{ "llm": { "conf": 0.9896106, "grade": "hostile", "model": "Qwen/Qwen3.8-27B", "before": { "lvl": -1, "prob": 0.98449343, "class": "benign" }, "outcome": "hostile", "interpretation": "Steals Minecraft credentials, executes code" }, "ml": { "v": "7", "eng": "2.12.0-beta.2", "lvl": 25, "conf": 92, "mods": [ { "cls": 0, "raw": 0.98449343, "rte": "az", "prob": 0.98449343 }, { "cls": 0, "raw": 0.99810743, "rte": "az/jar", "prob": 0.99810743 } ], "prob": 0.9896106, "files": [ { "id": 0, "lvl": 25, "conf": 92, "prob": 0.9896106123924255, "type": "jar" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.000044931966840522364, "type": "java_class" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.0000386039428121876, "type": "java_class" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.0018890202045440674, "type": "java_class" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.00005040566247771494, "type": "java_class" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.000015060107216413599, "type": "java_class" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.000010281801223754883, "type": "java_class" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.000006725390903739026, "type": "java_class" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.000010420878425065894, "type": "json" } ], "version": "v18.18", "analyzed_at": "2026-10-03T13:49:10Z" }, "path": "GlazedAddon.jar", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "p!H([6AwyA2MR(vb3+fG0000000000000(p003IEz7/KoBzb/afk+uBqHh}$Cp)xwvrlIlYMY-N/i6FGTeXV}gT!b%+qLv$Gkz()eHJL316i#zQNT*4VB8\u003cKjU]kS9J3.17o2:kMaA$C\u003eDps@=q=BnI+QLVw3x!8B-Up3aiQ@v3WV^2-\u003ch\u0026f=^a/ja7b5}=-Iolj(FM!@K]#uOCg/6@mx^hF$NE*Vj=x{XS%26=m:6u/GsJj]1}!EzL2Q}hvSk6^aZg#uy!^}]6C@yYpIciABA-{8J)W+{X[1VWe", "ln": 0 } ], "mol": "K₂(McGa)O₆(CaEuAlAs₃ErI)H₆(Cm₅Db₅F₃Os₂Po₅Ti)Md₂(Pa)", "sha": "1c81684f2e9338e419bae32abd15ace7951c355c431187f3aba8019280993d39", "path": "/data/samples/incoming/forager/bad/sha256/bazaar/GlazedAddon.jar", "risk": 301, "size": 991868, "type": "jar", "facts": { "metrics": { "jar": { "class_count": 7, "entry_count": 12, "index_count": 0, "service_count": 0, "signature_count": 0, "native_lib_count": 0, "embedded_jar_count": 0, "manifest.entry_count": 0, "manifest.digest_count": 0, "signature_block_count": 0, "versioned_class_count": 0, "manifest.section_count": 0, "manifest.attribute_count": 13, "manifest.class_path_count": 0, "manifest.boot_class_path_count": 0 }, "file": { "size": 991868, "entropy": 8 }, "binary": { "peak_region_bytes": 991232, "peak_region_entropy": 7.86 }, "archive": { "file_count": 12, "member_count": 12, "script_count": 0, "zip_bomb_ratio": 3.95, "compressed_size": 990156, "directory_count": 0, "executable_count": 0, "extra_field_size": 0, "noise_file_count": 0, "compression.ratio": 0.85, "hidden_file_count": 0, "uncompressed_size": 1158432, "crc_collision_count": 0, "entry_comment_count": 0, "max_filename_length": 36, "rtlo_filename_count": 0, "format.regular_count": 12, "nested_archive_count": 0, "path_traversal_count": 0, "symlink_escape_count": 0, "security.setgid_count": 0, "security.setuid_count": 0, "security.sticky_count": 0, "double_extension_count": 0, "duplicate_member_count": 0, "security.symlink_count": 0, "unicode_filename_count": 0, "homoglyph_filename_count": 0, "security.encrypted_count": 0, "timing.mtime_unique_count": 1, "timing.mtime_unique_ratio": 0.08, "misplaced_executable_count": 0, "timing.mtime_dominant_count": 12, "timing.mtime_spread_seconds": 0, "timing.sentinel_mtime_count": 0, "security.world_writable_count": 0, "timing.mtime_dominant_fraction": 1, "compression.method_counts.deflate": 12 } } }, "traits": [ { "id": "micro-behaviors/process/info/current::protection-domain-class", "conf": 0.85, "crit": 3, "desc": "Java ProtectionDomain class reference" }, { "id": "objectives/anti-analysis/timing/evasion::kotlin-thread-sleep-check", "atk": "T1497.003", "conf": 0.94, "crit": 3, "desc": "Kotlin Thread.sleep call", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/socket/send::java-raw-socket-client-write", "atk": "T1071", "mbc": "C0001", "conf": 0.94, "crit": 3, "desc": "Java socket client writes request bytes through DataOutputStream", "from": [ { "off": 3168, "file": 4 } ], "uses": [ 4, 12, 66 ] }, { "id": "micro-behaviors/communications/socket/framing::data-stream-transport", "atk": "T1573", "conf": 1.0, "crit": 3, "desc": "Java data-stream transport type", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/communications/socket/create::java-socket-class-import", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "Java imports the network socket class", "from": [ { "file": 4 } ] }, { "id": "privilege-escalation/indicator", "conf": 0.85, "crit": 3, "desc": "Privilege escalation indicator", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-errors", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder merges standard error", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/info/selfpath::java-protection-domain", "conf": 0.82, "crit": 3, "desc": "Java getProtectionDomain self-path lookup" }, { "id": "micro-behaviors/process/thread/lifecycle::jvm-thread-start-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM starts a thread", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/lib/urlconnection::java-url-class-bytecode", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Java URL class reference", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/archive/extract/zip::jvm-zip-entry-read-bytecode", "conf": 0.9, "crit": 3, "desc": "JVM reads ZIP archive entry data", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/data/buffer/transfer::bytearrayinputstream-ref", "conf": 0.88, "crit": 3, "desc": "Java ByteArrayInputStream class" }, { "id": "micro-behaviors/data/buffer/transfer::jvm-outputstream-write", "conf": 0.96, "crit": 2, "desc": "JVM writes bytes to output stream", "from": [ { "file": 4 } ] }, { "id": "objectives/credential-access/gaming/minecraft::minecraft-session-token-access", "atk": "T1528", "mbc": "B0006", "conf": 0.96, "crit": 4, "desc": "Minecraft session token and UUID access", "from": [ { "off": 2121, "file": 3 } ], "uses": [ 36, 53, 61 ] }, { "id": "metadata/package/config::fabric-mod-metadata", "conf": 0.9, "crit": 3, "desc": "Fabric mod metadata resource", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-x509trustmanager-class-ref", "conf": 0.94, "crit": 3, "desc": "JVM X509 trust-manager interface reference" }, { "id": "objectives/anti-static/obfuscation/string/control-prefix::java-character-digit-bytecode", "atk": "T1027", "mbc": "F0001", "conf": 0.9, "crit": 3, "desc": "Java bytecode calls Character.digit", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/fs/write/file/full::jvm-files-writestring-bytecode", "conf": 0.9, "crit": 3, "desc": "JVM bytecode Files.writeString", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-sslcontext-trustmanager-init-call", "conf": 0.94, "crit": 3, "desc": "JVM SSLContext.init trust-manager call", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/data/decode/base64::java-base64-decoding-bytecode", "conf": 0.94, "crit": 3, "desc": "Java bytecode Base64 decoding", "from": [ { "off": 19154, "file": 2 } ], "uses": [ 31, 75 ] }, { "id": "micro-behaviors/data/archive/extract/zip::jvm-zip-entry-extraction-to-file", "conf": 0.96, "crit": 3, "desc": "JVM extracts ZIP entries to files", "from": [ { "off": 12678, "file": 2 } ], "uses": [ 10, 27, 30 ] }, { "id": "objectives/impact/dos/disk::jvm-megabyte-byte-array-constant", "atk": "T1499.001", "conf": 0.94, "crit": 3, "desc": "JVM one-megabyte allocation constant", "from": [ { "file": 4 } ] }, { "id": "objectives/evasion/self-delete/file/script::java-code-source-location", "atk": "T1070.004", "mbc": "F0007", "conf": 0.78, "crit": 3, "desc": "Java code source location", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/create::jvm-socket-class-ref", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "JVM socket class reference" }, { "id": "micro-behaviors/communications/socket/ssl::jvm-x509trustmanager-issuer-callback", "conf": 0.94, "crit": 3, "desc": "JVM getAcceptedIssuers callback defined" }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.95, "crit": 3, "desc": "Java bytecode ProcessBuilder start", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/proxy/tunnel::inet-socket-address", "atk": "T1090", "mbc": "C0003", "conf": 0.6, "crit": 3, "desc": "Java InetSocketAddress reference", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/fs/write/file/handle::jvm-fileoutputstream-bytecode", "conf": 0.86, "crit": 3, "desc": "JVM imports FileOutputStream class", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/fs/read/file/handle::jvm-io-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM File API class reference" }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/archive/extract/zip::jvm-zip-entry-iteration-bytecode", "conf": 0.92, "crit": 3, "desc": "JVM iterates ZIP archive entries", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/data/decode/base64::java-base64-decoder-bytecode-call", "conf": 0.94, "crit": 3, "desc": "Java Base64 decoder accessor call", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/proxy/tunnel::byte-output-stream", "atk": "T1090", "mbc": "C0003", "conf": 0.5, "crit": 3, "desc": "Java ByteArrayOutputStream usage", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/http/lib/urlconnection::jvm-url-class-ref", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "JVM URL class reference" }, { "id": "micro-behaviors/os/env/gate::jvm-system-getenv-import", "conf": 0.94, "crit": 1, "desc": "JVM class imports System getenv", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/decode/base64::java-base64-decoder-class", "conf": 0.92, "crit": 3, "desc": "JVM Base64 decoder class reference", "from": [ { "file": 2 } ] }, { "id": "well-known/game/mod::minecraft-session-access", "conf": 0.91, "crit": 3, "desc": "Minecraft session profile access", "from": [ { "file": 3 } ], "uses": [ 47, 52, 63 ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-init-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.92, "crit": 3, "desc": "Java bytecode ProcessBuilder constructor", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/framing::bytebuffer-transport", "atk": "T1573", "conf": 1.0, "crit": 3, "desc": "Java byte-buffer transport type", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.88, "crit": 3, "desc": "Java bytecode ProcessBuilder reference", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/spawn::java-runtime-class", "atk": "T1059", "mbc": "E1203", "conf": 0.86, "crit": 3, "desc": "Java Runtime class reference", "from": [ { "file": 4 } ] }, { "id": "well-known/malware/stealer/prefire-shard::prefire-family-literal", "atk": "T1528", "mbc": "B0006", "conf": 0.9, "crit": 1, "desc": "Prefire family name literal", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-input", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard input", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/env/gate::jvm-string-equals-import", "conf": 0.94, "crit": 1, "desc": "JVM class imports String equals", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/env/gate::jvm-opaque-environment-key", "conf": 0.94, "crit": 1, "desc": "JVM class has generated gate value" }, { "id": "micro-behaviors/data/encode/base64::jvm-base64-encode-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM Base64 encodeToString call", "from": [ { "file": 1 } ] }, { "id": "objectives/anti-static/obfuscation/string/control-prefix::java-control-prefixed-long-string", "atk": "T1027", "mbc": "F0001", "conf": 0.92, "crit": 3, "desc": "Java string starts with control-length prefix" }, { "id": "well-known/game/mod::minecraft-name-getter-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft profile name getter reference", "from": [ { "file": 3 } ] }, { "id": "objectives/anti-static/obfuscation/string/crypto::java-byte-range-copy", "atk": "T1027", "mbc": "F0001", "conf": 0.7, "crit": 3, "desc": "Java byte range copy", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-sslsocket-handshake-call", "conf": 0.94, "crit": 3, "desc": "JVM SSLSocket.startHandshake call", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-trustmanager-class-ref", "conf": 0.9, "crit": 3, "desc": "JVM TrustManager interface reference", "from": [ { "file": 4 } ] }, { "id": "objectives/impact/dos/disk::jvm-two-backward-goto-branches", "atk": "T1499.001", "conf": 0.9, "crit": 3, "desc": "JVM repeated counter backedges", "from": [ { "file": 1 } ] }, { "id": "well-known/game/mod::minecraft-client-class-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft client singleton class reference", "from": [ { "file": 3 } ] }, { "id": "well-known/game/mod::minecraft-uuid-getter-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft profile UUID getter reference", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/socket/create::java-socket-bytecode-reference", "atk": "T1071", "mbc": "C0001", "conf": 0.86, "crit": 3, "desc": "Java bytecode socket reference", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.94, "crit": 3, "desc": "Java bytecode ProcessBuilder execution", "from": [ { "off": 3117, "file": 1 }, { "off": 15177, "file": 2 }, { "off": 848, "file": 3 } ], "uses": [ 25, 37 ] }, { "id": "micro-behaviors/process/create/spawn::child-process-creation-api", "atk": "T1106", "conf": 0.92, "crit": 3, "desc": "Starts a child process through a platform API", "from": [ { "off": 294, "file": 1 }, { "off": 664, "file": 2 }, { "file": 3 } ], "uses": [ 55 ] }, { "id": "micro-behaviors/time/sleep/interval::java-thread-sleep-bytecode", "conf": 0.9, "crit": 3, "desc": "Java bytecode thread sleep", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/info/current::touri-ref", "conf": 0.82, "crit": 3, "desc": "Java toURI call reference" }, { "id": "micro-behaviors/os/sysinfo/hostname::jvm-hostname-command-literal", "atk": "T1082", "mbc": "E1082", "conf": 0.9, "crit": 3, "desc": "JVM hostname command literal" }, { "id": "micro-behaviors/communications/socket/ssl::jvm-custom-x509trustmanager", "conf": 0.95, "crit": 3, "desc": "Class implements a custom X509 trust manager", "from": [ { "file": 5 } ], "uses": [ 15, 24, 69 ] }, { "id": "objectives/credential-access/gaming/minecraft::minecraft-token-getter-ref", "atk": "T1528", "mbc": "B0006", "conf": 0.92, "crit": 3, "desc": "Minecraft access token getter", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/os/env/gate::jvm-opaque-secret-environment-gate", "conf": 0.97, "crit": 3, "desc": "JVM compares opaque environment gate", "from": [ { "off": 2052, "file": 1 }, { "off": 14267, "file": 2 }, { "file": 5 }, { "file": 6 }, { "file": 7 } ], "uses": [ 34, 43, 44 ] }, { "id": "well-known/game/mod::minecraft-session-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft session object