{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 1.0, "class": 2, "threshold": 1.0 } ], "prob": 1.0, "class": 2, "level": 3, "models": [ { "m": "az", "prob": 0.96875, "class": 0 }, { "m": "az/vbs", "prob": 1.0, "class": 2 } ], "version": "v17.17", "threshold": 1.0, "analyzed_at": "2026-05-31T09:10:44Z" }, "path": "d2b61efb7798490945e133621450df5a9ee5dbe80720bbcf9fc8b4209d8c3958.vbe", "raw": { "v": "5", "fs": [ { "f": "O(As)Md", "x": 35, "ff": { "m": { "file": { "size": 393336.0, "entropy": 4.24, "size_bytes": 393336.0 }, "text": { "tab_count": 69.0, "digit_ratio": 0.27, "space_count": 5975.0, "total_lines": 1.0, "char_entropy": 4.24, "unique_chars": 100.0, "escape_density": 0.0, "lines_over_200": 1.0, "lines_over_500": 1.0, "avg_line_length": 393336.0, "high_byte_ratio": 0.0, "lines_over_1000": 1.0, "max_line_length": 393336.0, "non_ascii_ratio": 0.0, "null_byte_count": 1.0, "last_line_length": 393336.0, "long_token_count": 1010.0, "whitespace_ratio": 0.02, "most_common_ratio": 0.16, "octal_escape_count": 3.0, "non_printable_ratio": 0.02, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 2.0, "most_common_char_codepoint": 38.0 } }, "s": [ [ 0, "u8", "#@~^XQAGAA==@#@\u0026r2DkKxPA6ask1kO@#@\u0026@#@\u0026@#@\u0026@#@\u0026Gr:,SHw#B@#@\u0026?" ], [ 757, "u8", "rDt,1f\u0026AG KMkLo" ], [ 4547, "u8", "*r#@#@\u0026,PP~)~ptfv" ], [ 5112, "u8", "\\+Md+vM(}\\i`V(}Hi`!p}Hi`rf\u00262 ff2,\u0026ffy\u0026f\u0026Of2\u0026X2c2c\u00262\u00262f\u00262Ff\u00262 f*2c\u00262f*2c\u0026yff\u0026y\u00262\u00261\u0026ffy\u0026f\u0026Ff\u00262*f*2\u0026\u0026ffy\u0026f\u0026Ff2\u0026+2\u00262%\u00262\u0026Ff\u00262cf\u00262vff2" ], [ 7529, "u8", "Kn6OobVn`z/Z\\HcbBPK.;" ], [ 7634, "u8", "6Y@#@\u0026,~P,@#@\u0026P,P~)GI" ], [ 10374, "u8", "WGfGl" ], [ 10416, "u8", "fFZv8" ], [ 10422, "u8", "v+ GffG2Glvfvf" ], [ 10480, "u8", "TyZvl" ], [ 10557, "u8", "GA GvfGq" ], [ 10758, "u8", "yGfvO" ], [ 11126, "u8", ",F GfXvAvwv/vq" ], [ 11148, "u8", "cF\u0026{Ty 0fG" ], [ 11161, "u8", "cWXl*+yf2GvAvO" ], [ 11472, "u8", "TZ2 TTWGT!A" ], [ 11580, "u8", "T!yGZ!ocTT8!T!Zq!Z%*TZ!!TTZ T!ZTZ!*F!Z%vZ!F" ], [ 11644, "u8", "T!2cZ!/vTT8vT!F" ], [ 13308, "u8", "fvRGlc3vo" ], [ 13318, "u8", "AcTG8" ], [ 16246, "u8", "s+%vW{XvGvZ *vX" ], [ 16272, "u8", "X+Gv/fyFXvZ{OG*lcZ2!W*ZTFZ2fc+s" ], [ 16560, "u8", "fW!GW{cF%cZ{qvwv2*3 f{;vov2" ], [ 16588, "u8", "s+c{o+ GTXA fGl" ], [ 17247, "u8", "Z\u0026Z%!Z!ZT\u0026Z%fF8vTfZ%\u00268q!8 !8TT!+!R!3!qTZ!*!8f 8vTfZ!!){Z!1GZTRGTZGF!!+GZT*F!TcF!TfF!!y{!ZFGZTTGZ!wvT!3" ], [ 18428, "u8", "T!2cZ!T TTO T!w" ], [ 20880, "u8", "TZ2vTTOv9!ZTZ!fF!Z2vZ!w" ], [ 21200, "u8", "TZZvTTOGT!l" ], [ 22044, "u8", "Z!X+!Z%vZ!2X!Z2" ], [ 22248, "u8", "!Zc{!Z*{TZ%vZT\u0026Fs ZTT!WGZ!+GTT8vT!W{!Z\u0026{TZ*vTTy*T!2*Z!Tl\u00268!!Z!Zf!Z!