{ "llm": { "conf": 0.9887635, "grade": "hostile", "model": "Qwen/Qwen3.8-27B", "before": { "lvl": 1, "prob": 0.98322916, "class": "hostile" }, "outcome": "hostile", "interpretation": "Minecraft credential stealer" }, "ml": { "v": "7", "eng": "2.12.0-beta.1", "lvl": 0, "conf": 100, "mods": [ { "cls": 2, "raw": 0.98322916, "rte": "az", "prob": 0.98322916 }, { "cls": 0, "raw": 0.9937897, "rte": "az/jar", "prob": 0.9937897 } ], "prob": 0.98322916, "files": [ { "id": 0, "lvl": 0, "conf": 100, "prob": 0.9832291603088379, "type": "jar" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.000026623407393344678, "type": "java_class" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.000010311603546142578, "type": "java_class" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.000012646119103010278, "type": "java_class" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.000014851490959699731, "type": "java_class" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.0000241696834564209, "type": "java_class" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.000986297964118421, "type": "java_class" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.000024020671844482422, "type": "java_class" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.000011434157386247534, "type": "json" } ], "version": "v18.18", "analyzed_at": "2026-09-24T20:47:31Z" }, "path": "Radium Client V6.jar", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "p!H([6AwyA2MPPL}DK120000000000000/n003IEz7/KoBzb/afjx3yy?Vi*v@bN{BiIpvM%nf/cWWN3\u003cBCbW6i?]eicDo*zawQV+A?ltDLqlnP*XMazgS^GfQ%q:KKEsquzv{P:dSeZ\u003eP7HZ46QX]Vsy}i\u003c5G{onGuJqtw%$Q?*Tl7pS\u0026awKzq5Y=!*}za0hN/X}t7XD!Ov*?$}:@X.)zrB}og$D-2pD]SAmJd%EH\u003c*fAz]D=K}nRraL2RY=[iE^$qg{s{XiBf1G)C\u003cK=2:*]Vgnc?N8EuTe=}2", "ln": 0 } ], "mol": "K₂(McGa)O₆(CaEuAlAs₃ErI)H₆(Cm₅Db₅F₃Os₂Po₅Ti)Md₂(Pa)", "sha": "3a65fcc0a4e3916d47c3dba03e3b7f9e1451164a5b9baffda6b81183a3e7803d", "path": "Radium Client V6.jar", "risk": 300, "size": 5516860, "type": "jar", "facts": { "metrics": { "jar": { "class_count": 7, "entry_count": 12, "index_count": 0, "service_count": 0, "signature_count": 0, "native_lib_count": 0, "embedded_jar_count": 0, "manifest.entry_count": 0, "manifest.digest_count": 0, "signature_block_count": 0, "versioned_class_count": 0, "manifest.section_count": 0, "manifest.attribute_count": 13, "manifest.class_path_count": 0, "manifest.boot_class_path_count": 0 }, "file": { "size": 5516860, "entropy": 8 }, "binary": { "peak_region_bytes": 5516288, "peak_region_entropy": 7.87 }, "archive": { "file_count": 12, "member_count": 12, "script_count": 0, "zip_bomb_ratio": 4.34, "compressed_size": 5515114, "directory_count": 0, "executable_count": 0, "extra_field_size": 0, "noise_file_count": 0, "compression.ratio": 0.97, "hidden_file_count": 0, "uncompressed_size": 5692005, "crc_collision_count": 0, "entry_comment_count": 0, "max_filename_length": 42, "rtlo_filename_count": 0, "format.regular_count": 12, "nested_archive_count": 0, "path_traversal_count": 0, "symlink_escape_count": 0, "security.setgid_count": 0, "security.setuid_count": 0, "security.sticky_count": 0, "double_extension_count": 0, "duplicate_member_count": 0, "security.symlink_count": 0, "unicode_filename_count": 0, "homoglyph_filename_count": 0, "security.encrypted_count": 0, "timing.mtime_unique_count": 1, "timing.mtime_unique_ratio": 0.08, "misplaced_executable_count": 0, "timing.mtime_dominant_count": 12, "timing.mtime_spread_seconds": 0, "timing.sentinel_mtime_count": 0, "security.world_writable_count": 0, "timing.mtime_dominant_fraction": 1, "compression.method_counts.deflate": 12 } } }, "traits": [ { "id": "micro-behaviors/os/env/gate::jvm-opaque-secret-environment-gate", "conf": 0.97, "crit": 3, "desc": "JVM compares opaque environment gate", "from": [ { "off": 14084, "file": 1 }, { "file": 2 }, { "file": 3 }, { "file": 4 }, { "off": 2045, "file": 7 } ], "uses": [ 13, 43, 67 ] }, { "id": "micro-behaviors/process/info/current::protection-domain-class", "conf": 0.85, "crit": 3, "desc": "Java ProtectionDomain class reference" }, { "id": "micro-behaviors/communications/proxy/tunnel::inet-socket-address", "atk": "T1090", "mbc": "C0003", "conf": 0.6, "crit": 3, "desc": "Java InetSocketAddress reference", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-errors", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder merges standard error", "from": [ { "file": 1 } ] }, { "id": "well-known/game/mod::minecraft-name-getter-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft profile name getter reference", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/process/info/current::codesource-class", "conf": 0.85, "crit": 3, "desc": "Java CodeSource class reference" }, { "id": "micro-behaviors/data/decode/base64::java-base64-decoder-bytecode-call", "conf": 0.94, "crit": 3, "desc": "Java Base64 decoder accessor call", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-sslsocket-handshake-call", "conf": 0.94, "crit": 3, "desc": "JVM SSLSocket.startHandshake call", "from": [ { "file": 5 } ] }, { "id": "objectives/anti-static/obfuscation/string/control-prefix::java-control-prefixed-long-string", "atk": "T1027", "mbc": "F0001", "conf": 0.92, "crit": 3, "desc": "Java string starts with control-length prefix" }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.94, "crit": 3, "desc": "Java bytecode ProcessBuilder execution", "from": [ { "off": 14984, "file": 1 }, { "off": 875, "file": 6 }, { "off": 3202, "file": 7 } ], "uses": [ 32, 33 ] }, { "id": "well-known/malware/stealer/prefire-shard::prefire-family-literal", "atk": "T1528", "mbc": "B0006", "conf": 0.9, "crit": 1, "desc": "Prefire family name literal", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/create::jvm-socket-class-ref", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "JVM socket class reference" }, { "id": "objectives/impact/dos/disk::jvm-megabyte-byte-array-constant", "atk": "T1499.001", "conf": 0.94, "crit": 3, "desc": "JVM one-megabyte allocation constant", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/os/env/gate::jvm-string-equals-import", "conf": 0.94, "crit": 1, "desc": "JVM class imports String equals", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/info/selfpath::java-protection-domain", "conf": 0.82, "crit": 3, "desc": "Java getProtectionDomain self-path lookup" }, { "id": "well-known/game/mod::minecraft-uuid-getter-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft profile UUID getter reference", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/data/archive/extract/zip::jvm-zip-entry-read-bytecode", "conf": 0.9, "crit": 3, "desc": "JVM reads ZIP archive entry data", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/proxy/tunnel::byte-output-stream", "atk": "T1090", "mbc": "C0003", "conf": 0.5, "crit": 3, "desc": "Java ByteArrayOutputStream usage", "from": [ { "file": 1 } ] }, { "id": "well-known/game/mod::minecraft-client-class-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft client singleton class reference", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-x509trustmanager-class-ref", "conf": 0.94, "crit": 3, "desc": "JVM X509 trust-manager interface reference" }, { "id": "micro-behaviors/process/info/current::touri-ref", "conf": 0.82, "crit": 3, "desc": "Java toURI call reference" }, { "id": "micro-behaviors/data/archive/extract/zip::jvm-zip-entry-iteration-bytecode", "conf": 0.92, "crit": 3, "desc": "JVM iterates ZIP archive entries", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/decode/base64::java-base64-decoding-bytecode", "conf": 0.94, "crit": 3, "desc": "Java bytecode Base64 decoding", "from": [ { "off": 18965, "file": 1 } ], "uses": [ 6, 65 ] }, { "id": "micro-behaviors/data/encode/base64::jvm-base64-encode-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM Base64 encodeToString call", "from": [ { "file": 5 } ] }, { "id": "objectives/impact/dos/disk::jvm-two-backward-goto-branches", "atk": "T1499.001", "conf": 0.9, "crit": 3, "desc": "JVM repeated counter backedges", "from": [ { "file": 1 } ] }, { "id": "objectives/anti-static/obfuscation/string/control-prefix::java-character-digit-bytecode", "atk": "T1027", "mbc": "F0001", "conf": 0.9, "crit": 3, "desc": "Java bytecode calls Character.digit", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-sslparameters-set-server-names", "conf": 0.93, "crit": 3, "desc": "JVM sets TLS SNI server name", "from": [ { "file": 5 } ] }, { "id": "objectives/credential-access/gaming/minecraft::minecraft-session-token-access", "atk": "T1528", "mbc": "B0006", "conf": 0.96, "crit": 4, "desc": "Minecraft session token and UUID access", "from": [ { "off": 2201, "file": 6 } ], "uses": [ 15, 44, 58 ] }, { "id": "objectives/evasion/self-delete/file/script::java-code-source-location", "atk": "T1070.004", "mbc": "F0007", "conf": 0.78, "crit": 3, "desc": "Java code source location", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-sslcontext-trustmanager-init-call", "conf": 0.94, "crit": 3, "desc": "JVM SSLContext.init trust-manager call", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/data/archive/extract/zip::jvm-zip-entry-extraction-to-file", "conf": 0.96, "crit": 3, "desc": "JVM extracts ZIP entries to files", "from": [ { "off": 12481, "file": 1 } ], "uses": [ 16, 22, 68 ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.95, "crit": 3, "desc": "Java bytecode ProcessBuilder start", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-init-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.92, "crit": 3, "desc": "Java bytecode ProcessBuilder constructor", "from": [ { "file": 1 } ] }, { "id": "objectives/credential-access/gaming/minecraft::minecraft-token-child-process-stage", "atk": "T1528, T1059", "mbc": "B0006", "conf": 0.99, "crit": 5, "desc": "Minecraft token access alongside redirected child launch", "from": [ { "off": 673, "file": 1 }, { "off": 10387, "file": 5 }, { "off": 2064, "file": 6 }, { "off": 4154, "file": 7 } ], "uses": [ 9, 24, 28, 39 ] }, { "id": "micro-behaviors/process/thread/lifecycle::jvm-thread-start-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM starts a thread", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-x509trustmanager-server-callback", "conf": 0.94, "crit": 3, "desc": "JVM checkServerTrusted callback defined" }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-output", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard output", "from": [ { "file": 1 } ] }, { "id": "well-known/game/mod::minecraft-session-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft session object reference", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirected-stdio", "conf": 0.96, "crit": 3, "desc": "Java ProcessBuilder redirects all standard streams", "from": [ { "off": 14920, "file": 1 }, { "off": 5957, "file": 6 }, { "off": 3071, "file": 7 } ], "uses": [ 3, 37, 45 ] }, { "id": "metadata/package/config::fabric-mod-metadata", "conf": 0.9, "crit": 3, "desc": "Fabric mod metadata resource", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/buffer/transfer::bytearrayoutputstream-ref", "conf": 0.88, "crit": 3, "desc": "Java ByteArrayOutputStream class", "from": [ { "file": 1 } ] }, { "id": "objectives/anti-static/obfuscation/reflection/class::java-protectiondomain", "conf": 1.0, "crit": 3, "desc": "Java ProtectionDomain", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/os/env/gate::jvm-system-getenv-import", "conf": 0.94, "crit": 1, "desc": "JVM class imports System getenv", "from": [ { "file": 1 } ] }, { "id": "well-known/game/mod::minecraft-session-access", "conf": 0.91, "crit": 3, "desc": "Minecraft session profile access", "from": [ { "file": 6 } ], "uses": [ 4, 19, 38 ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-input", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard input", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/create::java-socket-slash-reference", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "Java slash-form socket reference", "from": [ { "file": 5 } ] }, { "id": "objectives/anti-analysis/timing/evasion::kotlin-thread-sleep-check", "atk": "T1497.003", "conf": 0.94, "crit": 3, "desc": "Kotlin Thread.sleep call", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.88, "crit": 3, "desc": "Java bytecode ProcessBuilder reference", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/buffer/transfer::jvm-outputstream-write", "conf": 0.96, "crit": 2, "desc": "JVM writes bytes to output stream", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-x509trustmanager-issuer-callback", "conf": 0.94, "crit": 3, "desc": "JVM getAcceptedIssuers callback defined" }, { "id": "micro-behaviors/communications/socket/ssl::jvm-trustmanager-class-ref", "conf": 0.9, "crit": 3, "desc": "JVM TrustManager interface reference", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/data/buffer/transfer::bytearrayinputstream-ref", "conf": 0.88, "crit": 3, "desc": "Java ByteArrayInputStream class" }, { "id": "micro-behaviors/process/create/spawn::child-process-creation-api", "atk": "T1106", "conf": 0.92, "crit": 3, "desc": "Starts a child process through a platform API", "from": [ { "off": 673, "file": 1 }, { "file": 6 }, { "off": 289, "file": 7 } ], "uses": [ 9 ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-custom-x509trustmanager", "conf": 0.95, "crit": 3, "desc": "Class implements a custom X509 trust manager", "from": [ { "file": 4 } ], "uses": [ 20, 36, 50 ] }, { "id": "objectives/anti-static/obfuscation/string/crypto::java-byte-range-copy", "atk": "T1027", "mbc": "F0001", "conf": 0.7, "crit": 3, "desc": "Java byte range copy", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/lib/urlconnection::jvm-url-class-ref", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "JVM URL class reference" }, { "id": "micro-behaviors/communications/socket/framing::data-stream-transport", "atk": "T1573", "conf": 1.0, "crit": 3, "desc": "Java data-stream transport type", "from": [ { "file": 5 } ] }, { "id": "objectives/credential-access/gaming/minecraft::minecraft-token-getter-ref", "atk": "T1528", "mbc": "B0006", "conf": 0.92, "crit": 3, "desc": "Minecraft access token getter", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/time/sleep/interval::java-thread-sleep-bytecode", "conf": 0.9, "crit": 3, "desc": "Java bytecode thread sleep", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/info/current::getpath-ref", "conf": 0.8, "crit": 3, "desc": "Java getPath call reference" }, { "id": "micro-behaviors/process/info/current::getlocation-ref", "conf": 0.82, "crit": 3, "desc": "Java getLocation call reference" }, { "id": "micro-behaviors/communications/socket/create::java-socket-bytecode-reference", "atk": "T1071", "mbc": "C0001", "conf": 0.86, "crit": 3, "desc": "Java bytecode socket reference", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/socket/framing::bytebuffer-transport", "atk": "T1573", "conf": 