reference", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-sslparameters-set-server-names", "conf": 0.93, "crit": 3, "desc": "JVM sets TLS SNI server name", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/fs/read/file/handle::jvm-nio-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM NIO file API reference" }, { "id": "micro-behaviors/communications/socket/send::java-dataoutputstream-class", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "Java DataOutputStream class reference", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/data/buffer/transfer::bytearrayoutputstream-ref", "conf": 0.88, "crit": 3, "desc": "Java ByteArrayOutputStream class", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/info/current::getpath-ref", "conf": 0.8, "crit": 3, "desc": "Java getPath call reference" }, { "id": "micro-behaviors/communications/socket/ssl::jvm-x509trustmanager-server-callback", "conf": 0.94, "crit": 3, "desc": "JVM checkServerTrusted callback defined" }, { "id": "micro-behaviors/process/info/current::codesource-class", "conf": 0.85, "crit": 3, "desc": "Java CodeSource class reference" }, { "id": "micro-behaviors/process/info/current::getlocation-ref", "conf": 0.82, "crit": 3, "desc": "Java getLocation call reference" }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-output", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard output", "from": [ { "file": 1 } ] }, { "id": "objectives/credential-access/gaming/minecraft::minecraft-token-child-process-stage", "atk": "T1528, T1059", "mbc": "B0006", "conf": 0.99, "crit": 5, "desc": "Minecraft token access alongside redirected child launch", "from": [ { "off": 4043, "file": 1 }, { "off": 664, "file": 2 }, { "off": 1984, "file": 3 }, { "off": 10076, "file": 4 } ], "uses": [ 13, 45, 55, 77 ] }, { "id": "objectives/anti-static/obfuscation/reflection/class::java-protectiondomain", "conf": 1.0, "crit": 3, "desc": "Java ProtectionDomain", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/decode/base64::java-base64-decode-bytecode-call", "conf": 0.96, "crit": 3, "desc": "Java Base64 decode call", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/socket/create::java-socket-slash-reference", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "Java slash-form socket reference", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirected-stdio", "conf": 0.96, "crit": 3, "desc": "Java ProcessBuilder redirects all standard streams", "from": [ { "off": 2986, "file": 1 }, { "off": 15098, "file": 2 }, { "off": 5829, "file": 3 } ], "uses": [ 6, 42, 72 ] }, { "id": "metadata/file/archive::archive-at-least-10-members", "conf": 0.9, "crit": 3, "desc": "Archive contains at least ten members" }, { "id": "metadata/package/entrypoint::jar-main-class", "conf": 0.95, "crit": 2, "desc": "JAR manifest declares an executable Main-Class" }, { "id": "metadata/file/naming::archive-member-over-200kb", "conf": 0.9, "crit": 3, "desc": "Archive has member larger than 200 KB" }, { "id": "metadata/file/naming::archive-member-under-10kb", "conf": 0.9, "crit": 3, "desc": "Archive has a sub-10KB member" }, { "id": "metadata/package/config::fabric-runnable-mod-archive", "conf": 0.9, "crit": 3, "desc": "Fabric mod JAR is directly runnable", "from": [ { "file": 9 } ], "uses": [ 14, 79 ], "spans": [ [ 0, 15 ] ] }, { "id": "objectives/exfiltration/stealer/credential/token::minecraft-token-http-body-exfil", "atk": "T1041", "mbc": "E1041", "conf": 0.98, "crit": 4, "desc": "Minecraft token access paired with raw socket request write", "from": [ { "off": 1984, "file": 3 }, { "off": 6197, "file": 4 } ], "uses": [ 2, 13 ], "spans": [ [ 0, 41 ] ] }, { "id": "well-known/malware/stealer/prefire-shard::prefire-packed-runtime-stealer", "atk": "T1528", "mbc": "B0006", "conf": 0.99, "crit": 5, "desc": "Prefire packed runtime Minecraft stealer", "from": [ { "file": 1 }, { "off": 20663, "file": 2 }, { "off": 1984, "file": 3 }, { "file": 4 } ], "uses": [ 10, 13, 16, 27, 30, 41, 46 ] } ] }, { "ctx": [ { "b": "+kO#^0000+0Af107H}x2fk20vxMW=qyb/)olq.eUp!jqN2lj=901-)NC404uvqYZhpHX6Iv@}}Q0%5xBygho]fkL6mxd)84z!0v1B3+1-y?d9$bVnh:x(W={Bo.^H0rr%KvrM6jy*?i]fhMXcv}x.5luN0UwmY=^00-J82VtkAx(W={Bo8vUygho]flIwJy+Fa-B7El^bT(PXz!9B12lk8i01-)NC404DBzkLAlsB}Dhz+Ts3\u0026{tkmq=QNwmY=Z03#w*C404uvqYZhx(n9jyH]d[wPRQ7wjQcDwnC*#bUSb{yJTO301P8g9+]bbvj#C9zF7RpzGY@lwIl+?BzbP6nmuyDy?mU)01/ki225@NyJTN%00UM1zFshR0rriIdol\u0026S6Aw\u003cP00Aoq0rrsvB7Xr/A@=mUoK\u00260Tfk20vxMW=qyb/)olq.eUp!jqNi@]r:zddc@0rr(-tte^uC404uvqYZhq/)4]zF83WrSJg6vrc140rr^FvrM6jy*?i]fgya}wPh:9z/b^W9r^xaGB:M.?gL)\u003c}2DSY2(LM[1POJ500^E}rrSv50000000", "ln": 0 }, { "b": "fh($kx(mMB2ll^=00V\u003eJAaJ]$0rs8/lN+YzvrM6jy*?i]fh($kx(mMIB.LV5wPx\u003cv06ylA3ih%:j]\u003eS?Bz\u003e91A+PA70rr/ZdnjF+C404uvqYZhq/)4]zF83t06*JI3ih%:lid5\u003cwPq\u003c3y\u0026YQS6^#:\u003cvrM6jy*?i]fhD4(wN/*zdoWbWl\u0026YT.04Xat0rr^yz/4dux([3hvLqRgCt-:0B:15\u003cndkFp02(mBnDqu-04[DrT+2O:UhVKU(AN+SY[UZLUh$nd\u0026\u0026Xd6V-8]#Y63k\u003c\u003c:%e+U9!HXN=zbZ2MNK001i)!lUD", "ln": 669 }, { "b": "\u003cC/[}Ho{fiL\u0026n^g\u003ebB:oN7izb0d1UC3#fi]vj#tkfgGU(wD@i.0rrTBvrM6jy*?i]fgfL:B8}M^EGoAZxjVfYA=l5hv@#B6zBwzWvqfPW03S*uoLO0Vvj#Xkv%8*aBA]JoA=l5hv@#B6zBwzWvqfQv3\u0026\u003e!TFEhyb0d\u003ejK9+]bbvj#Xkv%8*aBA]JoA=l5hv@#B6zBwzWvqfP:0e7vM4qfl]lVlHDq/u/0v}tVv94imfygho]flpYmB-IhrC}RK6wmXXTB-H#6i$8az0ey)YG-D]f02PDVC404BwN/\u003e6x([RNlVlHDq/u/0v}t(BIu9X+xjVfUz!0i$x(v\u003e\u002601ZLcoLO0Vvj#IfBt3S(oGJT.I#X?A0e*\u0026q0rrKyvrM6jzE)]yrz(G}0fviY1:1V.qB{(?5gw#3ygho]fk+uyfi7[wi$8aL0fW-\u0026KPpQD01*RMygho]fk+uyfi7[wj1jhs02bB03ikFOMJm6%xjVfJvSME7B-.g\u003evrue\u003e0gr*M3ikFONGiyU4:H\u003cgJ\u003cdPTU\u0026?7L\u003eDqLTXV\u003eaLL/XKrSH8wG)tcqCI0?4i\u0026!K+:UJg+V\u003cH??ZJ\u003cdYIVF\u0026r#\u003cbeJhLh@N9*p3y9L?p/#0gT5\u002624}H?wO#V10g\u003cf$3ijuiP8!{Y4^*^u\u0026?rytWW=M\u003cNC\u003c*q)y5zHMChNoVfdBx(xEa)L:{]\u0026Ncf3!\u0026IS4fXWgp*Gycd.\u003e^ELJP[\u00263ATl(mo\u003e.kw^M-*U{P-Ccw2i?2B(4(RkY@*Z^VGWZ\u0026\u003e!i$WI[OwiNd4Xu)VJ[2MxyyzP6qd", "ln": 1563 }, { "b": "c}[w:C404rz.BN]y?kWSoLO0Vvj#C9zF7R0A=kD0B8%V\u003cx(4r\u003eAWjK]wnc6}v@%^v0k5rB3igngZ5XiyA+e=}A+e:5nP5G\u0026Bo8wac}[w:C404uvqYZhp\u0026ZF:wPI]VB.LV5wPx4]wN]H}wN/*zdnjF+C404uvqYZhp\u0026ZF:wPI]VB.LV5wPx\u003cv0kFPJ3igti.t%S?)y/dSW$J+HHVr@=(4axLY@{UeNC$VA\u003caj2\u003cFSPoiFA\u003cOL\u0026\u003cVzSFq-VxW/)3q.#P\u0026yA+frgy\u003c6v\u003c04ol?ygho]fkL6mxd\u003c", "ln": 2629 }, { "b": "0ltfv26s=Mx(4tY01ZLcoLO0Vvj#tkfgGU(wJHq2:]GP)0bzOU0rrylAbYxawk)EQ0l$OT3igng=Ja1QA+e=}A+e:5pJZ+#B-X2(^eZ#\u002600\u0026OM0rr^NwN]H}wN/*JA=M8sq/)4\u003evqM2B9vL8uoLO0Vvj#C9zF7R0A=kD0B8%V\u003cx(4r\u003eAYTWf!bX2a00\u0026OQ0rrBpx(W={Bz(hB0rsO$oLO0Vvj#tkfgGU(wJItmygho]fkL6mxd)84z!0v1B3+1-y?d9$i$8bw0ndXV2MSMV00NB=vrcC\u003c02l[hoLO0Vvj#C9zF7R0A=kD0B8%zK0nEOg3igti?t)P-wO+^]B7F(WwO7@y5\u003e)4GC404uvqYZhq/)4]zF83i00^7KwO\u003edQzuf.LwPR\u003ckuW3sivqGp-A=C@ouV6[fzVG?LoLO0Vvj#Ijz.CZpy?km@vrufA0rrysz!@@}A.gcH00EdWxefF/6K\u003eS:x\u0026X+/", "ln": 2895 }, { "b": "0tbRs4/)pz00)jGBv7m{wPE\u003eL9W\u003cY%vrM6jzFs2xv}Yp\u003eB7GCDlUG[GB7GCPdo/aE0tCLH3ihQT76ayBwO#0@wmX.Uq/)4]zF5$I7arxNdnjF+C404uvqYZhq/)4]zF83t0t\u003e?P3igCm8ux*Fn{j6DrzdgzxinIJxLELF6?\u0026aQz7/KoBzb/afk+uBqHh}$Crk*91-OG[B#fj126:V]x?@ND02e%UA+/P8uT^}+Byfi9wO2j?w[p#y2vRT=l$7gC0rrpmy?mDu0rrdw0%0eg?#-$ByOg=7T#WW", "ln": 3979 }, { "b": "2ETQ?1y@kMwhT+a05^%{3ax){iTL%E3L:3:38dzG844k^1qIhI6:[AT05bn}1qIpV2YKgW05d@DWG5J[GBm*U%je4{WG5X607SET2R9s:or/%ue51dGj@\u003eSq0bB89gcbKQ1qjCq08U=!84D:9hv*VnZ64%Y4}ENf6+F1YiUqDL5!#2]5txdI84^O@84D=:4}3a+u]e-h1qIK:4@+]kwrG@C5=[{g*Q^CpsS4*X09lJdn0%tZXbYWpGAzmM%csp4iU-IE1gwg-hwNeBWG5b!web\u003e\u003chw-$9hDZ+hW/wAH7Y#Vl6=v-5Q5VRW7-s4\u003e6=7f(8do(MfC$Pd6=v-4Aa39OfL3uP06:Lr83cVn!!]sk07jl@vn5fPY-oP^0$]aL08U=%85@-nhxrUPZ64%Y9B}5H6=$0\u003eiV!CZaR=dn9?\u0026SW86oOp85@+]9BGQ9u]e-v1qJ6{9DkyyF%6b!aPXIv*z7^x1V^+z9%ix60#h(!0b5[zelJ\u0026kW/xDcsP/vKWG6e=bn?-u1y@w{uO\u003cU^86=\u003cgbXd3*hyf7:YAHty12.IwcLW@403Ada6^\u003c\u003ez6^\u003e*QbnzHtcLW[Cu]iE#rFh.2R#LU^04.m\u003ccBS$Qq[8*Co!lyW0cbHGCBwJtd*rP^elJ5/Da0YIiW#0%12I[^87Ju6wecR9hy]N]YAHtF12.+De!]}i03\u0026Bl6!QvN1qJB{6!S(J87C+7e!])Qu]iE#rFh$9R#LI-04.m\u003ceW\u003eZXq=%koD:S]KiX.HbZ64%:f\u003c=:}g8R*X6/6q5whVjUgRr(LgY]S[6/uZZQ5VqNg.?\u003e=f+(M588h\u003cZ6/uZYA9$IOL2We)0Jk$PY8Tx+88O/5r-uHdz+W?zEovf:WG7@*0eXb:Kg24NW/z/70gMZ@OWFI}iYF0p12I[@892tkwedanhAzNlYAHtT12-mVi#6\u003c}i0o%Ru\u003e\u003e!ig-nmQ6*9i\u003eA9$IOL2We$0tNZii?=PgY8Tx+89tqcr\u003e5d52e70/sPYqhWG3", "ln": 4974 } ], "depth": 1, "facts": { "imp": [ [ "", "java/nio/file/Path" ], [ "", "java/lang/invoke/MethodHandles$Lookup" ], [ "", "java/nio/file/Files" ], [ "", "java/lang/ProcessBuilder" ], [ "", "java/io/File" ], [ "", "[C" ], [ "", "java/lang/Class" ], [ "", "java/security/ProtectionDomain" ], [ "", "java/lang/ProcessBuilder$Redirect" ], [ "", "java/security/CodeSource" ], [ "", "java/net/URL" ], [ "", "java/nio/file/attribute/FileAttribute" ], [ "", "java/nio/charset/StandardCharsets" ], [ "", "java/util/Base64$Encoder" ], [ "", "java/lang/Integer" ], [ "", "java/lang/invoke/MethodHandles" ], [ "", "java/nio/file/LinkOption" ], [ "", "java/lang/StringBuilder" ], [ "", "java/util/Base64" ], [ "", "java/lang/Exception" ], [ "", "java/lang/String" ], [ "", "java/lang/Object" ], [ "", "[Ljava/lang/String;" ], [ "", "com/github/newRzfuw" ], [ "", "java/lang/System" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "java/util/Base64", "java/util/Base64.getEncoder" ], [ "java/util/Base64", "getEncoder" ], [ "java/lang/String", "java/lang/String.charAt" ], [ "java/lang/String", "charAt" ], [ "java/security/ProtectionDomain", "java/security/ProtectionDomain.getCodeSource" ], [ "java/security/ProtectionDomain", "getCodeSource" ], [ "com/github/newRzfuw", "com/github/newRzfuw.\u003cinit\u003e" ], [ "com/github/newRzfuw", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.\u003cinit\u003e" ], [ "java/lang/String", "\u003cinit\u003e" ], [ "java/nio/file/Path", "java/nio/file/Path.resolve" ], [ "java/nio/file/Path", "resolve" ], [ "java/nio/charset/StandardCharsets", "java/nio/charset/StandardCharsets.UTF_8" ], [ "java/nio/charset/StandardCharsets", "UTF_8" ], [ "java/util/Base64$Encoder", "java/util/Base64$Encoder.encodeToString" ], [ "java/util/Base64$Encoder", "encodeToString" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectOutput" ], [ "java/lang/ProcessBuilder", "redirectOutput" ], [ "com/github/j8hbBQaCPHMK", "com/github/j8hbBQaCPHMK.wnzLkml" ], [ "com/github/j8hbBQaCPHMK", "wnzLkml" ], [ "java/lang/String", "java/lang/String.getBytes" ], [ "java/lang/String", "getBytes" ], [ "java/lang/Class", "java/lang/Class.getName" ], [ "java/lang/Class", "getName" ], [ "java/security/CodeSource", "java/security/CodeSource.getLocation" ], [ "java/security/CodeSource", "getLocation" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectErrorStream" ], [ "java/lang/ProcessBuilder", "redirectErrorStream" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.\u003cinit\u003e" ], [ "java/lang/ProcessBuilder", "\u003cinit\u003e" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.start" ], [ "java/lang/ProcessBuilder", "start" ], [ "java/lang/ProcessBuilder$Redirect", "java/lang/ProcessBuilder$Redirect.from" ], [ "java/lang/ProcessBuilder$Redirect", "from" ], [ "java/lang/System", "java/lang/System.getenv" ], [ "java/lang/System", "getenv" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.directory" ], [ "java/lang/ProcessBuilder", "directory" ], [ "java/lang/String", "java/lang/String.equals" ], [ "java/lang/String", "equals" ], [ "java/lang/String", "java/lang/String.length" ], [ "java/lang/String", "length" ], [ "com/github/newRzfuw", "com/github/newRzfuw.ooXatmwuKissvKszawnk" ], [ "com/github/newRzfuw", "ooXatmwuKissvKszawnk" ], [ "java/lang/String", "java/lang/String.format" ], [ "java/lang/String", "format" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/nio/file/Path", "java/nio/file/Path.of" ], [ "java/nio/file/Path", "of" ], [ "com/github/newRzfuw", "com/github/newRzfuw.qqcrWorker" ], [ "com/github/newRzfuw", "qqcrWorker" ], [ "java/lang/System", "java/lang/System.getProperty" ], [ "java/lang/System", "getProperty" ], [ "java/lang/Integer", "java/lang/Integer.valueOf" ], [ "java/lang/Integer", "valueOf" ], [ "com/github/j8hbBQaCPHMK", "com/github/j8hbBQaCPHMK.run" ], [ "com/github/j8hbBQaCPHMK", "run" ], [ "com/github/newRzfuw", "com/github/newRzfuw.main" ], [ "com/github/newRzfuw", "main" ], [ "java/nio/file/Files", "java/nio/file/Files.exists" ], [ "java/nio/file/Files", "exists" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectInput" ], [ "java/lang/ProcessBuilder", "redirectInput" ], [ "java/nio/file/Files", "java/nio/file/Files.createDirectories" ], [ "java/nio/file/Files", "createDirectories" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/io/File", "java/io/File.\u003cinit\u003e" ], [ "java/io/File", "\u003cinit\u003e" ], [ "java/io/File", "java/io/File.getAbsolutePath" ], [ "java/io/File", "getAbsolutePath" ], [ "java/lang/System", "java/lang/System.arraycopy" ], [ "java/lang/System", "arraycopy" ], [ "java/lang/Class", "java/lang/Class.getProtectionDomain" ], [ "java/lang/Class", "getProtectionDomain" ], [ "java/net/URL", "java/net/URL.toURI" ], [ "java/net/URL", "toURI" ], [ "java/io/File", "java/io/File.