+!Zc{TZs ZT!y!!2{T!w Z!T TT+vT!w+!Z!+TZ*vTTRGT!l" ], [ 22588, "u8", "T!WGZ!fGTTAvT!O" ], [ 22908, "u8", "T!2GZ!fGTTlvT!2" ], [ 23164, "u8", "T!8vZ!3cTTOGT!8" ], [ 23184, "u8", "TZ!GTT2GT!O" ], [ 23484, "u8", "T!Wv2FT!TTWGT!O" ], [ 24028, "u8", "Z!+2!ZZcZ!~*!Z f!Z%fTZGcZTcF!!+{T!lvZ!{*TTw T!G*!ZG" ], [ 24112, "u8", "TZ%\u0026ZTGW!!G" ], [ 24272, "u8", "TZ%GTTW\u0026T!zXZ!0FF2!!Z!Gf!Zff!ZF*TZfvZT!l!!F{T!R\u0026Z!XcTT8GT!ZX!Z%fTZ,GTTO\u0026T!R*Z!qW!Z*vZ!W{!Zvf!Z%{TZ!GZTFW!!R" ], [ 24412, "u8", "Ov/+\u0026WfvyGw" ], [ 24582, "u8", "ZG9vw" ], [ 24598, "u8", "lvfG2{8cTZ*+cGlGy" ], [ 24854, "u8", "WGXGy" ], [ 24860, "u8", "Ov+FcFcG8cO{cF," ], [ 25052, "u8", "yGo+\u0026W%c2*ZTZ+Z" ], [ 25148, "u8", "Xvzvyvoc*{2vqvy{cF" ], [ 25308, "u8", "Fv3+F+%v2cZTc+2" ], [ 25558, "u8", "Av1cl" ], [ 25692, "u8", "FcTZcF2vlGw" ], [ 25744, "u8", "fF Gq" ], [ 25872, "u8", "XFcvo" ], [ 25884, "u8", "8v9WslcGlvF" ], [ 25916, "u8", "fvwvyGT*TT2GfGl" ], [ 25981, "u8", "cGvyGov" ], [ 25996, "u8", "FcXTZ Go" ], [ 26038, "u8", "s+fcwX*Glv2GT!X" ], [ 26102, "u8", "G+Zv8*fvOvyG*GX" ], [ 26182, "u8", "yGovF" ], [ 26294, "u8", "2+FvG*/vlv8v*v3" ], [ 26454, "u8", "Av1vFXwv3W*+cG8vl" ], [ 26652, "u8", "FcTZ F*vWGO" ], [ 26694, "u8", "FvqvA" ], [ 26806, "u8", "Z+ccZTfGlvWG1G+*WGXvF*!Z%f" ], [ 27222, "u8", "Gco*W{lvfF!ZcGlGw" ], [ 27372, "u8", "s+!{fF*vyX +*vFXTGWGWG0cTTWGfGl" ], [ 27516, "u8", "fcA GvXv*{2G1G2X!Z fT+\u0026v3" ], [ 27574, "u8", "ZWsvWXT!OGWGTG9" ], [ 27638, "u8", "fWs*W{XvFvZ!fGX" ], [ 27792, "u8", "/+*coXWGXvF" ], [ 27958, "u8", "FFvZ{9vwv2c/vq" ], [ 27974, "u8", "AvovO" ], [ 28220, "u8", "XvWG2G1GfXZ!{vA" ], [ 28470, "u8", "vWZvl" ], [ 28502, "u8", "Av1vF{8v+FcW2 Gvl" ], [ 28592, "u8", "TZ2vl" ], [ 28614, "u8", "Ov+GZXslc{X+GvTTAvXvl" ], [ 28662, "u8", "Z+*vW*T!yGlvfGXXWG3vl" ], [ 28684, "u8", "F {XF\u0026coXWGXvF" ], [ 28742, "u8", "wvfGw" ], [ 29078, "u8", "yGXvW{Av1W!Z\u0026G2Gl" ], [ 29142, "u8", "wvfcZTRv*FF+!*ZGG" ], [ 29180, "u8", "/cAvwv1v*{2vXvA" ], [ 29212, "u8", "lv*WslcGlv2{!ZZ" ], [ 29318, "u8", "WG3vw" ], [ 29366, "u8", "fWcGA" ], [ 29385, "u8", "Gy{*+\u0026XTZGv3" ], [ 29446, "u8", "FGovW" ], [ 29468, "u8", "Wv*F*F%v2*W{*+A" ], [ 29552, "u8", "o+%vW{*+fcl" ], [ 29820, "u8", "qv2vwv/c*+yc" ], [ 30076, "u8", "fclvWGqv/*Z!{vA" ], [ 30134, "u8", "F%vWX*vlvzG1v+{lv*Gl" ], [ 30204, "u8", "XvyGWGf*TTFv3vw" ], [ 30284, "u8", "+*{o+ccTTWv3vl{wv+l!Z%vWG8" ], [ 30460, "u8", "XvzvyvocX" ], [ 30470, "u8", "WGqvA" ], [ 30486, "u8", "wvfcZTOG*F!FfvlcZTcF\u0026" ], [ 30726, "u8", "yGXvG" ], [ 30736, "u8", "XWcGX" ], [ 30940, "u8", "Rvf+ FFvlv2XcF\u0026" ], [ 31363, "u8", "cTTlv9vO" ], [ 31420, "u8", "XvWG2G1GfXFv3vO" ], [ 31452, "u8", "yc*2v2\u0026GOcwXcF*" ], [ 31750, "u8", "wvfcZT*+b{1+\u0026*+{lv" ], [ 31932, "u8", "/v;v8vfc+{lv9vO" ], [ 32054, "u8", "2W2 G" ], [ 32086, "u8", "Gvqv;*w*TZ!2FvZ!2fslsXcyF" ], [ 32118, "u8", "F+ZcwXT!lvWGXG+" ], [ 32188, "u8", "qvRcWG1vq" ], [ 32214, "u8", "Ovovz*Z!