1.0, "crit": 3, "desc": "Java byte-buffer transport type", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/process/create/spawn::java-runtime-class", "atk": "T1059", "mbc": "E1203", "conf": 0.86, "crit": 3, "desc": "Java Runtime class reference", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/data/decode/base64::java-base64-decode-bytecode-call", "conf": 0.96, "crit": 3, "desc": "Java Base64 decode call", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/sysinfo/hostname::jvm-hostname-command-literal", "atk": "T1082", "mbc": "E1082", "conf": 0.9, "crit": 3, "desc": "JVM hostname command literal" }, { "id": "micro-behaviors/os/env/gate::jvm-opaque-environment-key", "conf": 0.94, "crit": 1, "desc": "JVM class has generated gate value" }, { "id": "micro-behaviors/fs/write/file/handle::jvm-fileoutputstream-bytecode", "conf": 0.86, "crit": 3, "desc": "JVM imports FileOutputStream class", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/create::java-socket-class-import", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "Java imports the network socket class", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/fs/write/file/full::jvm-files-writestring-bytecode", "conf": 0.9, "crit": 3, "desc": "JVM bytecode Files.writeString", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/communications/socket/send::java-dataoutputstream-class", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "Java DataOutputStream class reference", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/socket/send::java-raw-socket-client-write", "atk": "T1071", "mbc": "C0001", "conf": 0.94, "crit": 3, "desc": "Java socket client writes request bytes through DataOutputStream", "from": [ { "off": 3339, "file": 5 } ], "uses": [ 49, 69, 71 ] }, { "id": "micro-behaviors/data/decode/base64::java-base64-decoder-class", "conf": 0.92, "crit": 3, "desc": "JVM Base64 decoder class reference", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/lib/urlconnection::java-url-class-bytecode", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Java URL class reference", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/fs/read/file/handle::jvm-nio-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM NIO file API reference" }, { "id": "micro-behaviors/fs/read/file/handle::jvm-io-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM File API class reference" }, { "id": "metadata/file/archive::archive-at-least-10-members", "conf": 0.9, "crit": 3, "desc": "Archive contains at least ten members" }, { "id": "metadata/package/entrypoint::jar-main-class", "conf": 0.95, "crit": 2, "desc": "JAR manifest declares an executable Main-Class" }, { "id": "metadata/file/naming::archive-member-under-10kb", "conf": 0.9, "crit": 3, "desc": "Archive has a sub-10KB member" }, { "id": "metadata/package/config::fabric-runnable-mod-archive", "conf": 0.9, "crit": 3, "desc": "Fabric mod JAR is directly runnable", "from": [ { "file": 9 } ], "uses": [ 40, 78 ], "spans": [ [ 0, 15 ] ] }, { "id": "objectives/exfiltration/stealer/credential/token::minecraft-token-http-body-exfil", "atk": "T1041", "mbc": "E1041", "conf": 0.98, "crit": 4, "desc": "Minecraft token access paired with raw socket request write", "from": [ { "off": 6439, "file": 5 }, { "off": 2064, "file": 6 } ], "uses": [ 28, 72 ], "spans": [ [ 0, 41 ] ] }, { "id": "well-known/malware/stealer/prefire-shard::prefire-packed-runtime-stealer", "atk": "T1528", "mbc": "B0006", "conf": 0.99, "crit": 5, "desc": "Prefire packed runtime Minecraft stealer", "from": [ { "off": 20475, "file": 1 }, { "file": 5 }, { "off": 2064, "file": 6 }, { "file": 7 } ], "uses": [ 8, 10, 16, 22, 26, 28, 68 ] } ] }, { "ctx": [ { "b": "+kO#^0000+1CW0T5O2-@fk20vxMW=qvrMQax*J480rAfiygho]fkL6mxd)4\u0026ygQ)%2lj\u0026b03(5)z7/KoBzb/aflZ@GA=u2wqGlR*bU-x9zaEe]oh6tjrcwGD1PXPsv@Diqxk8E3BZ^1Fwoq\u003chADUl1z!GvQ2ls/lo($R%njMJIoMsAsB].N^ygho]fkL6mxd)84z!0v1B3+1-y?d9$bVnh:x(W={Bo.^M0rr%KvrM6jy*?i]fhMXcv}x.5luN0UwmY=^01n(d2VtkAx(W={Bo8vUygho]flIwJy+Fa-B7El^bT=iNz!9B12lknn01-)NC404DBzkLAlsB}Dhz+Ts5DI\u003epl$G\u003eDwmY=Z03#w*C404uvqYZhx(n9jyH]d[wPRQ7wjQcDwnC*#bUSb{yJTO302bCl9+]bbvj#C9zF7RpzGY@lwIl+?BzbP6nmuyDy?mU)02tOn225@NyJTN%01JQK", "ln": 0 }, { "b": "vj#Ijz.CZpy?km@vrufA0rrQrxf*JYC4UX\u003cDs?qowDq=GoLO0Vvj#C9zF7R3BAh8kxf{-Py?d9$i@]r=jzwXEBuPZ911kQ03\u0026?)Wfa4WZ05aAN5nCS%vj#C9zF7R3BAh8kx9Oz(0rr{JvrM6jy*?i]fh($kx(mMIB.LV5wPw1QgZTju05aANgZSxmLiwyI\u0026h.^%Y{4YLYZ8\u003eX\u003cBJuWH}z]:YY+\u0026@\u003e:EB/S\u003eWScQV[zi(:0+QFUzK*LN4mF0rrHHz:OhDAZs.^vr?\u003eN1sLZ6lKS}", "ln": 609 }, { "b": "\u003e.2L]H[K42UeWNbJ\u003cm(zI%dKm(YEp{Hp3uuO-d8n\u003e8D.dTCVj}LiX0!(y9\u003cQN=]^o(y%s5W2$W{m/-O}Bz\u003e91A+PA70rr/ZdnjF+C404uvqYZhq/)4]zF83t07^e.3ih{-o922Z2\u003ea:%(xE[5HQVz@Tlt!N(xm{VQ2J!\u0026[2I\u0026vMxHx!Tlb26\u003e:57gLBYQM\u0026\u003eI8NTdX:zJPM7)\u003e7oz)Mym35LeJBvZNLMfo-Uj#v}Yp\u003el39bc1sM?\u003clKS@\u003c", "ln": 967 }, { "b": "0rrQHvPWqQC%=**Ay$y#ASDdDxM4Y$wPyWWw=R(pAb]J4x(W+=07[Ukygho]fkL6mxd)h9A+PA7j4%x$C404uvqYZhq/)4]zF848ygho]fkL6mxd)h9A+PA7j1i\u003crvrM5", "ln": 4023 }, { "b": "mfI=O05K(FO%XDsQ#[5c[4U1CL7\u0026v%L\u0026e:C\u003e9.w2Zl4AtIsm78\u0026ifJINs:[wMe[cZ[1kM%UCzH98VY{yxjVf@zGVA?9rsK}0bqJQ0rtm\u003c\u0026\u0026nBnORcc!L\u003cb(z(v\u003c\u0026JO#gXvKm5)I\u003cfU#PK!R9LPYi2p[0{AwJ\u003c[n=QW0Jm\u003cE..2OUkzGM/CGx2MV4G051VsIh*R)LJYlF)wEL-F#^{*OzGB/J?kT7V/u\u003eg\u003c!YMLV54!AP6?k:\u003ca%+[P:g", "ln": 5441 }, { "b": ")wbT3KDFH)R%otf)wmtOK!gK5U\u003cdmv)wc-/0U\u003e\u003es0000000*\u003cK01-)NC404uvqYZhra{q-vpPPA836ZvB8kA0z#/}wc}U{?3\u003c4vH90#-=0V.pw3qL+Kq^S%pp=z[=01j0\u003eDtc?+vru:9yYKIFx)a9iv%IB5CYEXtuUsj\u003ezuf.zB8CVawLc(:yxjzHyIN*3AyjU\u003cvm$/\u0026DsGr=zFjrh0rrsjA+v:SBo8vGv%8*kz/PMfw]vXI6ky%0vj#tkfg!@dCW\u003er7BzkVh2lB", "ln": 11746 }, { "b": "wNPAX0X:SP1T)Owdol\u0026Se=)^n0X\u003c:j0rr@+oLO0Vvj#tkfg*52B-ZM7A+eV@j1jhs04[sg3iz\u003cZhur^^xjVfWwQ5q=zGG]A0rs2^dnjF+C404DBzkLADtdsKt4}}AzGG]Ai$8fI0YZO?f9jfn02xrTC404DBzkLADtdsKt4}}AzGG]A2lE0*00^dFBwumYwEFS707)O1jPW?G01iHZl${WMv@#TfC)\u003c:u0m}LVjPW}J010pHBwMy^wO#O\u003c02u$ioLO0Vvj#Ijz.CZpy?km@vrufA3\u003c5/#mgfbz0.9g\u003c9bn]9vj#tkfg6![w[u0]wkvt\u0026Acln3BAg@3z3Hbk0rr%KvrM6jx(tT]x(4uRB-.OBBw)p4wNPAX0.JE[26s=Mx(4tY01ZLcoLO0Vvj#tkfgGU(wJHq4oAE]@0vE}z0rrYWoLO0Vvj#tkfgGU(wJItw3\u0026?)YpZNm%0-n%#8yOo]vrM6jx(tU2B-.OBBw)p4wNPBqnHWWG04[sK3iA^2q#($4A+eV\u00263\u003c6Dh1QUq:0-]y51:t03By+EM2pJ!ynL7vi3\u003c6Mks{+s50:tW91.hv!B7C:Yt(VI+0.AD10rrNqwmORYAbY\u0026eB8$]60rr@+oLO0Vvj#C9zF7R4xMw3nvpB4:j1jhs0:(7r3izWUvGuDov@c78wKQGUA^n5{wb[m\u00260XTQ^3iz\u003cZui73ix(e5[x(Xf90rrG[vrkHSyCG/#ze]TS9.ZrSC3$", "ln": 12073 }, { "b": "1\u003eA^-\u003cQLz}B#g[71Y*84\u003evw{fs{oA6Nc})srbz/YmIo*em\u003cg!i01-)NC404DBzkLAl2}0OD2\u003ch(EGoARv@DsipI9HkzF9IY00\u003c#Slp\u003c-$ts5-1Fc7oe0!go60rrNIm)QrRDuiR7yGCK\u00263\u003c87.{6H^30!*TP3VfQ3CWCrfuV*E00rrKIxLRZmuVfI1vrcn!01Is^wO\u003cbos9OpprD6]-0rrsEvrbg^ASDdNoL47ruS}V1yHo!tlU*3#nOyM]01\u0026V", "ln": 12848 }, { "b": "0\u003c@buHkh]j02xrTC404DBzkLADtdsKnP5cRvru732lHt30?ffz0rryDwPQHYAclmh0?xxF3iDW#O=F*iygho]fkktTlv0V:l2}0OC#5N8Acln3BAg@3z3Hcn3iD[3soeycw[=c%B7/b}3\u003c9g7/9ROG0\u0026b?%2wF6/y*?A%3\u003c9pc1QUs20\u0026D503t%A^wogsWAclmh0\u0026VgK3iDW#STn*30:tW917=vX3\u003c9Khfa4=I0\u003chL73V{qND30Q-A=LPl0rrlJdo/aE0\u003cz:h3iD[5Vh\u003c}lADC]8z+bb0zC+p-0rrvoy?mE5z/U{V7!!WMC404DBzkLADtdsKnP5cRvru73i@]r:v[yiQ0rsinygho]fkktTlv0V:l2}0OC#5N8Acln3BAg@3z94:#2xKQ9wKyuS0rrKuyhvV}A9)f*uUiZE026l=vp:z1uUBj#uVZi[D3agKBo8vHy\u0026KchuTX51uUKuV\u00263x7-1aw\u0026Ff9u-{1uMY/U\u003c!Q)05K@uLB7S#I0fOA\u003cf+uwVZH3XI@pzd\u0026*2q=Ly.}MWD1-F(:qMjU^@X*LM", "ln": 13180 }, { "b": "O9cJn)$NT%HPp:/0[N?XbMF!\u003c00ikP0rshC\u003cbO@VH)v5oPYqMd\u0026/w=WT^!viRS-(f\u003cI3PkOW]7d*w}oUwPq\u003c3y\u0026Z0^?2=1i05BYk0rsCeHQ(=CSoH)A\u003c=UCVIOwneL\u003cCb#(asv+LD0M1NDfj6(:Sk=2M\u0026])03IsZ2(\u003e2d\u0026Sf3o4EPES\u003cf29uGqv\u003eFO9NtN\u0026Gg52R\u003eSaSLi[/$\u003c:-#-GP+AhU\u00268Z$)V\u0026Z\u003cUAXp6I0R)=2M\u003c5/051SwO4e", "ln": 14020 }, { "b": "c}[w:C404rz.BN]y?kWSoLO0Vvj#C9zF7R0A=kD0B8%V\u003cx(4r\u003eAWjK]wnc6}v@%^v0%5G93igCo0%5xhA+e=}A+e:5nP5G\u0026Bo8wac}[w:C404uvqYZhp\u0026ZF:wPI]VB.LV5wPx4]wN]H}wN/*zdnjF+C404uvqYZhp\u0026ZF:wPI]VB.LV5wPx\u003cv0%F=h3igIq2ls/#)Xl9iVyH3yMG+Yn)XWCMLEx?IPydD5(-MlhM7WMIYxtG+)XtN2V-\u0026FRQuP1+)X=AiLa7:eY6+uL(-N2DL-k4mL\u0026[y0\u003e.\u003ef82M\u003ewl00)1LAaJ]$rbSfE3J*Cq01e(q0rrQIwN]H}wN/*TB-.OBBpnlY0%P8j4fEaw026x:wnc6}v@$dWA=k$%BAg@3z2\u003cRSc%w5[ygho]fkL6mxd)84z!0v1B3+1-y?d9$i$8i60$\u003e}v4fEmA00NB=vrcC\u003c02l[hoLO0Vvj#C9zF7R0A=kD0B8%zK0#g[N3igIq7xBHFygho]fkL6mxd)84z!0v1A%z^+0rrjvx\u003edkA11kP\u003c3\u003cdBJ90#=^104yxpx*0?T)ADX\u0026F\u003c=0WVPNLXAQrk)6JFBJdQo5U\u0026q\u003cJ(9uciW5q(xHV(jw\u0026\u0026!g5Vw!dSQt.5/\u003e^N}UUBK\u003c-M*zb/\u0026F:b!", "ln": 14634 }, { "b": "CY$?x01AyCB7El^lVl\u003c:wQ5q0WhvTj13Bd}*5]$vhQ8z6!}/\u003c.jNd1((F=wyLi*n.1Q5mp!n}\u003ezDi10MxjVfMwN/T?wPv!K94imfygho]flIwJy+Fa-B7El^bT=iNz!9B1i$8ki1ip/H5^ckR00V$Bv@C)?0rr(-oLO0Vvj#C9zF7R3BAh8kxfdLDljr$t1i.8L5cHeT03M8=C404wx(tUmxKL}5wPPO7Byx5$vrb)CxKL}5wPR$#1j3#F1YXI\u003euPn5^8CB)OC404wx(tUmxKL}5wPPN)xKL}5wPQ0x1jmk02)nJR^/xB\u003cc%G2iygho]fk+GxfjOW7A=U/lfgfzYA=U/li@", "ln": 18847 }, { "b": "FZ8*!1j#-[FcC#M%nQQzx@Rsp00000003Qm%nSc0!pl(}0rr^FvrM6jy*?i]fgfzYA:-E1wPw1Uiro9-wnbW\u003cBo8vBc{{MPnEL.-1uW1]iS}OFY.1Vl1Sq69iA.JK-SXrV6AJeh[xRn#OcB4/R2[piRcsiR0rr{NvT8s7z^N3-w]Ir*CxE[xBye^cCwmcU33*k:f?C.wh!-o)1z7enCMv^GwmoN*nP1Le2v?W\u0026w[+)l0rrjqwQaw+C(qyWJy^[T0%2TJW/DEG2\u003cdL+\u003ek", "ln": 20411 }, { "b": "WG5AJ2]K3Kg=tWU3bcKM6:!Ff3L:5Z1V^4]hvQxg6:{-obPd194h/DP6:!s-4pz1g2)p$L6:![/g?q+HGBE%W%j+c=gG+O7W/w+607H3uWG601sP(tphcEx*hAzx!5e4-05G8e.WG6h-5/zp\u002609fkk6+U4n6t1l4sRRQV09It%12Z(e6+}yR04w^184=#^5)#B?v735k84=#^6+}v2v735kwrKw3tVVN[0Jk$G85fHVoTT{\u003cr#zLZuBx?@iV5.KZ64%:7*/9T85Tp96=yJ+whUtv8Oukm8V}#r6=W@bQ5VqN8X\u003ctg7.[2E85K8b6=W@aA9$IOL2WeP0Jk$PY8TS\u002685{3+lBD\u003e-r#zLZv734$iV/jY12I[U86uM}wecj$hx-!UYAHtu12.wsbnzw@03\u0026Ba6^BOr1qJ4!6^E9y86n$@bnztuu]hzSrFhN$R#LI-05E:}bdvLsWG5=#84:jRoJb6$5[noHjus/bciD7.cManB1y@k{whU?Jd7/ZAdfzET6!f}DQ5VCRdhsrIciL5hu\u003e\u003ee0g-mRy6!f}CA9$IOL2We+0Jk$LY8TS\u002687A2{lq}1\u003eY8TY\u003eW/wrEeG3bMwvqF2iXzp512I[?87@Sawec+dhzt\u003e1YAHtJ12.[Lf+(CYe^8[xu\u003e\u003eC8g-m[G6/3HSA9$IOL2We\u003c0tNv8fROK6Y8TS\u002688nP2lBD\u003e-r#AO5w\u0026.^!h3pn!qz{AJhmrG=1y@l9whVxU05W)]h[5=\u0026iYEj1itBK?h\u003e*p388@G\u003e1qJ?56//Wg08:W(1qJ{ihGi6j08^u\u003cWG6MlGGf7h%je5EWG61f07H3ceFq:906Aq889w0ThA.{uZ64%Yj.cDm6*xnliZiZ8k[#W2kb53589X\u003c489w3pjZY0\u003cu]e--1qKiqj-B^=F%6b!k()[-*z8]+1V!)^klz=*0#j2f0b/yGgG+OXW/w+607H3ceW+TMq=%vq05W]*05=(98ab3QiZ:\u0026N1gwhchBOGKWG6thwedKzhB+pUhcyU-W/xL(m/$Uu6?x6eQ5VRWm\u0026sX$6?8HBnmn\u003eaqw?\u003e96?x6dAa39OqE\u003e%009\u0026PUncbT*!!{#^08f*3mPQD{5]$zXjuuaMo9m1eoC{Hq1y@lvwhWc%o$QS\u003cp6iyI6\u0026bMsQ5VCRp8cLxo9t#6u\u003e(EBg-n{?6\u0026bMrA9$IkL2Wfh0Jk$LY8TS\u00268bvTvlBD\u003e-r#BvrBuiqqquKucqz}C\u003eqNMNa1y@lCwhWA005W)]rjq\u0026", "ln": 21678 }, { "b": "Ne^WDWG6tu0d{{B1P+?T1?1I4o!l\u0026v5DEu\u0026142:m5d(tObq]Vt1EPk$6:b9@5tPpf0Ka9!0dUTYFe5g\u003cxKFmJloko183NCKcoqvy05E:}2c[uXW/+l^o-.D#0SY4%+k", "ln": 152835 }, { "b": "1$NaZrY}Aay}H3G12Zn%1rscod\u003eIFs1-bX71HXqd5d(tOj{Mr.6:aUEWG6hp5v.\u003cbv3aAw1oLI3!E@6Ihu:*069HKgNGa\u0026L1va)H76LxPlvQ]$76LxPm1Eo269H=.2l", "ln": 153263 } ], "depth": 1, "facts": { "imp": [ [ "", "java/util/Base64" ], [ "", "java/util/zip/ZipInputStream" ], [ "", "java/io/IOException" ], [ "", "java/lang/Class" ], [ "", "java/lang/Process" ], [ "", "java/lang/Integer" ], [ "", "java/io/PrintStream" ], [ "", "java/lang/Character" ], [ "", "com/github/wdtrpqvRqoh$MtxmHGQKLq_Tv" ], [ "", "java/lang/invoke/MethodHandles$Lookup" ], [ "", "com/github/wdtrpqvRqoh" ], [ "", "java/nio/file/Path" ], [ "", "[C" ], [ "", "java/lang/StringBuilder" ], [ "", "java/lang/ProcessBuilder$Redirect" ], [ "", "java/io/ByteArrayInputStream" ], [ "", "java/util/zip/ZipEntry" ], [ "", "java/util/zip/Inflater" ], [ "", "java/util/ArrayList" ], [ "", "java/lang/Throwable" ], [ "", "java/util/List" ], [ "", "java/nio/file/LinkOption" ], [ "", "java/lang/Exception" ], [ "", "java/lang/InterruptedException" ], [ "", "java/util/Base64$Decoder" ], [ "", "java/lang/Object" ], [ "", "java/lang/ProcessBuilder" ], [ "", "java/lang/String" ], [ "", "java/io/BufferedOutputStream" ], [ "", "java/util/Arrays" ], [ "", "java/nio/charset/StandardCharsets" ], [ "", "[B" ], [ "", "java/io/FileOutputStream" ], [ "", "[Ljava/lang/String;" ], [ "", "java/lang/invoke/MethodHandles" ], [ "", "java/io/ByteArrayOutputStream" ], [ "", "java/nio/file/attribute/FileAttribute" ], [ "", "java/lang/System" ], [ "", "java/util/Map" ], [ "", "java/nio/file/Files" ], [ "", "java/io/File" ], [ "", "java/lang/Thread" ], [ "java/util/Map", "java/util/Map.of" ], [ "java/util/Map", "of" ], [ "com/github/avpliB", "com/github/avpliB.vhTvdU" ], [ "com/github/avpliB", "vhTvdU" ], [ "java/nio/file/Files", "java/nio/file/Files.readString" ], [ "java/nio/file/Files", "readString" ], [ "java/io/ByteArrayInputStream", "java/io/ByteArrayInputStream.\u003cinit\u003e" ], [ "java/io/ByteArrayInputStream", "\u003cinit\u003e" ], [ "java/nio/file/Path", "java/nio/file/Path.getParent" ], [ "java/nio/file/Path", "getParent" ], [ "java/lang/String", "java/lang/String.substring" ], [ "java/lang/String", "substring" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.directory" ], [ "java/lang/ProcessBuilder", "directory" ], [ "java/util/zip/ZipInputStream", "java/util/zip/ZipInputStream.closeEntry" ], [ "java/util/zip/ZipInputStream", "closeEntry" ], [ "java/lang/String", "java/lang/String.length" ], [ "java/lang/String", "length" ], [ "com/github/avpliB", "com/github/avpliB.wOobzztuso" ], [ "com/github/avpliB", "wOobzztuso" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/lang/String", "java/lang/String.toCharArray" ], [ "java/lang/String", "toCharArray" ], [ "com/github/wdtrpqvRqoh", "com/github/wdtrpqvRqoh.oY_dk_ijT" ], [ "com/github/wdtrpqvRqoh", "oY_dk_ijT" ], [ "java/util/zip/Inflater", "java/util/zip/Inflater.end" ], [ "java/util/zip/Inflater", "end" ], [ "java/io/FileOutputStream", "java/io/FileOutputStream.\u003cinit\u003e" ], [ "java/io/FileOutputStream", "\u003cinit\u003e" ], [ "com/github/avpliB", "com/github/avpliB.mwthky" ], [ "com/github/avpliB", "mwthky" ], [ "java/util/Base64$Decoder", "java/util/Base64$Decoder.decode" ], [ "java/util/Base64$Decoder", "decode" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "com/github/avpliB", "com/github/avpliB.yye" ], [ "com/github/avpliB", "yye" ], [ "java/lang/Integer", "java/lang/Integer.parseInt" ], [ "java/lang/Integer", "parseInt" ], [ "java/util/zip/ZipInputStream", "java/util/zip/ZipInputStream.read" ], [ "java/util/zip/ZipInputStream", "read" ], [ "com/github/avpliB", "com/github/avpliB.KbafHZwUXUvQe" ], [ "com/github/avpliB", "KbafHZwUXUvQe" ], [ "com/github/avpliB", "com/github/avpliB.zvzjmvHfsa" ], [ "com/github/avpliB", "zvzjmvHfsa" ], [ "java/lang/Character", "java/lang/Character.digit" ], [ "java/lang/Character", "digit" ], [ "com/github/avpliB", "com/github/avpliB.qnqQnq" ], [ "com/github/avpliB", "qnqQnq" ], [ "com/github/avpliB", "com/github/avpliB.ULqNeBecqJXJ5" ], [ "com/github/avpliB", "ULqNeBecqJXJ5" ], [ "java/util/zip/Inflater", "java/util/zip/Inflater.