\u003cinit\u003e" ], [ "java/io/File", "\u003cinit\u003e" ], [ "java/nio/file/Path", "java/nio/file/Path.toString" ], [ "java/nio/file/Path", "toString" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.toString" ], [ "java/lang/StringBuilder", "toString" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.toCharArray" ], [ "java/lang/String", "toCharArray" ], [ "java/nio/file/Path", "java/nio/file/Path.toFile" ], [ "java/nio/file/Path", "toFile" ], [ "java/lang/ProcessBuilder$Redirect", "java/lang/ProcessBuilder$Redirect.appendTo" ], [ "java/lang/ProcessBuilder$Redirect", "appendTo" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "com/github/newRzfuw", "com/github/newRzfuw.getDomain" ], [ "com/github/newRzfuw", "getDomain" ] ], "metrics": { "file": { "size": 12389, "entropy": 5.81 }, "class": { "major_version": 65, "interface_count": 0, "method_ref_count": 49, "constant_pool_size": 339, "external_class_count": 25 }, "binary": { "peak_region_bytes": 4096, "peak_region_entropy": 6.69 }, "imports": { "count": 74 }, "functions": { "count": 4 } } }, "id": 1, "mol": "O₃(As₂ErI)H₅(CmDb₂FOsPo₄)", "path": "/data/samples/incoming/forager/bad/sha256/bazaar/GlazedAddon.jar!!com/github/j8hbBQaCPHMK.class", "pid": 0, "risk": 11, "sha": "b6f1548da3090cff3e9e56b22aec474b29ca7734a8df9dace1f7dcec981a3e3f", "size": 12389, "traits": [ { "id": "micro-behaviors/communications/http/lib/urlconnection::java-url-class-bytecode", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Java URL class reference", "spans": [ [ 1833, 16 ], [ 1862, 12 ] ] }, { "id": "micro-behaviors/communications/http/lib/urlconnection::jvm-url-class-ref", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "JVM URL class reference" }, { "id": "micro-behaviors/data/encode/base64::jvm-base64-encode-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM Base64 encodeToString call", "spans": [ [ 4043, 39 ] ] }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method", "spans": [ [ 733, 8 ] ] }, { "id": "micro-behaviors/fs/read/file/handle::jvm-io-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM File API class reference" }, { "id": "micro-behaviors/fs/read/file/handle::jvm-nio-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM NIO file API reference" }, { "id": "micro-behaviors/os/env/gate::jvm-opaque-environment-key", "conf": 0.94, "crit": 1, "desc": "JVM class has generated gate value" }, { "id": "micro-behaviors/os/env/gate::jvm-string-equals-import", "conf": 0.94, "crit": 1, "desc": "JVM class imports String equals", "spans": [ [ 777, 0 ] ] }, { "id": "micro-behaviors/os/env/gate::jvm-system-getenv-import", "conf": 0.94, "crit": 1, "desc": "JVM class imports System getenv", "spans": [ [ 2052, 0 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.88, "crit": 3, "desc": "Java bytecode ProcessBuilder reference", "spans": [ [ 64, 71 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-init-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.92, "crit": 3, "desc": "Java bytecode ProcessBuilder constructor", "spans": [ [ 294, 31 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.95, "crit": 3, "desc": "Java bytecode ProcessBuilder start", "spans": [ [ 3117, 30 ] ] }, { "id": "micro-behaviors/process/info/current::codesource-class", "conf": 0.85, "crit": 3, "desc": "Java CodeSource class reference" }, { "id": "micro-behaviors/process/info/current::getlocation-ref", "conf": 0.82, "crit": 3, "desc": "Java getLocation call reference" }, { "id": "micro-behaviors/process/info/current::protection-domain-class", "conf": 0.85, "crit": 3, "desc": "Java ProtectionDomain class reference" }, { "id": "micro-behaviors/process/info/current::touri-ref", "conf": 0.82, "crit": 3, "desc": "Java toURI call reference" }, { "id": "micro-behaviors/process/info/selfpath::java-protection-domain", "conf": 0.82, "crit": 3, "desc": "Java getProtectionDomain self-path lookup" }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-errors", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder merges standard error", "spans": [ [ 2986, 44 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-input", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard input", "spans": [ [ 2693, 38 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-output", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard output", "spans": [ [ 2959, 39 ] ] }, { "id": "objectives/anti-static/obfuscation/reflection/class::java-protectiondomain", "conf": 1.0, "crit": 3, "desc": "Java ProtectionDomain", "spans": [ [ 1627, 19 ], [ 1649, 34 ], [ 1696, 30 ] ] }, { "id": "objectives/anti-static/obfuscation/string/control-prefix::java-control-prefixed-long-string", "atk": "T1027", "mbc": "F0001", "conf": 0.92, "crit": 3, "desc": "Java string starts with control-length prefix" }, { "id": "objectives/evasion/self-delete/file/script::java-code-source-location", "atk": "T1070.004", "mbc": "F0007", "conf": 0.78, "crit": 3, "desc": "Java code source location", "spans": [ [ 1732, 13 ] ] }, { "id": "objectives/impact/dos/disk::jvm-two-backward-goto-branches", "atk": "T1499.001", "conf": 0.9, "crit": 3, "desc": "JVM repeated counter backedges", "spans": [ [ 5038, 8 ], [ 5145, 8 ], [ 5170, 8 ], [ 5253, 8 ], [ 5341, 8 ], [ 5443, 8 ], [ 5547, 8 ], [ 5632, 8 ] ] }, { "id": "micro-behaviors/os/env/gate::jvm-opaque-secret-environment-gate", "conf": 0.97, "crit": 3, "desc": "JVM compares opaque environment gate", "uses": [ 6, 7, 8 ], "spans": [ [ 777, 6 ], [ 2052, 6 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.94, "crit": 3, "desc": "Java bytecode ProcessBuilder execution", "uses": [ 10, 11 ], "spans": [ [ 294, 31 ], [ 3117, 30 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirected-stdio", "conf": 0.96, "crit": 3, "desc": "Java ProcessBuilder redirects all standard streams", "uses": [ 17, 18, 19 ], "spans": [ [ 2693, 38 ], [ 2959, 39 ], [ 2986, 44 ] ] }, { "id": "micro-behaviors/process/create/spawn::child-process-creation-api", "atk": "T1106", "conf": 0.92, "crit": 3, "desc": "Starts a child process through a platform API", "uses": [ 25 ], "spans": [ [ 294, 31 ], [ 3117, 30 ] ] } ], "type": "java_class" }, { "ctx": [ { "b": "+kO#^0000+1Gqz46jU@$fk20vxMW=qzE[2\u0026Ds?qz2lj=901-)NC404uvqYZhpHX6Iv@}}Q0%5xuv@Diqxk8E3BZ^1AAB%6gv(bD5vN\u003cc.oHG9=1PXPov@Diqxk8E3BZ^1AAB%6gv(az\u003c2ls/fnN+g:m[=qK03M8=C404uvqYZhp\u0026ZF:wPI]VB.LV5wPx4]wN]H}wN//!015-b7\u00260G5vj#C9zF7R0A=kD0B8%V\u003cx(4r\u003eAT8NM0rry6wN]H}wN//.02PDVC404DBzkLAlsB}Dhz=WEwN/T?wPw1Q4/(Uwygho]flIwJy+Fa-B7El^2lktp00+]6v@C)?ASDd^ygho]fkL6mxd)$pC5Iecfhl21xM4ALvqYQ(wPGa\u003cz/oAlA0DvS0rsfQvrM6jy*?i]fkkrEz!\u0026]qo\u003ewAWz!8yEzE^M{A%zWX0rrr$z/oAlz#/}wydw", "ln": 0 }, { "b": "6IJmIC404wx(tUpx(4ulp*[DVi@]r/B-qOJwNxK*C(W).oLO0Vvj#C9zF7R3BAh8kxf{-Py?d9$i@]r=jzwXEBuPZ911kQ03\u0026?)Wfa4WZ05aAN5nCS%vj#C9zF7R3BAh8kx9Oz(0rr{JvrM6jy*?i]fh($kx(mMIB.LV5wPw1QgZTju05aANg3L%r(v$R\u0026RNkSPG6nq.)vQfmGS\u003cZCNDZ@l(w8b0R?15#VGNBD)vP*cGN\u0026x)WG)cshVS)^Bz\u003cJWvraUOA::j]00BY0tse/0irh8", "ln": 600 }, { "b": "gxphK00BYwdol\u0026Se=X-Q05T:O0rs8/lN+YzvrM6jy*?i]fh($kx(mMIB.LV5wPx\u003cv07c-=3ih{-rri79Bz\u003e91A+PA70rr/ZdnjF+C404uvqYZhq/)4]zF83t09oe53ih{-sPFH-1M(+s\u0026h@yjYnCN5S]*y+\u0026iea9YUruYN=ZYY\u0026i5meYsD)RNDyPU\u0026id}4YTD^QQVOUV\u0026id}4YTOjEtlaZO2jdFM\u003cG+DvLci/uUJyUN).s?HK+R@6G65nF", "ln": 1058 }, { "b": "02fP$vr=D]pgFPWlVlHSx(c%[Aaw$H1AXH1g64vWAb]J4x(W+=07[Ukygho]fkL6mxd)h9A+PA7j4%x$C404uvqYZhq/)4]zF848ygho]fkL6mxd)h9A+PA7j1i\u003crvrM5", "ln": 4068 }, { "b": "R\u003c3tdITuIu\u0026iYJxShn)IHV2+2\u003eb$GEVaPI8T)RWJ=5g}SPxr8p\u003e-?L6L8[LeUhDpR)vfQ6Ynu\u003c{e=+}RxjVf@zGVA?fAy8t0aV9+0rtH$\u003eDyVGO#HXFH3$N((6NR0XtF.+YvJ.rV99JcTNim9\u003ez3FcXX3*(G6fqt)W]3*Shx3NZV?f2(:-qHOS}-V\u003c/\u003efV0w:-RhW!SUHVtex)Vs73XuaU!LJX9}[3w[JPOhBhW=T/@)TQU-YPzfFMf[", "ln": 5572 }, { "b": ")692EV6KTvU\u0026@6y\u003cD^gkYRT})Zug@Y(aBLj0W!cK0000000*\u003cK01-)NC404uvqYZhra{q-vpPPAd//RNB8kA0z#/}wc}U{?3\u003c50Ze^.Uh0XTMO25XN2r:/!B00NB-st?#p01STJyKer?ADarYw{vE2z#/}Ezes5ZB8s]^Dsy(n0rr^zl$eX]Azf$ruVeXNpHvmxvrR.L40(DfwlB4{C4+I\u003eCMv^Gv@DHcBtT706ky%0vj#tkfg!@dCW\u003er7BzkVh2lD\u003c=00^*:A6%", "ln": 11929 }, { "b": "wNPAX0.im\u003e1T)Owdol\u0026Se=[PK0.rw+0rr@+oLO0Vvj#tkfg*52B-ZM7A+eV@j1jhs04[sD3iAV#o-Uk5xjVfWwQ5q=zGG]A0rs2^dnjF+C404DBzkLADtdsKt4}}AzGG]Ai$8f^0-fj9mGMA/02xrTC404DBzkLADtdsKt4}}AzGG]A2lE*800^dFBwumYwEFSu09xNfr038301iHZl${WMv@#TfC)\u003c:R0oKQ\u0026r03h6010pHBwMy^wO#O\u003c02u$ioLO0Vvj#Ijz.CZpy?km@vrufA3\u003c6SmtNHM[0:L*b9bn]9vj#tkfg6![w[u0]wkvt\u0026Acln3BAg@3z3HbH0rr%KvrM6jx(tT]x(4uRB-.OBBw)p4wNPAX0:#9f26s=Mx(4tY01ZLcoLO0Vvj#tkfgGU(wJHq4v/*fG0xHo[0rrYWoLO0Vvj#tkfgGU(wJItw3\u0026?)Yx9[YH0+.Pm8yOo]vrM6jx(tU2B-.OBBw)p4wNPBqnHWWG04[s/3iBPpyxjzrA+eV\u00263\u003c7nE8vuKn0=w2s1:t03By+EM2pJ!ynL7vi3\u003c7wHAs8+P0=!qw1.hv!B7C:YBo0%30:(7L0rrNqwmORYAbY\u0026eB8$]60rr@+oLO0Vvj#C9zF7R4xMw3nvpB4:j1jhs0^sY\u003c3iAr\u003eC(W)Lv@c78wKQGUA^n5{DJkYa0.9ls3iAV#BPzEQr6:$(uW3A.xKsFxCvU5-oKQD)02YxYyhv-]zF/", "ln": 12270 }, { "b": "uR2oXqd1u:B727H2xjM[l$7gC1=#\u003e+e:Pi]aP)/o355D=tB#r801-)NC404DBzkLAl2}0OD2\u003ch(Ko2s?v@DsipI9HkzF9IY00\u003c#Slp\u003c-$ts5-1K]**O0*9LG0rrpEmSh^U3\u003c8Z@4gi7p0*-]/6jD9bw)W[]zBN#0A.ZaKr8dNr0rr^al#tj%vqYKyuVX$KABioGzdrOD3t@)wygzpgk@7$i00NEQze.oi00m0)0rrvigib=ughW9)2xTJ]A8{x", "ln": 13056 }, { "b": "wN\u003e[bwLBrG02xrTC404DBzkLADtdsKnP5cRvru732lHXd0\u0026k(J0rryDwPQHYAclmh0\u0026D8\u003e3iE49R#V(sygho]fkktTlv0V:l2}0OC#5N8Acln3BAg@3z3Hcx3iEmdqul+6w[=c%B7/b}3\u003c9Kh\u003c{zf^0\u003chL72wF6/y*?A%3\u003c9Tm8vuLx0\u003cI+a3t%A^wogsWAclmh0\u003c.)?3iE49V\u003cD(n0=!qw17=vX3\u003c9)rfa4=S0\u003enmh3V{qND30Q-A=LPl0rrlJdo/aE0\u003eFDB3iEmfYA50sv%8*kz/Oi.Bo8vKB:v.dCX}hduVfN]x(\u003cvQ7!!WMC404DBzkLADtdsKnP5cRvru73i@]r/v[p-Hr^dbJh#%13oLO0Vvj#tkfg6@awKguSvr\u003eT\u003eBz#wAq/)4\u003evqO7b026iyogAn%y\u003ceY.nnh:CuRL=Dp5$t0x\u003ehD+z/U{V3Ua0@uWu)5xMe9s0rrsAwObv[CM!C+88C[sQr\u003c0oMUg%Nq36GX1TbkE+M.g.r0Akg7w9jkhV0VmO1G-?p2Z0\u003c06/ILZhS56JpjD.)vfi$J\u003eKOZRSCyv\u0026\u003cn", "ln": 13300 }, { "b": "Zk\u0026K3\u003el}to02#pB0S}P!04nfsPRpLyUiJD#[2SOGUAFvDWcTx\u003c\u0026!KF$O1F#tKlrpc(BhxlT+Ne-(J3$\u0026wPq\u003c3y\u0026Z0^)e(nO05BYA0rs?Z(zxv9R\u0026x]9MGa)b(7Ts4H(Z.}G5:Cr\u0026FiDXT^[EqYxVo2[29+XMX%?4Wcsu}2M\u003cG703IsZ2(\u003e2d[=n.G4^x7s(7s*tW$%pSN^lu8\u0026\u003eHJmUCQP[JP^{.\u0026*NppH[-55\u003c=cRhT=8CaZ3hbI)x#", "ln": 14203 }, { "b": "c}[w:C404rz.BN]y?kWSoLO0Vvj#C9zF7R0A=kD0B8%V\u003cx(4r\u003eAWjK]wnc6}v@%^v0$ttx3igCo4/(UtA+e=}A+e:5nP5G\u0026Bo8wac}[w:C404uvqYZhp\u0026ZF:wPI]VB.LV5wPx4]wN]H}wN/*zdnjF+C404uvqYZhp\u0026ZF:wPI]VB.LV5wPx\u003cv0$+RF3igIq69e7\u00261[fcP\u003cDU}@P$PJyQ3O?R[4tpNL+vApIr6ID)5C:cYSygUW^x-G\u003cCn(-S!{hSUJg}P2M\u003e!x00)1LAaJ]$rbSfE7xUcO01e(C0rrQIwN]H}wN/*TB-.OBBpnl\u00260$\u003e}v4fEKI026x:wnc6}v@$dWA=k$%BAg@3z2\u003cRSc%w5[ygho]fkL6mxd)84z!0v1B3+1-y?d9$i$8ii10d^H4fEWOl\u0026Z-+1jIOwpxLah]:?c71-[=]A=.rZ6^$I8ygho]fkL6mxd)84z!0v1B2%^jbM/t101x2S0rrZDvrM6jy*?i]fhMXcv}x.52lMvP00vgOwb#Vjc[d:%11By63iIZVecb-M2\u0026RCy(Xh?gYqKX{K)YJU\u0026id+1XRPvEF-iqQ(X6]MX}n$GU\u003cO\u0026I\u0026i60BXvQ!4Q2zYv(X75QX}YmKRTy^w\u0026i60BXua=", "ln": 14836 }, { "b": "pJZ:W01AyCB7El^lVl\u003c:wQ5q002LyF0%0\u0026l-03bv001c}HPHZW00000001eC000008H0rY1mUDw}t*N6xjVfMwN/T?wPv!K94imfygho]flIwJy+Fa-B7El^bT=iNz!9B1i$8kG1k\u003cH^5^d7[00V$Bv@C)?0rr(-oLO0Vvj#C9zF7R3BAh8kxfdLDljr$R1lo^?5cI1{03M8=C404wx(tUmxKL}5wPPO7Byx5$vrb)CxKL}5wPR$#1lPW+1YXI\u003euPn5^8CB)OC404wx(tUmxKL}5wPPN)xKL}5wPQ0x1l/{M2)ow[(J3#cc%G2iygho]fk+GxfjOW7A=U/lfgfzYA=U/li@", "ln": 19036 }, { "b": "}4s\u003eP000000000\u003c1][S5%e2mK2M)w{2ib^]\u003czJGI(ILzT0rr^FvrM6jy*?i]fgfzYA:-E1wPw1Usoey9wnbW\u003cBo8vBc{{MPnEL-91x#iosP?$g01J{Qydq-CB7[D^CYmUv0rrQug\u003cBajvk910v}mD7x-OhpzGP!K0rrvnvrt{zC4Q*Q32:A/B7GC\u003evrR.L18zE[1hA{DSrmGtNbXpZ\u003ex[iH03@3oO37.:Q#m#0\u003cbxh+ZMO2]VGX0}[4ll}PRp+6Gx]XP\u003eBvRt1zm-ne=", "ln": 20599 }, { "b": "s*[w?oE*-nWG5A:ewql$emgj$ewrcn1y%y[6:heMiT2Qz1@dsS1FL(p83H-VeenvCeenp51%4U\u003cg\u003eH(\u003cGA.EP%kHS\u003cgG+O0W/w+607H3u5\u003eC4\u002683{zN08boT840.KpY$qz3s(45Y8TY\u003e6:}FJq-Ur?hvQxg6:{-odh-Ki2)p$Iu\u003e\u003cbUWG5#s2)p$L6:![/WG60iLc$u\u003esa?1-R#Lr=47ldtWG5=#e4bBYq=%mn05W]*05=\u003eH84WA=WG5AJ5G8e.g=t%:5XXxU6+U4n6bqg[1V^t1hwD@w6+^qwbPdph6=vO^6+T)?6\u003c@\u003co5D\u0026*-6+UE[g?q+HGCsJ=%j+c=gG+OfW/w+607H3c5e5qg7-sd)WG5#V85Tp108J/e6=yKu8Ok#bsRR\u003c:08\u003e]$12.bl92fx^04w^885JF\u003e8djg0v735e85JF\u003e92fugv735eF%9Lxr-:}]0Jk$G85{0:tdaA2r#zLZv734$iV/jY12I[U86uNcay\u003eQ=hx-!UYAHtu12.wsbnzw@03\u0026Ba6^BOr6^9S!6^E9y86n$@bnztuu]iE#rFhN$R#LI-05E:}bdvLsWG5=#84:jRt2OMc5[noHjus/bciD7.cManB1y@k{whU?Jd7/ZAdfzEU6!p1EQ5VCRdhsuJciL5hu\u003e\u003eh1g-mRy6!p1DA9$IOL2We=0Jk$L6!3Y#iW#0@0#SM\u003c6!3M(xUam2sS5Y#076Q!2d\u003c\u003c)s*[w?iXqj35]a\u0026Pjut8jf1}E087]nMhzk}2Z7\u0026qi1y%zA6!)o7iXZZ{g8hLVfROK\u002688h\u003cY87(TVg-m[XfCMtTfk$qQF%6b!g6arM?[5\u003eAsS5%607a9]mPQDV5]s#Rjuttqh3kV[hw[x^1y@l9whVvYh[PqPi0h606/^0/Q5VCRi2aB\u003eh3sTLu\u003e\u003eXfg-ndN6/^0!A9$IOL2We}0Jk$LY8TS\u002689289lBD\u003e-r#AO5zNGKciY[ox12I]089CRowedmrhA?\u003ctYAHtX12-BWk[#OT03\u0026BD6*SZ11qK7c6*Vj:89w3pk[#L4u]iE#rFiTsR#LG^kd?4WkP8=*89!oskdyPaY8TS\u002689\u003eUhlBD\u003e-r#AP#09Sr72Ff%[s*[", "ln": 21832 }, { "b": "Ne^WDWG6bo0d{{B1P+?T1?1Ino!l\u0026v5DEu\u00261658F5d(tOk@F\u0026X1EPk$6:b9@5tPpf0Ka9!0dUTYFe5g\u003cxKFmJrxppk83NCKl]\u003eK:05E:}2c[u$W/=96o-.D#0S.6T1o", "ln": 136065 }, { "b": "1RR2sF%(VJ69It]1R?gO1xQai1UyC(1-bX71HXq75d(tOt)CQ86:aUEWG5#j5v.\u003cGv3aAw1oLI3X?gb^00066QYpw{5=-4V@S0xd2lCIs}#v\u0026u}t.(CR2QF}gYNWVf-", "ln": 136518 } ], "depth": 1, "facts": { "imp": [ [ "", "java/io/ByteArrayOutputStream" ], [ "", "[C" ], [ "", "java/lang/Thread" ], [ "", "java/nio/file/Path" ], [ "", "java/util/Base64$Decoder" ], [ "", "java/lang/String" ], [ "", "java/lang/Exception" ], [ "", "java/lang/ProcessBuilder$Redirect" ], [ "", "java/lang/invoke/MethodHandles$Lookup" ], [ "", "java/lang/Class" ], [ "", "java/util/zip/ZipEntry" ], [ "", "java/lang/Object" ], [ "", "java/util/Arrays" ], [ "", "java/nio/file/LinkOption" ], [ "", "java/util/List" ], [ "", "java/util/ArrayList" ], [ "", "java/lang/System" ], [ "", "java/io/File" ], [ "", "java/util/Map" ], [ "", "java/util/Base64" ], [ "", "java/io/ByteArrayInputStream" ], [ "", "java/nio/charset/StandardCharsets" ], [ "", "java/lang/Character" ], [ "", "java/util/zip/Inflater" ], [ "", "java/lang/StringBuilder" ], [ "", "java/nio/file/attribute/FileAttribute" ], [ "", "java/io/BufferedOutputStream" ], [ "", "java/lang/InterruptedException" ], [ "", "[Ljava/lang/String;" ], [ "", "com/github/rqfmuc4" ], [ "", "java/lang/ProcessBuilder" ], [ "", "[B" ], [ "", "java/lang/Process" ], [ "", "java/io/IOException" ], [ "", "java/nio/file/Files" ], [ "", "java/lang/Integer" ], [ "", "java/lang/Throwable" ], [ "", "java/io/FileOutputStream" ], [ "", "java/io/PrintStream" ], [ "", "java/util/zip/ZipInputStream" ], [ "", "com/github/rqfmuc4$IbGMGLD" ], [ "", "java/lang/invoke/MethodHandles" ], [ "com/github/rqfmuc4", "com/github/rqfmuc4.get" ], [ "com/github/rqfmuc4", "get" ], [ "java/lang/ProcessBuilder$Redirect", "java/lang/ProcessBuilder$Redirect.appendTo" ], [ "java/lang/ProcessBuilder$Redirect", "appendTo" ], [ "com/github/newRzfuw", "com/github/newRzfuw.endEjao" ], [ "com/github/newRzfuw", "endEjao" ], [ "com/github/newRzfuw", "com/github/newRzfuw.edpXSilAekRcVV" ], [ "com/github/newRzfuw", "edpXSilAekRcVV" ], [ "com/github/newRzfuw", "com/github/newRzfuw.upxye_tby" ], [ "com/github/newRzfuw", "upxye_tby" ], [ "com/github/newRzfuw", "com/github/newRzfuw.azlAqjZl" ], [ "com/github/newRzfuw", "azlAqjZl" ], [ "java/util/Map", "java/util/Map.of" ], [ "java/util/Map", "of" ], [ "com/github/newRzfuw", "com/github/newRzfuw.wVT2onLfVOvbr" ], [ "com/github/newRzfuw", "wVT2onLfVOvbr" ], [ "java/util/zip/Inflater", "java/util/zip/Inflater.finished" ], [ "java/util/zip/Inflater", "finished" ], [ "java/util/List", "java/util/List.add" ], [ "java/util/List", "add" ], [ "java/io/BufferedOutputStream", "java/io/BufferedOutputStream.write" ], [ "java/io/BufferedOutputStream", "write" ], [ "java/lang/System", "java/lang/System.getProperty" ], [ "java/lang/System", "getProperty" ], [ "java/lang/Thread", "java/lang/Thread.sleep" ], [ "java/lang/Thread", "sleep" ], [ "java/lang/String", "java/lang/String.indexOf" ], [ "java/lang/String", "indexOf" ], [ "com/github/rqfmuc4", "com/github/rqfmuc4.vJKRIr" ], [ "com/github/rqfmuc4", "vJKRIr" ], [ "com/github/newRzfuw", "com/github/newRzfuw.isxlxj" ], [ "com/github/newRzfuw", "isxlxj" ], [ "java/util/zip/ZipInputStream", "java/util/zip/ZipInputStream.read" ], [ "java/util/zip/ZipInputStream", "read" ], [ "java/util/Base64", "java/util/Base64.getDecoder" ], [ "java/util/Base64", "getDecoder" ], [ "java/nio/file/Path", "java/nio/file/Path.of" ], [ "java/nio/file/Path", "of" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectInput" ], [ "java/lang/ProcessBuilder", "redirectInput" ], [ "java/lang/System", "java/lang/System.getenv" ], [ "java/lang/System", "getenv" ], [ "java/util/zip/ZipInputStream", "java/util/zip/ZipInputStream.closeEntry" ], [ "java/util/zip/ZipInputStream", "closeEntry" ], [ "java/nio/file/Files", "java/nio/file/Files.readString" ], [ "java/nio/file/Files", "readString" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.toString" ], [ "java/lang/StringBuilder", "toString" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.