{ "llm": { "conf": 0.98461425, "error": "building LLM HTTP client: builder error: Too many open files (os error 24)", "model": "Qwen/Qwen3.8-27B", "outcome": "hostile" }, "ml": { "v": "7", "eng": "2.12.0-beta.1", "lvl": 1, "conf": 99, "mods": [ { "cls": 2, "raw": 0.98461425, "rte": "az", "prob": 0.98461425 }, { "cls": 0, "raw": 0.99719036, "rte": "az/zip", "prob": 0.99719036 } ], "prob": 0.98461425, "skip": [ { "rte": "az/jar", "why": "unavailable" }, { "rte": "az/jar", "why": "unavailable" } ], "files": [ { "id": 0, "lvl": 1, "conf": 99, "prob": 0.9846142530441284, "type": "jar" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.000026623407393344678, "type": "java_class" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.000010311603546142578, "type": "java_class" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.000012646119103010278, "type": "java_class" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.000014851490959699731, "type": "java_class" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.0000241696834564209, "type": "java_class" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.0009370942716486752, "type": "java_class" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.000024020671844482422, "type": "java_class" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.000011434157386247534, "type": "json" } ], "version": "v18.18", "analyzed_at": "2026-09-23T19:30:06Z" }, "path": "dupe-2.jar", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "p!H([6AwyA2MRkt5Ntwp0000000000000-l003IEz7/KoBzb/afl.2Jp+Dl]vrlIlYMX:d/l]2))*IC\u0026l5mdlo=Mm*:{@16MtBVyAu6*Irhy\u003euDI}Cw03\u003c\u003cZ0eXNU=1pMwZ4RM8{DDwHoFqmCx5hC{=l/Zo*+#T/o%R)Pp1^=M1bJmNoj2yiYGWFpZ#%06ZK5=LWEr\u003cWBmlQqse#M(^7H9x1W^i@tE/10/#rS98(JemDs(i#6A(t2tHgS4Nz09ACkpFBpO6++fT\u003cjHIdbPIUmU6KbaVF?@L\u003e9.\u003e(", "ln": 0 } ], "mol": "K₂(McGa)O₆(CaEuAlAs₃ErI)H₆(Cm₅Db₅F₃Os₂Po₅Ti)Md₂(Pa)", "sha": "96aebd4d37f98fa3a10f17d769ebf47e3b0b2aa478a84f564f0cc40eeb6bfea3", "path": "dupe-2.jar", "risk": 300, "size": 1780684, "type": "jar", "facts": { "metrics": { "jar": { "class_count": 7, "entry_count": 12, "index_count": 0, "service_count": 0, "signature_count": 0, "native_lib_count": 0, "embedded_jar_count": 0, "manifest.entry_count": 0, "manifest.digest_count": 0, "signature_block_count": 0, "versioned_class_count": 0, "manifest.section_count": 0, "manifest.attribute_count": 13, "manifest.class_path_count": 0, "manifest.boot_class_path_count": 0 }, "file": { "size": 1780684, "entropy": 8 }, "binary": { "peak_region_bytes": 1779712, "peak_region_entropy": 7.86 }, "archive": { "file_count": 12, "member_count": 12, "script_count": 0, "zip_bomb_ratio": 4.41, "compressed_size": 1778940, "directory_count": 0, "executable_count": 0, "extra_field_size": 0, "noise_file_count": 0, "compression.ratio": 0.9, "hidden_file_count": 0, "uncompressed_size": 1969465, "crc_collision_count": 0, "entry_comment_count": 0, "max_filename_length": 41, "rtlo_filename_count": 0, "format.regular_count": 12, "nested_archive_count": 0, "path_traversal_count": 0, "symlink_escape_count": 0, "security.setgid_count": 0, "security.setuid_count": 0, "security.sticky_count": 0, "double_extension_count": 0, "duplicate_member_count": 