\u003cinit\u003e" ], [ "java/util/zip/Inflater", "\u003cinit\u003e" ], [ "java/io/PrintStream", "java/io/PrintStream.println" ], [ "java/io/PrintStream", "println" ], [ "com/github/avpliB", "com/github/avpliB.wfjy9Z" ], [ "com/github/avpliB", "wfjy9Z" ], [ "java/lang/String", "java/lang/String.\u003cinit\u003e" ], [ "java/lang/String", "\u003cinit\u003e" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.\u003cinit\u003e" ], [ "java/lang/ProcessBuilder", "\u003cinit\u003e" ], [ "java/io/BufferedOutputStream", "java/io/BufferedOutputStream.write" ], [ "java/io/BufferedOutputStream", "write" ], [ "java/lang/String", "java/lang/String.startsWith" ], [ "java/lang/String", "startsWith" ], [ "java/util/zip/ZipInputStream", "java/util/zip/ZipInputStream.getNextEntry" ], [ "java/util/zip/ZipInputStream", "getNextEntry" ], [ "com/github/avpliB", "com/github/avpliB.\u003cinit\u003e" ], [ "com/github/avpliB", "\u003cinit\u003e" ], [ "java/util/zip/Inflater", "java/util/zip/Inflater.needsInput" ], [ "java/util/zip/Inflater", "needsInput" ], [ "java/lang/String", "java/lang/String.isEmpty" ], [ "java/lang/String", "isEmpty" ], [ "com/github/avpliB", "com/github/avpliB.xWsfn" ], [ "com/github/avpliB", "xWsfn" ], [ "com/github/wdtrpqvRqoh", "com/github/wdtrpqvRqoh.get" ], [ "com/github/wdtrpqvRqoh", "get" ], [ "com/github/avpliB", "com/github/avpliB.fdlfKu" ], [ "com/github/avpliB", "fdlfKu" ], [ "java/lang/String", "java/lang/String.charAt" ], [ "java/lang/String", "charAt" ], [ "com/github/avpliB", "com/github/avpliB.hlQFXAM" ], [ "com/github/avpliB", "hlQFXAM" ], [ "com/github/avpliB", "com/github/avpliB.bwjurxLahwiidRhn" ], [ "com/github/avpliB", "bwjurxLahwiidRhn" ], [ "com/github/avpliB", "com/github/avpliB.getPlu" ], [ "com/github/avpliB", "getPlu" ], [ "java/util/zip/Inflater", "java/util/zip/Inflater.setInput" ], [ "java/util/zip/Inflater", "setInput" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.toString" ], [ "java/lang/StringBuilder", "toString" ], [ "com/github/avpliB", "com/github/avpliB.uuv" ], [ "com/github/avpliB", "uuv" ], [ "java/lang/Process", "java/lang/Process.pid" ], [ "java/lang/Process", "pid" ], [ "com/github/avpliB", "com/github/avpliB.fnuIvCYALjX8cvoa" ], [ "com/github/avpliB", "fnuIvCYALjX8cvoa" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.\u003cinit\u003e" ], [ "java/io/ByteArrayOutputStream", "\u003cinit\u003e" ], [ "java/util/ArrayList", "java/util/ArrayList.\u003cinit\u003e" ], [ "java/util/ArrayList", "\u003cinit\u003e" ], [ "java/util/List", "java/util/List.add" ], [ "java/util/List", "add" ], [ "java/lang/Throwable", "java/lang/Throwable.addSuppressed" ], [ "java/lang/Throwable", "addSuppressed" ], [ "com/github/avpliB", "com/github/avpliB.vMe" ], [ "com/github/avpliB", "vMe" ], [ "java/util/zip/ZipInputStream", "java/util/zip/ZipInputStream.\u003cinit\u003e" ], [ "java/util/zip/ZipInputStream", "\u003cinit\u003e" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectOutput" ], [ "java/lang/ProcessBuilder", "redirectOutput" ], [ "com/github/avpliB", "com/github/avpliB.KkUDyHCquYLgn" ], [ "com/github/avpliB", "KkUDyHCquYLgn" ], [ "java/nio/file/Files", "java/nio/file/Files.exists" ], [ "java/nio/file/Files", "exists" ], [ "java/util/zip/ZipEntry", "java/util/zip/ZipEntry.getName" ], [ "java/util/zip/ZipEntry", "getName" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.write" ], [ "java/io/ByteArrayOutputStream", "write" ], [ "java/io/File", "java/io/File.\u003cinit\u003e" ], [ "java/io/File", "\u003cinit\u003e" ], [ "java/lang/ProcessBuilder$Redirect", "java/lang/ProcessBuilder$Redirect.from" ], [ "java/lang/ProcessBuilder$Redirect", "from" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "java/io/BufferedOutputStream", "java/io/BufferedOutputStream.close" ], [ "java/io/BufferedOutputStream", "close" ], [ "com/github/avpliB", "com/github/avpliB.sGAZRzsd_kWrh" ], [ "com/github/avpliB", "sGAZRzsd_kWrh" ], [ "java/util/zip/Inflater", "java/util/zip/Inflater.inflate" ], [ "java/util/zip/Inflater", "inflate" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectErrorStream" ], [ "java/lang/ProcessBuilder", "redirectErrorStream" ], [ "java/lang/ProcessBuilder$Redirect", "java/lang/ProcessBuilder$Redirect.appendTo" ], [ "java/lang/ProcessBuilder$Redirect", "appendTo" ], [ "com/github/avpliB", "com/github/avpliB.gdzh" ], [ "com/github/avpliB", "gdzh" ], [ "com/github/avpliB", "com/github/avpliB.cdFlAd" ], [ "com/github/avpliB", "cdFlAd" ], [ "java/util/Base64", "java/util/Base64.getDecoder" ], [ "java/util/Base64", "getDecoder" ], [ "com/github/avpliB", "com/github/avpliB.ebdkp_jylrw" ], [ "com/github/avpliB", "ebdkp_jylrw" ], [ "java/nio/charset/StandardCharsets", "java/nio/charset/StandardCharsets.UTF_8" ], [ "java/nio/charset/StandardCharsets", "UTF_8" ], [ "com/github/avpliB", "com/github/avpliB.xezc_urw_bdn" ], [ "com/github/avpliB", "xezc_urw_bdn" ], [ "java/util/zip/ZipEntry", "java/util/zip/ZipEntry.isDirectory" ], [ "java/util/zip/ZipEntry", "isDirectory" ], [ "java/lang/String", "java/lang/String.format" ], [ "java/lang/String", "format" ], [ "com/github/wdtrpqvRqoh$MtxmHGQKLq_Tv", "com/github/wdtrpqvRqoh$MtxmHGQKLq_Tv.statusCode" ], [ "com/github/wdtrpqvRqoh$MtxmHGQKLq_Tv", "statusCode" ], [ "java/lang/Class", "java/lang/Class.getSimpleName" ], [ "java/lang/Class", "getSimpleName" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectInput" ], [ "java/lang/ProcessBuilder", "redirectInput" ], [ "com/github/avpliB", "com/github/avpliB.xiRrl" ], [ "com/github/avpliB", "xiRrl" ], [ "java/lang/System", "java/lang/System.arraycopy" ], [ "java/lang/System", "arraycopy" ], [ "com/github/wdtrpqvRqoh$MtxmHGQKLq_Tv", "com/github/wdtrpqvRqoh$MtxmHGQKLq_Tv.body" ], [ "com/github/wdtrpqvRqoh$MtxmHGQKLq_Tv", "body" ], [ "java/nio/file/Path", "java/nio/file/Path.toString" ], [ "java/nio/file/Path", "toString" ], [ "java/nio/file/Files", "java/nio/file/Files.createDirectories" ], [ "java/nio/file/Files", "createDirectories" ], [ "java/io/BufferedOutputStream", "java/io/BufferedOutputStream.\u003cinit\u003e" ], [ "java/io/BufferedOutputStream", "\u003cinit\u003e" ], [ "com/github/wdtrpqvRqoh$MtxmHGQKLq_Tv", "com/github/wdtrpqvRqoh$MtxmHGQKLq_Tv.bodyString" ], [ "com/github/wdtrpqvRqoh$MtxmHGQKLq_Tv", "bodyString" ], [ "com/github/avpliB", "com/github/avpliB.runDetached" ], [ "com/github/avpliB", "runDetached" ], [ "com/github/avpliB", "com/github/avpliB.fdp_jawvl_sofy" ], [ "com/github/avpliB", "fdp_jawvl_sofy" ], [ "java/lang/String", "java/lang/String.indexOf" ], [ "java/lang/String", "indexOf" ], [ "java/nio/file/Path", "java/nio/file/Path.resolve" ], [ "java/nio/file/Path", "resolve" ], [ "java/lang/System", "java/lang/System.getenv" ], [ "java/lang/System", "getenv" ], [ "java/lang/Thread", "java/lang/Thread.sleep" ], [ "java/lang/Thread", "sleep" ], [ "com/github/avpliB", "com/github/avpliB.rhifx_rtev_hvll_ettm" ], [ "com/github/avpliB", "rhifx_rtev_hvll_ettm" ], [ "java/util/Arrays", "java/util/Arrays.copyOfRange" ], [ "java/util/Arrays", "copyOfRange" ], [ "java/lang/String", "java/lang/String.substring" ], [ "java/lang/String", "substring" ], [ "java/lang/String", "java/lang/String.\u003cinit\u003e" ], [ "java/lang/String", "\u003cinit\u003e" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/nio/file/Path", "java/nio/file/Path.of" ], [ "java/nio/file/Path", "of" ], [ "com/github/avpliB", "com/github/avpliB.yslxb_kmid_ylwpa_ucfxkq" ], [ "com/github/avpliB", "yslxb_kmid_ylwpa_ucfxkq" ], [ "java/lang/Integer", "java/lang/Integer.valueOf" ], [ "java/lang/Integer", "valueOf" ], [ "java/lang/String", "java/lang/String.indexOf" ], [ "java/lang/String", "indexOf" ], [ "java/lang/System", "java/lang/System.currentTimeMillis" ], [ "java/lang/System", "currentTimeMillis" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ], [ "com/github/wdtrpqvRqoh", "com/github/wdtrpqvRqoh.DRjXGmizqpuYDhp" ], [ "com/github/wdtrpqvRqoh", "DRjXGmizqpuYDhp" ], [ "java/lang/Object", "java/lang/Object.getClass" ], [ "java/lang/Object", "getClass" ], [ "java/util/zip/Inflater", "java/util/zip/Inflater.finished" ], [ "java/util/zip/Inflater", "finished" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.start" ], [ "java/lang/ProcessBuilder", "start" ], [ "com/github/avpliB", "com/github/avpliB.qgaXnpau" ], [ "com/github/avpliB", "qgaXnpau" ], [ "java/util/Map", "java/util/Map.of" ], [ "java/util/Map", "of" ], [ "java/lang/System", "java/lang/System.getProperty" ], [ "java/lang/System", "getProperty" ], [ "java/lang/System", "java/lang/System.out" ], [ "java/lang/System", "out" ], [ "com/github/avpliB", "com/github/avpliB.ln_mob" ], [ "com/github/avpliB", "ln_mob" ], [ "java/nio/file/Path", "java/nio/file/Path.toFile" ], [ "java/nio/file/Path", "toFile" ], [ "com/github/avpliB", "com/github/avpliB.agAqwvgnRzfule" ], [ "com/github/avpliB", "agAqwvgnRzfule" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.toByteArray" ], [ "java/io/ByteArrayOutputStream", "toByteArray" ], [ "java/lang/String", "java/lang/String.equals" ], [ "java/lang/String", "equals" ], [ "java/util/zip/ZipInputStream", "java/util/zip/ZipInputStream.close" ], [ "java/util/zip/ZipInputStream", "close" ], [ "java/lang/Exception", "java/lang/Exception.getMessage" ], [ "java/lang/Exception", "getMessage" ] ], "metrics": { "file": { "size": 156636, "entropy": 4.09 }, "class": { "major_version": 65, "interface_count": 0, "method_ref_count": 120, "constant_pool_size": 1159, "external_class_count": 42 }, "binary": { "peak_region_bytes": 17408, "peak_region_entropy": 7 }, "imports": { "count": 162 }, "functions": { "count": 20 } } }, "id": 1, "mol": "O₃(AlAs₂I)H₅(Db₄F₂OsPo₂Ti)", "path": "Radium Client V6.jar!!com/github/avpliB.class", "pid": 0, "risk": 13, "sha": "958670e23661f107734f19f7df815c4fb91efd218ca7d1550e89fe5970276fda", "size": 156636, "traits": [ { "id": "micro-behaviors/communications/proxy/tunnel::byte-output-stream", "atk": "T1090", "mbc": "C0003", "conf": 0.5, "crit": 3, "desc": "Java ByteArrayOutputStream usage", "spans": [ [ 681, 21 ], [ 12506, 21 ], [ 13252, 21 ], [ 13377, 21 ], [ 13468, 21 ] ] }, { "id": "micro-behaviors/data/archive/extract/zip::jvm-zip-entry-iteration-bytecode", "conf": 0.92, "crit": 3, "desc": "JVM iterates ZIP archive entries", "spans": [ [ 12137, 41 ] ] }, { "id": "micro-behaviors/data/archive/extract/zip::jvm-zip-entry-read-bytecode", "conf": 0.9, "crit": 3, "desc": "JVM reads ZIP archive entry data", "spans": [ [ 12481, 33 ] ] }, { "id": "micro-behaviors/data/buffer/transfer::bytearrayinputstream-ref", "conf": 0.88, "crit": 3, "desc": "Java ByteArrayInputStream class" }, { "id": "micro-behaviors/data/buffer/transfer::bytearrayoutputstream-ref", "conf": 0.88, "crit": 3, "desc": "Java ByteArrayOutputStream class", "spans": [ [ 13244, 29 ] ] }, { "id": "micro-behaviors/data/decode/base64::java-base64-decode-bytecode-call", "conf": 0.96, "crit": 3, "desc": "Java Base64 decode call", "spans": [ [ 18965, 31 ] ] }, { "id": "micro-behaviors/data/decode/base64::java-base64-decoder-bytecode-call", "conf": 0.94, "crit": 3, "desc": "Java Base64 decoder accessor call", "spans": [ [ 18911, 27 ] ] }, { "id": "micro-behaviors/data/decode/base64::java-base64-decoder-class", "conf": 0.92, "crit": 3, "desc": "JVM Base64 decoder class reference", "spans": [ [ 224, 24 ], [ 18924, 28 ] ] }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method", "spans": [ [ 1031, 8 ] ] }, { "id": "micro-behaviors/fs/read/file/handle::jvm-io-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM File API class reference" }, { "id": "micro-behaviors/fs/read/file/handle::jvm-nio-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM NIO file API reference" }, { "id": "micro-behaviors/fs/write/file/handle::jvm-fileoutputstream-bytecode", "conf": 0.86, "crit": 3, "desc": "JVM imports FileOutputStream class", "spans": [ [ 12344, 24 ] ] }, { "id": "micro-behaviors/os/env/gate::jvm-opaque-environment-key", "conf": 0.94, "crit": 1, "desc": "JVM class has generated gate value" }, { "id": "micro-behaviors/os/env/gate::jvm-string-equals-import", "conf": 0.94, "crit": 1, "desc": "JVM class imports String equals", "spans": [ [ 14084, 0 ] ] }, { "id": "micro-behaviors/os/env/gate::jvm-system-getenv-import", "conf": 0.94, "crit": 1, "desc": "JVM class imports System getenv", "spans": [ [ 5505, 0 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.88, "crit": 3, "desc": "Java bytecode ProcessBuilder reference", "spans": [ [ 144, 71 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-init-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.92, "crit": 3, "desc": "Java bytecode ProcessBuilder constructor", "spans": [ [ 673, 31 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.95, "crit": 3, "desc": "Java bytecode ProcessBuilder start", "spans": [ [ 14984, 30 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-errors", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder merges standard error", "spans": [ [ 14920, 44 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-input", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard input", "spans": [ [ 14698, 38 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-output", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard output", "spans": [ [ 14893, 39 ] ] }, { "id": "micro-behaviors/time/sleep/interval::java-thread-sleep-bytecode", "conf": 0.9, "crit": 3, "desc": "Java bytecode thread sleep", "spans": [ [ 11810, 22 ] ] }, { "id": "objectives/anti-analysis/timing/evasion::kotlin-thread-sleep-check", "atk": "T1497.003", "conf": 0.94, "crit": 3, "desc": "Kotlin Thread.sleep call", "spans": [ [ 11820, 12 ] ] }, { "id": "objectives/anti-static/obfuscation/string/control-prefix::java-character-digit-bytecode", "atk": "T1027", "mbc": "F0001", "conf": 0.9, "crit": 3, "desc": "Java bytecode calls Character.digit", "spans": [ [ 20475, 25 ] ] }, { "id": "objectives/anti-static/obfuscation/string/control-prefix::java-control-prefixed-long-string", "atk": "T1027", "mbc": "F0001", "conf": 0.92, "crit": 3, "desc": "Java string starts with control-length prefix" }, { "id": "objectives/anti-static/obfuscation/string/crypto::java-byte-range-copy", "atk": "T1027", "mbc": "F0001", "conf": 0.7, "crit": 3, "desc": "Java byte range copy", "spans": [ [ 12912, 11 ] ] }, { "id": "objectives/impact/dos/disk::jvm-two-backward-goto-branches", "atk": "T1499.001", "conf": 0.9, "crit": 3, "desc": "JVM repeated counter backedges", "spans": [ [ 21742, 8 ], [ 21856, 8 ], [ 21940, 8 ], [ 22027, 8 ], [ 22120, 8 ], [ 22310, 8 ], [ 22393, 8 ], [ 22525, 8 ] ] }, { "id": "well-known/malware/stealer/prefire-shard::prefire-family-literal", "atk": "T1528", "mbc": "B0006", "conf": 0.9, "crit": 1, "desc": "Prefire family name literal", "spans": [ [ 4055, 7 ] ] }, { "id": "micro-behaviors/data/archive/extract/zip::jvm-zip-entry-extraction-to-file", "conf": 0.96, "crit": 3, "desc": "JVM extracts ZIP entries to files", "uses": [ 1, 2, 11 ], "spans": [ [ 12137, 41 ], [ 12344, 24 ], [ 12481, 33 ] ] }, { "id": "micro-behaviors/data/decode/base64::java-base64-decoding-bytecode", "conf": 0.94, "crit": 3, "desc": "Java bytecode Base64 decoding", "uses": [ 5, 6 ], "spans": [ [ 18911, 27 ], [ 18965, 31 ] ] }, { "id": "micro-behaviors/os/env/gate::jvm-opaque-secret-environment-gate", "conf": 0.97, "crit": 3, "desc": "JVM compares opaque environment gate", "uses": [ 12, 13, 14 ], "spans": [ [ 5505, 6 ], [ 14084, 6 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.94, "crit": 3, "desc": "Java bytecode ProcessBuilder execution", "uses": [ 16, 17 ], "spans": [ [ 673, 31 ], [ 14984, 30 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirected-stdio", "conf": 0.96, "crit": 3, "desc": "Java ProcessBuilder redirects all standard streams", "uses": [ 18, 19, 20 ], "spans": [ [ 14698, 38 ], [ 14893, 39 ], [ 14920, 44 ] ] }, { "id": "micro-behaviors/process/create/spawn::child-process-creation-api", "atk": "T1106", "conf": 0.92, "crit": 3, "desc": "Starts a child process through a platform API", "uses": [ 31 ], "spans": [ [ 673, 31 ], [ 14984, 30 ] ] } ], "type": "java_class" }, { "ctx": [ { "b": "+kO#^0000+0675Wa.bCcfk20vxMW=qCvU/oAb*50AC]IoBzCYcv)T:Ay\u0026/)Z0rAfiygho]fkL6mxd)4\u0026ygQ)%2lj\u0026b02x6.z7/KoBzb/aflZ@GA=u2wqGlR*2lj]d019*-y?