\u003cinit\u003e" ], [ "java/io/ByteArrayOutputStream", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.substring" ], [ "java/lang/String", "substring" ], [ "com/github/newRzfuw", "com/github/newRzfuw.midFsd" ], [ "com/github/newRzfuw", "midFsd" ], [ "java/lang/Exception", "java/lang/Exception.getMessage" ], [ "java/lang/Exception", "getMessage" ], [ "com/github/newRzfuw", "com/github/newRzfuw.UV_e___SGkzO2" ], [ "com/github/newRzfuw", "UV_e___SGkzO2" ], [ "java/lang/String", "java/lang/String.\u003cinit\u003e" ], [ "java/lang/String", "\u003cinit\u003e" ], [ "com/github/rqfmuc4$IbGMGLD", "com/github/rqfmuc4$IbGMGLD.body" ], [ "com/github/rqfmuc4$IbGMGLD", "body" ], [ "java/util/Map", "java/util/Map.of" ], [ "java/util/Map", "of" ], [ "com/github/rqfmuc4", "com/github/rqfmuc4.npzakpoTion" ], [ "com/github/rqfmuc4", "npzakpoTion" ], [ "com/github/newRzfuw", "com/github/newRzfuw.\u003cinit\u003e" ], [ "com/github/newRzfuw", "\u003cinit\u003e" ], [ "java/nio/file/Path", "java/nio/file/Path.toString" ], [ "java/nio/file/Path", "toString" ], [ "com/github/newRzfuw", "com/github/newRzfuw.TZesd" ], [ "com/github/newRzfuw", "TZesd" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/io/BufferedOutputStream", "java/io/BufferedOutputStream.\u003cinit\u003e" ], [ "java/io/BufferedOutputStream", "\u003cinit\u003e" ], [ "com/github/newRzfuw", "com/github/newRzfuw.qX_ETUeAL" ], [ "com/github/newRzfuw", "qX_ETUeAL" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.directory" ], [ "java/lang/ProcessBuilder", "directory" ], [ "java/nio/charset/StandardCharsets", "java/nio/charset/StandardCharsets.UTF_8" ], [ "java/nio/charset/StandardCharsets", "UTF_8" ], [ "java/lang/Object", "java/lang/Object.getClass" ], [ "java/lang/Object", "getClass" ], [ "java/lang/String", "java/lang/String.toCharArray" ], [ "java/lang/String", "toCharArray" ], [ "com/github/newRzfuw", "com/github/newRzfuw.qcwdglKlzigduGshgcNcf" ], [ "com/github/newRzfuw", "qcwdglKlzigduGshgcNcf" ], [ "java/util/zip/Inflater", "java/util/zip/Inflater.needsInput" ], [ "java/util/zip/Inflater", "needsInput" ], [ "java/util/zip/Inflater", "java/util/zip/Inflater.end" ], [ "java/util/zip/Inflater", "end" ], [ "java/lang/Integer", "java/lang/Integer.parseInt" ], [ "java/lang/Integer", "parseInt" ], [ "com/github/newRzfuw", "com/github/newRzfuw.beXXSeXfzh" ], [ "com/github/newRzfuw", "beXXSeXfzh" ], [ "com/github/newRzfuw", "com/github/newRzfuw.kr_atcsru_khci_jvfi" ], [ "com/github/newRzfuw", "kr_atcsru_khci_jvfi" ], [ "com/github/newRzfuw", "com/github/newRzfuw.lauiehEpJtw" ], [ "com/github/newRzfuw", "lauiehEpJtw" ], [ "java/io/BufferedOutputStream", "java/io/BufferedOutputStream.close" ], [ "java/io/BufferedOutputStream", "close" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.toByteArray" ], [ "java/io/ByteArrayOutputStream", "toByteArray" ], [ "com/github/newRzfuw", "com/github/newRzfuw.tapfwkUtils" ], [ "com/github/newRzfuw", "tapfwkUtils" ], [ "java/lang/Integer", "java/lang/Integer.valueOf" ], [ "java/lang/Integer", "valueOf" ], [ "java/util/ArrayList", "java/util/ArrayList.\u003cinit\u003e" ], [ "java/util/ArrayList", "\u003cinit\u003e" ], [ "java/util/zip/ZipEntry", "java/util/zip/ZipEntry.isDirectory" ], [ "java/util/zip/ZipEntry", "isDirectory" ], [ "java/lang/Character", "java/lang/Character.digit" ], [ "java/lang/Character", "digit" ], [ "java/lang/System", "java/lang/System.currentTimeMillis" ], [ "java/lang/System", "currentTimeMillis" ], [ "com/github/newRzfuw", "com/github/newRzfuw.rwhvok_ecwwoa_hdhp_bgrcx" ], [ "com/github/newRzfuw", "rwhvok_ecwwoa_hdhp_bgrcx" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "com/github/rqfmuc4$IbGMGLD", "com/github/rqfmuc4$IbGMGLD.statusCode" ], [ "com/github/rqfmuc4$IbGMGLD", "statusCode" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.length" ], [ "java/lang/String", "length" ], [ "com/github/newRzfuw", "com/github/newRzfuw.ypp_pw_um" ], [ "com/github/newRzfuw", "ypp_pw_um" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.write" ], [ "java/io/ByteArrayOutputStream", "write" ], [ "java/lang/String", "java/lang/String.charAt" ], [ "java/lang/String", "charAt" ], [ "java/nio/file/Files", "java/nio/file/Files.createDirectories" ], [ "java/nio/file/Files", "createDirectories" ], [ "java/nio/file/Files", "java/nio/file/Files.exists" ], [ "java/nio/file/Files", "exists" ], [ "java/util/zip/Inflater", "java/util/zip/Inflater.inflate" ], [ "java/util/zip/Inflater", "inflate" ], [ "com/github/newRzfuw", "com/github/newRzfuw.wFoct" ], [ "com/github/newRzfuw", "wFoct" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.\u003cinit\u003e" ], [ "java/lang/ProcessBuilder", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.\u003cinit\u003e" ], [ "java/lang/String", "\u003cinit\u003e" ], [ "java/io/ByteArrayInputStream", "java/io/ByteArrayInputStream.\u003cinit\u003e" ], [ "java/io/ByteArrayInputStream", "\u003cinit\u003e" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "java/lang/Throwable", "java/lang/Throwable.addSuppressed" ], [ "java/lang/Throwable", "addSuppressed" ], [ "java/nio/file/Path", "java/nio/file/Path.resolve" ], [ "java/nio/file/Path", "resolve" ], [ "com/github/newRzfuw", "com/github/newRzfuw.zctpbf5" ], [ "com/github/newRzfuw", "zctpbf5" ], [ "com/github/rqfmuc4$IbGMGLD", "com/github/rqfmuc4$IbGMGLD.bodyString" ], [ "com/github/rqfmuc4$IbGMGLD", "bodyString" ], [ "com/github/newRzfuw", "com/github/newRzfuw.dMqqn" ], [ "com/github/newRzfuw", "dMqqn" ], [ "java/io/FileOutputStream", "java/io/FileOutputStream.\u003cinit\u003e" ], [ "java/io/FileOutputStream", "\u003cinit\u003e" ], [ "java/lang/Process", "java/lang/Process.pid" ], [ "java/lang/Process", "pid" ], [ "java/nio/file/Path", "java/nio/file/Path.getParent" ], [ "java/nio/file/Path", "getParent" ], [ "java/util/zip/ZipInputStream", "java/util/zip/ZipInputStream.getNextEntry" ], [ "java/util/zip/ZipInputStream", "getNextEntry" ], [ "java/lang/Class", "java/lang/Class.getSimpleName" ], [ "java/lang/Class", "getSimpleName" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.start" ], [ "java/lang/ProcessBuilder", "start" ], [ "com/github/newRzfuw", "com/github/newRzfuw.runDetached" ], [ "com/github/newRzfuw", "runDetached" ], [ "com/github/newRzfuw", "com/github/newRzfuw.saveUgqcyo" ], [ "com/github/newRzfuw", "saveUgqcyo" ], [ "com/github/newRzfuw", "com/github/newRzfuw.rmqDvw" ], [ "com/github/newRzfuw", "rmqDvw" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "com/github/newRzfuw", "com/github/newRzfuw.runBhf" ], [ "com/github/newRzfuw", "runBhf" ], [ "java/lang/System", "java/lang/System.out" ], [ "java/lang/System", "out" ], [ "java/lang/ProcessBuilder$Redirect", "java/lang/ProcessBuilder$Redirect.from" ], [ "java/lang/ProcessBuilder$Redirect", "from" ], [ "java/util/zip/ZipInputStream", "java/util/zip/ZipInputStream.\u003cinit\u003e" ], [ "java/util/zip/ZipInputStream", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.startsWith" ], [ "java/lang/String", "startsWith" ], [ "com/github/newRzfuw", "com/github/newRzfuw.jjvkResolver" ], [ "com/github/newRzfuw", "jjvkResolver" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectOutput" ], [ "java/lang/ProcessBuilder", "redirectOutput" ], [ "java/util/Arrays", "java/util/Arrays.copyOfRange" ], [ "java/util/Arrays", "copyOfRange" ], [ "java/lang/System", "java/lang/System.arraycopy" ], [ "java/lang/System", "arraycopy" ], [ "java/util/zip/ZipInputStream", "java/util/zip/ZipInputStream.close" ], [ "java/util/zip/ZipInputStream", "close" ], [ "com/github/newRzfuw", "com/github/newRzfuw.sgtldq_hxafy_sdyo_igd" ], [ "com/github/newRzfuw", "sgtldq_hxafy_sdyo_igd" ], [ "java/util/zip/Inflater", "java/util/zip/Inflater.setInput" ], [ "java/util/zip/Inflater", "setInput" ], [ "java/io/File", "java/io/File.\u003cinit\u003e" ], [ "java/io/File", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.format" ], [ "java/lang/String", "format" ], [ "com/github/newRzfuw", "com/github/newRzfuw.toBqryawmyr" ], [ "com/github/newRzfuw", "toBqryawmyr" ], [ "java/util/zip/ZipEntry", "java/util/zip/ZipEntry.getName" ], [ "java/util/zip/ZipEntry", "getName" ], [ "com/github/newRzfuw", "com/github/newRzfuw.huyval_hty" ], [ "com/github/newRzfuw", "huyval_hty" ], [ "java/util/Base64$Decoder", "java/util/Base64$Decoder.decode" ], [ "java/util/Base64$Decoder", "decode" ], [ "java/lang/String", "java/lang/String.indexOf" ], [ "java/lang/String", "indexOf" ], [ "com/github/newRzfuw", "com/github/newRzfuw.iNVjh" ], [ "com/github/newRzfuw", "iNVjh" ], [ "com/github/newRzfuw", "com/github/newRzfuw.jGqb" ], [ "com/github/newRzfuw", "jGqb" ], [ "java/lang/String", "java/lang/String.substring" ], [ "java/lang/String", "substring" ], [ "java/io/PrintStream", "java/io/PrintStream.println" ], [ "java/io/PrintStream", "println" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectErrorStream" ], [ "java/lang/ProcessBuilder", "redirectErrorStream" ], [ "java/util/zip/Inflater", "java/util/zip/Inflater.\u003cinit\u003e" ], [ "java/util/zip/Inflater", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.isEmpty" ], [ "java/lang/String", "isEmpty" ], [ "java/lang/String", "java/lang/String.equals" ], [ "java/lang/String", "equals" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ], [ "java/nio/file/Path", "java/nio/file/Path.toFile" ], [ "java/nio/file/Path", "toFile" ], [ "com/github/newRzfuw", "com/github/newRzfuw.msyafRwxg" ], [ "com/github/newRzfuw", "msyafRwxg" ] ], "metrics": { "file": { "size": 139295, "entropy": 4.43 }, "class": { "major_version": 65, "interface_count": 0, "method_ref_count": 120, "constant_pool_size": 1193, "external_class_count": 42 }, "binary": { "peak_region_bytes": 17408, "peak_region_entropy": 7.05 }, "imports": { "count": 162 }, "functions": { "count": 20 } } }, "id": 2, "mol": "O₃(AlAs₂I)H₅(Db₄F₂OsPo₂Ti)", "path": "/data/samples/incoming/forager/bad/sha256/bazaar/GlazedAddon.jar!!com/github/newRzfuw.class", "pid": 0, "risk": 13, "sha": "d6ad96b1f73368549a34182c7ed485278fce251ff407b1675a6ff6ac2b5388fd", "size": 139295, "traits": [ { "id": "micro-behaviors/communications/proxy/tunnel::byte-output-stream", "atk": "T1090", "mbc": "C0003", "conf": 0.5, "crit": 3, "desc": "Java ByteArrayOutputStream usage", "spans": [ [ 672, 21 ], [ 12703, 21 ], [ 13372, 21 ], [ 13497, 21 ], [ 13597, 21 ] ] }, { "id": "micro-behaviors/data/archive/extract/zip::jvm-zip-entry-iteration-bytecode", "conf": 0.92, "crit": 3, "desc": "JVM iterates ZIP archive entries", "spans": [ [ 12334, 41 ] ] }, { "id": "micro-behaviors/data/archive/extract/zip::jvm-zip-entry-read-bytecode", "conf": 0.9, "crit": 3, "desc": "JVM reads ZIP archive entry data", "spans": [ [ 12678, 33 ] ] }, { "id": "micro-behaviors/data/buffer/transfer::bytearrayinputstream-ref", "conf": 0.88, "crit": 3, "desc": "Java ByteArrayInputStream class" }, { "id": "micro-behaviors/data/buffer/transfer::bytearrayoutputstream-ref", "conf": 0.88, "crit": 3, "desc": "Java ByteArrayOutputStream class", "spans": [ [ 13364, 29 ] ] }, { "id": "micro-behaviors/data/decode/base64::java-base64-decode-bytecode-call", "conf": 0.96, "crit": 3, "desc": "Java Base64 decode call", "spans": [ [ 19154, 31 ] ] }, { "id": "micro-behaviors/data/decode/base64::java-base64-decoder-bytecode-call", "conf": 0.94, "crit": 3, "desc": "Java Base64 decoder accessor call", "spans": [ [ 19100, 27 ] ] }, { "id": "micro-behaviors/data/decode/base64::java-base64-decoder-class", "conf": 0.92, "crit": 3, "desc": "JVM Base64 decoder class reference", "spans": [ [ 206, 24 ], [ 19113, 28 ] ] }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method", "spans": [ [ 1122, 8 ] ] }, { "id": "micro-behaviors/fs/read/file/handle::jvm-io-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM File API class reference" }, { "id": "micro-behaviors/fs/read/file/handle::jvm-nio-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM NIO file API reference" }, { "id": "micro-behaviors/fs/write/file/handle::jvm-fileoutputstream-bytecode", "conf": 0.86, "crit": 3, "desc": "JVM imports FileOutputStream class", "spans": [ [ 12541, 24 ] ] }, { "id": "micro-behaviors/os/env/gate::jvm-opaque-environment-key", "conf": 0.94, "crit": 1, "desc": "JVM class has generated gate value" }, { "id": "micro-behaviors/os/env/gate::jvm-string-equals-import", "conf": 0.94, "crit": 1, "desc": "JVM class imports String equals", "spans": [ [ 14267, 0 ] ] }, { "id": "micro-behaviors/os/env/gate::jvm-system-getenv-import", "conf": 0.94, "crit": 1, "desc": "JVM class imports System getenv", "spans": [ [ 5636, 0 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.88, "crit": 3, "desc": "Java bytecode ProcessBuilder reference", "spans": [ [ 126, 71 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-init-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.92, "crit": 3, "desc": "Java bytecode ProcessBuilder constructor", "spans": [ [ 664, 31 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.95, "crit": 3, "desc": "Java bytecode ProcessBuilder start", "spans": [ [ 15177, 30 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-errors", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder merges standard error", "spans": [ [ 15098, 44 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-input", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard input", "spans": [ [ 14900, 38 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-output", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard output", "spans": [ [ 15071, 39 ] ] }, { "id": "micro-behaviors/time/sleep/interval::java-thread-sleep-bytecode", "conf": 0.9, "crit": 3, "desc": "Java bytecode thread sleep", "spans": [ [ 11993, 22 ] ] }, { "id": "objectives/anti-analysis/timing/evasion::kotlin-thread-sleep-check", "atk": "T1497.003", "conf": 0.94, "crit": 3, "desc": "Kotlin Thread.sleep call", "spans": [ [ 12003, 12 ] ] }, { "id": "objectives/anti-static/obfuscation/string/control-prefix::java-character-digit-bytecode", "atk": "T1027", "mbc": "F0001", "conf": 0.9, "crit": 3, "desc": "Java bytecode calls Character.digit", "spans": [ [ 20663, 25 ] ] }, { "id": "objectives/anti-static/obfuscation/string/control-prefix::java-control-prefixed-long-string", "atk": "T1027", "mbc": "F0001", "conf": 0.92, "crit": 3, "desc": "Java string starts