0, "security.symlink_count": 0, "unicode_filename_count": 0, "homoglyph_filename_count": 0, "security.encrypted_count": 0, "timing.mtime_unique_count": 1, "timing.mtime_unique_ratio": 0.08, "misplaced_executable_count": 0, "timing.mtime_dominant_count": 12, "timing.mtime_spread_seconds": 0, "timing.sentinel_mtime_count": 0, "security.world_writable_count": 0, "timing.mtime_dominant_fraction": 1, "compression.method_counts.deflate": 12 } } }, "traits": [ { "id": "micro-behaviors/process/info/current::touri-ref", "conf": 0.82, "crit": 3, "desc": "Java toURI call reference" }, { "id": "micro-behaviors/communications/socket/send::java-raw-socket-client-write", "atk": "T1071", "mbc": "C0001", "conf": 0.94, "crit": 3, "desc": "Java socket client writes request bytes through DataOutputStream", "from": [ { "off": 3257, "file": 5 } ], "uses": [ 32, 56, 64 ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-init-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.92, "crit": 3, "desc": "Java bytecode ProcessBuilder constructor", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/buffer/transfer::bytearrayinputstream-ref", "conf": 0.88, "crit": 3, "desc": "Java ByteArrayInputStream class" }, { "id": "well-known/game/mod::minecraft-client-class-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft client singleton class reference", "from": [ { "file": 6 } ] }, { "id": "objectives/credential-access/gaming/minecraft::minecraft-token-child-process-stage", "atk": "T1528, T1059", "mbc": "B0006", "conf": 0.99, "crit": 5, "desc": "Minecraft token access alongside redirected child launch", "from": [ { "off": 695, "file": 1 }, { "off": 10287, "file": 5 }, { "off": 1961, "file": 6 }, { "off": 4090, "file": 7 } ], "uses": [ 19, 28, 42, 51 ] }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/read/file/handle::jvm-nio-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM NIO file API reference" }, { "id": "well-known/game/mod::minecraft-name-getter-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft profile name getter reference", "from": [ { "file": 6 } ] }, { "id": "objectives/anti-static/obfuscation/string/control-prefix::java-character-digit-bytecode", "atk": "T1027", "mbc": "F0001", "conf": 0.9, "crit": 3, "desc": "Java bytecode calls Character.digit", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/archive/extract/zip::jvm-zip-entry-iteration-bytecode", "conf": 0.92, "crit": 3, "desc": "JVM iterates ZIP archive entries", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/create::java-socket-slash-reference", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "Java slash-form socket reference", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/process/create/spawn::java-runtime-class", "atk": "T1059", "mbc": "E1203", "conf": 0.86, "crit": 3, "desc": "Java Runtime class reference", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/fs/write/file/full::jvm-files-writestring-bytecode", "conf": 0.9, "crit": 3, "desc": "JVM bytecode Files.writeString", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/data/decode/base64::java-base64-decoder-class", "conf": 0.92, "crit": 3, "desc": "JVM Base64 decoder class