^C", "ln": 0 } ], "depth": 1, "facts": { "imp": [ [ "", "com/github/wdtrpqvRqoh" ], [ "", "java/lang/Object" ], [ "", "java/lang/System" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ], [ "com/github/wdtrpqvRqoh$tkljcBenlt", "com/github/wdtrpqvRqoh$tkljcBenlt.ip" ], [ "com/github/wdtrpqvRqoh$tkljcBenlt", "ip" ], [ "com/github/wdtrpqvRqoh$tkljcBenlt", "com/github/wdtrpqvRqoh$tkljcBenlt.expiresAt" ], [ "com/github/wdtrpqvRqoh$tkljcBenlt", "expiresAt" ], [ "java/lang/System", "java/lang/System.currentTimeMillis" ], [ "java/lang/System", "currentTimeMillis" ] ], "metrics": { "file": { "size": 849, "entropy": 5.67 }, "class": { "major_version": 65, "interface_count": 0, "method_ref_count": 4, "constant_pool_size": 57, "external_class_count": 3 }, "binary": { "peak_region_bytes": 849, "peak_region_entropy": 5.67 }, "imports": { "count": 7 }, "functions": { "count": 2 } } }, "id": 2, "path": "Radium Client V6.jar!!com/github/wdtrpqvRqoh$tkljcBenlt.class", "pid": 0, "risk": 1, "sha": "e492e14f2a019190f5ce62ebd2c8f3a96a5771465b79df65bfda42471e411222", "size": 849, "traits": [ { "id": "metadata/binary/code/complexity::functions-at-most-24", "conf": 1.0, "crit": 2, "desc": "Binary has 24 or fewer functions" }, { "id": "metadata/binary/code/complexity::functions-at-most-32", "conf": 1.0, "crit": 2, "desc": "Binary has 32 or fewer functions" }, { "id": "metadata/file/magic/identity::cafebabe-magic", "conf": 1.0, "crit": 2, "desc": "CAFEBABE magic at file start", "spans": [ [ 0, 0 ] ] }, { "id": "micro-behaviors/os/env/gate::jvm-opaque-environment-key", "conf": 0.94, "crit": 1, "desc": "JVM class has generated gate value" } ], "type": "java_class" }, { "ctx": [ { "b": "+kO#^0000+0bqJmbX7+ffk20vxMW=qCvU/oAb*50AC]Ioo($R%njMJIoMsAsB{w0F0rrWCvrM6jy*?i]fhD4(wN//!00rl47gRo1fk20vxMW=qCvU/oAb*50AC]H}00Jx64ny{", "ln": 0 }, { "b": "aPI/G0rr918up@Y3JHkd000]qbleeM0@@r38uq2.5c8?kv/MGe0SS(lw=I/h5D\u00267t0000a0000c0000f0000103}Q(0097g0001O00Ao90001a5*]^X5*%vMdh@)FQ5VzL04yeP6AxT$kPZWueRuq5053UZ6Ax\u003eqllN3ygL4\u003e9h9q/\u003chj%{*6Ay3R9#1Ym", "ln": 1344 } ], "depth": 1, "facts": { "imp": [ [ "", "java/lang/String" ], [ "", "java/nio/charset/StandardCharsets" ], [ "", "java/util/Map" ], [ "", "com/github/wdtrpqvRqoh" ], [ "", "java/lang/Object" ], [ "java/lang/String", "java/lang/String.toLowerCase" ], [ "java/lang/String", "toLowerCase" ], [ "com/github/wdtrpqvRqoh$MtxmHGQKLq_Tv", "com/github/wdtrpqvRqoh$MtxmHGQKLq_Tv.body" ], [ "com/github/wdtrpqvRqoh$MtxmHGQKLq_Tv", "body" ], [ "com/github/wdtrpqvRqoh$MtxmHGQKLq_Tv", "com/github/wdtrpqvRqoh$MtxmHGQKLq_Tv.statusCode" ], [ "com/github/wdtrpqvRqoh$MtxmHGQKLq_Tv", "statusCode" ], [ "java/util/Map", "java/util/Map.get" ], [ "java/util/Map", "get" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ], [ "java/nio/charset/StandardCharsets", "java/nio/charset/StandardCharsets.UTF_8" ], [ "java/nio/charset/StandardCharsets", "UTF_8" ], [ "com/github/wdtrpqvRqoh$MtxmHGQKLq_Tv", "com/github/wdtrpqvRqoh$MtxmHGQKLq_Tv.statusLine" ], [ "com/github/wdtrpqvRqoh$MtxmHGQKLq_Tv", "statusLine" ], [ "com/github/wdtrpqvRqoh$MtxmHGQKLq_Tv", "com/github/wdtrpqvRqoh$MtxmHGQKLq_Tv.headers" ], [ "com/github/wdtrpqvRqoh$MtxmHGQKLq_Tv", "headers" ], [ "java/lang/String", "java/lang/String.\u003cinit\u003e" ], [ "java/lang/String", "\u003cinit\u003e" ] ], "metrics": { "file": { "size": 1756, "entropy": 5.93 }, "class": { "major_version": 65, "interface_count": 0, "method_ref_count": 9, "constant_pool_size": 106, "external_class_count": 5 }, "binary": { "peak_region_bytes": 1024, "peak_region_entropy": 5.98 }, "imports": { "count": 14 }, "functions": { "count": 3 } } }, "id": 3, "path": "Radium Client V6.jar!!com/github/wdtrpqvRqoh$MtxmHGQKLq_Tv.class", "pid": 0, "risk": 1, "sha": "86dac7d8a1946ab56394aa164f0b7385e57383d1e5268db3789820d0677186c2", "size": 1756, "traits": [ { "id": "metadata/binary/code/complexity::few-functions-3", "conf": 1.0, "crit": 2, "desc": "Binary has 3+ functions" }, { "id": "metadata/binary/code/complexity::functions-at-most-24", "conf": 1.0, "crit": 2, "desc": "Binary has 24 or fewer functions" }, { "id": "metadata/binary/code/complexity::functions-at-most-32", "conf": 1.0, "crit": 2, "desc": "Binary has 32 or fewer functions" }, { "id": "micro-behaviors/os/env/gate::jvm-opaque-environment-key", "conf": 0.94, "crit": 1, "desc": "JVM class has generated gate value" } ], "type": "java_class" }, { "ctx": [ { "b": "+kO#^0000+080s)a7Gkafk20vxMW=qCvU/oAb*50AC]IoB8Lz#CZsjx2lj=901-)NC404uvqYZhpHX6Iv@}}Q0%5xyygho]CRr@CBt4YRy+F)FfGA9MB-RU0vqYH^wPw1Q1PXP", "ln": 0 } ], "depth": 1, "facts": { "imp": [ [ "", "java/lang/Object" ], [ "", "javax/net/ssl/X509TrustManager" ], [ "", "com/github/wdtrpqvRqoh" ], [ "", "java/security/cert/X509Certificate" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ] ], "metrics": { "file": { "size": 1414, "entropy": 6.09 }, "class": { "major_version": 65, "interface_count": 1, "method_ref_count": 1, "constant_pool_size": 75, "external_class_count": 4 }, "binary": { "peak_region_bytes": 1024, "peak_region_entropy": 6.17 }, "imports": { "count": 5 }, "functions": { "count": 4 } } }, "id": 4, "mol": "H(Cm)", "path": "Radium Client V6.jar!!com/github/wdtrpqvRqoh$so_gxzmk.class", "pid": 0, "risk": 1, "sha": "b7b6ed44c0d49deb7d3260f6ce327294439cef55ce272a96b0cb9cbe44891d40", "size": 1414, "traits": [ { "id": "micro-behaviors/os/env/gate::jvm-opaque-environment-key", "conf": 0.94, "crit": 1, "desc": "JVM class has generated gate value" }, { "id": "micro-behaviors/communications/socket/ssl::jvm-x509trustmanager-class-ref", "conf": 0.94, "crit": 3, "desc": "JVM X509 trust-manager interface reference" }, { "id": "micro-behaviors/communications/socket/ssl::jvm-x509trustmanager-issuer-callback", "conf": 0.94, "crit": 3, "desc": "JVM getAcceptedIssuers callback defined" }, { "id": "micro-behaviors/communications/socket/ssl::jvm-x509trustmanager-server-callback", "conf": 0.94, "crit": 3, "desc": "JVM checkServerTrusted callback defined" }, { "id": "micro-behaviors/communications/socket/ssl::jvm-custom-x509trustmanager", "conf": 0.95, "crit": 3, "desc": "Class implements a custom X509 trust manager", "uses": [ 1, 2, 3 ] } ], "type": "java_class" }, { "ctx": [ { "b": "+kO#^0000+1dPw(7gRo1fk20vxMW=qCvU/oAb*50AC]H}009925nCS%vj#C9zF7Q#vRPE:Bo.^F0rsiKz/4dux([3hvLq}oBAhtuC2Ar#xE4UquUsRfzefvR1PXPDv@Diqxk8C", "ln": 0 }, { "b": "vR#hD0ziv)31E))C$q{/A+tyMawuJUC42RGzE)]yB8#dJq=uv*z!0M]BvGXGBz(hBi@]r=jzwXEBuPZ911kQ03\u0026?\u003cVe^.NY051uM32s\u0026Dl0)#auT\u003c9p7!!BTz7/KoBzb/aflZ@GA=u2wqGlR*i@]r-xjVe=06hJ4ygho]fkL6mxd)h9A+PA7j1i\u003ckz/4dux([3hvLq}oBAhtuC2Ar#xE3q]CX]#wqa\u003cP5uSqhg0rr^FvrM6jx(tT@pEPIrwPh:9z/b^Wh30WYBP", "ln": 657 }, { "b": "v@=c?By+EMa$cc1vrM6jy*?i]fh($kx(mMBdnjF+C404wwPPO9qB@}U0iDm73imdcUk[RbBz\u003eeSoAtb8c[d\u00268vrM6jzE)]yrz(HL3\u0026)KjVi*Pk0j8Xa3#fi]vj#IfBt3S(oA$N90rrvqwPQEYB94A.6EUz7ygho]fkL6mxd)h9A+PA7i$8a#0jSvoWG9\u0026s00^dFBwM)@Bo8vzc[dZ@0j@lz3imHmY-w9vxjVfYA=l5rv@De(0kwJz3imHmZYsAY2KdI.(7UPDLBpZwHuT#2\u003c^\u00267kR?sk#PxSb4\u003cn", "ln": 2686 }, { "b": "fkL6mxd)h9A+PA7luN0UwmY^y3\u0026]2Z*Zj5m0nNUQ83/FZKkN7o[28/wJiIJIXA*q$\u003e-Rd}HoH{-?ViY.Bz\u003e91A+PA73\u0026]k^Xc-k?0oa1V4rVJ8Cwp#bnm=QRwPv!KcmzM5vrM6jy*?i]fh($kx(mMBdnjF+C404uvqYZhq/)4]zF83t0osdw3igbc\u003c]CC)ygho]fk+uyfh(!0yH}O)0o::\u0026\u003e(rvs00\u0026M80rr*PwPQ*Yv}xv$wKpJKw[u0Yx)Ks\u003e00BYwdol\u0026S(\u0026uzW0o\u003cHK0rs3MvrM6jzE)]ynP59Yq/ueYwPQjGwo8m5A%zZm0rr(-oLO0Vvj#C9zF7R3BAh8kxfeWlrTX%W0p*D%[C@d?03?K/2(\u003e2b]-k3$v@Dm5wN//.030yXygho]fk+uyfh(!0yH}PNwmPZ(B8%Amdol\u0026S{w\u003c%}0o\u003cHV3\u0026?NNaQFbI0q==%40c04q/tSHzdNTdBpnfF0pp9[\u003e(yX\u003e04O422(\u003e2c0096vygho]CRr@CBt4YRy+FZ=oJb\u003etyH}PSvpKy$A^m(\u003c0S-ofv@=c?By!x?v@2T$0rt8coLO0Vvj#IfBt3Nhv@2T$j4%x$C404uvqYZhq/)4]zF845s$9cWvrM6jzE)]yq/ueYwPQ0x0r-Ab3ipkf1{1Yuygho]CRr@CBt4YRy+FZ=oJb\u003etyH}O)0seYa5nbM@q=uv^vrb^[wPRH7A@=m.c[d\u00268vrM77fk+uyflqhJfh\u003e!yp*[xMzdN*2A=TqJ0sw\u0026n3ipCl3\u0026{tCygho]CRr@CBt4YRy+FZZnL0=vBwul", "ln": 3187 }, { "b": "j1i\u003crvrM6jB-.tlfhc83Buo)i6-/6T0tCLJ0rs6NvrM77fk+uyflqhJfh\u003e!yp*[xMzdN*2A=RD^836ZEB7GC(wPz%9A.Z4WwPE\u003eL6duK?vrM6jB-.tlfhc83Bup{L3\u0026}pF90#Y+0uzgvb)SwyQ#Eii\u003e-@17Mx79+OAtG@)yE(bZo3sJXAGfZ\u0026*ln0I\u0026ObA9@#u=B7GCZzE^Z8x(n2:wmYU2x\u003ez6?vruj4zB58Kz/PMlxL!dUaPSbY0u7$.0rrWLwPQ\u003cHoI/ervqPN$wPz?)03AW-ygho]CRr@CBt4YRy+FZ=oI/ervqPN$wPz\u0026Ndol\u0026TbMPg#0sn=N0rrQJByxiinmuyDB7!#$wEFO/04[PV2(#EQ01SZNBwE43Acln3BAg@3z2\u003cRNc[d\u00268vrM6jx(tU2B-.OBBw)p4wNPBq3\u0026}\u003cVed8yw0warL4RGu{nP5G\u0026Bw)p4wNPAR02E4joLO0Vvj#tkfg*52B-ZM7A+eV@i$8cy0wB\u0026X\u003e(AHt0446tG6]$t\u003c=b@2P]Xn^U\u0026@9*)1qv$INR\u00263WcC01\u003ek", "ln": 3903 }, { "b": "(Zt6vFU.Q(YZh2p\u003eCT)eV4?RPXBl+^\u0026FCegV+aF=(Ztx\u003e0I6k\u003e3q1e(uPp25iBsGH0IoyK2)2[:PAb2@CxdztwDq=mc%G1!rTY260IY#5huxPO00M$JB-Rj80J2\u0026H3ir3=RVu=aoFyxWlUxaGn?\u003cdY0rtnhoLO0Vvj#tkfg*52B-ZM7A+eV@j1i\u003ckz/4dux([3hvLq}oBAhtuC2Ar#xE3q]CX]#wqa\u003cP5uSqhg3\u003c0sdSTn.c0JMk31.hv!B7C:XTPf%X0o\u003cJ!0rr^FvrM6jy*?i]fh#R9z*bS0y?i?LUMj.jvTilcD2l]mC6vXx0rs0hygho]CRr@CBt4YRy+FZ=oJb\u003etyH}PH0rrBqB6\u0026QaC3/3a0rsclygho]CRr@CBt4YRy+FZ=oI/ervqPN$wPz\u0026N0rr^Ex(d^5uVys7B.kn[wncvhwmU=w5LM}FC404wwPPO7z!0M]BuoH626sZ3qEK+I01:A*xlN*6q!xVKl3NciyIT1K6?\u0026vJC404DBzkLAo\u003c}#^mq^i/C@(3b1z.4DyYKIKoLO0Vvj#tkfhD.jAcln3BAg@3z94:#6j$iZmpg7kq!6f6pF287wmxR20rr\u003cdygho]fkktTnP5G\u0026Bw)p4wNL", "ln": 6375 }, { "b": "uWt*:s6[Hlqelgj3ud.BuOTreB2b/S01A:TluEJHv}OICAcMKb026l(ze09@wn(=:xlv-TwO2$7C(W)PoLO0Vvj#IfBt3S(oGJmP5n(Vcygy{Oy?)J)yE?]TxAn8rBy/rdp\u0026yyQ019^yq*hd}uOU+@0rrvFvqFtuBytgI2x19$BwlE!0rrsyBAf@-CMv^TpIAsvuRKA:l%\u003c:%nKD\u0026KAbYm!00l\u003eL0rsiRvrM6jy*?i]fhuUbvR6NHz/PY6BvyB:wPd", "ln": 6999 }, { "b": "z.BC1w[CQ{wN[wIAcln3BAg@3z3H9]0rr@+oLO0Vvj#tkfg*52B-ZM7A+eV@j1jhs04!l93iw/X*w}o{ygho]fkktTlv0V:l2}0OC#5N8Acln3BAg@3z3H9$3iw#-f984QA+eV\u00263\u003c2n^YB1X)0PsB/Q5:M/0P0\u003eq0rrmzx)Kt00P:r]3iw#:\u003c]CC\u0026Bz\u003cG\u003eBy^:UA::j]00BY0ts5-0\u003eMf]P0P0\u003ex0rs-2oLO0Vvj#Ijz.CQlvrcB2Bt30{vrcB2Bup{Bygho]fkL6mxd)h9A+PA7i$8bF0QHc]?u00A04[-tQmyIGI0f]k)$lC:Gpp!\u0026GxG$Z\u003c*}zPQlL8ON=/][(w}O0HPYQgK)n@#2M:w{00NB.y?W$(04ff*ygho]f8", "ln": 7231 }, { "b": "fkktTnP5G\u0026Bw)p4wNPBqdo/aE0Xsy83igbee^5Q4cQv\u003c}X!l1=qTf)80rruMts7[Mdm\u003c{G?#UXw0OEJh0@@(j015+-0yN1\u00260SSi300K=PlmCFm0Pj2t3iw/YiSPi=c%G2fnHWWG0IPST3iw#+jPLKgc}N9EvrM6jy*?i]fh($kx(mMBoLO0Vvj#+Bx(2B%vq[qjlmC}z04!mp3igzmkMH\u0026%B8(khvrbZ(B7GG5w)Yd@A@=mzo)fn*0rrBFvrc0(Bv2", "ln": 8342 }, { "b": "2wE\u003c\u003ex\u003eY}z0rr^nnPelGqGltAuR\u003eVqByfc3peR8)6g+=or9%rax?\u002625Dq^WFo\u0026swJ0rsinygho]fkktTlv0V:l2}0OC#5N8Acln3BAg@3z94:#25F0\u003cx((9h01S)^yhdE6uWcJ%w[#WdwDq=nAccbqvr.!M25^%=lVc#D03a:FvrM6jx(tT\u003eB.kk%A+e=MzG6-uq/)4\u003evqO7b01:l\u003exKtp\u0026Cw?houUst7vTd$O25[H4qEK+I00)yJwMS}^okBRe6maH^xKsUaz#", "ln": 8683 }, { "b": "2xTJ]A7\u003c?X0rrc/0rrpoC1MHy0rrskCv9:tB]#M5\u003evjX}%nSb5(jSW(000000001i1POJ506\u003cO?x8}#Hygho]fkktTl$7gCpJZ+#B-ZM7A+eV@2lINt02WgUygho]fkktTpJZ+#B-ZM7A+eV@j1jhs04!n!3iE{yZYsAvzEEB3rb3hX3\u003caoEO^CEb0(Cfw000000rr61019{\u003cx()]+xM4{k3\u003caDH)fS{e0($xx90+/xKl-1f\u0026J[^pX$[L\u003eJoc.6\u0026\u003eILWY{4=CGA}U4", "ln": 9750 }, { "b": "A+PSblv0V:3\u003caSM)fS{e0)H-C3u{J8By^^:By/I40)Z(U3iE{y=\u0026Tn^vFo\u003c7.cWPMTQ0=?1m]!8l\u0026^oaygho]fkL6mxd)e9zGGPfwKQ\u0026NwPh:9z/b^Y!=t:/c}[w:C404uvqYZhra{q\u003cCvs@%wJItw3\u0026?\u003cX/A}Yi0[^OO17+eK0rrHrCW\u003e[LhB?\u003c\u003cnJcUI0Af103u{2%AD1GXA=\u003e^\u003e02ngxvrM6jx(tT@pEPIrwPh:9z/dSq00D\u003ecvr.!M2T}E7sY[Nzv/", "ln": 9970 }, { "b": "vrM6jB-.tlfg68*wI#v\u003cmq=QNwmY^y3\u003cb@2[^kvi0}MA)4ThSexM53np*))Bx(mL(0}=S=3ig.v{5Ld6wO#0@wmX.Uq/)4]zF6vV{Yu(\u003e022Cf0rtj^[1^hcMe/SV\u003eFaE[HQu64X9{b+:fBWsGY*76)Uvj\u0026J!W20G#ZBTZl[8$Km4^Y\u0026/ok\u003eRjL-8\u003cg*]^0@z##9%Q\u003e-MGKg3\u0026!B8]XXEB5Y5]3-\u003e82k-IL/x*I%[iG2M\u003c@906pIHSLdV3O-(lp(yTi)YYcL\u003c[0H=GN4\u0026-fMGCir)60nHLFlq", "ln": 10323 }, { "b": "oj8^lDurH\u003cx?hxlv)Tvs0rrsmB8+!]ASDdCvr=:mzBnbP0rryCwPI*ezGxv\u003ept#jk0rr^FvrM6jzFs2xlv0V:luM)LwPw1TaPRMCCxdbh0rr#=ts6=jygho]fk+Gxfg6@awKpJKw[u0A3\u003cdZRbNKR$10)%F2XNZ\u003cq!Q8\u0026Bo8vzc[e7611ag03iIEOdfxLIFb/VK0rr6100WQPy^@2S0rr@+oLO0Vvj#Ijz.BC5By^^Yw[CQ{j1jhs11:Qc3ig", "ln": 11191 }, { "b": "v}tVve*%zdvrM6jy*?i]fh($kx(mMBdnjF+C42RGzE)]yB8#dJq=uvSz/fVdCYV1Q19$5@3iLLQD\u0026Ti=ygho]CRr@CBt4YRy+F+dB-RU0vqYH^wPw1TEHl5V051uM8FSY7vj#Xkv%8*aBA]JrwN/\u003e6wL#@Own=q\u00261aZ^YF=EC800E1Nx(\u003cvQs14oDygho]CRr@CBt4YRy+FB)C$?Z+vp%d(j6Lx[vrM77fk+uyflqhJfh#$mB97b+zEEf?AYV%fvrM6jB7F\u003c7A+PSvfh(B(B-I4\u003evqYQ]z96gE3\u003chd+G:E{c1bl*R5nbM@q/ueYwPQyIv@#TfC(W)?c[d\u00268vrM77fk+uyflqhJfh\u003e!yq/ueYwPQyIv@#R", "ln": 12273 }, { "b": "6:UHVFhNYDv735ao!lx6j$KzJwf2hs1qI6L1V=!?hu%%46:glhaq\u003es$2p]##u\u003e\u0026]Og+n+A2ov+\u003eg\u003eH(\u003cGA?KQ%kaK]YAHt283H9W1{kOyXbZcM07o%c2dBOfdGGM2XbYKk000021d5#/051rO@@s!O2)QC#2lknm0000000961@@r@q2)QC#2lknt08rK}2lmH00rAf2blKki000=m0ST$Qve%{u9SMfug5$..xAfyW0rXX?000c40rt1W", "ln": 13326 }, { "b": "FJ0(FB*.ovpaVM8huURC1y@kIwhTPa1?U111{l:?6:LJTQ5VwP1@dy}1qI5E6:Oh7eD=^]6:eF-g\u003eH(\u003cGA}QR%j[y[YAHt383QfX2lLXAXbZaNB#xTw2[?AP04FY\u00265{H5Ibnpc5hWHla6AAC[hWHla6AAJkhWHaChvylc5}tu*3+DybsS4EN08Ui@ecilXrJ(D600im?0000W00BIC02$$B2lmc%07m4(l\u003cAY!0rAA9p5\u003ep{044TBli4q%", "ln": 13601 }, { "b": "WG5\u0026V1q}sAg=tHP1ILPOwcuB31@duP1V=\u003e\u003chv7366:yxjbPc?42Pi:W1Q5iF2W/Fb1oYCB6:nL:g\u003eH(\u003cGA}QR%j+c=l%gxjW/xnPd\u003eAoZ09cl600065MJd0=iSGp9@@r(o3i{M02lmc%07m4(4/=Of000310ri3v015@hl\u003cAYW2lmc%01Pqmp5$w208rK}001wGMh*)+dGxOKaolAZK]MK6001bwASzp69SMivaolAZLMh:80STtyASzv8cJBkJM\u0026E9^1onD5huPfz00062G-^.y000Pl05\u003c(T0bzMm0bISn09Gp400@T\u003e0e7sP1c\u0026\u0026^0t+.v01e=b0gBK!hvg985%[aYM.jr[5%$M-6:UARCS2\u003cy2[Nq*hvg1+WG5\u0026V1q}sAg=tHP1IL1H6:nba1@duP1V=(61{s", "ln": 13971 }, { "b": "WG5\u0026V9t]\u003e1g=ux)9LIU!6={)z9#b)g1V^+dhx-!U6^6dIbPdZtaShp66={-$aZ^bA9rW926=}s4g\u003eH(\u003cGDQw]%j+c=l%gxIW/xn^2]J]P0n2i\u003cCO{/91?1A.iWD*jY8ZI!W/Cb1b^)Zf65Zg#nie7nciD7.cManB6^)I{whU?Jd7/ZAdfzET6!f}DQ5VCRdhsrIckv)hu\u003e\u003ee0g-mRy6!f}CA9$IOL2We+0Jk$LY8Ul487A2{qmlFY86#Y\u003e?NiBAiTDVdXb+XM3Ccr5s*[y@iTV/k66($a)?