*F FFvWG2X!Zc{ FF" ], [ 32390, "u8", "WGTGl" ], [ 32492, "u8", "cW {X+GvF" ], [ 32598, "u8", "WGqvF" ], [ 32624, "u8", "1WcvA" ], [ 32944, "u8", "1+ GW{cFFcW" ], [ 33168, "u8", "/+svf*ZGXGw" ], [ 33244, "u8", "Wv3+F+%cGvw" ], [ 33286, "u8", "RcXvZ{,FcXX+fv1" ], [ 33392, "u8", "/+,vZ{f+sv2*3 lvGv1v*{AvXGyX2yf" ], [ 33846, "u8", "Z+,vZ{9vwv2c3 9" ], [ 33926, "u8", "WvXcZT*+c{XF v1" ], [ 34160, "u8", "9+,vWXGFcvZTXvzGOvf*+" ], [ 34508, "u8", "FWc{X+GcTTZGXvl" ], [ 34710, "u8", "WGfGO{2*TZGFsvWvA" ], [ 35030, "u8", "yG*G2XGvo+c+2v8vyXcF*" ], [ 35062, "u8", "F Gl{fvZ!;cT*TTGvovW" ], [ 35190, "u8", "GFFcO" ], [ 35196, "u8", "TGWc2GfGX" ], [ 35446, "u8", "FccF{T!8cAvov1" ], [ 35462, "u8", "WGTGO" ], [ 35536, "u8", "Tlcv3" ], [ 35846, "u8", "AvXv2X!Z *TZ2v1" ], [ 35996, "u8", "8vX+ l2vOvF" ], [ 36176, "u8", "flcGf" ], [ 36182, "u8", "lv3vA" ], [ 36304, "u8", "/+FvTTWG3vl" ], [ 36460, "u8", "*F *TZ%vW{G+2vl" ], [ 36476, "u8", "/cyGlv" ], [ 36652, "u8", "%W!TfFcG2{s+%cZTXv2vAvqv*{2G3vO*cF*" ], [ 36720, "u8", "+F%vWXslfvZTXv2vAvqv*{2G3vO*cF*" ], [ 36988, "u8", "/vZGZGqcTTyGXvW" ], [ 37040, "u8", "fl vl" ], [ 37072, "u8", "fl vX" ], [ 37116, "u8", "ocyGlvfGXXw*9vZT F*" ], [ 37180, "u8", "XvzvyvocT{ZGqcwXf+!T3+sv1" ], [ 37206, "u8", "WGqv2" ], [ 37372, "u8", "fvOv+GXv**A fvO" ], [ 37398, "u8", "lGfGO" ], [ 37494, "u8", "cFFv2" ], [ 37766, "u8", "yGXvW" ], [ 37808, "u8", "+F%vWX!Z\u0026Gl" ], [ 37974, "u8", "2vfGG" ], [ 37992, "u8", "s+f*Z2!TTZ!!RTG2F!23{!8!8!q%fTA!T!G+ Z\u00261TZf +T;cT!~qZ!TZ!Z!!y!;*!Z,q!Z!qTZ!!yTZW!!;TT!ZFZ!T!TTz!T!8q!ZfTTZs!TTG!T!ATZ!*Z!Zv!Z!WT" ], [ 38723, "u8", "sTTZ!T!w*FZffTZ!!TTl!T!+TZ!qZ!Zc!O!8T%Zv3%Zv30Z%fRTF;%!R10!F%R!Tv0Tz*+!O0%Zs*0Z%cTT;,0!2*y!1F%Z% y!l{%ZFqGZZ3{ZZbFTvOG!w" ], [ 40529, "u8", "82GfTOf+!l++FqF\u0026Z,fZ!2qFZ,q\u0026Z,9TZ*Z+q2l !O9T!lZ+F3c+TOf+!l+v8c**ZF +Tl q!OqW!18!Z*Z+FO+FZF3GZ\u0026)qZ,FWT,Z !l+q!OFW!q!{T~%f!A3!ZFf{" ], [ 40684, "u8", "bZb1fZ,2FTF+*Fy$f!O2W!oG1TF*f!O{GZAXX8b%fTOG{!y*~!*W\u0026ZF!y!l+*8Z{\u0026Z,9{ZA\u0026lqZ+\u0026!O9+!l 8!1FfTOf" ], [ 40777, "u8", "!G0*8!XqZ,vqT~!XFy*2!qyFZ\u0026vlF~+ Z,/GZ +X8sF2T,~ !l+XFR!2!1AfT2f*F;o\u0026Z,$fZ%F*q+2f!O$y!Xyc8%f2!O$GZAqc8F9fZ,Z+TfAcF2)f!Ob2!0 qTOFT" ], [ 42096, "u8", "TZ%vAT\u0026F!!8{T!RvA!fGqTOvT!8{ Z!fTZFGTT2F3!~" ], [ 42636, "u8", "\u0026ZA1$ZvAqTOvf!Rq8!18!Z,cZ!2qFZ,qFZFXfZG,~TslF!O*f!8,~!ocTT8vT!2qFZ,qTZFvTT2F$!z*Z!1l!Z\u0026F~!W*!Z,X\u0026Z!0qZ,FZT,l\u0026!R+q!OF8!qcTTFF$!++" ], [ 43999, "u8", "Z!Z!!Z!ZTcWc*!ZF*TZ\u0026FzTbO\u0026!+*T!2!Z!T!TTZ!T!Z*\u0026ZGf)ZZGfT+cT!2TZ!TZ!Z!!Z!Af\u0026Z2+bZZ*fZvcZT\u0026Z!!ZTT!Z!Z!/\u0026fTR q!Oq%8vTTZ\u0026!TTZ!T!ZTZ!