with control-length prefix" }, { "id": "objectives/anti-static/obfuscation/string/crypto::java-byte-range-copy", "atk": "T1027", "mbc": "F0001", "conf": 0.7, "crit": 3, "desc": "Java byte range copy", "spans": [ [ 13120, 11 ] ] }, { "id": "objectives/impact/dos/disk::jvm-two-backward-goto-branches", "atk": "T1499.001", "conf": 0.9, "crit": 3, "desc": "JVM repeated counter backedges", "spans": [ [ 21896, 8 ], [ 21993, 8 ], [ 22092, 8 ], [ 22190, 8 ], [ 22273, 8 ], [ 22366, 8 ], [ 22479, 8 ], [ 22566, 8 ] ] }, { "id": "well-known/malware/stealer/prefire-shard::prefire-family-literal", "atk": "T1528", "mbc": "B0006", "conf": 0.9, "crit": 1, "desc": "Prefire family name literal", "spans": [ [ 4100, 7 ] ] }, { "id": "micro-behaviors/data/archive/extract/zip::jvm-zip-entry-extraction-to-file", "conf": 0.96, "crit": 3, "desc": "JVM extracts ZIP entries to files", "uses": [ 1, 2, 11 ], "spans": [ [ 12334, 41 ], [ 12541, 24 ], [ 12678, 33 ] ] }, { "id": "micro-behaviors/data/decode/base64::java-base64-decoding-bytecode", "conf": 0.94, "crit": 3, "desc": "Java bytecode Base64 decoding", "uses": [ 5, 6 ], "spans": [ [ 19100, 27 ], [ 19154, 31 ] ] }, { "id": "micro-behaviors/os/env/gate::jvm-opaque-secret-environment-gate", "conf": 0.97, "crit": 3, "desc": "JVM compares opaque environment gate", "uses": [ 12, 13, 14 ], "spans": [ [ 5636, 6 ], [ 14267, 6 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.94, "crit": 3, "desc": "Java bytecode ProcessBuilder execution", "uses": [ 16, 17 ], "spans": [ [ 664, 31 ], [ 15177, 30 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirected-stdio", "conf": 0.96, "crit": 3, "desc": "Java ProcessBuilder redirects all standard streams", "uses": [ 18, 19, 20 ], "spans": [ [ 14900, 38 ], [ 15071, 39 ], [ 15098, 44 ] ] }, { "id": "micro-behaviors/process/create/spawn::child-process-creation-api", "atk": "T1106", "conf": 0.92, "crit": 3, "desc": "Starts a child process through a platform API", "uses": [ 31 ], "spans": [ [ 664, 31 ], [ 15177, 30 ] ] } ], "type": "java_class" }, { "ctx": [ { "b": "+kO#^0000+0LONm5mYS}fk20vxMW=qAbO^0yZf}v0rrWCvrM6jy*?i]fhD4(wN//!00rl4a8UUifj[T4A+P32v\u003eRnfx!Jh0wjZVMBzkf1x)Kuh2lj]d02PDVC404DBzkLAlsB}Dhz=WFzEWP}wPw1Q2ls/oygho]flIwJy+Fa-B7El^2lk5h00+@gv@C)?ASDd-ygho]fkL6mxd)84z!0v1B3+1-y?d9$bVnh:x(W={Bo.^O0rr%KvrM6jy*?i]fhMXcv}x.5luN0UwmY=^01G2f2VtkAx(W={Bo8v/ygho]fkL6mxd)$pC5Iecfhl21xM4ALvqYQ(wPGa\u003cz/oAlA0DvP0rsfQvrM6jy*?i]fkkrEz!\u0026]qo\u003ewAWz!8yEzE^M{A%zWU0rrr$z/oAlz#/}yjzwXEBuPZ911kQ03\u0026?4y7yycB02L.p15R{t0rr:av@Diqxk8E3BZ^1yz=Q%@i@]r\u0026z/ec:x([5$y?Xib1c%/J.#?-46:s=BLLeh.}^/Di13jGGhuQaE\u0026{3KA5nCS%vj#C9zF7R4xMvV)wcS8V5c9HE01S\u003c?CxWF5x\u003eqg8zc{\u003e1z43y\u003e02C$x0STOU1PP}K03Ve^C404uvqYZhx(n9jyH]d)vqPE:vngrPvp\u0026}TBz(hB2lljO01iTPByw=\u0026v@#TfC(W]?c}[w:C404uvqYZhx(n9jyH]d[wPRQ7wjQcDwnC*#bUSb{yJTOToLO0Vvj#C9zF7R3BAh8kxfe!4vrM6jy*?i]fkkrEz!\u0026]qo\u003ewz", "ln": 0 }, { "b": "fkL6mxd)e9zF\u0026((y?kWp05jEe5=.[igxvE(c}[w:C404uvqYZhqGV\u003e{vpB4:j1jhs02tL(3ihsKhur^YB97\u0026hBpnde02C$xbMG?900WEPw{dQ00rrZOD1?nmv@$N\u003cCXyMeoLcRa0rsC{oLO0Vvj#C9zF7R3BAh8kxfdLoygho]fkL6mxd)h9A+PA7i@]rZA%6M-MLY[:Rd?/:!BBBWFkcu!fpsbm1\u003e\u0026]y(:UTRB]#U!tQ6mH00\u0026M{0rr{JvrM6jy*?i]fh($kx(mMIB.LV5wPv", "ln": 784 }, { "b": "o-Ptq00BYwdol\u0026S765N^07)lp0rs8/lN+YzvrM6jy*?i]fh($kx(mMIB.LV5wPx\u003cv09GqG3iiV#D\u0026TiMBz\u003e91A+PA70rr/ZdnjF+C404uvqYZhq/)4]zF83t0dB]$3iiV#Fb]SZygho]fkL6mxd(?]By/8@AT8O@0rrvFvqH6$pI6Rc7aq:6oLO0Vvj#C9zF7Q]zGGD5wPx\u003cv0e7ua3ikXUH5?nUw]zZbvrqIIivENovrM6jy*?i]fh($k", "ln": 1561 }, { "b": "C404uvqYZhq/)4]zF8pUx(4r\u003eAYTp46ky%0vj#C9zF7Q\u003eCW\u003er7BzkVh2lo}\u0026l.le\u003c10[xrBo8vNv%8*jwO#P?x(dAQx(4Q1A@=myc[d:%0g9XM3ijPpNe)p7zE)]yze0)0v@=0\u0026Bt4cuvrlG%gCHM*0gJ#?3VfD%xM4A*f/p*y0rs5!dnjR\u003cBt4GBzE)r#vp\u003cQmv@bN{B6*ZTfGPWyODbk*0gT4Y0rrHAwPRQ7wm45Gg=LHo8Z)dezE)]yze0)0v@=0\u0026Bt4cuvrlG%gCQTC3\u0026($3Q6Z)\u003c0hxL{7J9/afkUAvwN/:?w]]Xoy*?yauO:C\u003e2lpO301iTPBzbP6uOKC$gZ\u003cwZ0dLsQRu0K}01iTPBzbP6uOKC$hvGO=0dLsQRu0T$01rZQBzbP6uO\u003cO#f/Gak5?2h5ygho]flIwJy+F^*nKLSG0iDm73il}6Uk[Rkygho]flIwJy+F^*nKJ^-U)HGp0dU7I0:wn40jh+bb)AqrWD0gL(-(32PoX\u003e$WC[=$\u003cbG/0VAi5VGysI\u0026\u0026\u003c#kKJIlWUWGcvwv@Diqxk8E3BZ^1wwP}3#w{5q50jS4f6Mm[(vruvgBXuB\u0026B9ph$Dsq2nyyyiO0dLsQXD6kx019Z=v@+T?A+/lb3\u0026)%vE*Mg^0knElbYmgnfj[T4A+P32v\u003eRUpvpS}\u0026fjw*lfgC", "ln": 1888 }, { "b": "0l\u003e\u0026JXD0DE010pHBvp4:vqfP/0mgZ}3imQp^e:jLAb]J4x(W+=07[Ukygho]fkL6mxd)h9A+PA7j4%x$C404uvqYZhq/)4]zF848ygho]fkL6mxd)h9A+PA7j1i\u003crvrM6jy*?i]fh($kx(mMB3\u0026[-R!cVf", "ln": 2601 }, { "b": "A=U/lfh($3zE^f@wj73sA=U/lA%zZb0rrp6r7pjO0rs3iygho]fk+GxfjOW7A=U/lfgfzYA=U/li$8bL0o:Z?\u003c]BSD00)jGBv7m{wPE\u003eL9W\u003cY%vrM6jzFs2xv}Yp\u003eB7GCDlUG[GB7GCPdo/aE0p6TK3ii^2)eWg%wO#0@wmX.Uq/)4]zF5$I7arxNdnjF+C404uvqYZhq/)4]zF83t0pG{S3igti[C@Rt3Gd./\u0026HNdtWYX.ZQu^-e*NNC+TNAJ(\u003eCr)\u003cXv*:@O8G)b)ZE/fOSi%Q]9UMw0dU7If5.L:\u003eCj72P0mH*Oz/i(\u003eCrZ)P1Bo@KL$#0\u003eCjvaPtfuuLinTz\u003e+1BhX4-4K0qlA[oBy0vPy4F$)3\u003cKhN2*j0Ncou)(AlYDKDYd7RSbmv\u003e.^7vIm@nBZu.i4\u0026I0pnIl=AIYyg([[0]T4Y@71KMHfHo)3\u003e-PN6\u003e[CX^erh0rtp\u0026)vg(HTax.#P2VVPQor^]SPHmi)Uc$(Y1vv0O-cSK)#j{0Z3.U^(B\u0026esS\u003cq5CPx:4X)vfT", "ln": 3077 }, { "b": "\u003cE7X^L9bajR0rPs\u0026hz\u003e8Y[kBzGyteh\u003cD#UfTE!:AO-\u003e(-3Ku+R0rrTBvrM6jy*?i]fgfL:B8}M!blm=TxjVfYA=l5hv@#B6zBwzWvqfPW03S*uoLO0Vvj#Xkv%8*aBA]JoA=l5hv@#B6zBwzWvqfQv3\u0026}TPcjf=00vE)F9+]bbvj#Xkv%8*aBA]JoA=l5hv@#B6zBwzWvqfP:0vX3H4qfl]lVlHDq/u/0v}tVv94imfygho]flpYmB-IhrC}RK6wmXXTB-H#6i$8cu0w1MUdGIa402PDVC404BwN/\u003e6x([RNlVlHDq/u/0v}t(Cf984XxjVfUz!0i$x(v\u003e\u002601ZLcoLO0Vvj#IfBt3S(oGJT-f-:3p0wBKg0rrKyvrM6jzE)]yrz(G}0w%(T1:1V.qB{(?5gw#3ygho]fk+uyfi7[wi$8cG0xpz!hut/s03\u0026%^ygho]fk+uyfi7[wj1i\u003crvrM6jzFs2xw[=6)fhM80xGDR669gf50lUy90rs}W\u0026hz$4Ri*RyHVse^(8f{bSHz\u003eyNc{V3\u003ca:w]RJ*2rM/B\u003e", "ln": 4411 }, { "b": "c}[w:C404rz.BN]y?kWSoLO0Vvj#C9zF7R0A=kD0B8%V\u003cx(4r\u003eAWjK]wnc6}v@%^v0BL}p3igIovGuDrA+e=}A+e:5nP5G\u0026Bo8wac}[w:C404uvqYZhp\u0026ZF:wPI]VB.LV5wPx4]wN]H}wN/*zdnjF+C404uvqYZhp\u0026ZF:wPI]VB.LV5wPx\u003cv0B#jx3igOqw=R(!2Kwj#)6izFORu6YRqu*+XVC1KOA(#D)68/pOvdvlGX%h#XpS}3VG[rM)68xdOt3n\u0026xAn8rA+frgy\u003c6v\u003c04ol?ygho]fkH", "ln": 5468 }, { "b": "0C?=p26s=Mx(4tY01ZLcoLO0Vvj#tkfgGU(wJHq3zujU-0lUyZ0rrylAbYxawk)EQ0DFiH3igIoA@=mJA+e=}A+e:5pJZ+#B-X2)BPD4X01P9N0rr^NwN]H}wN/*JA=M8sq/)4\u003evqM2B9vL8uoLO0Vvj#C9zF7R0A=kD0B8%V\u003cx(4r\u003eAYTWgCMA6%01P9R0rrBpx(W={Bz(hB0rsO$oLO0Vvj#tkfgGU(wJItmygho]fkL6mxd)84z!0v1B3+1-y?d9$i$8dq0EUpP4/}aW02l[hoLO0Vvj#C9zF7R0A=kD0B8%zK05$1f3igOqFDk:f2\u0026*JA\u003e7]u", "ln": 5738 }, { "b": "[3d\u0026T0Gm3V6xLNo\u003c^i4cY1vmtYx\u003ery(AW2=2MY}^02PDVC404wx(tUpx(4ulpJf(.pJgz\u0026z/b^XKo2s?CxdztwM9X\u003ex(mL:09}0Dygho]fk+Gxfj[{mwIl\u003e*Bz9:fygho]fkL6mxd(R=vrbpTADL\u0026gv}v-aoLO0Vvj#Ijz.CZpy?km}AaJ].Acb/jzAxpvygho]fk+Gxfj[{mwIl\u003e*Bz9-A0G)FE3iq4CLMp:{Ab]VgBw)o\u0026v@24:vpJ\u003cS0HrZ43ilp\u003eMJm71B3@X(uVO[TDs6+", "ln": 6191 }, { "b": "WG6e=2n):Gg=tQS2FHsK6:Otd2]9=V1V=$)hvylc6:ZPmbPc}73MffL6:OgZ3T+!e2lU+H6:O+^g?q+HGBm*U%j+c=o\u003c5tvW/xKs09\u0026Q60WYDhuBx\u0026hiU02q12I[D84Kv}4}C/Nhv{PmYAHtd12Z=b5!$$L03\u0026A]6+Rw]6+pBP6+T[h84D=:5!${@u]iE#rFg$=R#LI-08lPl5W}:xWG6MlRVC3[5[5cFq92Bf6$%/Y85lHnhwNeBZ7?z]1y%zb6=jH^iV4@S85j277OQ)L85K8a85i(7g-m2y7zN/57i0UrF%6b!83cVn?[5\u003e.sS56=09DVftVW*7B1v@kWG6e=92PZ#g=uu(9khL^6=**y9U/:e1V^.chx-!U6=%7HbPdWsaShm56=*V%aZ^bA90v016=?m3g\u003eH(\u003cGDQw]%jXnfYAHts86n}#aoJu1XbZiO08lPlaH.tMWG6MlRVv8px/mQVfa}#F5]10sc\u003eZnMfblbL0pBkMfblbMyL1C$6!Y-nhzkTA1Vw4HfC4\u0026fhzuV{zmfBwiWkH!12I[Y86=\u0026#wecw2hyf7:YAHty12.IAckv)CblO-bu\u003e\u003e4%", "ln": 7347 }, { "b": "dZ/t31y@k$whV0J07{xeevLR9iXpB(e!]#Netra[87=ZQ1qJB{6!S[50co2c1qJK7d@X[80cqXlWG7.SGF0q6%je5tWG7\u003cYY-ngr0#h3I0eBH.0e[n=tVW*63m([@WG7.SGARyO@xq^v0d?uO00063X=qZihujNH2laVp00SVd0TwZ12lmv308\u0026[0008]%lim8^aoh/P00ix9o:pU\u003c2lmW60rAA9qVM[708\u0026)#0s5P%x9OAe@@rMf2l$kg2lmE607)E@qVM[100930aoi5W00ix9o:pU\u003c2lmW60rAf200000", "ln": 7876 }, { "b": "WG6e=7A11\u003eg=uf*7RQ2.6=pEt85j441V^L7hx9wI6=A.CbPdHn8YoB{6=pr[8^\u003eGu7x+D(6=p)$g?q+HGC%@\u0026%j+c=o\u003c5tLW/xI\u003e2dKVCiTrd{ZD8Ug0l8FG:PhyL0l$PBiTEqtXb.%]Y8YxAW/B-n3k\u003chV0mA[od*rA.NOT\u003ee84e2l2ETS-iT^IyXb.%]Xb+kj83EwF*:TfCWGb8jeW+VmiV{E9iV+)kn)eR6oa{9\u002608U^286G8shx\u003c1ZZ7?\u002651y%zn6^Hu{iWs!=b]4ZvbCCe-86/}y86G.s1yI@\u003cu]e-A1qJi$b5*{DF%6b!b(%}z*Q^CWsS5G]09DVftP1P\u003e09*e{WG6e=c(BAng=u^2d83ABwcuB3dITCC1V!dohy]N]6!k{TbPe9EeeY\u0026JdfK2[emppLc\u003cgno6!a9fg\u003eH(\u003cGE^e4%j+c=o\u003c5t:W/xKs09*x-WG6LB\u0026\u003cF?:iXIv712I[\u0026885Ybwec!ehzC{", "ln": 8742 } ], "depth": 1, "facts": { "imp": [ [ "", "java/lang/System" ], [ "", "java/nio/file/OpenOption" ], [ "", "java/io/File" ], [ "", "java/lang/invoke/MethodHandles" ], [ "", "java/lang/invoke/MethodHandles$Lookup" ], [ "", "net/fabricmc/loader/api/FabricLoader" ], [ "", "java/lang/ProcessBuilder" ], [ "", "java/lang/StringBuilder" ], [ "", "java/nio/file/Files" ], [ "", "java/lang/Object" ], [ "", "java/nio/charset/StandardCharsets" ], [ "", "java/nio/file/LinkOption" ], [ "", "java/nio/file/Path" ], [ "", "java/lang/String" ], [ "", "com/github/newRzfuw" ], [ "", "java/lang/Class" ], [ "", "java/security/ProtectionDomain" ], [ "", "java/net/URL" ], [ "", "java/util/Base64" ], [ "", "java/net/URI" ], [ "", "java/lang/Thread" ], [ "", "java/lang/invoke/LambdaMetafactory" ], [ "", "java/nio/file/attribute/FileAttribute" ], [ "", "java/lang/Exception" ], [ "", "net/fabricmc/api/ModInitializer" ], [ "", "net/minecraft/class_310" ], [ "", "net/minecraft/class_320" ], [ "", "java/lang/ProcessBuilder$Redirect" ], [ "", "[C" ], [ "", "[J" ], [ "", "[Ljava/lang/String;" ], [ "", "java/security/CodeSource" ], [ "", "java/lang/Integer" ], [ "", "java/util/UUID" ], [ "", "java/util/Base64$Encoder" ], [ "com/github/poVtl", "com/github/poVtl.uyiqlctQuxhbuLfBj" ], [ "com/github/poVtl", "uyiqlctQuxhbuLfBj" ], [ "java/lang/String", "java/lang/String.length" ], [ "java/lang/String", "length" ], [ "java/nio/file/Path", "java/nio/file/Path.getParent" ], [ "java/nio/file/Path", "getParent" ], [ "com/github/newRzfuw", "com/github/newRzfuw.qqcrWorker" ], [ "com/github/newRzfuw", "qqcrWorker" ], [ "net/fabricmc/loader/api/FabricLoader", "net/fabricmc/loader/api/FabricLoader.getInstance" ], [ "net/fabricmc/loader/api/FabricLoader", "getInstance" ], [ "java/io/File", "java/io/File.\u003cinit\u003e" ], [ "java/io/File", "\u003cinit\u003e" ], [ "java/security/CodeSource", "java/security/CodeSource.getLocation" ], [ "java/security/CodeSource", "getLocation" ], [ "java/util/Base64$Encoder", "java/util/Base64$Encoder.encodeToString" ], [ "java/util/Base64$Encoder", "encodeToString" ], [ "java/lang/Class", "java/lang/Class.getProtectionDomain" ], [ "java/lang/Class", "getProtectionDomain" ], [ "net/minecraft/class_320", "net/minecraft/class_320.method_44717" ], [ "net/minecraft/class_320", "method_44717" ], [ "com/github/newRzfuw", "com/github/newRzfuw.prefire" ], [ "com/github/newRzfuw", "prefire" ], [ "java/nio/file/Files", "java/nio/file/Files.writeString" ], [ "java/nio/file/Files", "writeString" ], [ "java/lang/System", "java/lang/System.getProperty" ], [ "java/lang/System", "getProperty" ], [ "java/nio/file/Path", "java/nio/file/Path.toString" ], [ "java/nio/file/Path", "toString" ], [ "com/github/poVtl", "com/github/poVtl.kwwwa_ienum_eym" ], [ "com/github/poVtl", "kwwwa_ienum_eym" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.format" ], [ "java/lang/String", "format" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "net/minecraft/class_310", "net/minecraft/class_310.method_1551" ], [ "net/minecraft/class_310", "method_1551" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.directory" ], [ "java/lang/ProcessBuilder", "directory" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ], [ "java/nio/charset/StandardCharsets", "java/nio/charset/StandardCharsets.UTF_8" ], [ "java/nio/charset/StandardCharsets", "UTF_8" ], [ "java/lang/String", "java/lang/String.getBytes" ], [ "java/lang/String", "getBytes" ], [ "java/util/UUID", "java/util/UUID.toString" ], [ "java/util/UUID", "toString" ], [ "java/nio/file/Path", "java/nio/file/Path.of" ], [ "java/nio/file/Path", "of" ], [ "net/minecraft/class_310", "net/minecraft/class_310.method_1548" ], [ "net/minecraft/class_310", "method_1548" ], [ "java/lang/ProcessBuilder$Redirect", "java/lang/ProcessBuilder$Redirect.appendTo" ], [ "java/lang/ProcessBuilder$Redirect", "appendTo" ], [ "java/net/URL", "java/net/URL.toURI" ], [ "java/net/URL", "toURI" ], [ "java/nio/file/Path", "java/nio/file/Path.of" ], [ "java/nio/file/Path", "of" ], [ "java/lang/System", "java/lang/System.getenv" ], [ "java/lang/System", "getenv" ], [ "net/minecraft/class_320", "net/minecraft/class_320.method_1676" ], [ "net/minecraft/class_320", "method_1676" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.\u003cinit\u003e" ], [ "java/lang/String", "\u003cinit\u003e" ], [ "java/nio/file/Files", "java/nio/file/Files.exists" ], [ "java/nio/file/Files", "exists" ], [ "net/fabricmc/loader/api/FabricLoader", "net/fabricmc/loader/api/FabricLoader.getConfigDir" ], [ "net/fabricmc/loader/api/FabricLoader", "getConfigDir" ], [ "java/lang/invoke/LambdaMetafactory", "java/lang/invoke/LambdaMetafactory.metafactory" ], [ "java/lang/invoke/LambdaMetafactory", "metafactory" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.toString" ], [ "java/lang/StringBuilder", "toString" ], [ "java/util/Base64", "java/util/Base64.getEncoder" ], [ "java/util/Base64", "getEncoder" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectInput" ], [ "java/lang/ProcessBuilder", "redirectInput" ], [ "java/lang/ProcessBuilder$Redirect", "java/lang/ProcessBuilder$Redirect.from" ], [ "java/lang/ProcessBuilder$Redirect", "from" ], [ "java/lang/Thread", "java/lang/Thread.\u003cinit\u003e" ], [ "java/lang/Thread", "\u003cinit\u003e" ], [ "java/lang/System", "java/lang/System.arraycopy" ], [ "java/lang/System", "arraycopy" ], [ "java/lang/Thread", "java/lang/Thread.start" ], [ "java/lang/Thread", "start" ], [ "java/nio/file/Files", "java/nio/file/Files.createDirectories" ], [ "java/nio/file/Files", "createDirectories" ], [ "java/nio/file/Path", "java/nio/file/Path.resolve" ], [ "java/nio/file/Path", "resolve" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectOutput" ], [ "java/lang/ProcessBuilder", "redirectOutput" ], [ "java/lang/Class", "java/lang/Class.getName" ], [ "java/lang/Class", "getName" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.