(IB0p:hf3kA/P0q9L%{o\u003c$$84i.I@i=R96:QicSiMB884dq^6:B(I0scyv2%5Ik4yMoDiU02qY8-BB83WLJ61v@VWGdA!4IF\u003c=WG5\u0026VeG3bxg=u%7eXRu#6!T2PfbldM1V!sthzM156!=oYbPeoJg8RUD6!S(eggh{ReD=!z6!TDkg\u003eH(\u003cGFAOa%jXnwYAHtJ888dgf-@dzXbZcM07o%cf$dcWWGdP\u003c4h/U:0vF-]WGd\u0026}4ls]}00:wHiT=(mWGe0w4h/O.0wVXCY8ZI!W/Cby4\u0026C)cWGbd$0w}j+nieNBg}\u003c9688LXShz(veZ7\u0026Io1y%zG6/JYdiYvd0i2ay/hLHf]88\u0026o\u002688J6/g-na+hwFg^he(}WF%6b!i02@S?[5\u003eRsS6fc08Zf8?wDTd0nXv\u0026i\u003c]2ViY!iv12I[#89tLnwedjqhA.^rYAHtW12-vUknutQ03\u0026BC6*AM$1qK4b6*D7.89m%oknuq1u]iE#rFiNqR#LI-07o%ckdpI?WGbe=84NwYjut!DliBT%kSg$ElBD[Z1y@lmwhV\u0026/0ngG\u0026m7ig=iZ\u003ccemIOxcm4%Vg8atAf1qKpi6?hPt0ydI?1qKxvlVuCw0yggUWGe{2GHM0u%je5RWGbu@0nXN$WGbe=6:Qic3L-)U0Lt084\u00262ws00", "ln": 14760 }, { "b": "1R?ig01x!G0#h0F0TH*\u002683EwF^Wp7tRVp6w1HXvw5d(tMBV6Bs2atI@RVov82d$j52lM\u003c\u00266:LJUQ5VF?83Z(Z6:txUwvqL.hvg980?YI$RVmev2O^UNhvckX*aa3C0@", "ln": 36779 } ], "depth": 1, "facts": { "imp": [ [ "", "java/lang/RuntimeException" ], [ "", "java/nio/ByteBuffer" ], [ "", "java/util/concurrent/ConcurrentHashMap" ], [ "", "java/lang/Exception" ], [ "", "[Ljava/lang/String;" ], [ "", "java/io/InputStream" ], [ "", "java/net/URL" ], [ "", "java/io/IOException" ], [ "", "java/lang/StringBuilder" ], [ "", "javax/net/ssl/SSLParameters" ], [ "", "java/lang/Integer" ], [ "", "java/util/LinkedHashMap" ], [ "", "javax/net/ssl/SSLContext" ], [ "", "java/security/SecureRandom" ], [ "", "com/github/wdtrpqvRqoh$so_gxzmk" ], [ "", "java/util/Map$Entry" ], [ "", "java/lang/String" ], [ "", "java/net/Socket" ], [ "", "javax/net/ssl/SNIHostName" ], [ "", "[B" ], [ "", "[C" ], [ "", "java/io/ByteArrayOutputStream" ], [ "", "javax/net/ssl/SSLSocketFactory" ], [ "", "java/util/Map" ], [ "", "java/util/Base64$Encoder" ], [ "", "java/lang/Throwable" ], [ "", "java/lang/invoke/MethodHandles" ], [ "", "java/util/Iterator" ], [ "", "javax/net/ssl/SSLSocket" ], [ "", "java/io/OutputStream" ], [ "", "java/lang/System" ], [ "", "java/lang/NumberFormatException" ], [ "", "javax/net/ssl/TrustManager" ], [ "", "java/lang/invoke/MethodHandles$Lookup" ], [ "", "java/util/Base64" ], [ "", "com/github/wdtrpqvRqoh$tkljcBenlt" ], [ "", "java/util/List" ], [ "", "java/lang/Object" ], [ "", "java/net/InetSocketAddress" ], [ "", "java/util/Set" ], [ "", "java/net/URI" ], [ "", "java/nio/charset/StandardCharsets" ], [ "", "java/io/DataOutputStream" ], [ "", "java/io/BufferedInputStream" ], [ "", "com/github/wdtrpqvRqoh$MtxmHGQKLq_Tv" ], [ "javax/net/ssl/SSLParameters", "javax/net/ssl/SSLParameters.setEndpointIdentificationAlgorithm" ], [ "javax/net/ssl/SSLParameters", "setEndpointIdentificationAlgorithm" ], [ "java/util/LinkedHashMap", "java/util/LinkedHashMap.\u003cinit\u003e" ], [ "java/util/LinkedHashMap", "\u003cinit\u003e" ], [ "java/util/Map", "java/util/Map.put" ], [ "java/util/Map", "put" ], [ "java/lang/String", "java/lang/String.length" ], [ "java/lang/String", "length" ], [ "java/io/DataOutputStream", "java/io/DataOutputStream.writeByte" ], [ "java/io/DataOutputStream", "writeByte" ], [ "java/lang/RuntimeException", "java/lang/RuntimeException.\u003cinit\u003e" ], [ "java/lang/RuntimeException", "\u003cinit\u003e" ], [ "java/lang/System", "java/lang/System.arraycopy" ], [ "java/lang/System", "arraycopy" ], [ "javax/net/ssl/SSLSocket", "javax/net/ssl/SSLSocket.getOutputStream" ], [ "javax/net/ssl/SSLSocket", "getOutputStream" ], [ "java/lang/String", "java/lang/String.substring" ], [ "java/lang/String", "substring" ], [ "com/github/wdtrpqvRqoh", "com/github/wdtrpqvRqoh.duwfuiItem" ], [ "com/github/wdtrpqvRqoh", "duwfuiItem" ], [ "java/lang/String", "java/lang/String.toLowerCase" ], [ "java/lang/String", "toLowerCase" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.toByteArray" ], [ "java/io/ByteArrayOutputStream", "toByteArray" ], [ "java/net/URL", "java/net/URL.getQuery" ], [ "java/net/URL", "getQuery" ], [ "com/github/wdtrpqvRqoh$so_gxzmk", "com/github/wdtrpqvRqoh$so_gxzmk.\u003cinit\u003e" ], [ "com/github/wdtrpqvRqoh$so_gxzmk", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.isEmpty" ], [ "java/lang/String", "isEmpty" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.\u003cinit\u003e" ], [ "java/io/ByteArrayOutputStream", "\u003cinit\u003e" ], [ "java/util/Base64$Encoder", "java/util/Base64$Encoder.encodeToString" ], [ "java/util/Base64$Encoder", "encodeToString" ], [ "com/github/wdtrpqvRqoh", "com/github/wdtrpqvRqoh.valFfr" ], [ "com/github/wdtrpqvRqoh", "valFfr" ], [ "java/lang/String", "java/lang/String.trim" ], [ "java/lang/String", "trim" ], [ "java/util/Iterator", "java/util/Iterator.next" ], [ "java/util/Iterator", "next" ], [ "com/github/wdtrpqvRqoh", "com/github/wdtrpqvRqoh.copyHqgrg" ], [ "com/github/wdtrpqvRqoh", "copyHqgrg" ], [ "com/github/wdtrpqvRqoh", "com/github/wdtrpqvRqoh.gZB" ], [ "com/github/wdtrpqvRqoh", "gZB" ], [ "java/lang/String", "java/lang/String.toCharArray" ], [ "java/lang/String", "toCharArray" ], [ "java/net/URI", "java/net/URI.create" ], [ "java/net/URI", "create" ], [ "javax/net/ssl/SSLSocketFactory", "javax/net/ssl/SSLSocketFactory.createSocket" ], [ "javax/net/ssl/SSLSocketFactory", "createSocket" ], [ "javax/net/ssl/SSLContext", "javax/net/ssl/SSLContext.init" ], [ "javax/net/ssl/SSLContext", "init" ], [ "java/lang/String", "java/lang/String.contains" ], [ "java/lang/String", "contains" ], [ "com/github/wdtrpqvRqoh", "com/github/wdtrpqvRqoh.qtT" ], [ "com/github/wdtrpqvRqoh", "qtT" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.setLength" ], [ "java/lang/StringBuilder", "setLength" ], [ "java/util/Iterator", "java/util/Iterator.hasNext" ], [ "java/util/Iterator", "hasNext" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.position" ], [ "java/nio/ByteBuffer", "position" ], [ "javax/net/ssl/SSLContext", "javax/net/ssl/SSLContext.getSocketFactory" ], [ "javax/net/ssl/SSLContext", "getSocketFactory" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.getInt" ], [ "java/nio/ByteBuffer", "getInt" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.get" ], [ "java/nio/ByteBuffer", "get" ], [ "javax/net/ssl/SSLSocketFactory", "javax/net/ssl/SSLSocketFactory.getDefault" ], [ "javax/net/ssl/SSLSocketFactory", "getDefault" ], [ "java/io/BufferedInputStream", "java/io/BufferedInputStream.read" ], [ "java/io/BufferedInputStream", "read" ], [ "javax/net/ssl/SSLSocket", "javax/net/ssl/SSLSocket.close" ], [ "javax/net/ssl/SSLSocket", "close" ], [ "java/lang/System", "java/lang/System.nanoTime" ], [ "java/lang/System", "nanoTime" ], [ "java/net/URL", "java/net/URL.getHost" ], [ "java/net/URL", "getHost" ], [ "java/lang/String", "java/lang/String.startsWith" ], [ "java/lang/String", "startsWith" ], [ "java/util/Map$Entry", "java/util/Map$Entry.getValue" ], [ "java/util/Map$Entry", "getValue" ], [ "java/lang/String", "java/lang/String.equals" ], [ "java/lang/String", "equals" ], [ "com/github/wdtrpqvRqoh", "com/github/wdtrpqvRqoh.iofzgrukTraversal" ], [ "com/github/wdtrpqvRqoh", "iofzgrukTraversal" ], [ "java/io/DataOutputStream", "java/io/DataOutputStream.writeBytes" ], [ "java/io/DataOutputStream", "writeBytes" ], [ "java/util/Set", "java/util/Set.iterator" ], [ "java/util/Set", "iterator" ], [ "java/util/Base64", "java/util/Base64.getUrlEncoder" ], [ "java/util/Base64", "getUrlEncoder" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.toString" ], [ "java/io/ByteArrayOutputStream", "toString" ], [ "java/nio/charset/StandardCharsets", "java/nio/charset/StandardCharsets.ISO_8859_1" ], [ "java/nio/charset/StandardCharsets", "ISO_8859_1" ], [ "com/github/wdtrpqvRqoh", "com/github/wdtrpqvRqoh.endTyebn" ], [ "com/github/wdtrpqvRqoh", "endTyebn" ], [ "java/net/URL", "java/net/URL.getPath" ], [ "java/net/URL", "getPath" ], [ "javax/net/ssl/SSLParameters", "javax/net/ssl/SSLParameters.setServerNames" ], [ "javax/net/ssl/SSLParameters", "setServerNames" ], [ "java/util/Map$Entry", "java/util/Map$Entry.getKey" ], [ "java/util/Map$Entry", "getKey" ], [ "com/github/wdtrpqvRqoh", "com/github/wdtrpqvRqoh.BArQKeLGGG" ], [ "com/github/wdtrpqvRqoh", "BArQKeLGGG" ], [ "java/lang/String", "java/lang/String.indexOf" ], [ "java/lang/String", "indexOf" ], [ "java/net/Socket", "java/net/Socket.\u003cinit\u003e" ], [ "java/net/Socket", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.split" ], [ "java/lang/String", "split" ], [ "java/io/InputStream", "java/io/InputStream.read" ], [ "java/io/InputStream", "read" ], [ "java/security/SecureRandom", "java/security/SecureRandom.\u003cinit\u003e" ], [ "java/security/SecureRandom", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.substring" ], [ "java/lang/String", "substring" ], [ "java/io/DataOutputStream", "java/io/DataOutputStream.\u003cinit\u003e" ], [ "java/io/DataOutputStream", "\u003cinit\u003e" ], [ "java/io/BufferedInputStream", "java/io/BufferedInputStream.\u003cinit\u003e" ], [ "java/io/BufferedInputStream", "\u003cinit\u003e" ], [ "java/lang/Integer", "java/lang/Integer.parseInt" ], [ "java/lang/Integer", "parseInt" ], [ "java/lang/String", "java/lang/String.indexOf" ], [ "java/lang/String", "indexOf" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.write" ], [ "java/io/ByteArrayOutputStream", "write" ], [ "java/io/BufferedInputStream", "java/io/BufferedInputStream.read" ], [ "java/io/BufferedInputStream", "read" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.wrap" ], [ "java/nio/ByteBuffer", "wrap" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "javax/net/ssl/SNIHostName", "javax/net/ssl/SNIHostName.\u003cinit\u003e" ], [ "javax/net/ssl/SNIHostName", "\u003cinit\u003e" ], [ "java/nio/charset/StandardCharsets", "java/nio/charset/StandardCharsets.UTF_8" ], [ "java/nio/charset/StandardCharsets", "UTF_8" ], [ "java/net/Socket", "java/net/Socket.getInputStream" ], [ "java/net/Socket", "getInputStream" ], [ "java/lang/Integer", "java/lang/Integer.parseInt" ], [ "java/lang/Integer", "parseInt" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.position" ], [ "java/nio/ByteBuffer", "position" ], [ "javax/net/ssl/SSLContext", "javax/net/ssl/SSLContext.getInstance" ], [ "javax/net/ssl/SSLContext", "getInstance" ], [ "java/net/URL", "java/net/URL.getPort" ], [ "java/net/URL", "getPort" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "com/github/wdtrpqvRqoh$tkljcBenlt", "com/github/wdtrpqvRqoh$tkljcBenlt.isExpired" ], [ "com/github/wdtrpqvRqoh$tkljcBenlt", "isExpired" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.getShort" ], [ "java/nio/ByteBuffer", "getShort" ], [ "java/net/URI", "java/net/URI.toURL" ], [ "java/net/URI", "toURL" ], [ "javax/net/ssl/SSLSocket", "javax/net/ssl/SSLSocket.setSSLParameters" ], [ "javax/net/ssl/SSLSocket", "setSSLParameters" ], [ "java/util/Map", "java/util/Map.get" ], [ "java/util/Map", "get" ], [ "com/github/wdtrpqvRqoh$tkljcBenlt", "com/github/wdtrpqvRqoh$tkljcBenlt.\u003cinit\u003e" ], [ "com/github/wdtrpqvRqoh$tkljcBenlt", "\u003cinit\u003e" ], [ "java/net/Socket", "java/net/Socket.getOutputStream" ], [ "java/net/Socket", "getOutputStream" ], [ "com/github/wdtrpqvRqoh", "com/github/wdtrpqvRqoh.L0oNCgM2J1Pp" ], [ "com/github/wdtrpqvRqoh", "L0oNCgM2J1Pp" ], [ "com/github/wdtrpqvRqoh", "com/github/wdtrpqvRqoh.vh_dmjzdl_gnjgw_yebp" ], [ "com/github/wdtrpqvRqoh", "vh_dmjzdl_gnjgw_yebp" ], [ "com/github/wdtrpqvRqoh", "com/github/wdtrpqvRqoh.ummwjmfHelper" ], [ "com/github/wdtrpqvRqoh", "ummwjmfHelper" ], [ "com/github/wdtrpqvRqoh$MtxmHGQKLq_Tv", "com/github/wdtrpqvRqoh$MtxmHGQKLq_Tv.\u003cinit\u003e" ], [ "com/github/wdtrpqvRqoh$MtxmHGQKLq_Tv", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.getBytes" ], [ "java/lang/String", "getBytes" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.toString" ], [ "java/lang/StringBuilder", "toString" ], [ "java/io/BufferedInputStream", "java/io/BufferedInputStream.read" ], [ "java/io/BufferedInputStream", "read" ], [ "javax/net/ssl/SSLSocket", "javax/net/ssl/SSLSocket.getSSLParameters" ], [ "javax/net/ssl/SSLSocket", "getSSLParameters" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.write" ], [ "java/io/ByteArrayOutputStream", "write" ], [ "java/lang/String", "java/lang/String.\u003cinit\u003e" ], [ "java/lang/String", "\u003cinit\u003e" ], [ "java/net/Socket", "java/net/Socket.setSoTimeout" ], [ "java/net/Socket", "setSoTimeout" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "javax/net/ssl/SSLSocket", "javax/net/ssl/SSLSocket.startHandshake" ], [ "javax/net/ssl/SSLSocket", "startHandshake" ], [ "java/lang/String", "java/lang/String.equalsIgnoreCase" ], [ "java/lang/String", "equalsIgnoreCase" ], [ "com/github/wdtrpqvRqoh", "com/github/wdtrpqvRqoh.gszfEr" ], [ "com/github/wdtrpqvRqoh", "gszfEr" ], [ "com/github/wdtrpqvRqoh", "com/github/wdtrpqvRqoh.nLtadeku" ], [ "com/github/wdtrpqvRqoh", "nLtadeku" ], [ "com/github/wdtrpqvRqoh", "com/github/wdtrpqvRqoh.aPm" ], [ "com/github/wdtrpqvRqoh", "aPm" ], [ "com/github/wdtrpqvRqoh$tkljcBenlt", "com/github/wdtrpqvRqoh$tkljcBenlt.ip" ], [ "com/github/wdtrpqvRqoh$tkljcBenlt", "ip" ], [ "java/io/OutputStream", "java/io/OutputStream.write" ], [ "java/io/OutputStream", "write" ], [ "com/github/wdtrpqvRqoh", "com/github/wdtrpqvRqoh.ETPArt3zgZJY" ], [ "com/github/wdtrpqvRqoh", "ETPArt3zgZJY" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.\u003cinit\u003e" ], [ "java/io/ByteArrayOutputStream", "\u003cinit\u003e" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.hasRemaining" ], [ "java/nio/ByteBuffer", "hasRemaining" ], [ "java/lang/System", "java/lang/System.currentTimeMillis" ], [ "java/lang/System", "currentTimeMillis" ], [ "java/net/URL", "java/net/URL.getProtocol" ], [ "java/net/URL", "getProtocol" ], [ "com/github/wdtrpqvRqoh", "com/github/wdtrpqvRqoh.vwdsr" ], [ "com/github/wdtrpqvRqoh", "vwdsr" ], [ "java/net/Socket", "java/net/Socket.close" ], [ "java/net/Socket", "close" ], [ "java/util/Base64$Encoder", "java/util/Base64$Encoder.withoutPadding" ], [ "java/util/Base64$Encoder", "withoutPadding" ], [ "java/net/Socket", "java/net/Socket.setReceiveBufferSize" ], [ "java/net/Socket", "setReceiveBufferSize" ], [ "java/util/concurrent/ConcurrentHashMap", "java/util/concurrent/ConcurrentHashMap.