/" ], [ 44867, "u8", "FTTZ!T!ZTcWcXTZv TT2Fq!OqRF" ], [ 47071, "u8", "8!Z!,y!~{!ZFq!ZG*qZ%fZTF2!!zfq!2AZ!q\u0026TTG q!81!ZFfTZ! qTRvT!8fZ!$l!ZF\u0026Z!GT!Z!TsZ*3TZ!!ZT*Z!!FXT!8\u0026Z!X%TTZ!1!~o!Z!TqZ!!TTF*T!G+Z!X" ], [ 47897, "u8", "Fl$FF/W!Zv!+Fl$G8Ff!ZvTqZvcFqvy!!+T" ], [ 48159, "u8", "Zc82GWFz0!Z2qFZv**8AvZTvZcFlT*FZ Z!" ], [ 48451, "u8", "cTqFAT!+T ZG9T8s,TTA!TFy08!" ], [ 50965, "u8", "q+!qF++z!TZ!Z GR FqvZFqZOvq08v!8qZOvFFq" ], [ 52057, "u8", "FRqR!q8ZOvFFFRTF8Z1G8vq0ZFFRT\u00268F!ZTT!R\u0026G%1F*qWF{!8qGZ\u0026q" ], [ 52726, "u8", ",Z%fyf{AA%+!qFXT8FX!2qvGGqXZFF" ], [ 57375, "u8", "GG8v!R,yfG~20GZFq" ], [ 57542, "u8", "O!0!l*Ay T/yb!TTZ!/AR+z!TZ!ZAAwvOTfZb1vZFq{ZFFZ" ], [ 58001, "u8", "Z!!TT;*{!Aol" ], [ 61686, "u8", "fZFFzTT!Z!FbovTq8F)!ZT!ZZ" ], [ 62553, "u8", "FZ{Z!XZFG G2F8q!Z!TFZc302v!ZT!Z2 R+" ], [ 63185, "u8", "8cFqqWFfF8TZ!TZfyf%~FzT!Z!TFO%+)O%F+TbOGF+TT!Z!Z!XbT*+F)!ZT!Zb*0yvFT{Z!X!G+yGf8F8!!Z!2TFW%fvZ!TTZ* R+bZ!!ZToGR WFqF+)z!T!ZT!O%+{" ], [ 63656, "u8", "cZ!T!Zfq3F! 2fv8b!ZTT!zcR" ], [ 64661, "u8", "0R T!ZTF oZ!yb!Z!ZT*R%+!Z!T/Z!!Z+bZ!!ZT*%R FF9*ff+F)!ZT!Zb*0yvFT{Z!f!F)yGf8F8!!Z!+TFy%fvyvTTZ!!Rf%yv!ZTT!8*R )!TTZ!f%R+bOGq" ], [ 64863, "u8", "ZbOGF+!zq\u00262vqbZ!TTZbcR+v8!GZTf!~,yGfFqqZ!T!+T\u0026F%f" ], [ 70097, "u8", "8c!TTZ!9!A{z!TZ!Z,cR WT!Z!T\u0026y2{q8!!ZTF8!!ZTT!OcZ!f!Tf~Fq!ZT!Z*+$8!!f+2 T!ZTZ!TZ!Z!!ZF8TbyvT!Z29)Z!!ZTcy% FT3fz!Z!T!*+R )!Z{!ZFT{" ], [ 70469, "u8", "TZ!T!8+%ycqo8,!+)W!T!ZTz!3F\u00268sFO!y)FZ!T!Z%f/Rv!ZT!Zv\u0026R++FwFO!+b*TZ!T!zT2FFqo8,!+)+!T!ZTAF0y!8sFO!y)cZ!T!ZbT3Fs!wq,Z b+TT!Z!GF0 3" ], [ 72325, "u8", "q+Z) R/fyGq" ], [ 72917, "u8", "TZ!T!AfR *Z!Z!!+!A{bZ!T!Z!+0y%fZT!Z\u0026!R3T W!Z!T!$TAGqFZT!ZZTTZ!!TTF2T!yTZ\u0026$8byb!Z!ZTG8%+ Z2q)yb!ZT!ZGFR++!AFZ!T!)+W!T!ZT2Z!0TF!!q" ], [ 74460, "u8", "WG3y!Z!!Z!ZT!Z!T!Z!TTZ!!ZT%W!!ZTT R!Z!T!TTZ!T!ZT!Z!TTZ!!TTR!T!ZTZ TZ!Z!!Z!ZT!Z!T!Z!TTZ!!ZT!Z!!ZTT!Z!Z!T!TTZ!T!ZT!Z!TTZ!!TTZ!T!ZT" ], [ 75004, "u8", "1vZ AvXG+{Z Xvy" ], [ 76013, "u8", "b1OkKxd ;D+CO" ], [ 85029, "u8", "\u00262\u0026\u00262ffv2\u00262,f\u0026f{2\u0026fc2f\u0026Z\u0026*f8\u0026\u0026f*2\u0026fc2f2vf2\u0026O\u0026\u00262v2*\u0026W\u0026f\u0026y\u0026ffZ\u0026\u00262{\u00262\u0026\u00262ffv2\u00262%f\u0026f+2cf\u00262f\u0026y\u0026ffZ\u0026\u0026f{2\u0026fG2f2vf2\u0026O\u0026\u00262v2*\u0026l\u0026f\u0026W\u0026ffW\u0026\u00262" ], [ 86885, "u8", "\u00262\u0026c2ff 2\u00262%f\u0026f+2\u0026f 2f\u0026W\u0026ffR\u0026\u0026f*2cf 2f2cf2\u00262\u0026\u00262*2f\u0026l\u0026f\u0026l\u0026*f2\u0026\u00262X\u00262\u0026\u00262ffv2c2vf\u0026f" ], [ 87301, "u8", "2\u0026f*2f2vf2\u00268\u0026\u00262v2f\u0026W\u0026f\u0026y\u0026ffR\u0026\u00262+\u00262\u0026 2ffc2\u00262%f\u0026f*2cf 2f\u0026W\u0026ff2\u0026\u0026fX2\u0026f*2f2*fW\u00262\u0026\u00262*2f\u00262\u0026f\u0026+\u0026*f+\u0026\u00262" ], [ 87877, "u8", "2\u0026fc2f2 