reference", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/archive/extract/zip::jvm-zip-entry-read-bytecode", "conf": 0.9, "crit": 3, "desc": "JVM reads ZIP archive entry data", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/env/gate::jvm-opaque-environment-key", "conf": 0.94, "crit": 1, "desc": "JVM class has generated gate value" }, { "id": "micro-behaviors/process/info/current::protection-domain-class", "conf": 0.85, "crit": 3, "desc": "Java ProtectionDomain class reference" }, { "id": "well-known/game/mod::minecraft-uuid-getter-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft profile UUID getter reference", "from": [ { "file": 6 } ] }, { "id": "objectives/credential-access/gaming/minecraft::minecraft-session-token-access", "atk": "T1528", "mbc": "B0006", "conf": 0.96, "crit": 4, "desc": "Minecraft session token and UUID access", "from": [ { "off": 2098, "file": 6 } ], "uses": [ 18, 43, 55 ] }, { "id": "micro-behaviors/communications/http/lib/urlconnection::java-url-class-bytecode", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Java URL class reference", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/os/env/gate::jvm-system-getenv-import", "conf": 0.94, "crit": 1, "desc": "JVM class imports System getenv", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/sysinfo/hostname::jvm-hostname-command-literal", "atk": "T1082", "mbc": "E1082", "conf": 0.9, "crit": 3, "desc": "JVM hostname command literal" }, { "id": "micro-behaviors/communications/socket/ssl::jvm-x509trustmanager-class-ref", "conf": 0.94, "crit": 3, "desc": "JVM X509 trust-manager interface reference" }, { "id": "objectives/anti-analysis/timing/evasion::kotlin-thread-sleep-check", "atk": "T1497.003", "conf": 0.94, "crit": 3, "desc": "Kotlin Thread.sleep call", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/info/current::getpath-ref", "conf": 0.8, "crit": 3, "desc": "Java getPath call reference" }, { "id": "micro-behaviors/communications/socket/ssl::jvm-x509trustmanager-server-callback", "conf": 0.94, "crit": 3, "desc": "JVM checkServerTrusted callback defined" }, { "id": "micro-behaviors/communications/socket/ssl::jvm-custom-x509trustmanager", "conf": 0.95, "crit": 3, "desc": "Class implements a custom X509 trust manager", "from": [ { "file": 4 } ], "uses": [ 23, 26, 62 ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.94, "crit": 3, "desc": "Java bytecode ProcessBuilder execution", "from": [ { "off": 15216, "file": 1 }, { "off": 864, "file": 6 }, { "off": 3176, "file": 7 } ], "uses": [ 2, 47 ] }, { "id": "micro-behaviors/data/archive/extract/zip::jvm-zip-entry-extraction-to-file", "conf": 0.96, "crit": 3, "desc": "JVM extracts ZIP entries to files", "from": [ { "off": 12778, "file": 1 } ], "uses": [ 10, 15, 73 ] }, { "id": "well-known/game/mod::minecraft-session-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft session object reference", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-sslcontext-trustmanager-init-call", "conf": 0.94, "crit": 3, "desc": "JVM SSLContext.init trust-manager call", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/data/buffer/transfer::jvm-outputstream-write", "conf": 0.96, "crit": 2, "desc": "JVM writes bytes to output stream", "from": [ { "file": 5 } ] }, { "id": "well-known/malware/stealer/prefire-shard::prefire-family-literal", "atk": "T1528", "mbc": "B0006", "conf": 0.9, "crit": 1, "desc": "Prefire family name literal", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/framing::bytebuffer-transport", "atk": "T1573", "conf": 1.0, "crit": 3, "desc": "Java byte-buffer transport type", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-sslparameters-set-server-names", "conf": 0.93, "crit": 3, "desc": "JVM sets TLS SNI server name", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/data/decode/base64::java-base64-decode-bytecode-call", "conf": 0.96, "crit": 3, "desc": "Java Base64 decode call", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-trustmanager-class-ref", "conf": 0.9, "crit": 3, "desc": "JVM TrustManager interface reference", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-input", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard input", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/buffer/transfer::bytearrayoutputstream-ref", "conf": 0.88, "crit": 3, "desc": "Java ByteArrayOutputStream class", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/env/gate::jvm-string-equals-import", "conf": 0.94, "crit": 1, "desc": "JVM class imports String equals", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.88, "crit": 3, "desc": "Java bytecode ProcessBuilder reference", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/encode/base64::jvm-base64-encode-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM Base64 encodeToString call", "from": [ { "file": 5 } ] }, { "id": "objectives/credential-access/gaming/minecraft::minecraft-token-getter-ref", "atk": "T1528", "mbc": "B0006", "conf": 0.92, "crit": 3, "desc": "Minecraft access token getter", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/communications/socket/create::java-socket-bytecode-reference", "atk": "T1071", "mbc": "C0001", "conf": 0.86, "crit": 3, "desc": "Java bytecode socket reference", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-output", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard output", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/create::jvm-socket-class-ref", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "JVM socket class reference" }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.95, "crit": 3, "desc": "Java bytecode ProcessBuilder start", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-errors", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder merges standard error", "from": [ { "file": 1 } ] }, { "id": "metadata/package/config::fabric-mod-metadata", "conf": 0.9, "crit": 3, "desc": "Fabric mod metadata resource", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/process/info/current::codesource-class", "conf": 0.85, "crit": 3, "desc": "Java CodeSource class reference" }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirected-stdio", "conf": 0.96, "crit": 3, "desc": "Java ProcessBuilder redirects all standard streams", "from": [ { "off": 15152, "file": 1 }, { "off": 5855, "file": 6 }, { "off": 3045, "file": 7 } ], "uses": [ 38, 45, 48 ] }, { "id": "micro-behaviors/process/create/spawn::child-process-creation-api", "atk": "T1106", "conf": 0.92, "crit": 3, "desc": "Starts a child