvo" ], [ 71741, "u8", "/vyv8vfG{{wv+Gy* Fs" ], [ 72157, "u8", "ycfFG+2vOvW{cF*" ], [ 72189, "u8", "/vZGZGqcTTlvfG8" ] ], "v": { "file.stem": "cb2c603f556c97544e3af512a35634cea1360482efd48b9832af3648d33445d3", "file.basename": "cb2c603f556c97544e3af512a35634cea1360482efd48b9832af3648d33445d3.vbe" }, "id": "vbs" }, "id": 0, "sz": 423439, "ts": [ { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 423439.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Last line is over 1000 chars", "e": [ "text.last_line_length = 423439.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Exactly one line exceeds 1000 chars", "e": [ "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "File is a one-liner", "e": [ "text.total_lines = 1.00" ], "i": "metadata/file/text/metrics::file-one-liner", "l": 1 }, { "a": "T1562.001", "c": 0.8199999928474426, "d": "PowerShell char arithmetic", "e": [ "2Gfc2q\u0026l\u0026qf+\u0026*f*2Ff*2q2cfR\u0026W\u0026F2G21\u0026W\u0026+\u0026l\u0026qflcF2*\u00268\u0026c2qfc2,fFf{2vfc2+\u0026+\u0026{f+\u0026\u0026f*2Ffc2q2\u0026f8\u0026l\u0026 2c2q\u0026W\u0026q...", "2 fc2f\u0026F\u0026{f+\u0026Gf*2*fG2f2cf+\u0026W\u0026F2*2*\u0026W\u0026f\u0026W\u0026qf+\u0026G2*\u0026F\u0026v2{fc2F2cfFf*2cfc2*\u0026l\u0026qf+\u0026Ff*2*fvW+2cfF\u0026W\u0026F2\u00262{\u0026W...", "Wvfc2+\u0026F\u0026{flcFf*2FfvW+2cfF\u0026W\u0026F2G21\u0026W\u0026+\u0026l\u0026qf+\u0026*2*\u00268\u0026c2qfc2,fFf{2vfc2+\u0026F\u0026{fl\u0026Ff*2Ffc2q2cf8\u0026W\u0026F2\u00262T\u0026W\u0026+...", "2 fc2q\u0026+\u0026{fWc\u0026f*2cfc212cfO\u0026W\u0026F2*2*\u0026W\u0026q\u0026+\u0026{fWc\u00262*\u0026W\u0026vW+fc2,fFf*W\u0026fc2q\u0026+\u0026{fWc\u0026f*2vfcW*2c*+\u0026W\u0026F2c2*\u0026W\u0026*...", "W\u0026fc2+\u0026W\u0026qf+\u0026cf*2Ff\u00262*2cfF\u0026W\u0026F2v20\u0026W\u0026+\u0026W\u0026qf+\u0026c2*\u00268\u0026cW*fc2,fFf{2!fc2+\u0026W\u0026qf+\u0026*f*2Ff*2X2cfF\u0026W\u0026F2G2X\u0026W\u0026+..." ], "i": "objectives/evasion/anti-av/amsi::powershell-char-arithmetic", "l": 1, "m": "E1562", "el": [ "0x361be", "0x3c2fe", "0x322be", "0x3c57e", "0x364be" ] }, { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 1.00" ], "i": "metadata/file/text/metrics::file-under-12-lines", "l": 1 }, { "c": 0.8500000238418579, "d": "PowerShell or VBScript line bloat", "e": [ "text.avg_line_length = 423439.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::script-host-line-bloat", "l": 4 }, { "a": "T1027", "c": 0.699999988079071, "d": "Very low whitespace ratio (minified/compressed)", "e": [ "text.whitespace_ratio = 0.02" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace", "l": 2, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Encoded payload detected: url", "e": [ "2 fc2f\u0026F\u0026{f+\u0026Gf*2*fG2f2cf+\u0026W\u0026F2*2*\u0026W\u0026f\u0026W \u003curl\u003e", "Wvfc2+\u0026F\u0026{flcFf*2FfvW+2cfF\u0026W\u0026F2G21\u0026W\u0026+\u0026l \u003curl\u003e", "2Gfc2q\u0026l\u0026qf+\u0026*f*2Ff*2q2cfR\u0026W\u0026F2G21\u0026W\u0026+\u0026l \u003curl\u003e", "W\u0026fc2+\u0026W\u0026qf+\u0026cf*2Ff\u00262*2cfF\u0026W\u0026F2v20\u0026W\u0026+\u0026W \u003curl\u003e", "cy\u0026*2XfvWc2vf\u0026ff2FfcWX\u00262\u0026ff+\u0026 f{2\u0026fcWX2\u0026 \u003curl\u003e", "2 fc2q\u0026+\u0026{fWc\u0026f*2cfc212cfO\u0026W\u0026F2*2*\u0026W\u0026q\u0026+ \u003curl\u003e" ], "i": "metadata/encoded-payload/url", "l": 3, "el": [ "offset:246526", "offset:205502", "offset:221630", "offset:222398", "offset:241710", "offset:247166" ] } ], "sha": "cb2c603f556c97544e3af512a35634cea1360482efd48b9832af3648d33445d3", "path": "cb2c603f556c97544e3af512a35634cea1360482efd48b9832af3648d33445d3.vbe", "type": "vbs" } ], "tv": "52045" } }