\u003cinit\u003e" ], [ "java/util/concurrent/ConcurrentHashMap", "\u003cinit\u003e" ], [ "java/util/Map", "java/util/Map.entrySet" ], [ "java/util/Map", "entrySet" ], [ "com/github/wdtrpqvRqoh", "com/github/wdtrpqvRqoh.isX" ], [ "com/github/wdtrpqvRqoh", "isX" ], [ "java/util/List", "java/util/List.of" ], [ "java/util/List", "of" ], [ "com/github/wdtrpqvRqoh", "com/github/wdtrpqvRqoh.zmXqxn" ], [ "com/github/wdtrpqvRqoh", "zmXqxn" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.get" ], [ "java/nio/ByteBuffer", "get" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.size" ], [ "java/io/ByteArrayOutputStream", "size" ], [ "java/net/InetSocketAddress", "java/net/InetSocketAddress.\u003cinit\u003e" ], [ "java/net/InetSocketAddress", "\u003cinit\u003e" ], [ "java/net/Socket", "java/net/Socket.connect" ], [ "java/net/Socket", "connect" ], [ "java/io/InputStream", "java/io/InputStream.read" ], [ "java/io/InputStream", "read" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "java/io/DataOutputStream", "java/io/DataOutputStream.writeShort" ], [ "java/io/DataOutputStream", "writeShort" ], [ "javax/net/ssl/SSLSocket", "javax/net/ssl/SSLSocket.getInputStream" ], [ "javax/net/ssl/SSLSocket", "getInputStream" ], [ "com/github/wdtrpqvRqoh$MtxmHGQKLq_Tv", "com/github/wdtrpqvRqoh$MtxmHGQKLq_Tv.body" ], [ "com/github/wdtrpqvRqoh$MtxmHGQKLq_Tv", "body" ], [ "java/lang/String", "java/lang/String.charAt" ], [ "java/lang/String", "charAt" ], [ "com/github/wdtrpqvRqoh", "com/github/wdtrpqvRqoh.qtfjzufJhicUgdMsmyx" ], [ "com/github/wdtrpqvRqoh", "qtfjzufJhicUgdMsmyx" ], [ "java/io/OutputStream", "java/io/OutputStream.flush" ], [ "java/io/OutputStream", "flush" ] ], "metrics": { "file": { "size": 44012, "entropy": 5.23 }, "class": { "major_version": 65, "interface_count": 0, "method_ref_count": 129, "constant_pool_size": 924, "external_class_count": 45 }, "binary": { "peak_region_bytes": 5120, "peak_region_entropy": 7.05 }, "imports": { "count": 174 }, "functions": { "count": 16 } } }, "id": 5, "mol": "O₂(AsI)H₄(Cm₅Db₃OsPo₂)", "path": "Radium Client V6.jar!!com/github/wdtrpqvRqoh.class", "pid": 0, "risk": 10, "sha": "db066c67d1ff5f47bac932d4b3d8c195a31c9b23be935ab405309041ce7f2895", "size": 44012, "traits": [ { "id": "micro-behaviors/communications/http/lib/urlconnection::java-url-class-bytecode", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Java URL class reference", "spans": [ [ 2750, 16 ], [ 2779, 12 ], [ 7063, 14 ] ] }, { "id": "micro-behaviors/communications/http/lib/urlconnection::jvm-url-class-ref", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "JVM URL class reference" }, { "id": "micro-behaviors/communications/proxy/tunnel::byte-output-stream", "atk": "T1090", "mbc": "C0003", "conf": 0.5, "crit": 3, "desc": "Java ByteArrayOutputStream usage", "spans": [ [ 721, 21 ], [ 3259, 21 ], [ 6447, 21 ], [ 7303, 21 ], [ 7370, 21 ], [ 7387, 21 ], [ 8747, 21 ] ] }, { "id": "micro-behaviors/communications/proxy/tunnel::inet-socket-address", "atk": "T1090", "mbc": "C0003", "conf": 0.6, "crit": 3, "desc": "Java InetSocketAddress reference", "spans": [ [ 722, 17 ], [ 3419, 17 ] ] }, { "id": "micro-behaviors/communications/socket/create::java-socket-bytecode-reference", "atk": "T1071", "mbc": "C0001", "conf": 0.86, "crit": 3, "desc": "Java bytecode socket reference", "spans": [ [ 3634, 56 ], [ 6724, 17 ] ] }, { "id": "micro-behaviors/communications/socket/create::java-socket-class-import", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "Java imports the network socket class", "spans": [ [ 3339, 15 ] ] }, { "id": "micro-behaviors/communications/socket/create::java-socket-slash-reference", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "Java slash-form socket reference", "spans": [ [ 3339, 15 ], [ 3497, 28 ], [ 3634, 56 ], [ 6724, 17 ] ] }, { "id": "micro-behaviors/communications/socket/create::jvm-socket-class-ref", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "JVM socket class reference" }, { "id": "micro-behaviors/communications/socket/framing::bytebuffer-transport", "atk": "T1573", "conf": 1.0, "crit": 3, "desc": "Java byte-buffer transport type", "spans": [ [ 11255, 10 ] ] }, { "id": "micro-behaviors/communications/socket/framing::data-stream-transport", "atk": "T1573", "conf": 1.0, "crit": 3, "desc": "Java data-stream transport type", "spans": [ [ 9822, 16 ] ] }, { "id": "micro-behaviors/communications/socket/send::java-dataoutputstream-class", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "Java DataOutputStream class reference", "spans": [ [ 9814, 24 ] ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-sslcontext-trustmanager-init-call", "conf": 0.94, "crit": 3, "desc": "JVM SSLContext.init trust-manager call", "spans": [ [ 12411, 29 ] ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-sslparameters-set-server-names", "conf": 0.93, "crit": 3, "desc": "JVM sets TLS SNI server name", "spans": [ [ 3967, 42 ] ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-sslsocket-handshake-call", "conf": 0.94, "crit": 3, "desc": "JVM SSLSocket.startHandshake call", "spans": [ [ 4170, 38 ] ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-trustmanager-class-ref", "conf": 0.9, "crit": 3, "desc": "JVM TrustManager interface reference", "spans": [ [ 12337, 26 ] ] }, { "id": "micro-behaviors/data/buffer/transfer::bytearrayoutputstream-ref", "conf": 0.88, "crit": 3, "desc": "Java ByteArrayOutputStream class", "spans": [ [ 7295, 29 ] ] }, { "id": "micro-behaviors/data/buffer/transfer::jvm-outputstream-write", "conf": 0.96, "crit": 2, "desc": "JVM writes bytes to output stream", "spans": [ [ 6439, 0 ] ] }, { "id": "micro-behaviors/data/encode/base64::jvm-base64-encode-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM Base64 encodeToString call", "spans": [ [ 10387, 39 ] ] }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method", "spans": [ [ 3251, 8 ] ] }, { "id": "micro-behaviors/os/sysinfo/hostname::jvm-hostname-command-literal", "atk": "T1082", "mbc": "E1082", "conf": 0.9, "crit": 3, "desc": "JVM hostname command literal" }, { "id": "micro-behaviors/process/create/spawn::java-runtime-class", "atk": "T1059", "mbc": "E1203", "conf": 0.86, "crit": 3, "desc": "Java Runtime class reference", "spans": [ [ 10034, 17 ] ] }, { "id": "micro-behaviors/process/info/current::getpath-ref", "conf": 0.8, "crit": 3, "desc": "Java getPath call reference" }, { "id": "objectives/anti-static/obfuscation/string/control-prefix::java-control-prefixed-long-string", "atk": "T1027", "mbc": "F0001", "conf": 0.92, "crit": 3, "desc": "Java string starts with control-length prefix" }, { "id": "objectives/impact/dos/disk::jvm-megabyte-byte-array-constant", "atk": "T1499.001", "conf": 0.94, "crit": 3, "desc": "JVM one-megabyte allocation constant", "spans": [ [ 8406, 14 ] ] }, { "id": "objectives/impact/dos/disk::jvm-two-backward-goto-branches", "atk": "T1499.001", "conf": 0.9, "crit": 3, "desc": "JVM repeated counter backedges", "spans": [ [ 13390, 8 ], [ 13665, 8 ], [ 14035, 8 ], [ 14824, 8 ], [ 14938, 8 ], [ 15132, 8 ], [ 15287, 8 ], [ 15377, 8 ] ] }, { "id": "micro-behaviors/communications/socket/send::java-raw-socket-client-write", "atk": "T1071", "mbc": "C0001", "conf": 0.94, "crit": 3, "desc": "Java socket client writes request bytes through DataOutputStream", "uses": [ 5, 10, 16 ], "spans": [ [ 3339, 15 ], [ 6439, 26 ], [ 9814, 24 ] ] } ], "type": "java_class" }, { "ctx": [ { "b": "+kO#^0000+0M\u003eAy6K#5#fk20vxMW=qwP.-#s7DhTClX9G0rrWCvrM6jy*?i]fhD4(wN//!00rl4a8UUifj[T4A+P32v\u003eRnfx!Jh0wjZVMBzkf1x)Kuh2lj]d02PDVC404DBzkLAlsB}Dhz=WFzEWP}wPw1Q2ls/oygho]flIwJy+Fa-B7El^2lk5h00+@gv@C)?ASDd-ygho]fkL6mxd)84z!0v1B3+1-y?d9$bVnh:x(W={Bo.^O0rr%KvrM6jy*?i]fhMXcv}x.5luN0UwmY=^01G2f2VtkAx(W={Bo8v/ygho]fkL6mxd)$pC5Iecfhl21xM4ALvqYQ(wPGa\u003cz/oAlA0DvP0rsfQvrM6jy*?i]fkkrEz!\u0026]qo\u003ewAWz!8yEzE^M{A%zWU0rrr$z/oAlz#/}yjzwXEBuPZ911kQ03\u0026?4y7yycB02L.p15-Yj0rr)ev@Diqxk8E3BZ^1nB.UC*wnU\u003e2i@]r\u0026z/ec:x([5$y?Xib0$N\u003c-=JsZpEs}ZsjIES}%nSc0Z:A.@1POJ500000c\u003cxUJ%nORzMGnjQIxj!V01-)NC404uvqYZhra{q-vpPPycLcm]0rrNHxl59huU9?.uT^.\u003e3\u0026?:S7yycz04OM-04XcJb5gLfvj#C9zF7RpzGY@lwIl.=zdm3:o\u003ewAPw)]g\u003ez/Qad04[oL3VfD%vp\u0026}TBz(hB0rys(oLO0Vvj#C9zF7RpzGY@lwIl+?BzbP6nmuyDy?mVkoMa\u0026+B-oAoygho]fkL6mxd)h9A+PA7j4%w", "ln": 0 }, { "b": "fkL6mxd)e9zF\u0026((y?kWp05T:m5=.[ihVS){c}[w:C404uvqYZhqGV\u003e{vpB4:j1jhs02tL{3ihEOiSPi:B97\u0026hBpndi02C$xc\u0026=yh025p7xKLmoqa1/1vR]W(uQm^@Di10LvmKf\u0026C4kJ0xAn8Wc}[w:C404uvqYZhq/)4]zF83WoLO0Vvj#C9zF7R3BAh8kxfca]0DOv-)[9lSxFD#/REwJV1Qliw\u003ckeD!SrBL$HeD*AZ0=#Z00\u0026M%0rr{JvrM6jy*?i]fh($kx(mMIB.LV5wPv", "ln": 811 }, { "b": "pYLkh00BYwdol\u0026S765dT08iDg0rs8/lN+YzvrM6jy*?i]fh($kx(mMIB.LV5wPx\u003cv09/Ix3ii^2z#/}ABz\u003e91A+PA70rr/ZdnjF+C404uvqYZhq/)4]zF83t0ce6X3ii^2Bo8v]4DT^M\u003eD{unT+ubxN^42z\u003eD7@JKHTOiQ#nkx\u003e^NRQFU?LkTM)Ef\u003c/\u003e-EWT[++B].NX2j4Ii\u003ed=-nJ!)8jO-LWi\u003eA7qYM6ZTEYA!HZ0rrWCvrM6jy*?i]", "ln": 1337 }, { "b": "C404uvqYZhmr\u0026rNAcb/jzu*fg0@$Pi*5?s:2MB%%-*NWZrcDp=@TfH]Ii\u0026kd1(\u003cRY[(*[{L(Q\u003c%v%8*jwO#P?x(dAQx(4Q1A@=myc[d:%0hGQ\u003e3ikzMRu3VkzE)]yze0)0v@=0\u0026Bt4cuvrlG%gCHM*0h][#3VfD%xM4A*f/p*y0rs5!dnjR\u003cBt4GBzE)r#vp\u003cQmv@bN{B6*ZTfGPWySSo7b0i2$10rrHAwPRQ7wm45Gg=LHo8Z)dezE)]yze0)0v@=0\u0026Bt4cuvrlG%gCQTC3\u0026)BgUl\u003eoe0i=F77J9/afkUAvwN/:?w]]Xoy*?yauO:C\u003e2lq4g01iTPBzbP6uOKC$gZ\u003cw\u003e0cnFEVJdxl01iTPBzbP6uOKC$hvGO{0cnFEVJdGo01rZQBzbP6uO\u003cO#f/Gak5?2h5ygho]flIwJy+F^*nKLSG0j\u0026fx3imyjYA50xygho]flIwJy+F^*nKJ^-Z6T\u003eP0cwkw0:wn40kOWogZ-SjIrG\u003eR\u0026HkU+M8B8CZ3h5T\u0026L7JoY]?MDX:1Y%)u20AILx70Q2.C{[1M0fOVpU-Y:aRQ0rrZwz/4dux([3hvLqekAbokP2lqZz01B6qnOhTgnnqHkxhi:Y0lk7X3in6C:n(nAAC4WVz43A!0cnFE-Sjf.03(C[Bt4lmvSDf)zdtknz^^f/AXy\u003cux!G", "ln": 1968 }, { "b": "0nm+W-Sc?R010pHBvp4:vqfP/0nNS@3in6C?t)PYAb]J4x(W+=07[Ukygho]fkL6mxd)h9A+PA7j4%x$C404uvqYZhq/)4]zF848ygho]fkL6mxd)h9A+PA7j1i\u003crvrM6jy*?i]fh($kx(mMB3\u0026]h=\u0026q", "ln": 2682 }, { "b": "A=U/lfh($3zE^f@wj73sA=U/lA%zZo0rrp6r7pjO0rs3iygho]fk+GxfjOW7A=U/lfgfzYA=U/li$8bY0qcS#]8OE+00)jGBv7m{wPE\u003eL9W\u003cY%vrM6jzFs2xv}Yp\u003eB7GCDlUG[GB7GCPdo/aE0qDM\u00263ii)5}t*NawO#0@wmX.Uq/)4]zF5$I7arxNdnjF+C404uvqYZhq/)4]zF83t0q(\u0026}3igti@S90N4cKy[\u003cb/+]UyV8AJPdHx)5u#CIk]J#S{kC7\u003eC:TfQpxDxH3bh1\u003cb{IdUc48]P:gV03JO/VBo8wf\u003cC5uMG{}hpFw^PfII{\u003e=GxYbj\u003ec}RRKD5s-SP/+P\u003cCgInG$crST\u0026mQ9I?ptVT)8Qs\u003ec*(xKGW-cLJ!A}(YOmR2MU2d06HLFO1n#CMf9*+\u003cCP=3G]BiC\u003c^T3MSjz5BVe*!9)$wA$XAff\u003e)Y0\u003eYHOr^^HWP[I+dlS6ZWw57\u003e7ZbD0r\u0026G7ndBTrF-J(6\u003c?lh]RRn/EOULzXF:5CV\u0026E^]\u003eFv1gbH2OkK\u003eaF12I\u003e/t", "ln": 3143 }, { "b": "Zu}kG\u0026\u0026e*tW#fBPVf3!k(9F4*Ws)FqUJA0[)Z5zIM-n#yG9RGg0rrTBvrM6jy*?i]fgfL:B8}M!fAzd!xjVfYA=l5hv@#B6zBwzWvqfPW03S*uoLO0Vvj#Xkv%8*aBA]JoA=l5hv@#B6zBwzWvqfQv3\u0026@9:gysdq0w\u003c/S9+]bbvj#Xkv%8*aBA]JoA=l5hv@#B6zBwzWvqfP:0x6@U4qfl]lVlHDq/u/0v}tVv94imfygho]flpYmB-IhrC}RK6wmXXTB-H#6i$8cH0xyF/hVU@u02PDVC404BwN/\u003e6x([RNlVlHDq/u/0v}t(CjokA\u0026xjVfUz!0i$x(v\u003e\u002601ZLcoLO0Vvj#IfBt3S(oGJT-j])\u003eP0x*DG0rrKyvrM6jzE)]yrz(G}0yu!!1:1V.qB{(?5gw#3ygho]fk+uyfi7[wi$8cT0yWs@lJGTS03\u0026%^ygho]fk+uyfi7[wj1i\u003crvrM6jzFs2xw[=6)fhM80xGDR6aot1v0n4rz0rtE{?hZA)LKByt\u003e^ll9V.M(#JQa0c)Y%N{Lc\u003czRH3TX$?Krv", "ln": 4528 }, { "b": "c}[w:C404rz.BN]y?kWSoLO0Vvj#C9zF7R0A=kD0B8%V\u003cx(4r\u003eAWjK]wnc6}v@%^v0C}\u003cP3igIozVG?EA+e=}A+e:5nP5G\u0026Bo8wac}[w:C404uvqYZhp\u0026ZF:wPI]VB.LV5wPx4]wN]H}wN/*zdnjF+C404uvqYZhp\u0026ZF:wPI]VB.LV5wPx\u003cv0DwcX3igOqA@=ng4DrXw\u003e7yheV5m.UM/:P*\u003c/Tf$P]F0jHvg}F)UX4hYPRM[Jo#X9\u0026*kzZF@w]#Y63\u0026p\u003e9JvmUDNb.QU@kN)X=DuI\u0026v#yBPz", "ln": 5576 }, { "b": "0EjXC26s=Mx(4tY01ZLcoLO0Vvj#tkfgGU(wJHq3DJwH40n4s20rrylAbYxawk)EQ0E\u003eb/3igIoFb]SWA+e=}A+e:5pJZ+#B-X2)F=P)001P9.0rr^NwN]H}wN/*JA=M8sq/)4\u003evqM2B9vL8uoLO0Vvj#C9zF7R0A=kD0B8%V\u003cx(4r\u003eAYTWgG-M]n01P9=0rrBpx(W={Bz(hB0rsO$oLO0Vvj#tkfgGU(wJItmygho]fkL6mxd)84z!0v1B3+1-y?d9$i$8dD0G4i:4/}N?02l[hoLO0Vvj#C9zF7R0A=kD0B8%zK06ypw3igOqJSxbj1($@U)1*z", "ln": 5866 }, { "b": "T(uH%(w7O-K!y:6Q2.e{\u003e.M?hOR=Z1MfkiL2MZy}02PDVC404wx(tUpx(4ulpJf(.pJgz\u0026z/b^XODeY#CxdztwM9X\u003ex(mL:09}0Dygho]fk+Gxfj[{mwIl\u003e*Bz9:fygho]fkL6mxd(R=vrbpTADL\u0026gv}v-aoLO0Vvj#Ijz.CZpy?km}AaJ].Acb/jzAxpvygho]fk+Gxfj[{mwIl\u003e*Bz9-A0Ioy=3iqHPP-Cc7Ab]VgBw)o\u0026v@24:vpJ\u003cS0IYSh3ilK@QYyC#w{DWN0rs0hzE)[", "ln": 6363 }, { "b": "WG6n/2n):Gg=tQS2FH]UwcuB32]9=V1V=$)hvylc6:ZPmbPc}73Mff:2N1JI3T+!e2lU+H6:O+^g\u003eH(\u003cGBm*U%j+c=p*1UyW/xTv0ae*90Xt(nvyueniU02qZ64%:4QR4J4\u0026C\u003e\u003e6+s*TwhT#l5wefc5D:{76+Rk)Q5VqN5FU]@4IYQk84Ew)6+Rk(A9$IOL2WeF0Jk$PY8UVg84\u003csTtEBJsseM8Eed#CN6=v.*WG6}#78W\u003c}0bzZF6=7sr7RoVwsRR:Z0b:?m12.2i85i%Z04w^585in?7gm\u003c{v735F85in?85i{av735FwrKw3AAv/h0Jk$G85P^ZB*.oSseM7tee0d/92PZ#WG6}#9t]\u003c90bzZF6=**y9\u003eIzDsRS0!0b:?t12.npaqC@(04w^c85@+]9BGQ8v735F85@+]aqC]ov735FwrKw3AAv/o0Jk$G86uo!B*.oSseM6iee0lp08#0786Ykuhy6d+Z64%YbXe!V6^ZG@iWK}!c(1cBc87w+8737D86Yn0bW.unu]e-C1qJs1bYEcFF%6b!c\u0026{mC*z83E1V!1GciCbk0#ib(0dRPXp*1U-W/xTv0ae!uFhP4}fa@!=5}DRPbOQlfh.L}16AA=1h.L}16AA\u0026th.L:\u0026OhJ8pf+v9ehzI9fC[*I{aFF\u003cKee0=E08#0e87C.Bhy/T{Z7\u0026ee1y%zw6!E03iXpB(e!]#Netra\u002687=NQ87DvK1yI@%u]e-J1qJK7d@X(MF%6b!e=?)I*Q^CZsS5*209YPt00DBb6:zeFJ-iB/Lc$u$seM39eenw$0c87[1P+L1i4RGrB*7\u0026C00ihv0006P02Wx[@@rYj1{Ubf2lmN908iW#rSJj30q(*-0SJcx01o8j0TwZ42lmE609fa30s5Q90rAA9rSJg32lmFh2lmG#01P5m2lj/g08J[2o:pV00rAi30ri3B022Oq0TwZ42lmE609fa30rr910000", "ln": 7513 }, { "b": "WG6n/aShB9g=uJ}a?!7\u00266^vfDbnzDo1V^[hhyf7:6^GBMbPd\u003cxb]E\u003ce6^v32c15LEaP@Ja6^vQ8g?q+HGE3U%%j+c=p*1UYW/xTv0acP+WG6UE)y00]iW+\u003c]Z64%:c%[!?dh:LF6!9U@whU[Ld.C{Cd*4WX6!y7HQ5VqNd?%PMc(1o\u002687ljH6!y7GA9$IOL2We^0Jk$PY8UVg87Se@tEBJs86uo!uLq/*fbVzBWG6}#fC#KL0bzZF6!\u003ceR", "ln": 9126 } ], "depth": 1, "facts": { "imp": [ [ "", "java/lang/StringBuilder" ], [ "", "[C" ], [ "", "java/lang/Object" ], [ "", "java/nio/file/attribute/FileAttribute" ], [ "", "java/lang/ProcessBuilder" ], [ "", "java/lang/invoke/LambdaMetafactory" ], [ "", "java/io/File" ], [ "", "java/net/URL" ], [ "", "java/lang/invoke/MethodHandles$Lookup" ], [ "", "net/minecraft/class_320" ], [ "", "java/lang/Exception" ], [ "", "java/nio/file/Path" ], [ "", "java/security/ProtectionDomain" ], [ "", "com/github/avpliB" ], [ "", "java/util/Base64$Encoder" ], [ "", "java/nio/file/LinkOption" ], [ "", "java/lang/invoke/MethodHandles" ], [ "", "java/lang/Integer" ], [ "", "java/util/UUID" ], [ "", "java/lang/Class" ], [ "", "java/util/Base64" ], [ "", "java/lang/ProcessBuilder$Redirect" ], [ "", "java/security/CodeSource" ], [ "", "[Ljava/lang/String;" ], [ "", "[J" ], [ "", "net/fabricmc/loader/api/FabricLoader" ], [ "", "net/minecraft/class_310" ], [ "", "java/lang/System" ], [ "", "java/lang/Thread" ], [ "", "java/lang/String" ], [ "", "java/nio/charset/StandardCharsets" ], [ "", "java/nio/file/Files" ], [ "", "java/net/URI" ], [ "", "net/fabricmc/api/ModInitializer" ], [ "", "java/nio/file/OpenOption" ], [ "com/github/eujdWdnbw", "com/github/eujdWdnbw.rgrtm_efh_bit" ], [ "com/github/eujdWdnbw", "rgrtm_efh_bit" ], [ "com/github/avpliB", "com/github/avpliB.uBIfhMHj_WgNz" ], [ "com/github/avpliB", "uBIfhMHj_WgNz" ], [ "java/nio/file/Path", "java/nio/file/Path.getParent" ], [ "java/nio/file/Path", "getParent" ], [ "java/util/Base64$Encoder", "java/util/Base64$Encoder.encodeToString" ], [ "java/util/Base64$Encoder", "encodeToString" ], [ "java/lang/System", "java/lang/System.arraycopy" ], [ "java/lang/System", "arraycopy" ], [ "java/lang/String", "java/lang/String.getBytes" ], [ "java/lang/String", "getBytes" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ], [ "com/github/avpliB", "com/github/avpliB.