process through a platform API", "from": [ { "off": 695, "file": 1 }, { "file": 6 }, { "off": 294, "file": 7 } ], "uses": [ 28 ] }, { "id": "micro-behaviors/communications/http/lib/urlconnection::jvm-url-class-ref", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "JVM URL class reference" }, { "id": "objectives/evasion/self-delete/file/script::java-code-source-location", "atk": "T1070.004", "mbc": "F0007", "conf": 0.78, "crit": 3, "desc": "Java code source location", "from": [ { "file": 6 } ] }, { "id": "well-known/game/mod::minecraft-session-access", "conf": 0.91, "crit": 3, "desc": "Minecraft session profile access", "from": [ { "file": 6 } ], "uses": [ 4, 8, 30 ] }, { "id": "micro-behaviors/communications/socket/send::java-dataoutputstream-class", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "Java DataOutputStream class reference", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/os/env/gate::jvm-opaque-secret-environment-gate", "conf": 0.97, "crit": 3, "desc": "JVM compares opaque environment gate", "from": [ { "off": 14317, "file": 1 }, { "file": 2 }, { "file": 3 }, { "file": 4 }, { "off": 2110, "file": 7 } ], "uses": [ 16, 21, 40 ] }, { "id": "micro-behaviors/time/sleep/interval::java-thread-sleep-bytecode", "conf": 0.9, "crit": 3, "desc": "Java bytecode thread sleep", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/proxy/tunnel::byte-output-stream", "atk": "T1090", "mbc": "C0003", "conf": 0.5, "crit": 3, "desc": "Java ByteArrayOutputStream usage", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/read/file/handle::jvm-io-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM File API class reference" }, { "id": "micro-behaviors/process/info/selfpath::java-protection-domain", "conf": 0.82, "crit": 3, "desc": "Java getProtectionDomain self-path lookup" }, { "id": "micro-behaviors/communications/socket/ssl::jvm-x509trustmanager-issuer-callback", "conf": 0.94, "crit": 3, "desc": "JVM getAcceptedIssuers callback defined" }, { "id": "objectives/impact/dos/disk::jvm-megabyte-byte-array-constant", "atk": "T1499.001", "conf": 0.94, "crit": 3, "desc": "JVM one-megabyte allocation constant", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/socket/create::java-socket-class-import", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "Java imports the network socket class", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/process/info/current::getlocation-ref", "conf": 0.82, "crit": 3, "desc": "Java getLocation call reference" }, { "id": "objectives/anti-static/obfuscation/string/control-prefix::java-control-prefixed-long-string", "atk": "T1027", "mbc": "F0001", "conf": 0.92, "crit": 3, "desc": "Java string starts with control-length prefix" }, { "id": "micro-behaviors/communications/proxy/tunnel::inet-socket-address", "atk": "T1090", "mbc": "C0003", "conf": 0.6, "crit": 3, "desc": "Java InetSocketAddress reference", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-sslsocket-handshake-call", "conf": 0.94, "crit": 3, "desc": "JVM SSLSocket.startHandshake call", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/data/decode/base64::java-base64-decoder-bytecode-call", "conf": 0.94, "crit": 3, "desc": "Java Base64 decoder accessor call", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/decode/base64::java-base64-decoding-bytecode", "conf": 0.94, "crit": 3, "desc": "Java bytecode Base64 decoding", "from": [ { "off": 19330, "file": 1 } ], "uses": [ 36, 69 ] }, { "id": "objectives/impact/dos/disk::jvm-two-backward-goto-branches", "atk": "T1499.001", "conf": 0.9, "crit": 3, "desc": "JVM repeated counter backedges", "from": [ { "file": 1 } ] }, { "id": "objectives/anti-static/obfuscation/reflection/class::java-protectiondomain", "conf": 1.0, "crit": 3, "desc": "Java ProtectionDomain", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/fs/write/file/handle::jvm-fileoutputstream-bytecode", "conf": 0.86, "crit": 3, "desc": "JVM imports FileOutputStream class", "from": [ { "file": 1 } ] }, { "id": "objectives/anti-static/obfuscation/string/crypto::java-byte-range-copy", "atk": "T1027", "mbc": "F0001", "conf": 0.7, "crit": 3, "desc": "Java byte range copy", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/framing::data-stream-transport", "atk": "T1573", "conf": 1.0, "crit": 3, "desc": "Java data-stream transport type", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/process/thread/lifecycle::jvm-thread-start-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM starts a thread", "from": [ { "file": 6 } ] }, { "id": "metadata/file/archive::archive-at-least-10-members", "conf": 0.9, "crit": 3, "desc": "Archive contains at least ten members" }, { "id": "metadata/package/entrypoint::jar-main-class", "conf": 0.95, "crit": 2, "desc": "JAR manifest declares an executable Main-Class" }, { "id": "metadata/file/naming::archive-member-under-10kb", "conf": 0.9, "crit": 3, "desc": "Archive has a sub-10KB member" }, { "id": "metadata/package/config::fabric-runnable-mod-archive", "conf": 0.9, "crit": 3, "desc": "Fabric mod JAR is directly runnable", "from": [ { "file": 9 } ], "uses": [ 49, 78 ], "spans": [ [ 0, 15 ] ] }, { "id": "objectives/exfiltration/stealer/credential/token::minecraft-token-http-body-exfil", "atk": "T1041", "mbc": "E1041", "conf": 0.98, "crit": 4, "desc": "Minecraft token access paired with raw socket request write", "from": [ { "off": 6272, "file": 5 }, { "off": 1961, "file": 6 } ], "uses": [ 1, 19 ], "spans": [ [ 0, 41 ] ] }, { "id": "well-known/malware/stealer/prefire-shard::prefire-packed-runtime-stealer", "atk": "T1528", "mbc": "B0006", "conf": 0.99, "crit": 5, "desc": "Prefire packed runtime Minecraft stealer", "from": [ { "off": 20892, "file": 1 }, { "file": 5 }, { "off": 1961, "file": 6 }, { "file": 7 } ], "uses": [ 9, 10, 15, 19, 33, 66, 73 ] } ] }, { "ctx": [ { "b": "+kO#^0000+1LiUO4}xJ{fk20vxMW=qCv\u003e$]2lj=901-)NC404uvqYZhpHX6Iv@}}Q0%5xzv@Diqxk8E3BZ^1uC3!^6D3TTzuT^H\u003cw[\u003c\u003eOp^]sd00Jx67H}x2fk20vxMW=qy\u003c6e@C6OySv{-XP2lj#f00^aJnn.l)z#/}Zygho]fkL6mxd)84z!0v1B3+1-y?d9$bVnh:x(W={Bo.^M0rr%KvrM6jy*?i]fhMXcv}x.5luN0UwmY=^01n(d2VtkAx(W={Bo8vUygho]flIwJy+Fa-B7El^bT=iNz!9B12lknn01-)NC404DBzkLAlsB}Dhz+Ts5DI\u003epl$G\u003eDwmY=Z03#w*C404uvqYZhx(n9jyH]d[wPRQ7wjQcDwnC*#bUSb{yJTO302bCl9+]bbvj#C9zF7RpzGY@lwIl+?BzbP6nmuyDy?mU)02tOn225@NyJTN%01:fZ", "ln": 0 }, { "b": "oLO0Vvj#Ijz.CZpy?km@vrufA0rrECvrcB2pIa/%v/VMEoLO0Vvj#C9zF7R3BAh8kxf{-Py?d9$i@]r=jzwXEBuPZ911kQ03\u0026?)Wfa4WZ05aAN5nCS%vj#C9zF7R3BAh8kx9Oz(0rr{JvrM6jy*?i]fh($kx(mMIB.LV5wPw1QgZTju05aANnE:WCGZLX3(.