f2\u0026R\u0026\u00262 2f\u0026y\u0026f\u0026W\u0026ffR\u0026\u00262*\u0026W\u0026 2ffc2\u00262\u0026f\u0026fX2\u0026f*2f\u0026l\u0026*f2\u0026\u0026fX2\u0026f\u00262f2vfW\u0026+\u0026\u00262v2f\u0026+\u0026f\u0026F\u0026ffW\u0026\u00262{\u00262\u0026G2ffv2\u00262Ff\u0026f{2\u0026f 2f\u0026+\u0026ffl\u0026\u0026fX" ], [ 88837, "u8", "2\u0026f*2f2Gf2\u0026R\u0026\u00262v2f\u0026l\u0026f\u0026y\u0026ffy\u0026\u00262+\u0026W\u0026\u00262ff 2\u00262!f\u0026ff2\u0026f 2f\u0026Z\u0026*f8\u0026\u0026f+2\u0026f!2f2 f2\u0026Z\u0026\u00262 2f\u0026Z\u0026f\u0026y\u0026ffZ\u0026\u00262+\u00262\u0026!2ff 2\u00262!f\u0026f+2\u0026f!2f\u0026y\u0026ffZ\u0026\u0026f+" ], [ 89477, "u8", "2\u0026f,2f2Gf2\u0026W\u0026\u00262v2f\u0026R\u0026f\u0026y\u0026ffZ\u0026\u00262{\u00262\u0026\u00262ffv2\u00262%f\u0026f+2\u0026f!2f\u00262\u0026*f8\u0026\u0026f+2\u0026f!2f2 fW\u0026l\u0026\u00262c2f\u00268\u0026f\u0026F\u0026ffZ\u0026\u00262{\u00262\u0026!2ffc2\u00262Ff\u0026f" ], [ 89893, "url", "\u00262\u0026F2ffv2\u00262cf\u0026f+2\u0026f/\u0026y\u0026ffy\u0026\u0026f*2\u0026f/2cfW\u0026y\u0026\u00262c2f\u00262\u0026f\u0026l\u0026ffl\u0026\u00262X\u0026W\u0026\u00262ff*2\u00262\u0026f\u0026f" ], [ 90549, "url", "2\u0026f*2f\u0026+\u0026ffF\u0026\u0026fX2\u0026f 2f2vf2\u0026l\u0026\u00262v2f\u00268\u0026f\u0026+\u0026ffW\u0026\u00262+\u00262\u0026/f 2\u00262 f\u0026f*2\u0026f/\u0026W\u0026*fy\u0026\u0026f*2\u0026f\u00262f2*f2\u0026l\u0026\u00262*2*\u00262\u0026f\u0026l\u0026ff2\u0026\u00262" ], [ 92613, "url", "2\u0026f,2f2vfW\u0026W\u0026\u00262G2f\u0026+\u0026f\u00262\u0026ffy\u0026\u00262+\u00262\u0026 2ff 2\u00262,f\u0026f+2cf*2f\u0026W\u0026ffl\u0026\u0026f{2\u0026f/2vf2\u0026l\u0026\u00262v2f\u00262\u0026f\u0026l\u0026ff8\u0026\u00262{\u00262\u0026*2ffv2\u00262*f\u0026f{2\u0026f 2f\u0026F\u0026ffO\u0026\u0026f+2\u0026" ], [ 94373, "u8", "\u0026W\u0026\u00262ffv2c2\u0026f\u0026f+2cf*2f\u0026+\u0026ffl\u0026\u0026f{2\u0026f%2f2vf2\u0026l\u0026\u00262 2f\u0026y\u0026f\u0026y\u0026ffZ\u0026\u00262X\u00262\u0026c2ffv2\u00262%f\u0026f" ], [ 99431, "u8", "2cfG2" ], [ 100557, "u8", "f\u00262G2*fGf02*fG2" ], [ 100685, "u8", "f\u00262v2%f\u0026fX2vf,2" ], [ 101389, "u8", "f\u00262v2%fGf02v*F2*\u00262\u0026**l\u0026v*" ], [ 101693, "u8", "\u0026y\u0026{fW\u0026v20\u00262\u0026\u00262Xf!2\u00262%f\u0026f02\u0026fG2{\u0026l\u0026{f+\u0026cf*2cfF2*2FfW\u00268\u0026c2F2*\u00268\u0026*\u00268\u0026*f8\u0026c2q\u0026W\u0026F2*fF2c2Ffcfq2*fF2*\u00268\u0026{f8\u0026cf*2cfF2*2Ff+c8\u0026G2%2*\u0026O\u0026*" ], [ 104077, "u8", "fF2c2Ffcfq2cfF2*\u00268\u0026*f8\u0026cfq2vfG2" ], [ 105037, "u8", "fc2c2FfcfX2cfG2*\u00268\u0026{f2\u0026cf+2GfG2" ], [ 108109, "u8", "f 2c2Ff\u0026f*2*fG2" ], [ 