\u003cinit\u003e" ], [ "com/github/avpliB", "\u003cinit\u003e" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectInput" ], [ "java/lang/ProcessBuilder", "redirectInput" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "java/lang/Thread", "java/lang/Thread.start" ], [ "java/lang/Thread", "start" ], [ "java/util/UUID", "java/util/UUID.toString" ], [ "java/util/UUID", "toString" ], [ "java/nio/charset/StandardCharsets", "java/nio/charset/StandardCharsets.UTF_8" ], [ "java/nio/charset/StandardCharsets", "UTF_8" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.toString" ], [ "java/lang/StringBuilder", "toString" ], [ "net/minecraft/class_310", "net/minecraft/class_310.method_1548" ], [ "net/minecraft/class_310", "method_1548" ], [ "java/io/File", "java/io/File.\u003cinit\u003e" ], [ "java/io/File", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.toCharArray" ], [ "java/lang/String", "toCharArray" ], [ "com/github/avpliB", "com/github/avpliB.getDomain" ], [ "com/github/avpliB", "getDomain" ], [ "java/lang/String", "java/lang/String.\u003cinit\u003e" ], [ "java/lang/String", "\u003cinit\u003e" ], [ "com/github/avpliB", "com/github/avpliB.prefire" ], [ "com/github/avpliB", "prefire" ], [ "java/security/ProtectionDomain", "java/security/ProtectionDomain.getCodeSource" ], [ "java/security/ProtectionDomain", "getCodeSource" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.start" ], [ "java/lang/ProcessBuilder", "start" ], [ "java/nio/file/Files", "java/nio/file/Files.writeString" ], [ "java/nio/file/Files", "writeString" ], [ "java/security/CodeSource", "java/security/CodeSource.getLocation" ], [ "java/security/CodeSource", "getLocation" ], [ "net/minecraft/class_320", "net/minecraft/class_320.method_44717" ], [ "net/minecraft/class_320", "method_44717" ], [ "java/lang/invoke/LambdaMetafactory", "java/lang/invoke/LambdaMetafactory.metafactory" ], [ "java/lang/invoke/LambdaMetafactory", "metafactory" ], [ "java/lang/ProcessBuilder$Redirect", "java/lang/ProcessBuilder$Redirect.appendTo" ], [ "java/lang/ProcessBuilder$Redirect", "appendTo" ], [ "java/lang/Class", "java/lang/Class.getProtectionDomain" ], [ "java/lang/Class", "getProtectionDomain" ], [ "java/lang/ProcessBuilder$Redirect", "java/lang/ProcessBuilder$Redirect.from" ], [ "java/lang/ProcessBuilder$Redirect", "from" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectErrorStream" ], [ "java/lang/ProcessBuilder", "redirectErrorStream" ], [ "com/github/avpliB", "com/github/avpliB.qgDqm" ], [ "com/github/avpliB", "qgDqm" ], [ "java/lang/String", "java/lang/String.charAt" ], [ "java/lang/String", "charAt" ], [ "net/minecraft/class_320", "net/minecraft/class_320.method_1674" ], [ "net/minecraft/class_320", "method_1674" ], [ "java/nio/file/Files", "java/nio/file/Files.exists" ], [ "java/nio/file/Files", "exists" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/lang/System", "java/lang/System.getProperty" ], [ "java/lang/System", "getProperty" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/nio/file/Path", "java/nio/file/Path.of" ], [ "java/nio/file/Path", "of" ], [ "java/nio/file/Path", "java/nio/file/Path.resolve" ], [ "java/nio/file/Path", "resolve" ], [ "java/lang/Thread", "java/lang/Thread.\u003cinit\u003e" ], [ "java/lang/Thread", "\u003cinit\u003e" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.\u003cinit\u003e" ], [ "java/lang/ProcessBuilder", "\u003cinit\u003e" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/nio/file/Path", "java/nio/file/Path.of" ], [ "java/nio/file/Path", "of" ], [ "java/lang/System", "java/lang/System.getenv" ], [ "java/lang/System", "getenv" ], [ "net/minecraft/class_320", "net/minecraft/class_320.method_1676" ], [ "net/minecraft/class_320", "method_1676" ], [ "net/minecraft/class_310", "net/minecraft/class_310.method_1551" ], [ "net/minecraft/class_310", "method_1551" ], [ "java/lang/Class", "java/lang/Class.getName" ], [ "java/lang/Class", "getName" ], [ "java/nio/file/Path", "java/nio/file/Path.toString" ], [ "java/nio/file/Path", "toString" ], [ "java/lang/System", "java/lang/System.currentTimeMillis" ], [ "java/lang/System", "currentTimeMillis" ], [ "com/github/eujdWdnbw", "com/github/eujdWdnbw.aGQNvcq_h" ], [ "com/github/eujdWdnbw", "aGQNvcq_h" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.length" ], [ "java/lang/String", "length" ], [ "java/nio/file/Files", "java/nio/file/Files.createDirectories" ], [ "java/nio/file/Files", "createDirectories" ], [ "net/fabricmc/loader/api/FabricLoader", "net/fabricmc/loader/api/FabricLoader.getInstance" ], [ "net/fabricmc/loader/api/FabricLoader", "getInstance" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectOutput" ], [ "java/lang/ProcessBuilder", "redirectOutput" ], [ "java/util/Base64", "java/util/Base64.getEncoder" ], [ "java/util/Base64", "getEncoder" ], [ "java/net/URL", "java/net/URL.toURI" ], [ "java/net/URL", "toURI" ], [ "java/lang/Integer", "java/lang/Integer.valueOf" ], [ "java/lang/Integer", "valueOf" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.directory" ], [ "java/lang/ProcessBuilder", "directory" ], [ "java/nio/file/Path", "java/nio/file/Path.toFile" ], [ "java/nio/file/Path", "toFile" ], [ "java/lang/String", "java/lang/String.format" ], [ "java/lang/String", "format" ], [ "java/lang/Exception", "java/lang/Exception.printStackTrace" ], [ "java/lang/Exception", "printStackTrace" ], [ "net/fabricmc/loader/api/FabricLoader", "net/fabricmc/loader/api/FabricLoader.getConfigDir" ], [ "net/fabricmc/loader/api/FabricLoader", "getConfigDir" ] ], "metrics": { "file": { "size": 27472, "entropy": 5.15 }, "class": { "major_version": 65, "interface_count": 1, "method_ref_count": 63, "constant_pool_size": 458, "external_class_count": 35 }, "binary": { "peak_region_bytes": 5120, "peak_region_entropy": 6.82 }, "imports": { "count": 98 }, "functions": { "count": 4 } } }, "id": 6, "mol": "K(Ga)O₄(CaAs₂ErI)H₄(CmDb₂F₂Po₅)", "path": "Radium Client V6.jar!!com/github/eujdWdnbw.class", "pid": 0, "risk": 131, "sha": "a241b2a10de6c36e470ec8e1f3614a511112464dc3576ed7f9ec7621b97770b2", "size": 27472, "traits": [ { "id": "micro-behaviors/communications/http/lib/urlconnection::java-url-class-bytecode", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Java URL class reference", "spans": [ [ 4798, 16 ], [ 4827, 12 ] ] }, { "id": "micro-behaviors/communications/http/lib/urlconnection::jvm-url-class-ref", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "JVM URL class reference" }, { "id": "micro-behaviors/data/encode/base64::jvm-base64-encode-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM Base64 encodeToString call", "spans": [ [ 3271, 39 ] ] }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method", "spans": [ [ 1401, 8 ] ] }, { "id": "micro-behaviors/fs/read/file/handle::jvm-io-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM File API class reference" }, { "id": "micro-behaviors/fs/read/file/handle::jvm-nio-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM NIO file API reference" }, { "id": "micro-behaviors/fs/write/file/full::jvm-files-writestring-bytecode", "conf": 0.9, "crit": 3, "desc": "JVM bytecode Files.writeString", "spans": [ [ 6427, 31 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.88, "crit": 3, "desc": "Java bytecode ProcessBuilder reference", "spans": [ [ 160, 71 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-init-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.92, "crit": 3, "desc": "Java bytecode ProcessBuilder constructor", "spans": [ [ 328, 31 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.95, "crit": 3, "desc": "Java bytecode ProcessBuilder start", "spans": [ [ 875, 30 ] ] }, { "id": "micro-behaviors/process/info/current::codesource-class", "conf": 0.85, "crit": 3, "desc": "Java CodeSource class reference" }, { "id": "micro-behaviors/process/info/current::getlocation-ref", "conf": 0.82, "crit": 3, "desc": "Java getLocation call reference" }, { "id": "micro-behaviors/process/info/current::protection-domain-class", "conf": 0.85, "crit": 3, "desc": "Java ProtectionDomain class reference" }, { "id": "micro-behaviors/process/info/current::touri-ref", "conf": 0.82, "crit": 3, "desc": "Java toURI call reference" }, { "id": "micro-behaviors/process/info/selfpath::java-protection-domain", "conf": 0.82, "crit": 3, "desc": "Java getProtectionDomain self-path lookup" }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-errors", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder merges standard error", "spans": [ [ 5957, 44 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-input", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard input", "spans": [ [ 5640, 38 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-output", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard output", "spans": [ [ 5930, 39 ] ] }, { "id": "micro-behaviors/process/thread/lifecycle::jvm-thread-start-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM starts a thread", "spans": [ [ 875, 22 ] ] }, { "id": "objectives/anti-static/obfuscation/reflection/class::java-protectiondomain", "conf": 1.0, "crit": 3, "desc": "Java ProtectionDomain", "spans": [ [ 4592, 19 ], [ 4614, 34 ], [ 4661, 30 ] ] }, { "id": "objectives/anti-static/obfuscation/string/control-prefix::java-control-prefixed-long-string", "atk": "T1027", "mbc": "F0001", "conf": 0.92, "crit": 3, "desc": "Java string starts with control-length prefix" }, { "id": "objectives/credential-access/gaming/minecraft::minecraft-token-getter-ref", "atk": "T1528", "mbc": "B0006", "conf": 0.92, "crit": 3, "desc": "Minecraft access token getter", "spans": [ [ 2230, 35 ] ] }, { "id": "objectives/evasion/self-delete/file/script::java-code-source-location", "atk": "T1070.004", "mbc": "F0007", "conf": 0.78, "crit": 3, "desc": "Java code source location", "spans": [ [ 4697, 13 ] ] }, { "id": "objectives/impact/dos/disk::jvm-two-backward-goto-branches", "atk": "T1499.001", "conf": 0.9, "crit": 3, "desc": "JVM repeated counter backedges", "spans": [ [ 7577, 8 ], [ 7667, 8 ], [ 7767, 8 ], [ 7863, 8 ], [ 7948, 8 ], [ 8108, 8 ], [ 8152, 8 ], [ 9190, 8 ] ] }, { "id": "well-known/game/mod::minecraft-client-class-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft client singleton class reference", "spans": [ [ 2064, 23 ] ] }, { "id": "well-known/game/mod::minecraft-name-getter-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft profile name getter reference", "spans": [ [ 2254, 35 ] ] }, { "id": "well-known/game/mod::minecraft-session-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft session object reference", "spans": [ [ 2201, 23 ] ] }, { "id": "well-known/game/mod::minecraft-uuid-getter-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft profile UUID getter reference", "spans": [ [ 2278, 36 ] ] }, { "id": "well-known/malware/stealer/prefire-shard::prefire-family-literal", "atk": "T1528", "mbc": "B0006", "conf": 0.9, "crit": 1, "desc": "Prefire family name literal", "spans": [ [ 2732, 7 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.94, "crit": 3, "desc": "Java bytecode ProcessBuilder execution", "uses": [ 8, 9 ], "spans": [ [ 328, 31 ], [ 875, 30 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirected-stdio", "conf": 0.96, "crit": 3, "desc": "Java ProcessBuilder redirects all standard streams", "uses": [ 15, 16, 17 ], "spans": [ [ 5640, 38 ], [ 5930, 39 ], [ 5957, 44 ] ] }, { "id": "well-known/game/mod::minecraft-session-access", "conf": 0.91, "crit": 3, "desc": "Minecraft session profile access", "uses": [ 24, 25, 26 ], "spans": [ [ 2064, 23 ], [ 2201, 23 ], [ 2254, 35 ] ] }, { "id": "objectives/credential-access/gaming/minecraft::minecraft-session-token-access", "atk": "T1528", "mbc": "B0006", "conf": 0.96, "crit": 4, "desc": "Minecraft session token and UUID access", "uses": [ 21, 27, 31 ], "spans": [ [ 2064, 23 ], [ 2201, 23 ], [ 2230, 35 ], [ 2254, 35 ], [ 2278, 36 ] ] }, { "id": "objectives/credential-access/gaming/minecraft::minecraft-token-child-process-stage", "atk": "T1528, T1059", "mbc": "B0006", "conf": 0.99, "crit": 5, "desc": "Minecraft token access alongside redirected child launch", "uses": [ 2, 29, 30, 32 ], "spans": [ [ 328, 31 ], [ 875, 30 ], [ 2064, 23 ], [ 2201, 23 ], [ 2230, 35 ], [ 2254, 35 ], [ 2278, 36 ], [ 3271, 39 ] ] }, { "id": "micro-behaviors/process/create/spawn::child-process-creation-api", "atk": "T1106", "conf": 0.92, "crit": 3, "desc": "Starts a child process through a platform API", "uses": [ 29 ], "spans": [ [ 328, 31 ], [ 875, 30 ] ] } ], "type": "java_class" }, { "ctx": [ { "b": "+kO#^0000+0Axd25[t\u0026%fk20vxMW=qv%8G)x\u003ehw(009925nCS%vj#C9zF7Q#vRPE:Bo.^F0rsoTvrM6jy*?i]fhMXcv}x.5luN0UwmY^bqE%xMA+e:52lj]d02PDVC404uvqYZhp\u0026ZF:wPI]VB.LV5wPw1Q2ls/gqE%xMA+e:50rr%KvrM6jB-.tlfg68*wI#v\u003cmq=QNwmY=^015-b5nCS%vj#+Bx(2B?vrl0rgZs0?0rru[zEWP}wPv!Kc2c\u003eivj#C9zF7RpzGY@lwIl+?BzbP6nmuyDy?mVkoMa\u0026+B-mM=4/(UKygho]fkL6mxd)$pC5Iecfhl21xM4ALvqYQ(wPF7R5DI\u003eooMa\u0026+B-muY20uQqx((Jt00sR#rTX%x02k?v1oohr019sOD2Wh1B.t]x0rr*cv@Diqxk8E3BZ^1lB.Lh%woH3n00EdEx(i}K7arxXygho]fkL6mxd)h9A+PA7j1jhh00D.Jxla7N6ky%0vj#C9zF7Q\u003eCW\u003er7BzkVh2lk+DTUOmN1djBg@St=Fpm.E^6i!dBvrM6jy*?i]fh($kx(mMB", "ln": 0 }, { "b": "x9Oz-0rrHHz:OhDAZs.^vr?\u003eN1sLZ6lKS@y04wlPcJCQ%00lv(2llpQ00K=PlN=4A02bz=3ihBNf984SwPq\u003c3y\u0026YQS6^#:\u003cvrM6jy*?i]fhD4(wN/*zdoWbWf-S%o04d+50rrZwz/4dux([3hvLqekAbokP2llQ\u002602+?R3ih%:hV)6v0xpn.%nSb*gCj4U000000001p1POJ5004HT-rex{O\u003ef1:6l\u003et{07EBWR[p]]G6xON(:S.LG1I", "ln": 548 }, { "b": "rTX%x0b\u0026hAzuaRR00V\u003eJAaJ]$0rs8/lN+YzvrM6jy*?i]fh($kx(mMIB.LV5wPx\u003cv0ce6X3ij@zBo8vEBz\u003e91A+PA70rr/ZdnjF+C404uvqYZhq/)4]zF83t0cOu^3ij@zCMv^Mygho]fkktTmRMWI2lo5J01S*MC404uvqYZhlU{gLA%zX)0rr^CwPQ:?z//M2BzkVhl#M{Jx(i}Ka$a)lygho]flpYmB-IhrC}S0mz//M2BzkVhl#M{Jx(l0v0dB]$3ikFOFb]S\u003eygho]flpYmB-IhrC}S0mz//M2BzkVhl#M{Jx(jdQF=L\u0026XxjVfLz!9ATz/{8gwDq=Jc[d\u00268vrM6jB7F\u003c7A+PSvfgfU*wM9I\u0026A:@Vx3\u0026\u003e}XG:E*j0epHO7\u00260G5vj#Xkv%8*aBA]Jbz!9ATz/{8gwD@i\u003e0rrHuwPQQ:v{%E[z/bNQ5gw#3ygho]fk+uyfi7[zi$8aD0e?f:I2-Fn01rQJC404wwPPO9qCmq}JSxa-Bz\u003eeSnDw/5c[d\u00268vrM6jzE)]yrz(yI3\u0026(v?KQq8H0fNu.5HZs/vrM6jzE)]yrz(yIdol\u0026S6ABv80daZh0rrTywPQjEB8L(qBy!oSBz86.MJhjp0daZk0rtv\u003e[3OXMVA-zPXAe):)6J?ZQn^s\u003cX9!