}kKP116YNDPGT(XId%G01yvQ3vMy\u0026jcq-Hqh#=U\u0026q4K)X+)bS\u0026t3KR%Hms\u003e.V[pIh*+LOB0zv(w.N%X$/PihVS)", "ln": 631 }, { "b": "gxphK00BYwdol\u0026Se=X-Q05T:O0rs8/lN+YzvrM6jy*?i]fh($kx(mMIB.LV5wPx\u003cv07c-=3ih{-rri79Bz\u003e91A+PA70rr/ZdnjF+C404uvqYZhq/)4]zF83t09oe53ih{-sPFH/2\u003e0RM)Zv@pI[OqAR%pv/\u003e=??/V9rR]R%YB@)ZG\u003c]IIZI^M*gY9\u003e=/^bV7HAZI0*d\u003e)ZGaVIJN7(P6ACA2MO6f08A%.Xs.@.S{^uU\u003e.=w1GO]8VP5$@\u003c", "ln": 1114 }, { "b": "0rrZSA+/#Dz^N*lBZF%2C5.hq0rrsagf3?Cx-OhsAb]J4x(W+=07[Ukygho]fkL6mxd)h9A+PA7j4%x$C404uvqYZhq/)4]zF848ygho]fkL6mxd)h9A+PA7j1i\u003crvrM5", "ln": 4221 }, { "b": "?)sNMB(0c0g3(ow\u0026\u0026[HiUCHYsPZo4W\u0026\u0026[14UEr[JVfX\u0026$\u0026\u0026[14UD)RFPZo7?\u0026\u003c144UbpVrP-+S4o921%xjVf@zGVA?o-Ue10aVa90rtH$(YegeKDeCmO-4bQ(y\u003eGcG71C!\u003c^zy{JJ8iGY6biQ\u0026\u003cCfxJg]s4Ir*j%\u003cb{n3Y1WalMG\u003ecm+^3R(Kl8+n\u003cCYSn0z\u0026^%i{93b\u003cE7L=QLE\u0026WJ{JBL\u003c!vv\u0026R?a05X8-{Q)v{PtFu4$fLi5ED\u003eCw", "ln": 5693 }, { "b": "\u0026hqF3VZH9RP67%6\u003cFX%lSjzx7TlMN*\u003ezkc70-oa30000000*\u003cK01-)NC404uvqYZhra{q-vpPPArri76B8kA0z#/}wc}U{?3\u003c6Gispbag0:bK71Br*=z2\u003cRzv@Dl%x\u003eH1VwO?CF2Xv)}A^pG1A@=mIl}ZSVr7gzdm{/RvpYQLbzfGJ6t4@qcz!@r.w(-TE026VFx()YHAa\u003ck#A^gD9uUJnBmf9w[xM4Y$wPxHa0269QC404rz.BWTmr\u0026rNAcb/jzu*kL0rrvJx(B", "ln": 12018 }, { "b": "wNPAX0=[wx1T)Owdol\u0026Se={e50^1G!0rr@+oLO0Vvj#tkfg*52B-ZM7A+eV@j1jhs04[s$3iCkHC(W)NxjVfWwQ5q=zGG]A0rs2^dnjF+C404DBzkLADtdsKt4}}AzGG]Ai$8gq0^\u003esRASQT\u002602xrTC404DBzkLADtdsKt4}}AzGG]A2lGwQ00^dFBwumYwEFS\u003e09xNfFc7r601iHZl${WMv@#TfC)\u003c+c0rJPfFc7A9010pHBwMy^wO#O\u003c02u$ioLO0Vvj#Ijz.CZpy?km@vrufA3\u003c8g=HZKk+0/l{T9bn]9vj#tkfg6![w[u0]wkvt\u0026Acln3BAg@3z3Hc20rr%KvrM6jx(tT]x(4uRB-.OBBw)p4wNPAX0/WiX26s=Mx(4tY01ZLcoLO0Vvj#tkfgGU(wJHq4J@\u003eyJ0APt+0rrYWoLO0Vvj#tkfgGU(wJItw3\u0026?)YLl}wK0*AY=8yOo]vrM6jx(tU2B-.OBBw)p4wNPBqnHWWG04[ts3iDd/MJm6?A+eV\u00263\u003c8*#l\u003c:0o0?6b\u00261:t03By+EM2pJ!ynL7vi3\u003c8}2OEbBS0?Gz)1.hv!B7C:YPA3RL0/NhO14Zwt/Al*Xv5s4o{wyM=CBniw0rrNqwmORYAbY\u0026eB8$]60rr@+oLO0Vvj#C9zF7R4xMw3nvpB4:j1jhs0\u0026D9#3iB/vSq##av@c78wKQGUA^n5{S@K^W0=!vz3iCkHP-Cb$vN\u003eo5CtOwv4R#", "ln": 12370 }, { "b": "uT^LPzGY/5BA8qeuWcc\u003cx\u003c#t*00^EXxgcfIvfq^ra+fW)d5iBo01-)NC404DBzkLAl2}0OD2\u003ch(Z5Xiwv@DsipI9HkzF9IY00\u003c#Slp\u003c-$ts5-1ZYIsV0(1/N0rrHBxMNQ7vp9URyIBmV.#.\u003e800ikv0rr:Iv%h-%wo@u8xL.A)Cxd56Di10VyK6!+uRtDXwm4(7m{onkqdT\u003eJ00)WRoL#\u003c!k@X(B2xBx/nP5cU0rrl(h=8)y00uzHvf3ulwO+=", "ln": 13141 }, { "b": "0000QL(szU02xrTC404DBzkLADtdsKnP5cRvru732lJP^0]0Ye0rryDwPQHYAclmh0]i{23iF@-?t)P%ygho]fkktTlv0V:l2}0OC#5N8Acln3BAg@3z3Hd23iGe^qul+6w[=c%B7/b}3\u003cbC\u00260TY1-0]%vZ2wF6/y*?A%3\u003cbL)l\u003c:1I0{oN:3t%A^wogsWAclmh0{GZ!3iF@-(iWQK0?Gz)17=vX3\u003cb!@fa4^n0}36?3V{qND30Q-A=LPl0rrlJdo/aE0}loY3iGe/[=nZ[yc=#!0rrpqnP5cU0rr%gygho]flIwJy+H9GA4:!2w]7)$wPx\u003ck019NSA:J%iD3KgJ0rsinygho]fkktTlv0V:l2}0OC#5N8Acln3BAg@3z94:#3QYa)s7j^0vkfMo0rr{UxNj\u0026gxKt$awmP4^A=b#yD0+igz*zA:6hJ{Tmpf4\u003et1h\u003c=lQ%%WCW%oB0rr^awPHNMojy\u003e6uVX}Ylsjm%lR^^:6XRav02zBY15^8fT]OIS2iyx6(.