108157, "u8", "\u00262\u0026{f+\u0026cWX\u00262\u0026!2Xf%2c2Ffcfq2cfF2*\u00268\u0026*f8\u0026cfq2cfF2*2FfW\u00268\u0026c2F2*\u00268\u0026*\u00268\u0026*f8\u0026c2q\u0026W\u0026F2*fF2cWcfc*q2c**2*\u00268\u0026*f8\u0026cfq2cfF2*2FfW\u00268\u0026c2F2*\u00268\u0026*" ], [ 108493, "u8", "f 2vW\u0026fvf02cfG2X\u0026R\u0026" ], [ 111053, "u8", "f 2c2Ffcfq2cfF2*\u00268\u0026Xfy\u0026cff2cfF2*2FfW\u00268\u0026c2*2" ], [ 111373, "u8", "f 2c2Gf\u0026fX2*f\u00262" ], [ 111501, "u8", "f 2G2vfv*f2cfG2" ], [ 112109, "u8", "2cfF\u0026O\u0026*2v2f\u0026y\u0026X\u0026l\u0026{fl\u0026c21\u0026l\u0026G2X*F2*2%f\u0026fX2*f\u00262" ], [ 112397, "u8", "f 2G2Gfc*X2*f%2" ], [ 112413, "u8", "\u00268\u0026*fl\u0026c*X2Gf%2X2%f+\u0026+\u0026*2v2f\u0026y\u0026X\u0026O\u0026{fl\u0026c2" ], [ 112769, "u8", "*2\u0026\u00262X\u0026l\u0026G2X*F2c2%f*f" ], [ 113357, "u8", "fc2*2cf\u0026fX2Gf,2" ], [ 113469, "u8", "\u0026W\u0026{*8\u0026vWf\u00262\u0026\u00262Xf*2GWFfcfq2*fF2*\u00268\u0026*f8\u0026cf+2cfF2*2FfF\u0026F\u0026\u00262c2*\u00262\u0026*cW\u0026{fl\u0026c2q\u0026+cF2**\u00262G2%fcfX2cfc2*\u00262\u0026" ], [ 114541, "u8", "2*fF\u0026F\u0026\u00262,2f\u0026y\u0026X\u00268\u0026Xf2\u0026c2q\u0026l\u0026F2*fF2*2%fcfq2cfF2*\u00268\u0026*f8\u0026cfq2*fF2*2FfW\u0026+\u0026c2F2*\u00268\u0026*\u00268\u0026{fW\u0026*2" ], [ 115581, "u8", "c2\u0026*f8\u0026cW+\u0026l\u0026 2*fF2c2 fcfq2vfG2*\u0026y\u0026Xf+\u0026cff2v*v2*2*fW\u00268\u0026c2F2X\u00268\u0026*\u0026y\u0026Xfy\u0026c2f\u0026+cv2*f*2c2Ffcfq2*fF2*\u0026y\u0026{f2\u0026cf12cf 2*2FfW\u00268\u0026*2F2*\u00268\u0026*" ], [ 116653, "u8", "2Gfl\u00262\u0026c2*2{\u0026F\u0026*\u0026y\u0026*f+\u0026v2{\u0026l\u0026F2*fF2c2%fc**2cfF2*\u0026R\u0026*fy\u0026cfX2cfF2*2,fW\u0026l\u0026*2*2*c2\u0026" ], [ 116985, "u8", "cl\u0026*\u0026l\u0026*f2\u0026c21\u0026+\u0026G2*fF2c2Ff\u0026f*2Gf%2*\u0026y\u0026*fR\u0026Gff2*fF2*2FfW\u00268\u0026c2F2{\u0026F\u0026*\u00268\u0026ff8\u0026c2f\u0026+cv2*f*2c2 fcfX2cfF2*\u00268\u0026*fF\u0026Gf{2*f 2*2%f+\u00262\u0026G2G2" ], [ 117121, "u8", "fF\u0026*21\u0026+\u0026G2*fc2G2%fcff2v*v2*\u0026l\u0026*fy\u0026cfq2vf,2*2 fWc+\u0026c2*2*\u0026O\u0026" ], [ 117377, "u8", "fW\u0026\u00262*\u0026F\u0026G2*f 2c2%fcf12*f 2*\u0026y\u0026*fy\u0026v*" ], [ 118113, "u8", "fF\u0026*fX2*fF2f2%fW\u00268\u0026c2G2X\u0026y\u0026*\u00268\u0026*fy\u0026c2q\u0026+\u0026,2*f 2G2!fcf*2*f,2*\u0026l\u0026*fy\u0026cfX2cfF2*2,fW\u0026F\u0026G2G2*\u00268\u0026*\u0026W\u0026*fy\u0026c21\u0026W\u0026F2*f,2c2vf\u0026fT2c**2" ], [ 118689, "u8", "fF\u0026*fX2*fF2{2%fW\u00268\u0026c2G2X\u0026y\u0026" ], [ 118781, "u8", "cy\u0026*f8\u0026cW+\u0026+\u0026%2*fF2*2 fcff2v*v2*\u0026l\u0026*fW\u0026vff2*fF2*2\u0026fF\u00262\u0026c2,2X\u0026y\u0026*\u00268\u0026*fR\u0026*2q\u0026W\u0026F2** 2*2\u0026fcfX2GfG2*\u0026y\u0026*fl\u0026v*+2v*c2*2*fW\u0026y\u0026v2\u00262*\u00268\u0026*" ], [ 