\u003cinit\u003e" ], [ "java/lang/ProcessBuilder", "\u003cinit\u003e" ], [ "com/github/newRzfuw", "com/github/newRzfuw.getDomain" ], [ "com/github/newRzfuw", "getDomain" ], [ "java/lang/String", "java/lang/String.toCharArray" ], [ "java/lang/String", "toCharArray" ], [ "java/lang/System", "java/lang/System.currentTimeMillis" ], [ "java/lang/System", "currentTimeMillis" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "net/minecraft/class_320", "net/minecraft/class_320.method_1674" ], [ "net/minecraft/class_320", "method_1674" ], [ "java/lang/String", "java/lang/String.charAt" ], [ "java/lang/String", "charAt" ], [ "java/security/ProtectionDomain", "java/security/ProtectionDomain.getCodeSource" ], [ "java/security/ProtectionDomain", "getCodeSource" ], [ "java/lang/Integer", "java/lang/Integer.valueOf" ], [ "java/lang/Integer", "valueOf" ], [ "com/github/newRzfuw", "com/github/newRzfuw.ooXatmwuKissvKszawnk" ], [ "com/github/newRzfuw", "ooXatmwuKissvKszawnk" ], [ "com/github/newRzfuw", "com/github/newRzfuw.\u003cinit\u003e" ], [ "com/github/newRzfuw", "\u003cinit\u003e" ], [ "java/nio/file/Path", "java/nio/file/Path.toFile" ], [ "java/nio/file/Path", "toFile" ], [ "java/lang/Exception", "java/lang/Exception.printStackTrace" ], [ "java/lang/Exception", "printStackTrace" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.start" ], [ "java/lang/ProcessBuilder", "start" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectErrorStream" ], [ "java/lang/ProcessBuilder", "redirectErrorStream" ] ], "metrics": { "file": { "size": 34297, "entropy": 4.37 }, "class": { "major_version": 65, "interface_count": 1, "method_ref_count": 63, "constant_pool_size": 446, "external_class_count": 35 }, "binary": { "peak_region_bytes": 4096, "peak_region_entropy": 6.75 }, "imports": { "count": 98 }, "functions": { "count": 4 } } }, "id": 3, "mol": "K(Ga)O₄(CaAs₂ErI)H₄(CmDb₂F₂Po₅)", "path": "/data/samples/incoming/forager/bad/sha256/bazaar/GlazedAddon.jar!!com/github/poVtl.class", "pid": 0, "risk": 131, "sha": "0ca7dc704299539bfdfde9d661f306f1e8eb1d20ef2ed1ed11f6b699cb6153ee", "size": 34297, "traits": [ { "id": "micro-behaviors/communications/http/lib/urlconnection::java-url-class-bytecode", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Java URL class reference", "spans": [ [ 4681, 16 ], [ 4710, 12 ] ] }, { "id": "micro-behaviors/communications/http/lib/urlconnection::jvm-url-class-ref", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "JVM URL class reference" }, { "id": "micro-behaviors/data/encode/base64::jvm-base64-encode-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM Base64 encodeToString call", "spans": [ [ 3205, 39 ] ] }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method", "spans": [ [ 1625, 8 ] ] }, { "id": "micro-behaviors/fs/read/file/handle::jvm-io-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM File API class reference" }, { "id": "micro-behaviors/fs/read/file/handle::jvm-nio-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM NIO file API reference" }, { "id": "micro-behaviors/fs/write/file/full::jvm-files-writestring-bytecode", "conf": 0.9, "crit": 3, "desc": "JVM bytecode Files.writeString", "spans": [ [ 6255, 31 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.88, "crit": 3, "desc": "Java bytecode ProcessBuilder reference", "spans": [ [ 156, 71 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-init-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.92, "crit": 3, "desc": "Java bytecode ProcessBuilder constructor", "spans": [ [ 324, 31 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.95, "crit": 3, "desc": "Java bytecode ProcessBuilder start", "spans": [ [ 848, 30 ] ] }, { "id": "micro-behaviors/process/info/current::codesource-class", "conf": 0.85, "crit": 3, "desc": "Java CodeSource class reference" }, { "id": "micro-behaviors/process/info/current::getlocation-ref", "conf": 0.82, "crit": 3, "desc": "Java getLocation call reference" }, { "id": "micro-behaviors/process/info/current::protection-domain-class", "conf": 0.85, "crit": 3, "desc": "Java ProtectionDomain class reference" }, { "id": "micro-behaviors/process/info/current::touri-ref", "conf": 0.82, "crit": 3, "desc": "Java toURI call reference" }, { "id": "micro-behaviors/process/info/selfpath::java-protection-domain", "conf": 0.82, "crit": 3, "desc": "Java getProtectionDomain self-path lookup" }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-errors", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder merges standard error", "spans": [ [ 5829, 44 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-input", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard input", "spans": [ [ 5532, 38 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-output", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard output", "spans": [ [ 5802, 39 ] ] }, { "id": "micro-behaviors/process/thread/lifecycle::jvm-thread-start-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM starts a thread", "spans": [ [ 848, 22 ] ] }, { "id": "objectives/anti-static/obfuscation/reflection/class::java-protectiondomain", "conf": 1.0, "crit": 3, "desc": "Java ProtectionDomain", "spans": [ [ 4475, 19 ], [ 4497, 34 ], [ 4544, 30 ] ] }, { "id": "objectives/anti-static/obfuscation/string/control-prefix::java-control-prefixed-long-string", "atk": "T1027", "mbc": "F0001", "conf": 0.92, "crit": 3, "desc": "Java string starts with control-length prefix" }, { "id": "objectives/credential-access/gaming/minecraft::minecraft-token-getter-ref", "atk": "T1528", "mbc": "B0006", "conf": 0.92, "crit": 3, "desc": "Minecraft access token getter", "spans": [ [ 2150, 35 ] ] }, { "id": "objectives/evasion/self-delete/file/script::java-code-source-location", "atk": "T1070.004", "mbc": "F0007", "conf": 0.78, "crit": 3, "desc": "Java code source location", "spans": [ [ 4580, 13 ] ] }, { "id": "objectives/impact/dos/disk::jvm-two-backward-goto-branches", "atk": "T1499.001", "conf": 0.9, "crit": 3, "desc": "JVM repeated counter backedges", "spans": [ [ 7411, 8 ], [ 7500, 8 ], [ 7590, 8 ], [ 7679, 8 ], [ 7940, 8 ], [ 7980, 8 ], [ 8806, 8 ], [ 8993, 8 ] ] }, { "id": "well-known/game/mod::minecraft-client-class-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft client singleton class reference", "spans": [ [ 1984, 23 ] ] }, { "id": "well-known/game/mod::minecraft-name-getter-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft profile name getter reference", "spans": [ [ 2174, 35 ] ] }, { "id": "well-known/game/mod::minecraft-session-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft session object reference", "spans": [ [ 2121, 23 ] ] }, { "id": "well-known/game/mod::minecraft-uuid-getter-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft profile UUID getter reference", "spans": [ [ 2198, 36 ] ] }, { "id": "well-known/malware/stealer/prefire-shard::prefire-family-literal", "atk": "T1528", "mbc": "B0006", "conf": 0.9, "crit": 1, "desc": "Prefire family name literal", "spans": [ [ 2653, 7 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.94, "crit": 3, "desc": "Java bytecode ProcessBuilder execution", "uses": [ 8, 9 ], "spans": [ [ 324, 31 ], [ 848, 30 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirected-stdio", "conf": 0.96, "crit": 3, "desc": "Java ProcessBuilder redirects all standard streams", "uses": [ 15, 16, 17 ], "spans": [ [ 5532, 38 ], [ 5802, 39 ], [ 5829, 44 ] ] }, { "id": "well-known/game/mod::minecraft-session-access", "conf": 0.91, "crit": 3, "desc": "Minecraft session profile access", "uses": [ 24, 25, 26 ], "spans": [ [ 1984, 23 ], [ 2121, 23 ], [ 2174, 35 ] ] }, { "id": "objectives/credential-access/gaming/minecraft::minecraft-session-token-access", "atk": "T1528", "mbc": "B0006", "conf": 0.96, "crit": 4, "desc": "Minecraft session token and UUID access", "uses": [ 21, 27, 31 ], "spans": [ [ 1984, 23 ], [ 2121, 23 ], [ 2150, 35 ], [ 2174, 35 ], [ 2198, 36 ] ] }, { "id": "objectives/credential-access/gaming/minecraft::minecraft-token-child-process-stage", "atk": "T1528, T1059", "mbc": "B0006", "conf": 0.99, "crit": 5, "desc": "Minecraft token access alongside redirected child launch", "uses": [ 2, 29, 30, 32 ], "spans": [ [ 324, 31 ], [ 848, 30 ], [ 1984, 23 ], [ 2121, 23 ], [ 2150, 35 ], [ 2174, 35 ], [ 2198, 36 ], [ 3205, 39 ] ] }, { "id": "micro-behaviors/process/create/spawn::child-process-creation-api", "atk": "T1106", "conf": 0.92, "crit": 3, "desc": "Starts a child process through a platform API", "uses": [ 29 ], "spans": [ [ 324, 31 ], [ 848, 30 ] ] } ], "type": "java_class" }, { "ctx": [ { "b": "+kO#^0000+1bc:Q5[t\u0026%fk20vxMW=qA=CYdBZ)lk009925nCS%vj#C9zF7Q#vRPE:Bo.^F0rsfJz/4dux([3hvLq+ww]hW2g:EuTvSk{\u003cC2So/ClX9K0rs3Fz/4dux([3hvLq:", "ln": 0 }, { "b": "xjCW-C6FaoCX*?@z/Q2yB8z0UawuJUC42RGzE)]yB8#dJq=uv*z!0M]BvGXGBz(hBi@]r=jzwXEBuPZ911kQ03\u0026?\u003cVe^.NY051uM1zH!RASDdOoK\u00260Tfk20vxMW=qA=CYdBZ)l\u00260rrjmwPN}MfEPRfvrM6jy*?i]fh($kx(mMBdnjk\u0026z7/KoBzb/aflh5AzfotBbUqDno?d(Bi@]r{ygho]fkktTnL.^1v}xR3x(v\u003e]05T=S26B%5q/)3Zexqqy1POJ5039X[=\u0026", "ln": 627 }, { "b": "rTX%W0b-bzz2!FP00V\u003eJAaJ]$0rs8/lN+YzvrM6jy*?i]fh($kx(mMIB.LV5wPx\u003cv0c50V3ij]yA@=mDBz\u003e91A+PA70rr/ZdnjF+C404uvqYZhq/)4]zF83t0cFo+3ij]yCl4WHz/x/tnPXJX0rrKDxl)3?wm]N!rDhWM00WQsohXu40ru7EoLO0Vvj#C9zF7R3BAh8kxfe!4vrM6jy*?i]fh($kx(mMBoLO0Vvj#C9zF7R3BAh8kxfdLov@Diqxk8E3BZ^1AAB%6gv(bD5vG", "ln": 1579 }, { "b": "v@=c?By+EMa$cc1vrM6jy*?i]fh($kx(mMBdnjF+C404wwPPO9qB@}U0h])%3il$7SSr86Bz\u003eeSoAtb8c[d\u00268vrM6jzE)]yrz(HL3\u0026)veTQk6a0iMt53#fi]vj#IfBt3S(oA$N40rrvqwPQEYB94/\u003cVh/4P0i(Kg0rrvqwPQ:!A=.Y\u0026We:[F0i(Kj0rrHuwPQ:?z//]cz!]*ZXbZWV0i(Km0rs+X\u003cEq!fYsu}jLeAKDM.ADrSogKC\u0026g^vqJ?2r-V*Uk\u003e\u003cEiNCX@tZWROYd\u003eMxzHNY8.)ywPq\u003c3yY", "ln": 2592 }, { "b": "oNfVEuQ)Rgs-TPzcmzM5vrM6jy*?i]fh($kx(mMBdnjF+C404uvqYZhq/)4]zF83t0m}k63igbc/-q6-ygho]fk+uyfh(!0yH}O)0nv?X*Ye#f00\u0026M80rr*PwPQ*Yv}xv$wKpJKw[u0Yx)Kt00n^=]3in\u0026Y?#J/@ygho]fk+uyfg*4)Bw)9/yH}PNwmPZ(B8}M^\u0026Sf2{c}[w:C404uvqYZhq/)4]zF845dol\u0026SeDB\u0026s0oj7v3\u0026?KMaQFbI0oTv.2v?W\u0026zE)s10rs8/oLO0Vvj#IfBt3Nhv@2T$l1BIDwPI]OnHWWG0o\u003cHG3in\u0026Y(Ki+t03ITG0S.P*01r{WBw)9Sx(dB1B-X2()/mkj0nEOz3\u0026?^Tec#pT0p*c\u003c9+]bbvr:CywPPODB8iHdq+Qbdv@2T$mQY!Gz/Qad0q3o(3$Br?vru6Vz!0M]Bo8w3c}[w:C404wwPPO7z!0M]BurfhvrM6jy*?i]fh($kx(mMBnM)Mpygho]fk+uyfh(!0yH}PH3\u0026]#3{x*][0qDM{7IWx4vr:CywPPODB8iHdq+Qbdv@2T$2lsP301-^OBw(aip*[xMzdN*2A=RlYa1eNiygho]CRr@CBt4YRy+FZ=oI/ervqPN$wPz\u0026N3\u0026{h9@r-M40r9008erP6vr:CywPPODB8iHdpdW#{B97e=", "ln": 3104 }, { "b": "j1i\u003crvrM6jB-.tlfhc83Buo)i2lt8r0r@Mh0rs6NvrM77fk+uyflqhJfh\u003e!yp*[xMzdN*2A=RD^3JQkqB7GC(wPz%9A.Z4WwPE\u003eL6duK?vrM6jB-.tlfhc83Bup{L3\u0026{!r4HJjB0s]hhalP8A\u0026\u003eHxlG{7/dT)R)S\u003eBmv*ZmKIvHu#mW)X3/*2MUIr03VF}Bvy7TAbPDdBv*1OzGGP8x\u003e7N[x(v(Py?EWbx([393\u0026}1x0TX@p0tCLm5ozA8q=uv^vrb^[wPRH7A@=m-c}[w:C42RGzE)]yB8#dJq=uv^vrb^[wPRH7B2$*K3\u0026}aA7yyft0t\u003e?q4S=-2A=:\u0026XzE^*4vqxA.0u7}\u003c3io@78VY{HxjVfXB-.OBBw)p4wNPAR02NakoLO0Vvj#tkfhD.jAcln3BAg@3z95db9rvh*0nEO%0rrQxwPQHYAcln3BAg@3z2\u003cRMc[d\u00268vrM6jx(tT@zG6-uq/)4\u003evqO7m0u?E/3in\u0026Zblm=%4^Gyo(6ET}XT}@tF-r-r\u003e^VGpQP\u003c6RRra20(YFK", "ln": 3725 }, { "b": "G8\u003e@]2\u0026}1%\u003c*hhLPp$CIYxU]-)w#PvM7^iHGxe5K\u003c*hJ70FHKO3q1e(uPp25iBsGH0FZX$2)25EHYEFVCxdztwDq=mc%G1!rTY1^0Gdo=c\u0026]nc00M$JB-Rj80GEdj3iqKQJ@Yj^CX?tpB9.W-0rs]7oLO0Vvj#tkfg*52B-ZM7A+eV@j1i\u003ckz/4dux([3hvLq+ww]hW2g:CU4m[(GEl]$!TKPyQL00ig+0rrpky\u0026sxa3\u0026#Q[e^.Ql0Hr-^6ky%0vj#C9zF7R4xMw3nvpB4:2lyg)01\u003cl\u003cCWCxdB8c8eDu9w8z!Ky%02XEBvrM77fk+uyflqhJfh\u003e!yq/ueYwPQ0m00WH^AZK.^0rsclygho]CRr@CBt4YRy+FZ=oI/ervqPN$wPz\u0026N0rr^OA:@S}B4Z^JCZ14Go)Q?(z!5\u003eG5LM}FC404wwPPO7z!0M]BuoH60+a1/00^E+A+PA6zVG?MoLO0Vvj#+Bx(2B%vq)FXzGG]Ai@]r{p*dx$uSxD^CvbF^mnmbWs9EHx02wmyvrM6jx(tU2B-.OBBw)p4wNPBq0rrBoD2O1AuUTz60rr\u003cdygho]fkktTnP5G\u0026Bw)p4wNPBq0rrBFvr8", "ln": 6133 }, { "b": "w\u0026a:twOCHUnkf9+307zBnITgJi5HZp1y\u003c-uCMv^LzFJ3*B:cF]D2vl}00N7UwO\u003cd500^gDCw7t@yxjzBoLO0Vvj#IfBt3S(oGJmP4o^abuWbv\u003es6]=JiB\u0026c\u003c3u7b#B9H2$okXwy025d9pI:xRl19-1wnDg6uUz!}s]!QazbK!^0rrEGpg3q5uTD-Sm/-O}zGF)0Dt)Lt0rrvxz!9AWvqC@A0+(JM03t@:C404uvqYZhpiyz.wPymUA=2lbmr\u0026rNAc8", "ln": 6702 }, { "b": "z.BC1w[CQ{wN[wIAcln3BAg@3z3H9T0rr@+oLO0Vvj#tkfg*52B-ZM7A+eV@j1jhs04!k?3iw0A.#P\u0026Uygho]fkktTlv0V:l2}0OC#5N8Acln3BAg@3z3H9Y3iwfEf984QA+eV\u00263\u003c1DIx:K)T0M\u003e/KIu4J30MLk+0rrmzx)Kt00NpWV3iwfF=Ja1NBz\u003cG\u003eBy^:UA::j]00BY0ts5-0^e?V50MLk\u00260rs-2oLO0Vvj#Ijz.CQlvrcB2Bt30{vrcB2Bup{Bygho]fkL6mxd)h9A+PA7i$8ai0O4IT-@T-(02#m7T!T\u003c^Qt}-a)$n1iV.M][WbFGY\u003ce]GyX#k(n/z$%QB8U@fBo8v?c}[w:C404uvqYZhq/)4]zF83Wtte^uB]", "ln": 6938 }, { "b": "lt6$lCUn5q87nf[vrM6jx(tT@zG6-uq/)4\u003evqO7Pts5-190db/00iiy0rruMts7[Mdm\u003c{G:PrN(0M1)Y0@@(j015+E0b?@t0SSi300K=PlmCFm0M+x\u00263iw0BcJKhLc%G2fnHWWG0G3}c3iwfGdGGI%c}N9EvrM6jy*?i]fh($kx(mMBoLO0Vvj#+Bx(2B%vq[qjlmC}z04!m63igzmeDC?YB9I5oCX7MduVZKmA+ksL1W+\u003c*l3Atf32:A/B7GC\u003ewO7", "ln": 8036 }, { "b": "025BWo*\u0026tYA:@Y*rzMNXuS7Mivf3uwoHThduQEp.z^MpKwM-wfryRlm00WyXB5DB\u003c0rsinygho]fkktTlv0V:l2}0OC#5N8Acln3BAg@3z94:#26ao%oL58x025aEwOCHyBzU#7t5N}wuT^?}mf9x0w{v\u003c8uU%p\u003eDs7YmCZaxj00CXXt3p}b9zyiRC404rz.BC1w[CQ{wN[wIAcln3BAg@3z94:#2y57jvNJO50rrEewJaP+m]\u0026$#CMv^ToJj?$uRUADt3\u003eY7q2", "ln": 8383 }, { "b": "GOY5(H#Cw12M*y{00D!jvqC@A0yD\u003e/1yV4px-OhEvn{b)uQ^%@CWC=jBwMsZDsxqB0bUBA0%0]tz2\u003cRNygho]fkktTl$7gCpJZ+#B-ZM7A+eV@2lHO102WgUygho]fkktTpJZ+#B-ZM7A+eV@j1jhs04!nE3iD}6QYyD3zEEB3rb3hX3\u003c9pcG9?PP0\u0026Dh4000000rr61019{\u003cx()]+xM4{k3\u003c9EfzvcDt0\u0026#z5b)%7qJoDRm(zQ@DMXaFhL\u0026X^2(XQ+:HR8]mO-vq!)X^2EN4T=!T]OIeCxdztwKpV:wEFTA0b-bBQ5}O2019{\u003cx()]MD30Rs3\u003c9:o0TY160\u003c?$d8FSY7vj#C9zF7R2B-8qnzdMdXv}xR3x(v\u003e]0\u003e5af7:@6)vrM6jy*?i]fh#R9z*bS0y?kWSrTX%W0\u003enNsW/T8v01ABZxkHE^ze0Qcs-!]\u002600EdgwoXaP0Af103VfA\u003cCXHucDs]Y-0rr\u003cdygho]fkktTnL.^1v}xR3x(v(J0rrywx(dNap\u0026{ZU01e", "ln": 9448 }, { "b": "vrM6jB-.tlfg68*wI#v\u003cmq=QNwmY^y3\u003ca=S^fY\u003c*0[48H4ThSexM53np*))Bx(mL(0[mq03ig.v!D2TWwO#0@wmX.Uq/)4]zF6vV/8*Be022B^0rtyDMwU3XVfF*8)#\u0026j^G1G%sRSBea)1hFbX3bm-IT2!)\u0026hr{yMY7iZRS$Q.\u003c^8+fGo+-gO:R=G(vLtWRK4F)0[)UPc\u003c!\u003esX9ZO-\u003eC(eOU9[syFA?Y()Vi?7ZM!h\u003eMF]cN)x?/mTfpM^XD\u0026n(0rt!6\u003eC\u003ePHNviq)J{8+m\u003c:-cERIsAhP6-D", "ln": 10012 }, { "b": "nP5cU0rryCwPI*ezGxv\u003e0TZWR1:^$yAWGPiJ0l}J?zZWHvbq7gU16v310=!cX}DtM0rr^FvrM6jzFs2xlv0V:luM)LwPw1T2($2eCxdbh0rr#=ts6=jygho]fk+Gxfg6@awKpJKw[u0A3\u003cc\u003et3\u003c)7z0$tnh2XNZ\u003cq!Q8\u0026Bo8vzc[e760$LFB3iHRq5D-1kFb/VK0rr61010T^x\u003cV17B8Vj402NaTygho]fk+Gxfg6@awKpJKw[u0Adol\u0026V6:1", "ln": 10928 }, { "b": "v}tVve*%zdvrM6jy*?i]fh($kx(mMBdnjF+C42RGzE)]yB8#dJq=uvSz/fVdCYV1Q17IBz3iK-twDq=Hygho]CRr@CBt4YRy+F+dB-RU0vqYH^wPw1Tx9[Ry051uM8FSY7vj#Xkv%8*aBA]JrwN/\u003e6wL#@Own=q\u002618neByxc0*00E1Nx(\u003cvQs14oDygho]CRr@CBt4YRy+FB)C$?Z+vp%d(j6Lx[vrM77fk+uyflqhJfh#$mB97b+zEEf?AYV%fvrM6jB7F\u003c7A+PSvfh(B(B-I4\u003evqYQ]z96gE3\u003cgtGzvcFP18!hu5nbM@q/ueYwPQyIv@#TfC(W)?c[d\u00268vrM77fk+uyflqhJfh\u003e!yq/ueYwPQyIv@#R", "ln": 12023 }, { "b": "hWHla6AyHMhWH9^WG5#{d*4Q\u003ee4#c%9aRkNYAHt012Zt#1%6Araq\u003ep%1$G/@u\u003e\u0026(Ng+eXz1@}O\u0026g\u003eH(\u003cGA.EP%kj{g1V=/81oPIB10a(Krj-c3sS4yL09pSJ0rGXgtD!8c00imM0000o00tjX02LXv2lmp108rK}2lmH00rr9z1aHpJ01n\u0026d05%%-09/HB000aL000040096T1a*HM00Jx6hVJ*T2((:Yt(U0fEGfuF=J1dH2MK\u00268Bp}$t", "ln": 12815 }, { "b": "1gwhxj$KbxyxOe*whTO50bU\u003cN1H!wIiT2Qz1@dsS1FL(x83IL]9BGP^v735FecDW(9Dkz{0b2\u00269WG7zJGA.EP%jOs]WG7L40rBZX09=Vc00065Fb/MHeDt[M0384B2lmp101P5f0000100930aohVL07Ws{4*J890rAA9z2\u003cUq04m@00000m00icv09oeC03hau0385v0d1R)009gM000040096T1apdH00idb1a*HM00@YbhVJ*TuJp6a", "ln": 13045 }, { "b": "huURu0bzZF6:e591?K+KsRRaH0b%$612Zx02nEAp04eS*eD=^\u003eu\u003e\u0026]OWG6}(1qIdR1Am+S0b2\u00269WG7zJGA?KQ%jwg[WG7L4d\u003ey.h09=Vc00065Fb/MH9rlf-@@sky2Npu22lmp107Ws{nc5.