*K\u003cd0*LW2\u003cWYZt+G\u003e\u003c=^jvWwSF*Sop)))TQ$\u003cN.e3}O:A+W\u0026*mgY0gA]*24}H?wO#V10gT3.3iiV#ODeZy2iANZ(.xs4Y[tHAN=YWv\u0026ixGEZN%?/VG/f3\u003eCKp3K/dczQul#S(.H-HZpavFP8!{u2jwpw\u0026\u0026FsfFURyXQueF:\u003e.b\u00263Rif=tYx\u003e6c\u003eyODIT^XEcK)Y6N2MQL0096J(Q}VeDR%Yb2\u0026F+8aV8Wf", "ln": 1480 }, { "b": "c}[w:C404rz.BN]y?kWSoLO0Vvj#C9zF7R0A=kD0B8%V\u003cx(4r\u003eAWjK]wnc6}v@%^v0knDF3igngZYsAAA+e=}A+e:5nP5G\u0026Bo8wac}[w:C404uvqYZhp\u0026ZF:wPI]VB.LV5wPx4]wN]H}wN/*zdnjF+C404uvqYZhp\u0026ZF:wPI]VB.LV5wPx\u003cv0kX-N3igti.#P\u0026*1NI!z\u003cas2)T+b}[Mf+iG\u003caJY+UcNCGW^o-A\u003caJJYT*4hEF:xaY\u003caJl{0lb3t2xBx%z!%Pd0rsI@oLO0Vvj#C9zF7R3BAd", "ln": 2717 }, { "b": "0lLrx26s=Mx(4tY01ZLcoLO0Vvj#tkfgGU(wJHq2+Mb(}08@%z0rrylAbYxawk)EQ0mg.X3igng^e:jSA+e=}A+e:5pJZ+#B-X2(^/vn)00\u0026OO0rr^NwN]H}wN/*JA=M8sq/)4\u003evqM2B9vL8uoLO0Vvj#C9zF7R0A=kD0B8%V\u003cx(4r\u003eAYTWf!=sqe00\u0026OS0rrBpx(W={Bz(hB0rsO$oLO0Vvj#tkfgGU(wJItmygho]fkL6mxd)84z!0v1B3+1-y?d9$i$8by0nv?X2MSSX00NB=vrcC\u003c02l[hoLO0Vvj#C9zF7R0A=kD0B8%zK0nW.k3igti?#J/=C4CMlA6!w^mq((v01}$uvrM6jy*?i]fh($kx(mMB0rrmpwoY{i01T9:uU\u003e10xNj36CZr\u003eAB].NSoLO0Vvj#Ijz.CZpy?km@vrufA0rr^AzGOPVm{oF9uWc\u003c9l%\u0026G8wL\u0026Ed6lE/bBZGDmlW8)h", "ln": 2980 }, { "b": "0tU$x6AG0J00)jGBv7m{wPE\u003eL9W\u003cY%vrM6jzFs2xv}Yp\u003eB7GCDlUG[GB7GCPdo/aE0t$[R3ihBO8VY{GwO#0@wmX.Uq/)4]zF5$I7arxNdnjF+C404uvqYZhq/)4]zF83t0uzgZ3igCm9@#uDC6wmtxjDh/0254oz/4dux([3hvLqekAbokPi@]r/zeTG5AB%DbDi10Lv%8*kz/O(!yYKIzCx)X9B9Rh3wQn4\u003e01i{Xx\u003e7H+ADt=6BPzEDz^)DWBAdxZ0DOt.[SqYi+)l9i1k6?bjokAZ2MVE", "ln": 4090 }, { "b": "WG4*s2n):Gg=tQS2FHsK6:Otd2]9=V1V=$)hvylc6:ZPmbPc}73MffL6:OgZ3T+!e2lU+H6:O+^g\u003eH(\u003cGBm*U%j+c=cS}q]W/wa\u003c05QbA2R9s:ii:8RhF%mE5\u0026\u003cG\u003e03-fTiYy{(zwi7kx/x]Bzwi7mGeWVXkSiM@A1UD!hGgcte51dGj@\u003eSq0bB89gcbKQ1qj8g04Q8u84D:9hv*VnZ7?e?1y%z46+F1YiUqDL5!#2]5txdI84^O@84Ew(1yI@Su]e-h1qIK:4@+]kF%6b!5=[{g*Q^CksS4*X05g?Yg)[sGXbY16GAzmM%cso*WG4*s6=v.*g=u9!6$%/Y6=7sr7zN+01V^F5hw)wH6=v(71qIXW6=yyo85in?85i{au]iE#rFhj\u003c6=v-5Q5S#Y04g[!7}fG0XbYn$d*rP^cS{J:p{{uOiVG1SZ64%:9a7JX9t]\u003ch6=*//whUFz9\u003eRUq9%jzz6^akjQ5VqN9#b[o92fOM85%wj6^akiA9$IOL2WeT0Jk$PY8TiY86ur/fJh9S5(Mdrd([))bFBp\u003e86-GBhy6d+Z7?]71y%zp6^ZG@iWK}!cLX0zc87wZ8737C86Y\u003ezg-mIMb]4^xbYEcFF%6b!cJQdB?[5\u003eosS5M}05duY09z@D1haXrXbY{90j%-+Y-oA.0$]7K04Q8W87C.Bhy/T{Z64%Yd}yK?6!E03iXpB(e!]#Netra\u002687=NQ87C+7d{%8Au]e-J1qJK7d@X(MwrG@Ce=?)I*Q^CksS5*205dtO1qklaf=qXFWG6#0g8R*P0bI^G6/6qTgRiT8sRS:40c74R12-1Kh5d{w04w^x88hmeggg?Ov735G88hmeh5d(=v735GwrKw3BYTkN0Jk$G88O=4C#IiMswuycDSZ%.WG7(!0eE#.JKw?JW/z-50guN{O3\u0026qEiYF0p12I[@892tkwedanhAzNlYAHtT12-mVi#6\u003c}i0o%Ru\u003e\u003e!ig-nmQ6*9i\u003eA9$IOL2We$0tNZii?=PgY8TiY89tqcfT}aO2e70:sPYqfiZjGD1gw", "ln": 5032 }, { "b": "kEHMd1y@ljwhV-=0b+{Olal\u0026liZJ{blLR%6l81ud8a2i91qKgf6*(xq0b9lm1qKoskYybt0bb]aWG7CKGHk^r%je5OWG7OKsP/wiiZ%#R1gwhyhB!SOWG7aDwedQBhB$BWzDNYBW/yzenDQ\u003ey6?PiiQ5VRWnF%#26?qTDn)]7cxC\u003cnx6?PihAa39OxO8zQ0cIv@n=+\u003c\u0026!!}5/0c}HC1RNSt04Q988bgh\u0026hCLb:Z64%YpgMmU6\u0026hECi-2]p", "ln": 5863 } ], "depth": 1, "facts": { "imp": [ [ "", "java/lang/Object" ], [ "", "java/lang/Exception" ], [ "", "java/lang/ProcessBuilder" ], [ "", "java/nio/charset/StandardCharsets" ], [ "", "java/lang/invoke/MethodHandles" ], [ "", "[Ljava/lang/String;" ], [ "", "java/lang/String" ], [ "", "[C" ], [ "", "com/github/avpliB" ], [ "", "java/net/URL" ], [ "", "java/util/Base64$Encoder" ], [ "", "java/util/Base64" ], [ "", "java/lang/System" ], [ "", "java/lang/StringBuilder" ], [ "", "java/security/CodeSource" ], [ "", "java/lang/Integer" ], [ "", "java/lang/invoke/MethodHandles$Lookup" ], [ "", "java/security/ProtectionDomain" ], [ "", "java/nio/file/attribute/FileAttribute" ], [ "", "java/io/File" ], [ "", "java/lang/Class" ], [ "", "java/lang/ProcessBuilder$Redirect" ], [ "", "java/nio/file/Files" ], [ "", "java/nio/file/LinkOption" ], [ "", "java/nio/file/Path" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.length" ], [ "java/lang/String", "length" ], [ "java/lang/Class", "java/lang/Class.getName" ], [ "java/lang/Class", "getName" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectErrorStream" ], [ "java/lang/ProcessBuilder", "redirectErrorStream" ], [ "java/lang/System", "java/lang/System.getenv" ], [ "java/lang/System", "getenv" ], [ "com/github/avpliB", "com/github/avpliB.uBIfhMHj_WgNz" ], [ "com/github/avpliB", "uBIfhMHj_WgNz" ], [ "java/lang/String", "java/lang/String.getBytes" ], [ "java/lang/String", "getBytes" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.\u003cinit\u003e" ], [ "java/lang/ProcessBuilder", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.charAt" ], [ "java/lang/String", "charAt" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "java/nio/file/Path", "java/nio/file/Path.toFile" ], [ "java/nio/file/Path", "toFile" ], [ "com/github/avpliB", "com/github/avpliB.main" ], [ "com/github/avpliB", "main" ], [ "java/io/File", "java/io/File.\u003cinit\u003e" ], [ "java/io/File", "\u003cinit\u003e" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ], [ "java/nio/file/Path", "java/nio/file/Path.resolve" ], [ "java/nio/file/Path", "resolve" ], [ "com/github/avpliB", "com/github/avpliB.\u003cinit\u003e" ], [ "com/github/avpliB", "\u003cinit\u003e" ], [ "com/github/cui_idv", "com/github/cui_idv.xdnjd_rt_dlwv_qlclhs" ], [ "com/github/cui_idv", "xdnjd_rt_dlwv_qlclhs" ], [ "java/security/ProtectionDomain", "java/security/ProtectionDomain.getCodeSource" ], [ "java/security/ProtectionDomain", "getCodeSource" ], [ "java/nio/file/Files", "java/nio/file/Files.createDirectories" ], [ "java/nio/file/Files", "createDirectories" ], [ "java/net/URL", "java/net/URL.toURI" ], [ "java/net/URL", "toURI" ], [ "java/lang/ProcessBuilder$Redirect", "java/lang/ProcessBuilder$Redirect.from" ], [ "java/lang/ProcessBuilder$Redirect", "from" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectInput" ], [ "java/lang/ProcessBuilder", "redirectInput" ], [ "com/github/avpliB", "com/github/avpliB.getDomain" ], [ "com/github/avpliB", "getDomain" ], [ "java/nio/file/Files", "java/nio/file/Files.exists" ], [ "java/nio/file/Files", "exists" ], [ "java/lang/System", "java/lang/System.getProperty" ], [ "java/lang/System", "getProperty" ], [ "java/io/File", "java/io/File.getAbsolutePath" ], [ "java/io/File", "getAbsolutePath" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectOutput" ], [ "java/lang/ProcessBuilder", "redirectOutput" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.start" ], [ "java/lang/ProcessBuilder", "start" ], [ "java/nio/file/Path", "java/nio/file/Path.of" ], [ "java/nio/file/Path", "of" ], [ "java/nio/charset/StandardCharsets", "java/nio/charset/StandardCharsets.UTF_8" ], [ "java/nio/charset/StandardCharsets", "UTF_8" ], [ "com/github/cui_idv", "com/github/cui_idv.run" ], [ "com/github/cui_idv", "run" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.toString" ], [ "java/lang/StringBuilder", "toString" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.directory" ], [ "java/lang/ProcessBuilder", "directory" ], [ "java/lang/String", "java/lang/String.\u003cinit\u003e" ], [ "java/lang/String", "\u003cinit\u003e" ], [ "java/io/File", "java/io/File.\u003cinit\u003e" ], [ "java/io/File", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.format" ], [ "java/lang/String", "format" ], [ "java/util/Base64", "java/util/Base64.getEncoder" ], [ "java/util/Base64", "getEncoder" ], [ "java/util/Base64$Encoder", "java/util/Base64$Encoder.encodeToString" ], [ "java/util/Base64$Encoder", "encodeToString" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/lang/Integer", "java/lang/Integer.valueOf" ], [ "java/lang/Integer", "valueOf" ], [ "java/lang/System", "java/lang/System.arraycopy" ], [ "java/lang/System", "arraycopy" ], [ "java/lang/Class", "java/lang/Class.getProtectionDomain" ], [ "java/lang/Class", "getProtectionDomain" ], [ "java/nio/file/Path", "java/nio/file/Path.toString" ], [ "java/nio/file/Path", "toString" ], [ "java/lang/ProcessBuilder$Redirect", "java/lang/ProcessBuilder$Redirect.appendTo" ], [ "java/lang/ProcessBuilder$Redirect", "appendTo" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/lang/String", "java/lang/String.toCharArray" ], [ "java/lang/String", "toCharArray" ], [ "java/lang/String", "java/lang/String.equals" ], [ "java/lang/String", "equals" ], [ "com/github/avpliB", "com/github/avpliB.qgDqm" ], [ "com/github/avpliB", "qgDqm" ], [ "java/security/CodeSource", "java/security/CodeSource.getLocation" ], [ "java/security/CodeSource", "getLocation" ] ], "metrics": { "file": { "size": 12200, "entropy": 5.92 }, "class": { "major_version": 65, "interface_count": 0, "method_ref_count": 49, "constant_pool_size": 341, "external_class_count": 25 }, "binary": { "peak_region_bytes": 4096, "peak_region_entropy": 6.66 }, "imports": { "count": 74 }, "functions": { "count": 4 } } }, "id": 7, "mol": "O₃(As₂ErI)H₅(CmDb₂FOsPo₄)", "path": "Radium Client V6.jar!!com/github/cui_idv.class", "pid": 0, "risk": 11, "sha": "1875effc000b8c9818490f7c9d00401f0f2f923189f6e3677e39cde0a3e3e8eb", "size": 12200, "traits": [ { "id": "micro-behaviors/communications/http/lib/urlconnection::java-url-class-bytecode", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Java URL class reference", "spans": [ [ 1833, 16 ], [ 1862, 12 ] ] }, { "id": "micro-behaviors/communications/http/lib/urlconnection::jvm-url-class-ref", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "JVM URL class reference" }, { "id": "micro-behaviors/data/encode/base64::jvm-base64-encode-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM Base64 encodeToString call", "spans": [ [ 4154, 39 ] ] }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method", "spans": [ [ 1544, 8 ] ] }, { "id": "micro-behaviors/fs/read/file/handle::jvm-io-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM File API class reference" }, { "id": "micro-behaviors/fs/read/file/handle::jvm-nio-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM NIO file API reference" }, { "id": "micro-behaviors/os/env/gate::jvm-opaque-environment-key", "conf": 0.94, "crit": 1, "desc": "JVM class has generated gate value" }, { "id": "micro-behaviors/os/env/gate::jvm-string-equals-import", "conf": 0.94, "crit": 1, "desc": "JVM class imports String equals", "spans": [ [ 612, 0 ] ] }, { "id": "micro-behaviors/os/env/gate::jvm-system-getenv-import", "conf": 0.94, "crit": 1, "desc": "JVM class imports System getenv", "spans": [ [ 2045, 0 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.88, "crit": 3, "desc": "Java bytecode ProcessBuilder reference", "spans": [ [ 59, 71 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-init-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.92, "crit": 3, "desc": "Java bytecode ProcessBuilder constructor", "spans": [ [ 289, 31 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.95, "crit": 3, "desc": "Java bytecode ProcessBuilder start", "spans": [ [ 3202, 30 ] ] }, { "id": "micro-behaviors/process/info/current::codesource-class", "conf": 0.85, "crit": 3, "desc": "Java CodeSource class reference" }, { "id": "micro-behaviors/process/info/current::getlocation-ref", "conf": 0.82, "crit": 3, "desc": "Java getLocation call reference" }, { "id": "micro-behaviors/process/info/current::protection-domain-class", "conf": 0.85, "crit": 3, "desc": "Java ProtectionDomain class reference" }, { "id": "micro-behaviors/process/info/current::touri-ref", "conf": 0.82, "crit": 3, "desc": "Java toURI call reference" }, { "id": "micro-behaviors/process/info/selfpath::java-protection-domain", "conf": 0.82, "crit": 3, "desc": "Java getProtectionDomain self-path lookup" }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-errors", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder merges standard error", "spans": [ [ 3071, 44 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-input", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard input", "spans": [ [ 2781, 38 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-output", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard output", "spans": [ [ 3044, 39 ] ] }, { "id": "objectives/anti-static/obfuscation/reflection/class::java-protectiondomain", "conf": 1.0, "crit": 3, "desc": "Java ProtectionDomain", "spans": [ [ 1627, 19 ], [ 1649, 34 ], [ 1696, 30 ] ] }, { "id": "objectives/anti-static/obfuscation/string/control-prefix::java-control-prefixed-long-string", "atk": "T1027", "mbc": "F0001", "conf": 0.92, "crit": 3, "desc": "Java string starts with control-length prefix" }, { "id": "objectives/evasion/self-delete/file/script::java-code-source-location", "atk": "T1070.004", "mbc": "F0007", "conf": 0.78, "crit": 3, "desc": "Java code source location", "spans": [ [ 1732, 13 ] ] }, { "id": "objectives/impact/dos/disk::jvm-two-backward-goto-branches", "atk": "T1499.001", "conf": 0.9, "crit": 3, "desc": "JVM repeated counter backedges", "spans": [ [ 5096, 8 ], [ 5251, 8 ], [ 5276, 8 ], [ 5438, 8 ], [ 5523, 8 ], [ 5627, 8 ], [ 5722, 8 ], [ 5927, 8 ] ] }, { "id": "micro-behaviors/os/env/gate::jvm-opaque-secret-environment-gate", "conf": 0.97, "crit": 3, "desc": "JVM compares opaque environment gate", "uses": [ 6, 7, 8 ], "spans": [ [ 612, 6 ], [ 2045, 6 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.94, "crit": 3, "desc": "Java bytecode ProcessBuilder execution", "uses": [ 10, 11 ], "spans": [ [ 289, 31 ], [ 3202, 30 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirected-stdio", "conf": 0.96, "crit": 3, "desc": "Java ProcessBuilder redirects all standard streams", "uses": [ 17, 18, 19 ], "spans": [ [ 2781, 38 ], [ 3044, 39 ], [ 3071, 44 ] ] }, { "id": "micro-behaviors/process/create/spawn::child-process-creation-api", "atk": "T1106", "conf": 0.92, "crit": 3, "desc": "Starts a child process through a platform API", "uses": [ 25 ], "spans": [ [ 289, 31 ], [ 3202, 30 ] ] } ], "type": "java_class" }, { "ctx": [ { "b": "DKp(rb6dmcwO\u003e\u003cRwPz\u003caz/c:wiV{dd3lQDnx\u003eezgiV]R=vpK7YxjSnr3lQDnC4CYnx(v(kauyR?f!LdjfD@4ParR\u003eCvqPN1auyR?p*)\u003cHvp%c}ed9Hxb4Lnav/", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 428, "entropy": 4.56 }, "json": { "parsed_bytes": 428, "parse_limit_bytes": 76800 }, "binary": { "peak_region_bytes": 428, "peak_region_entropy": 4.56 } } }, "id": 9, "mol": "Md(Pa)", "path": "Radium Client V6.jar!!fabric.mod.json", "pid": 0, "risk": 1, "sha": "c9803479843505e368bf0b9f5902bed4d1744016c7c2743ee28121f521001376", "size": 428, "traits": [ { "id": "metadata/package/config::fabric-mod-metadata", "conf": 0.9, "crit": 3, "desc": "Fabric mod metadata resource" } ], "type": "json" } ], "rev": "c1ea9", "v": "8" } }