120077, "u8", "f\u00262c2Ffcfq2\u0026fF2X\u0026y\u0026*f8\u0026cfq2vfG2" ], [ 120781, "u8", "f\u00262c2%fcfq2cfF2*\u00268\u0026{fO\u0026c*X2cfF2*2FfW\u00268\u0026\u00262c2*\u00262\u0026*\u00268\u0026{fl\u0026c2q\u0026+\u0026G2**\u00262c2Ff*fq2cf%2*\u00268\u0026{fl\u0026cf+2*fF2X2,fW\u00268\u0026*2F2*\u0026R\u0026*\u00268\u0026{*8\u0026c2+\u0026l\u0026F2" ], [ 121997, "u8", "fc2GWFfv*f2\u0026f 2Xc8\u0026" ], [ 123149, "u8", "fc2vW\u0026fc*X2*fv2" ], [ 123597, "u8", "fc2*2\u0026fcf+2GfG2" ], [ 123661, "u8", "f 2c2cf\u0026fX2*f\u00262" ], [ 123981, "u8", "f 2vW f\u0026fX2*fG2" ], [ 124545, "u8", "*2\u0026G20\u0026+cc2Xf,2v2%f\u0026fX2*fG2X\u0026y\u0026" ], [ 124621, "u8", "f 2cW*fvf*2v*c2" ], [ 125837, "u8", "f 2G2,fc*X2*fG2" ], [ 126733, "u8", "f*2cW*fcf+2vfG2" ], [ 126925, "u8", "f\u00262*2vf\u0026f12cfv2" ], [ 127245, "u8", "fF2*2cfcf+2vfG2" ], [ 127501, "u8", "f 2G2,fcf+2cfv2" ], [ 127821, "u8", "fF2v2,f\u0026f12v* 2" ], [ 127885, "u8", "f 2c2Ffcf12*f%2Xc8\u0026" ], [ 128781, "u8", "f\u00262vW\u0026fc*X2cfG2" ], [ 128845, "u8", "fc2G2*fv*f2cf*2" ], [ 129485, "u8", "f 2G2vfcf+2*f%2" ], [ 129613, "u8", "f\u00262c2Ff\u0026fT2v*c2" ], [ 129741, "u8", "fF2v2%f\u0026fq2\u0026f!2X\u0026R\u0026ffZ\u0026*f" ], [ 129869, "u8", "f 2c2cfvf*2\u0026f\u00262" ], [ 130061, "u8", "f 2vW\u0026f\u0026fX2\u0026f 2" ], [ 130445, "u8", "fF2vW fcf+2GfG2Xc8\u0026{fl\u0026v*f2v*c2" ], [ 130791, "u8", "2\u0026fF2X2%f2\u0026Z\u0026*2v2f\u0026y\u0026Xc8\u0026*f8\u0026v2f\u0026+cc2" ], [ 130829, "u8", "f 2G2!f\u0026fX2\u0026f 2" ], [ 131597, "u8", "fc2G2!fGf02*fG2" ], [ 132237, "u8", "fc2v2%fGf02*fG2" ], [ 132557, "u8", "f\u00262c2%fv*f2*f%2X\u0026W\u0026*f8\u0026*fX2cfG2" ], [ 132621, "u8", "fc2c2 f\u0026fX2\u0026f 2" ], [ 132749, "u8", "fc2v2,fv*f2v*c2" ], [ 132941, "u8", "f 2v2%fc*q2v**2X\u0026y\u0026ffZ\u0026*f" ], [ 133005, "u8", "fc2\u00262Ffc*q2*fG2" ], [ 134273, "u8", "*2\u0026\u00262X\u0026l\u0026G2X*F2c2%fcf+2*fF2Xc8\u0026ffZ\u0026*f" ], [ 134669, "u8", "fc2c2 f*f+2*fG2Xc8\u0026ffZ\u0026cf" ] ], "v": { "file.stem": "d2b61efb7798490945e133621450df5a9ee5dbe80720bbcf9fc8b4209d8c3958", "file.basename": "d2b61efb7798490945e133621450df5a9ee5dbe80720bbcf9fc8b4209d8c3958.vbe" }, "id": "vbs" }, "id": 0, "sz": 393336, "ts": [ { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 393336.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Last line is over 1000 chars", "e": [ "text.last_line_length = 393336.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Exactly one line exceeds 1000 chars", "e": [ "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "File is a one-liner", "e": [ "text.total_lines = 1.00" ], "i": "metadata/file/text/metrics::file-one-liner", "l": 1 }, { "a": "T1562.001", "c": 0.8199999928474426, "d": "PowerShell char arithmetic", "e": [ "*v2!2Gfcfq2!fF2{\u00268\u0026Tf2cv*X2!f!2q2FfZ\u00268cc2F2TclcXcy\u0026Tfl\u0026\u00262+\u0026Z\u0026,2*f!2!2vf!