@0bR-p04F820000w00riy09YCW03hau03qhB0eZ:$0096w09YCY03haw1aZBL00Ao505:}h0000d0@$mW004AE004DF000r9I#X?q1oT8M", "ln": 13305 }, { "b": "WG5#Z1q}sAg=tHP1IL1H6:nba1@duP1V=\u003e\u003chvg986:yxjbPc?42]J\u003cG6:m$W31bOc1oYCC6:nL:g\u003eH(\u003cGB4WS%jXm)YAHt483ZlY2M\u003e!CXbYHu07Zlg2!6!ndL054XbY:q000021aQvK06pe.@@r@q3KlV52lmp107Ws{4/=Of00001009309@(VN07Ws{ncYb=2lknt08rK}2lmH00rAf2cJ!?#001FG1ootuy5\u003cy%9SMfu8usHLLk(T70rs2ry5\u003cE#9SMlw8usHLL(Jfi0%s8O000c40rt1WEe\u003clE0SXk.F=C=J5D\u00267)0001E0001F0001a000090g0RA00AyM0003B00-Gh0001U5%\u003eG.6:UItFd!iw01PVL\u003eqARY2[QJ%hvg1:WG5#Z1q}sAg=tHP1IL1H6:nba1@duP1V=(3NL\u003eD!2[\u0026Xq", "ln": 13544 }, { "b": "WG5#Z78W\u003e\u0026g=uc/7qo]Z6=gys7.)[21V^I6hx0qG6=rUBbPdEm8w%p[6=gl)8ELxt76Cu\u003c6=g*%g\u003eH(\u003cGC\u003c(?%j+c=nlD/FW/xHr0kHF#6:B/k0237MNe^M00k+Sl2c[lEhu$96WGaue2]K5?01fUJWGaHs09f-SWG5#Z9t]\u003e1g=ux)9LJmfwcuB39#b)g1V^+dhx-!U6^6dIbPdZtaShpn9T2\u003c=aZ^bA9rW926=}s4g\u003eH(\u003cGDQw]%j+c=nlD/MW/xF\u003c2]J]P0mnZ=C]l]a1?1ATiWD*jY8VXJW/B![b^)Z564TF\u003eoGBHrciD7.cManB1y@k{whU?Jd7/ZAdhsllwhU[LdW{z-87upI872F3cTWVsu]e-F1qJy3cVADIF%6b!d/VBD?mAUTsS5V$09uPe!eoNv", "ln": 14241 }, { "b": "08bB987\u0026M9weM$ag=u%7eXR@LwcuB3fbldM1V!sthzC}36!=oYaq(\u003cFf=qLTf/f+16!ZpR6!TDkg\u003eH(\u003cGFrI9%kgA*nlD/:W/xHr0tMEY84K7Q85S)(0uq%^iT?[^2n)[g3(GFZ0u:Aj84r}ObSVBE0bU(F0mr?r84Oj90mRU.cBJ[FiY4Zh12I[[88P5gwec$jhz#pdYAHtP12-aNi2auC03\u0026Bv6/W6/1qJ!46/YOT88IEhi2aq\u0026u]hzSrFisjR#LI-07Zlgh[5=*WGa!{3ao\u0026-69fU)08bBn89m{ShAR\u003csZ64%Yjy*uk6*ohkiZaow1y%zP6*Fe/bPe=Xkn=J=6*b\u003eskvuq=i%lo.6*cCyg\u003eH(\u003cGG]Hm%j$o!nlD/]W/xHr0mU6/4?!%@WG5#Zlk-8(g=vYslCsg4wcuB3l\u0026", "ln": 14679 }, { "b": "1R?ig01x!G0#h0F0R5hN83EwF+B5tmRVp6w1HXv95d(tMst*u#2atI@RVov82d$j52lM\u003c\u00266:LJUQ5VF?83Z(Z6:txUwvqLxhvg980?YI$RVmev2O^UNhvckX*aa3C0@", "ln": 36527 } ], "depth": 1, "facts": { "imp": [ [ "", "java/util/Map" ], [ "", "java/nio/ByteBuffer" ], [ "", "java/lang/NumberFormatException" ], [ "", "java/lang/RuntimeException" ], [ "", "java/lang/Exception" ], [ "", "java/util/concurrent/ConcurrentHashMap" ], [ "", "javax/net/ssl/SNIHostName" ], [ "", "java/util/Iterator" ], [ "", "javax/net/ssl/TrustManager" ], [ "", "javax/net/ssl/SSLParameters" ], [ "", "[Ljava/lang/String;" ], [ "", "java/util/Base64" ], [ "", "java/lang/Throwable" ], [ "", "com/github/rqfmuc4$IbGMGLD" ], [ "", "java/net/InetSocketAddress" ], [ "", "java/lang/invoke/MethodHandles" ], [ "", "java/util/LinkedHashMap" ], [ "", "java/net/URI" ], [ "", "java/io/InputStream" ], [ "", "java/lang/System" ], [ "", "com/github/rqfmuc4$yebpfevTlcw" ], [ "", "java/lang/Integer" ], [ "", "java/lang/Object" ], [ "", "[C" ], [ "", "javax/net/ssl/SSLContext" ], [ "", "java/net/URL" ], [ "", "java/util/Map$Entry" ], [ "", "javax/net/ssl/SSLSocket" ], [ "", "java/security/SecureRandom" ], [ "", "java/util/Base64$Encoder" ], [ "", "[B" ], [ "", "java/io/BufferedInputStream" ], [ "", "java/net/Socket" ], [ "", "java/lang/String" ], [ "", "java/io/OutputStream" ], [ "", "java/io/ByteArrayOutputStream" ], [ "", "java/lang/StringBuilder" ], [ "", "java/util/Set" ], [ "", "java/nio/charset/StandardCharsets" ], [ "", "java/io/DataOutputStream" ], [ "", "javax/net/ssl/SSLSocketFactory" ], [ "", "java/util/List" ], [ "", "com/github/rqfmuc4$ySqtetf" ], [ "", "java/lang/invoke/MethodHandles$Lookup" ], [ "", "java/io/IOException" ], [ "com/github/rqfmuc4", "com/github/rqfmuc4.hxHygiaweOyapmmJb" ], [ "com/github/rqfmuc4", "hxHygiaweOyapmmJb" ], [ "java/net/URL", "java/net/URL.getProtocol" ], [ "java/net/URL", "getProtocol" ], [ "com/github/rqfmuc4", "com/github/rqfmuc4.fxgo_yl" ], [ "com/github/rqfmuc4", "fxgo_yl" ], [ "com/github/rqfmuc4$ySqtetf", "com/github/rqfmuc4$ySqtetf.\u003cinit\u003e" ], [ "com/github/rqfmuc4$ySqtetf", "\u003cinit\u003e" ], [ "java/lang/System", "java/lang/System.nanoTime" ], [ "java/lang/System", "nanoTime" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.position" ], [ "java/nio/ByteBuffer", "position" ], [ "java/io/OutputStream", "java/io/OutputStream.write" ], [ "java/io/OutputStream", "write" ], [ "com/github/rqfmuc4", "com/github/rqfmuc4.xlpnszm9" ], [ "com/github/rqfmuc4", "xlpnszm9" ], [ "java/lang/String", "java/lang/String.toLowerCase" ], [ "java/lang/String", "toLowerCase" ], [ "com/github/rqfmuc4", "com/github/rqfmuc4.yymgkkvjing" ], [ "com/github/rqfmuc4", "yymgkkvjing" ], [ "javax/net/ssl/SSLSocket", "javax/net/ssl/SSLSocket.getOutputStream" ], [ "javax/net/ssl/SSLSocket", "getOutputStream" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.write" ], [ "java/io/ByteArrayOutputStream", "write" ], [ "javax/net/ssl/SSLSocket", "javax/net/ssl/SSLSocket.close" ], [ "javax/net/ssl/SSLSocket", "close" ], [ "java/security/SecureRandom", "java/security/SecureRandom.\u003cinit\u003e" ], [ "java/security/SecureRandom", "\u003cinit\u003e" ], [ "java/util/LinkedHashMap", "java/util/LinkedHashMap.\u003cinit\u003e" ], [ "java/util/LinkedHashMap", "\u003cinit\u003e" ], [ "java/io/OutputStream", "java/io/OutputStream.flush" ], [ "java/io/OutputStream", "flush" ], [ "com/github/rqfmuc4", "com/github/rqfmuc4.WyGLyVa_GGwYs" ], [ "com/github/rqfmuc4", "WyGLyVa_GGwYs" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.position" ], [ "java/nio/ByteBuffer", "position" ], [ "com/github/rqfmuc4", "com/github/rqfmuc4.oldKjhmqvi" ], [ "com/github/rqfmuc4", "oldKjhmqvi" ], [ "com/github/rqfmuc4$IbGMGLD", "com/github/rqfmuc4$IbGMGLD.body" ], [ "com/github/rqfmuc4$IbGMGLD", "body" ], [ "java/net/URL", "java/net/URL.getHost" ], [ "java/net/URL", "getHost" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/util/Base64", "java/util/Base64.getUrlEncoder" ], [ "java/util/Base64", "getUrlEncoder" ], [ "java/net/URI", "java/net/URI.toURL" ], [ "java/net/URI", "toURL" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.get" ], [ "java/nio/ByteBuffer", "get" ], [ "java/io/BufferedInputStream", "java/io/BufferedInputStream.\u003cinit\u003e" ], [ "java/io/BufferedInputStream", "\u003cinit\u003e" ], [ "com/github/rqfmuc4", "com/github/rqfmuc4.dKV2vrJPKYJALgsN" ], [ "com/github/rqfmuc4", "dKV2vrJPKYJALgsN" ], [ "javax/net/ssl/SSLContext", "javax/net/ssl/SSLContext.getInstance" ], [ "javax/net/ssl/SSLContext", "getInstance" ], [ "java/net/Socket", "java/net/Socket.\u003cinit\u003e" ], [ "java/net/Socket", "\u003cinit\u003e" ], [ "java/net/Socket", "java/net/Socket.connect" ], [ "java/net/Socket", "connect" ], [ "com/github/rqfmuc4", "com/github/rqfmuc4.vBghXxK" ], [ "com/github/rqfmuc4", "vBghXxK" ], [ "java/util/Map$Entry", "java/util/Map$Entry.getValue" ], [ "java/util/Map$Entry", "getValue" ], [ "java/util/Map", "java/util/Map.entrySet" ], [ "java/util/Map", "entrySet" ], [ "javax/net/ssl/SSLParameters", "javax/net/ssl/SSLParameters.setEndpointIdentificationAlgorithm" ], [ "javax/net/ssl/SSLParameters", "setEndpointIdentificationAlgorithm" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.toByteArray" ], [ "java/io/ByteArrayOutputStream", "toByteArray" ], [ "java/lang/System", "java/lang/System.currentTimeMillis" ], [ "java/lang/System", "currentTimeMillis" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.toString" ], [ "java/lang/StringBuilder", "toString" ], [ "java/lang/String", "java/lang/String.getBytes" ], [ "java/lang/String", "getBytes" ], [ "java/net/Socket", "java/net/Socket.setReceiveBufferSize" ], [ "java/net/Socket", "setReceiveBufferSize" ], [ "java/lang/Integer", "java/lang/Integer.parseInt" ], [ "java/lang/Integer", "parseInt" ], [ "com/github/rqfmuc4", "com/github/rqfmuc4.ozmue_rmuza_qwj" ], [ "com/github/rqfmuc4", "ozmue_rmuza_qwj" ], [ "java/nio/charset/StandardCharsets", "java/nio/charset/StandardCharsets.UTF_8" ], [ "java/nio/charset/StandardCharsets", "UTF_8" ], [ "java/lang/String", "java/lang/String.equals" ], [ "java/lang/String", "equals" ], [ "com/github/rqfmuc4", "com/github/rqfmuc4.cBUQV0AXN" ], [ "com/github/rqfmuc4", "cBUQV0AXN" ], [ "java/util/concurrent/ConcurrentHashMap", "java/util/concurrent/ConcurrentHashMap.\u003cinit\u003e" ], [ "java/util/concurrent/ConcurrentHashMap", "\u003cinit\u003e" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/net/Socket", "java/net/Socket.close" ], [ "java/net/Socket", "close" ], [ "javax/net/ssl/SSLSocket", "javax/net/ssl/SSLSocket.getSSLParameters" ], [ "javax/net/ssl/SSLSocket", "getSSLParameters" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.\u003cinit\u003e" ], [ "java/io/ByteArrayOutputStream", "\u003cinit\u003e" ], [ "java/io/BufferedInputStream", "java/io/BufferedInputStream.read" ], [ "java/io/BufferedInputStream", "read" ], [ "java/io/DataOutputStream", "java/io/DataOutputStream.writeBytes" ], [ "java/io/DataOutputStream", "writeBytes" ], [ "com/github/rqfmuc4", "com/github/rqfmuc4.JsGuLx" ], [ "com/github/rqfmuc4", "JsGuLx" ], [ "java/util/Iterator", "java/util/Iterator.hasNext" ], [ "java/util/Iterator", "hasNext" ], [ "com/github/rqfmuc4", "com/github/rqfmuc4.pcgyIrunXbIhnrmso" ], [ "com/github/rqfmuc4", "pcgyIrunXbIhnrmso" ], [ "java/util/Set", "java/util/Set.iterator" ], [ "java/util/Set", "iterator" ], [ "java/net/URL", "java/net/URL.getPath" ], [ "java/net/URL", "getPath" ], [ "java/net/URL", "java/net/URL.getPort" ], [ "java/net/URL", "getPort" ], [ "com/github/rqfmuc4$ySqtetf", "com/github/rqfmuc4$ySqtetf.ip" ], [ "com/github/rqfmuc4$ySqtetf", "ip" ], [ "javax/net/ssl/SSLParameters", "javax/net/ssl/SSLParameters.setServerNames" ], [ "javax/net/ssl/SSLParameters", "setServerNames" ], [ "java/lang/String", "java/lang/String.indexOf" ], [ "java/lang/String", "indexOf" ], [ "java/lang/String", "java/lang/String.indexOf" ], [ "java/lang/String", "indexOf" ], [ "com/github/rqfmuc4$yebpfevTlcw", "com/github/rqfmuc4$yebpfevTlcw.\u003cinit\u003e" ], [ "com/github/rqfmuc4$yebpfevTlcw", "\u003cinit\u003e" ], [ "com/github/rqfmuc4", "com/github/rqfmuc4.zjxfLen" ], [ "com/github/rqfmuc4", "zjxfLen" ], [ "java/lang/String", "java/lang/String.contains" ], [ "java/lang/String", "contains" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.getInt" ], [ "java/nio/ByteBuffer", "getInt" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.toString" ], [ "java/io/ByteArrayOutputStream", "toString" ], [ "com/github/rqfmuc4", "com/github/rqfmuc4.qsi_usspt" ], [ "com/github/rqfmuc4", "qsi_usspt" ], [ "java/lang/String", "java/lang/String.charAt" ], [ "java/lang/String", "charAt" ], [ "javax/net/ssl/SSLSocket", "javax/net/ssl/SSLSocket.setSSLParameters" ], [ "javax/net/ssl/SSLSocket", "setSSLParameters" ], [ "java/net/Socket", "java/net/Socket.setSoTimeout" ], [ "java/net/Socket", "setSoTimeout" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "java/net/URL", "java/net/URL.getQuery" ], [ "java/net/URL", "getQuery" ], [ "java/lang/String", "java/lang/String.length" ], [ "java/lang/String", "length" ], [ "java/util/Iterator", "java/util/Iterator.next" ], [ "java/util/Iterator", "next" ], [ "javax/net/ssl/SSLContext", "javax/net/ssl/SSLContext.getSocketFactory" ], [ "javax/net/ssl/SSLContext", "getSocketFactory" ], [ "java/lang/String", "java/lang/String.startsWith" ], [ "java/lang/String", "startsWith" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.\u003cinit\u003e" ], [ "java/io/ByteArrayOutputStream", "\u003cinit\u003e" ], [ "java/net/Socket", "java/net/Socket.getOutputStream" ], [ "java/net/Socket", "getOutputStream" ], [ "javax/net/ssl/SNIHostName", "javax/net/ssl/SNIHostName.\u003cinit\u003e" ], [ "javax/net/ssl/SNIHostName", "\u003cinit\u003e" ], [ "java/util/Map$Entry", "java/util/Map$Entry.getKey" ], [ "java/util/Map$Entry", "getKey" ], [ "java/lang/System", "java/lang/System.arraycopy" ], [ "java/lang/System", "arraycopy" ], [ "com/github/rqfmuc4", "com/github/rqfmuc4.tbU" ], [ "com/github/rqfmuc4", "tbU" ], [ "java/lang/String", "java/lang/String.isEmpty" ], [ "java/lang/String", "isEmpty" ], [ "java/lang/String", "java/lang/String.substring" ], [ "java/lang/String", "substring" ], [ "java/util/Map", "java/util/Map.get" ], [ "java/util/Map", "get" ], [ "javax/net/ssl/SSLSocketFactory", "javax/net/ssl/SSLSocketFactory.getDefault" ], [ "javax/net/ssl/SSLSocketFactory", "getDefault" ], [ "com/github/rqfmuc4", "com/github/rqfmuc4.disposePkyqsmerf" ], [ "com/github/rqfmuc4", "disposePkyqsmerf" ], [ "java/util/Map", "java/util/Map.put" ], [ "java/util/Map", "put" ], [ "com/github/rqfmuc4", "com/github/rqfmuc4.zsky_ilvip" ], [ "com/github/rqfmuc4", "zsky_ilvip" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "com/github/rqfmuc4$ySqtetf", "com/github/rqfmuc4$ySqtetf.isExpired" ], [ "com/github/rqfmuc4$ySqtetf", "isExpired" ], [ "java/io/InputStream", "java/io/InputStream.read" ], [ "java/io/InputStream", "read" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.write" ], [ "java/io/ByteArrayOutputStream", "write" ], [ "java/net/URI", "java/net/URI.create" ], [ "java/net/URI", "create" ], [ "java/lang/String", "java/lang/String.split" ], [ "java/lang/String", "split" ], [ "java/lang/String", "java/lang/String.substring" ], [ "java/lang/String", "substring" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.getShort" ], [ "java/nio/ByteBuffer", "getShort" ], [ "java/lang/String", "java/lang/String.trim" ], [ "java/lang/String", "trim" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.wrap" ], [ "java/nio/ByteBuffer", "wrap" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.get" ], [ "java/nio/ByteBuffer", "get" ], [ "java/net/InetSocketAddress", "java/net/InetSocketAddress.\u003cinit\u003e" ], [ "java/net/InetSocketAddress", "\u003cinit\u003e" ], [ "java/lang/RuntimeException", "java/lang/RuntimeException.\u003cinit\u003e" ], [ "java/lang/RuntimeException", "\u003cinit\u003e" ], [ "java/nio/charset/StandardCharsets", "java/nio/charset/StandardCharsets.ISO_8859_1" ], [ "java/nio/charset/StandardCharsets", "ISO_8859_1" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.setLength" ], [ "java/lang/StringBuilder", "setLength" ], [ "com/github/rqfmuc4", "com/github/rqfmuc4.gcj_vxt_xlb_orvtsn" ], [ "com/github/rqfmuc4", "gcj_vxt_xlb_orvtsn" ], [ "java/util/List", "java/util/List.of" ], [ "java/util/List", "of" ], [ "java/io/DataOutputStream", "java/io/DataOutputStream.\u003cinit\u003e" ], [ "java/io/DataOutputStream", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.toCharArray" ], [ "java/lang/String", "toCharArray" ], [ "java/io/BufferedInputStream", "java/io/BufferedInputStream.read" ], [ "java/io/BufferedInputStream", "read" ], [ "java/util/Base64$Encoder", "java/util/Base64$Encoder.withoutPadding" ], [ "java/util/Base64$Encoder", "withoutPadding" ], [ "java/lang/String", "java/lang/String.