Thank you Marcos. It appears these are malicious, not false positives. Thanks for looking into my list via email. For others reading this, it was cryptocurrency miner scripts. We have seen other detections labeled as such. This would be good to define this one as crypto miner script?