*+2!f!\u0026Z\u0026TfW\u0026\u0026fT2!f*2qW*fZ\u0026y...", "2\u0026f,2f2vfW\u0026W\u0026\u00262G2f\u0026+\u0026f\u00262\u0026ffy\u0026\u00262+\u00262\u0026 2ff 2\u00262,f\u0026f+2cf*2f\u0026W\u0026ffl\u0026\u0026f{2\u0026f/2vf2\u0026l\u0026\u00262v2f\u00262\u0026f\u0026l\u0026ff8\u0026\u00262{\u00262\u0026*2f...", "2\u0026f*2f\u0026+\u0026ffF\u0026\u0026fX2\u0026f 2f2vf2\u0026l\u0026\u00262v2f\u00268\u0026f\u0026+\u0026ffW\u0026\u00262+\u00262\u0026/f 2\u00262 f\u0026f*2\u0026f/\u0026W\u0026*fy\u0026\u0026f*2\u0026f\u00262f2*f2\u0026l\u0026\u00262*2*\u00262\u0026f\u0026l...", "f!2!W\u0026fcfT2!f!2qcy\u0026TfR\u0026,f+2!f,Wf2 fZcl\u0026 2\u00262Tc2\u0026T\u0026Z\u0026TfOc\u00262+\u0026Z\u0026,W+*c2!W\u0026fvfT2!f,Wf\u0026Z\u0026Tf+\u0026!f*2!*FWq2 fZ..." ], "i": "objectives/evasion/anti-av/amsi::powershell-char-arithmetic", "l": 1, "m": "E1562", "el": [ "0x58d15", "0x169c5", "0x161b5", "0x58915" ] }, { "c": 0.8399999737739563, "d": "ANSI terminal erase operation", "e": [ "[K" ], "i": "micro-behaviors/ui/terminal::ansi-erase-op", "l": 1 }, { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 1.00" ], "i": "metadata/file/text/metrics::file-under-12-lines", "l": 1 }, { "c": 0.8500000238418579, "d": "PowerShell or VBScript line bloat", "e": [ "text.avg_line_length = 393336.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::script-host-line-bloat", "l": 4 }, { "a": "T1027", "c": 0.699999988079071, "d": "Very low whitespace ratio (minified/compressed)", "e": [ "text.whitespace_ratio = 0.02" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace", "l": 2, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Encoded payload detected: url", "e": [ "2\u0026f*2f\u0026+\u0026ffF\u0026\u0026fX2\u0026f 2f2vf2\u0026l\u0026\u00262v2f\u00268\u0026f\u0026+ \u003curl\u003e", "\u00262\u0026F2ffv2\u00262cf\u0026f+2\u0026f/\u0026y\u0026ffy\u0026\u0026f*2\u0026f/2cfW\u0026y \u003curl\u003e", "*v2!2Gfcfq2!fF2{\u00268\u0026Tf2cv*X2!f!2q2FfZ\u00268cc \u003curl\u003e", "\u0026Z\u0026Tfl\u0026F*+2!f!2!fZ\u0026O\u0026*2!2T\u0026Z\u0026qcy\u0026TfR\u0026,2T \u003curl\u003e", "f!2!W\u0026fcfT2!f!2qcy\u0026TfR\u0026,f+2!f,Wf2 fZcl\u0026 \u003curl\u003e", "2\u0026f,2f2vfW\u0026W\u0026\u00262G2f\u0026+\u0026f\u00262\u0026ffy\u0026\u00262+\u00262\u0026 2ff \u003curl\u003e" ], "i": "metadata/encoded-payload/url", "l": 3, "el": [ "offset:90549", "offset:89893", "offset:363797", "offset:365925", "offset:362773", "offset:92613" ] } ], "sha": "d2b61efb7798490945e133621450df5a9ee5dbe80720bbcf9fc8b4209d8c3958", "path": "d2b61efb7798490945e133621450df5a9ee5dbe80720bbcf9fc8b4209d8c3958.vbe", "type": "vbs" } ], "tv": "52045" } }