\u003cinit\u003e" ], [ "java/lang/String", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.equalsIgnoreCase" ], [ "java/lang/String", "equalsIgnoreCase" ], [ "javax/net/ssl/SSLSocketFactory", "javax/net/ssl/SSLSocketFactory.createSocket" ], [ "javax/net/ssl/SSLSocketFactory", "createSocket" ], [ "java/util/Base64$Encoder", "java/util/Base64$Encoder.encodeToString" ], [ "java/util/Base64$Encoder", "encodeToString" ], [ "java/io/BufferedInputStream", "java/io/BufferedInputStream.read" ], [ "java/io/BufferedInputStream", "read" ], [ "javax/net/ssl/SSLContext", "javax/net/ssl/SSLContext.init" ], [ "javax/net/ssl/SSLContext", "init" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.hasRemaining" ], [ "java/nio/ByteBuffer", "hasRemaining" ], [ "com/github/rqfmuc4$IbGMGLD", "com/github/rqfmuc4$IbGMGLD.\u003cinit\u003e" ], [ "com/github/rqfmuc4$IbGMGLD", "\u003cinit\u003e" ], [ "java/lang/Integer", "java/lang/Integer.parseInt" ], [ "java/lang/Integer", "parseInt" ], [ "javax/net/ssl/SSLSocket", "javax/net/ssl/SSLSocket.getInputStream" ], [ "javax/net/ssl/SSLSocket", "getInputStream" ], [ "com/github/rqfmuc4", "com/github/rqfmuc4.xcy_kjz" ], [ "com/github/rqfmuc4", "xcy_kjz" ], [ "java/io/DataOutputStream", "java/io/DataOutputStream.writeShort" ], [ "java/io/DataOutputStream", "writeShort" ], [ "javax/net/ssl/SSLSocket", "javax/net/ssl/SSLSocket.startHandshake" ], [ "javax/net/ssl/SSLSocket", "startHandshake" ], [ "java/io/InputStream", "java/io/InputStream.read" ], [ "java/io/InputStream", "read" ], [ "java/io/DataOutputStream", "java/io/DataOutputStream.writeByte" ], [ "java/io/DataOutputStream", "writeByte" ], [ "java/net/Socket", "java/net/Socket.getInputStream" ], [ "java/net/Socket", "getInputStream" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.size" ], [ "java/io/ByteArrayOutputStream", "size" ] ], "metrics": { "file": { "size": 43315, "entropy": 5.2 }, "class": { "major_version": 65, "interface_count": 0, "method_ref_count": 129, "constant_pool_size": 901, "external_class_count": 45 }, "binary": { "peak_region_bytes": 4096, "peak_region_entropy": 7 }, "imports": { "count": 174 }, "functions": { "count": 16 } } }, "id": 4, "mol": "O₂(AsI)H₄(Cm₅Db₃OsPo₂)", "path": "/data/samples/incoming/forager/bad/sha256/bazaar/GlazedAddon.jar!!com/github/rqfmuc4.class", "pid": 0, "risk": 11, "sha": "4c9ce3b3354e7c97b22328cf53629976f8b0c5e64f1253378f92d05110819b60", "size": 43315, "traits": [ { "id": "privilege-escalation/indicator", "conf": 0.85, "crit": 3, "desc": "Privilege escalation indicator" }, { "id": "micro-behaviors/communications/http/lib/urlconnection::java-url-class-bytecode", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Java URL class reference", "spans": [ [ 2656, 16 ], [ 2685, 12 ], [ 6766, 14 ] ] }, { "id": "micro-behaviors/communications/http/lib/urlconnection::jvm-url-class-ref", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "JVM URL class reference" }, { "id": "micro-behaviors/communications/proxy/tunnel::byte-output-stream", "atk": "T1090", "mbc": "C0003", "conf": 0.5, "crit": 3, "desc": "Java ByteArrayOutputStream usage", "spans": [ [ 691, 21 ], [ 1651, 21 ], [ 6205, 21 ], [ 7010, 21 ], [ 7077, 21 ], [ 7094, 21 ], [ 8447, 21 ] ] }, { "id": "micro-behaviors/communications/proxy/tunnel::inet-socket-address", "atk": "T1090", "mbc": "C0003", "conf": 0.6, "crit": 3, "desc": "Java InetSocketAddress reference", "spans": [ [ 692, 17 ], [ 3241, 17 ] ] }, { "id": "micro-behaviors/communications/socket/create::java-socket-bytecode-reference", "atk": "T1071", "mbc": "C0001", "conf": 0.86, "crit": 3, "desc": "Java bytecode socket reference", "spans": [ [ 3456, 56 ], [ 6470, 17 ] ] }, { "id": "micro-behaviors/communications/socket/create::java-socket-class-import", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "Java imports the network socket class", "spans": [ [ 3168, 15 ] ] }, { "id": "micro-behaviors/communications/socket/create::java-socket-slash-reference", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "Java slash-form socket reference", "spans": [ [ 3168, 15 ], [ 3319, 28 ], [ 3456, 56 ], [ 6470, 17 ] ] }, { "id": "micro-behaviors/communications/socket/create::jvm-socket-class-ref", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "JVM socket class reference" }, { "id": "micro-behaviors/communications/socket/framing::bytebuffer-transport", "atk": "T1573", "conf": 1.0, "crit": 3, "desc": "Java byte-buffer transport type", "spans": [ [ 10992, 10 ] ] }, { "id": "micro-behaviors/communications/socket/framing::data-stream-transport", "atk": "T1573", "conf": 1.0, "crit": 3, "desc": "Java data-stream transport type", "spans": [ [ 9520, 16 ] ] }, { "id": "micro-behaviors/communications/socket/send::java-dataoutputstream-class", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "Java DataOutputStream class reference", "spans": [ [ 9512, 24 ] ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-sslcontext-trustmanager-init-call", "conf": 0.94, "crit": 3, "desc": "JVM SSLContext.init trust-manager call", "spans": [ [ 12161, 29 ] ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-sslparameters-set-server-names", "conf": 0.93, "crit": 3, "desc": "JVM sets TLS SNI server name", "spans": [ [ 3789, 42 ] ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-sslsocket-handshake-call", "conf": 0.94, "crit": 3, "desc": "JVM SSLSocket.startHandshake call", "spans": [ [ 3986, 38 ] ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-trustmanager-class-ref", "conf": 0.9, "crit": 3, "desc": "JVM TrustManager interface reference", "spans": [ [ 12087, 26 ] ] }, { "id": "micro-behaviors/data/buffer/transfer::bytearrayoutputstream-ref", "conf": 0.88, "crit": 3, "desc": "Java ByteArrayOutputStream class", "spans": [ [ 7002, 29 ] ] }, { "id": "micro-behaviors/data/buffer/transfer::jvm-outputstream-write", "conf": 0.96, "crit": 2, "desc": "JVM writes bytes to output stream", "spans": [ [ 6197, 0 ] ] }, { "id": "micro-behaviors/data/encode/base64::jvm-base64-encode-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM Base64 encodeToString call", "spans": [ [ 10076, 39 ] ] }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method", "spans": [ [ 1643, 8 ] ] }, { "id": "micro-behaviors/os/sysinfo/hostname::jvm-hostname-command-literal", "atk": "T1082", "mbc": "E1082", "conf": 0.9, "crit": 3, "desc": "JVM hostname command literal" }, { "id": "micro-behaviors/process/create/spawn::java-runtime-class", "atk": "T1059", "mbc": "E1203", "conf": 0.86, "crit": 3, "desc": "Java Runtime class reference", "spans": [ [ 9721, 17 ] ] }, { "id": "micro-behaviors/process/info/current::getpath-ref", "conf": 0.8, "crit": 3, "desc": "Java getPath call reference" }, { "id": "objectives/anti-static/obfuscation/string/control-prefix::java-control-prefixed-long-string", "atk": "T1027", "mbc": "F0001", "conf": 0.92, "crit": 3, "desc": "Java string starts with control-length prefix" }, { "id": "objectives/impact/dos/disk::jvm-megabyte-byte-array-constant", "atk": "T1499.001", "conf": 0.94, "crit": 3, "desc": "JVM one-megabyte allocation constant", "spans": [ [ 8100, 14 ] ] }, { "id": "objectives/impact/dos/disk::jvm-two-backward-goto-branches", "atk": "T1499.001", "conf": 0.9, "crit": 3, "desc": "JVM repeated counter backedges", "spans": [ [ 12879, 8 ], [ 13109, 8 ], [ 13369, 8 ], [ 13608, 8 ], [ 14305, 8 ], [ 14433, 8 ], [ 14743, 8 ], [ 14880, 8 ] ] }, { "id": "micro-behaviors/communications/socket/send::java-raw-socket-client-write", "atk": "T1071", "mbc": "C0001", "conf": 0.94, "crit": 3, "desc": "Java socket client writes request bytes through DataOutputStream", "uses": [ 6, 11, 17 ], "spans": [ [ 3168, 15 ], [ 6197, 26 ], [ 9512, 24 ] ] } ], "type": "java_class" }, { "ctx": [ { "b": "+kO#^0000+06phY9+fb9fk20vxMW=qA=CYdBZ)lND1yD7w[uc+y?4U]009925nCS%vj#C9zF7Q#vRPE:Bo.^F0rsfQvrM77fk+uyflqhJfiy7=iAg3wB97b+zEEf?AT8NF0rr-", "ln": 0 } ], "depth": 1, "facts": { "imp": [ [ "", "java/lang/Object" ], [ "", "com/github/rqfmuc4" ], [ "", "javax/net/ssl/X509TrustManager" ], [ "", "java/security/cert/X509Certificate" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ] ], "metrics": { "file": { "size": 1221, "entropy": 5.74 }, "class": { "major_version": 65, "interface_count": 1, "method_ref_count": 1, "constant_pool_size": 59, "external_class_count": 4 }, "binary": { "peak_region_bytes": 1024, "peak_region_entropy": 5.83 }, "imports": { "count": 5 }, "functions": { "count": 4 } } }, "id": 5, "mol": "H(Cm)", "path": "/data/samples/incoming/forager/bad/sha256/bazaar/GlazedAddon.jar!!com/github/rqfmuc4$yebpfevTlcw.class", "pid": 0, "risk": 1, "sha": "e6c5e9f9db99aaedc314d5b0293d80288d890169460c7bcd0541942a499eb2f7", "size": 1221, "traits": [ { "id": "micro-behaviors/os/env/gate::jvm-opaque-environment-key", "conf": 0.94, "crit": 1, "desc": "JVM class has generated gate value" }, { "id": "micro-behaviors/communications/socket/ssl::jvm-x509trustmanager-class-ref", "conf": 0.94, "crit": 3, "desc": "JVM X509 trust-manager interface reference" }, { "id": "micro-behaviors/communications/socket/ssl::jvm-x509trustmanager-issuer-callback", "conf": 0.94, "crit": 3, "desc": "JVM getAcceptedIssuers callback defined" }, { "id": "micro-behaviors/communications/socket/ssl::jvm-x509trustmanager-server-callback", "conf": 0.94, "crit": 3, "desc": "JVM checkServerTrusted callback defined" }, { "id": "micro-behaviors/communications/socket/ssl::jvm-custom-x509trustmanager", "conf": 0.95, "crit": 3, "desc": "Class implements a custom X509 trust manager", "uses": [ 1, 2, 3 ] } ], "type": "java_class" }, { "ctx": [ { "b": "+kO#^0000+08AQ}8E)Y5fk20vxMW=qA=CYdBZ)lNnN+g:m[=qQ009925nCS%vj#C9zF7Q#vRPE:Bo.^F0rr:xz/4dux([3hvLq+ww]hW2gZs0:0rru@vN\u003cc.oHF)Y3uHq$BAIT", "ln": 0 }, { "b": "aPI/G0rr918up@Y3JHkd000]qbleeM0@@r38uq2.5c8?knb@R\u00260SS(lo8[}(5D\u00267t0000a0000c0000f0000103}Q(0096\u003e0001700Ao70000O5*]^X5*@p102#R1jr1\u0026Bu{2wvds%V31:AcxdM[::d$x^{04?t6V\u0026zeM05I7:hN0eY00ic]0000600h#$", "ln": 1174 } ], "depth": 1, "facts": { "imp": [ [ "", "java/nio/charset/StandardCharsets" ], [ "", "java/lang/Object" ], [ "", "com/github/rqfmuc4" ], [ "", "java/util/Map" ], [ "", "java/lang/String" ], [ "com/github/rqfmuc4$IbGMGLD", "com/github/rqfmuc4$IbGMGLD.statusLine" ], [ "com/github/rqfmuc4$IbGMGLD", "statusLine" ], [ "com/github/rqfmuc4$IbGMGLD", "com/github/rqfmuc4$IbGMGLD.headers" ], [ "com/github/rqfmuc4$IbGMGLD", "headers" ], [ "com/github/rqfmuc4$IbGMGLD", "com/github/rqfmuc4$IbGMGLD.body" ], [ "com/github/rqfmuc4$IbGMGLD", "body" ], [ "java/lang/String", "java/lang/String.\u003cinit\u003e" ], [ "java/lang/String", "\u003cinit\u003e" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ], [ "com/github/rqfmuc4$IbGMGLD", "com/github/rqfmuc4$IbGMGLD.statusCode" ], [ "com/github/rqfmuc4$IbGMGLD", "statusCode" ], [ "java/nio/charset/StandardCharsets", "java/nio/charset/StandardCharsets.UTF_8" ], [ "java/nio/charset/StandardCharsets", "UTF_8" ], [ "java/lang/String", "java/lang/String.toLowerCase" ], [ "java/lang/String", "toLowerCase" ], [ "java/util/Map", "java/util/Map.get" ], [ "java/util/Map", "get" ] ], "metrics": { "file": { "size": 1491, "entropy": 5.65 }, "class": { "major_version": 65, "interface_count": 0, "method_ref_count": 9, "constant_pool_size": 79, "external_class_count": 5 }, "binary": { "peak_region_bytes": 1024, "peak_region_entropy": 5.65 }, "imports": { "count": 14 }, "functions": { "count": 3 } } }, "id": 6, "path": "/data/samples/incoming/forager/bad/sha256/bazaar/GlazedAddon.jar!!com/github/rqfmuc4$IbGMGLD.class", "pid": 0, "risk": 1, "sha": "39737e49d4a62e147b22e94f0c985b4280452d2a233d74e5c14cc57e0edad1b4", "size": 1491, "traits": [ { "id": "metadata/binary/code/complexity::few-functions-3", "conf": 1.0, "crit": 2, "desc": "Binary has 3+ functions" }, { "id": "metadata/binary/code/complexity::functions-at-most-24", "conf": 1.0, "crit": 2, "desc": "Binary has 24 or fewer functions" }, { "id": "metadata/binary/code/complexity::functions-at-most-32", "conf": 1.0, "crit": 2, "desc": "Binary has 32 or fewer functions" }, { "id": "micro-behaviors/os/env/gate::jvm-opaque-environment-key", "conf": 0.94, "crit": 1, "desc": "JVM class has generated gate value" } ], "type": "java_class" }, { "ctx": [ { "b": "+kO#^0000+04!iK8E)Y5fk20vxMW=qA=CYdBZ)lNC#FZ8wPRI?009925nCS%vj#C9zF7Q#vRPE:Bo.^F0rr:xz/4dux([3hvLq+ww]hW2gZs0:0rrvIq/M[\u003cBy\u003eKN0+(PO01}%", "ln": 0 } ], "depth": 1, "facts": { "imp": [ [ "", "com/github/rqfmuc4" ], [ "", "java/lang/Object" ], [ "", "java/lang/System" ], [ "java/lang/System", "java/lang/System.currentTimeMillis" ], [ "java/lang/System", "currentTimeMillis" ], [ "com/github/rqfmuc4$ySqtetf", "com/github/rqfmuc4$ySqtetf.expiresAt" ], [ "com/github/rqfmuc4$ySqtetf", "expiresAt" ], [ "com/github/rqfmuc4$ySqtetf", "com/github/rqfmuc4$ySqtetf.ip" ], [ "com/github/rqfmuc4$ySqtetf", "ip" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ] ], "metrics": { "file": { "size": 738, "entropy": 5.52 }, "class": { "major_version": 65, "interface_count": 0, "method_ref_count": 4, "constant_pool_size": 45, "external_class_count": 3 }, "binary": { "peak_region_bytes": 738, "peak_region_entropy": 5.52 }, "imports": { "count": 7 }, "functions": { "count": 2 } } }, "id": 7, "path": "/data/samples/incoming/forager/bad/sha256/bazaar/GlazedAddon.jar!!com/github/rqfmuc4$ySqtetf.class", "pid": 0, "risk": 1, "sha": "94481f283d2efe148a9e8e74e0d9cf15e5cbeb75b522f5db5ac5ce4a6ef27e60", "size": 738, "traits": [ { "id": "metadata/binary/code/complexity::functions-at-most-24", "conf": 1.0, "crit": 2, "desc": "Binary has 24 or fewer functions" }, { "id": "metadata/binary/code/complexity::functions-at-most-32", "conf": 1.0, "crit": 2, "desc": "Binary has 32 or fewer functions" }, { "id": "metadata/file/magic/identity::cafebabe-magic", "conf": 1.0, "crit": 2, "desc": "CAFEBABE magic at file start", "spans": [ [ 0, 0 ] ] }, { "id": "micro-behaviors/os/env/gate::jvm-opaque-environment-key", "conf": 0.94, "crit": 1, "desc": "JVM class has generated gate value" } ], "type": "java_class" }, { "ctx": [ { "b": "DKp(rb6dmcwO\u003e\u003cRwPz\u003caz/c:wiV{dd3lQDnx\u003eezgiV]RVy*?T3wmGB\u0026wO#Pled9Hxb6EKrB7]Mga%n]?a#7Y7e?!F23lQDnzEEx[a%n]?b1DDTDsZROy?WD#Bn", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 427, "entropy": 4.54 }, "json": { "parsed_bytes": 427, "parse_limit_bytes": 76800 }, "binary": { "peak_region_bytes": 427, "peak_region_entropy": 4.54 } } }, "id": 9, "mol": "Md(Pa)", "path": "/data/samples/incoming/forager/bad/sha256/bazaar/GlazedAddon.jar!!fabric.mod.json", "pid": 0, "risk": 1, "sha": "291ad2412dcfb966cbb2d0342d33cd006f541763d2405698b38b3dc0d3073d11", "size": 427, "traits": [ { "id": "metadata/package/config::fabric-mod-metadata", "conf": 0.9, "crit": 3, "desc": "Fabric mod metadata resource" } ], "type": "json" } ], "rev": "c1ea9", "v": "8" } }