*/xK*Kz^Z3*@C\u003eb#8MFVm$jK]", "ln": 13418 }, { "b": "HmddVFz)An\u003e7Hd*X^nSA77pf*02#pB0S%nu02#g3UyU?]YY+GT\u0026iOv9NYULKUJy.0\u003e-yLSVzN%g8ux*xwPq\u003c3y\u0026Z0!90l=W05BY$0rs\u003etLCNJsJoDnm\u0026h%9HQQPJLI0pXd\u003e.$wRTC#XyKMh7Q\u0026g+$/Gn!-[UhV)[)X^=b2M(dS03IsZ2(\u003e2eaPRM(\u003cb]I?LCEoNR%5@c\u003cb*}rL9a?uI%c25(zGy8Q\u003ecE?!@eT\u003cUiQRg3j3.U0rtE%\u003eA#", "ln": 14253 }, { "b": "c}[w:C404rz.BN]y?kWSoLO0Vvj#C9zF7R0A=kD0B8%V\u003cx(4r\u003eAWjK]wnc6}v@%^v13uVG3igCoj]\u003eS)A+e=}A+e:5nP5G\u0026Bo8wac}[w:C404uvqYZhp\u0026ZF:wPI]VB.LV5wPx4]wN]H}wN/*zdnjF+C404uvqYZhp\u0026ZF:wPI]VB.LV5wPx\u003cv13=@O3igIqlid6N3!Z%eTbc7@R0iF{\u003e9qm{Rix#NRSanq)w4wWYRT#5I}UY4TH)!ONcxmk\u003e9AHsROzibI@HE\u0026)wc/FZld=\u003cY4.-v14id\u00262W}W\u003ewO#3TzWV.q13D$\u003e3J\u0026)101K3Xwnc6}v@$H?Bz#wA3\u003cf66k)^P314\u0026N]6lmU{x(W={Bvyj\u003cz/O=#A+eV@0rsb*s$9cWvrM6jy*?i]fhMXcv}x.5luN0UwmY^y3\u003cff9o:Q\u003ef15n\u003c%1-[=]A=.rZ6^$I8ygho]fkL6mxd)84z!0v1B2%^jpY\u003cM401x3d0rrZDvrM6jy*?i]fhMXcv}x.52lN{a00vgOwb#Vjc[d:%16bI93iKogsoezm)7wwuGR!7fRrsIN\u0026HE4pTb2#FOA)nx\u003cD=O5FpV^pLj1o^[283eYTW6RWE6S#\u003eB]0oOu.BYI%vZc(-u3hY}ansK)O!", "ln": 14875 }, { "b": "1p$Ol24.W]A^oIy00NsZuVG\u0026Y00uUIx8}#wvQTs?hz^^tzGGDmBoqIQ0@r00.kiL4fV9zy10w\u003eX=h^[LxjVfMwN/T?wPv!K94imfygho]flIwJy+Fa-B7El^bT=iNz!9B1i$8lg1rdWF5^ffP00V$Bv@C)?0rr(-oLO0Vvj#C9zF7R3BAh8kxfdLDljr#r1rN%J5cK9R03M8=C404wx(tUmxKL}5wPPO7Byx5$vrb)CxKL}5wPR$#1r)\u003cD1YXI\u003euPn5^8CB)OC404wx(tUmxKL}5wPPN)xKL}5wPQ0x1sa9@2)qEQcij8*c%G2iygho]fk+GxfjOW7A=U/lfgfzYA=U/li@", "ln": 19212 }, { "b": "I#0Lls-TMDxHh[KMb.J{1gV!Jr0daTyZQteP9u5k2EB7T0rr^FvrM6jy*?i]fgfzYA:-E1wPw1UFDk-OwnbW\u003cBo8vBc{{MPnEL-O1Cv9+F={=d010gJvngoBB-q0{00^jWwO\u003e{{Bo8vPC%(d/uQn)Wy*Q1SA7snDmnv1!01rW-zddG{uT^RVv}kPu3sN\u003c*uWur#AC6p)00v1FC)d%byitu5wvR)bc+^aw\u0026j7Az87^eD)h}tI1T7Jj2qx2+00Ju50042KVuVPN0000000", "ln": 20828 }, { "b": "hcEx*hCtRlijn/Ho!lx6j$KzJwf2hs1qI6L1V=!?hu\u003c)26:glhaq\u003es$1$P($u\u003e\u0026(Ng+n+A1%4U\u003cg?q+HGA.EP%kgA*gG+O0W/w+607H3u5\u003eC4\u002683{zN08boT840.KpY$qz3s(45Y8TY\u003e6:}FJq-Ur?hvQxg6:{-odh-Ki2)p$Iu\u003e\u003cbUWG5#s2)p$L6:![/WG60iLc$u\u003esa?1-R#Lr=47ldtWG5=#e4bBYq=%mn05W]*05=\u003eH84WA=WG5AJ5G8e.g=t%:5XXxU6+U4n6bqg[1V^t1hwE8z6+}O#1qILS6+$ak84=#^6+}v2u]iE#rFh7/6+}C%Q5S#Y05E:}6T[6eWG5=#84WA!WG5AJ7-sd)g=ui?7}{b-6=yKu8wKg61V^O8hxiCK6=J!DbPdKo92PN@6=yx]9agPv7Z7M[6=y%#g?q+HGD72\u003c%j+c=gG+OmW/w+607H3c5e5xV06Ap:86uM}weME@g=uD]aheEjwcuB3aR=fk1V^?fhx@}Y6^opKaq(vrbn?NrbqZnW6^jqp6^dE6g\u003eH(\u003cGD*I}%kgA*gG+OtW/w+607H3c5vINxq=%npvZVn0iWLZ\u003e12I[-87962wecF5hyGp*YAHtB12.UAd?%Fb03\u0026Bh6!pdG1qJp(6!rVG872F3d?%BJu]iE#rFh\u003e6R#LG^d7/ZAdJ6Vq87C.6d7xm\u003cY8TS\u002687J8}lq}1\u003eY8TY\u003eW/wrEeG3bMypja8iXzp512I[?87@Sawec+dhzt\u003e1YAHtJ12.[Hg8hHq03\u0026Bp6/3TV1qJN$6/6eN87(4bg8hDYu]hzSrFiadR#LI-05E:}f$dcHWG5=#87=FqWG5AJh5OmNg=vlfhnfi76/GOXhX!o:1V!QThW0UHitBMz03\u0026Bw6/^c?1qJ?56//UU88RKiitBC\u003eu]iE#rFiyjR#LO+05E:}ijw(OWG5=#87=FsWG5AJjq*l-g=vGmjIy@e6*l7=j@3n]1P", "ln": 22115 }, { "b": "m797(1y@lowhV]?05W)]mZ\u0026v@i.6ognejVgmXP(i8aLMj1qKvk6?z-v08am#1qKDxmq#Uy08c{^WG6ufGH=cw%je5TWG6Ht07H3clLsBF06Aqn8b4WDweO3Eg=w2BothcmwcuB3o+*yn1V/xXhCU5-6?$z5aq)]?pz(!upC-}Z6?]As6?\u0026NOg\u003eH(\u003cGIISD%kgA*gG+O\u003cW/w+607H3clLsHH06Aqu8bZL[hD7F\u003eZ64%Yq!d^=6\u0026.*Hi-MnurUXTIrh6vr8c4zL8bZOLq^Ztvu]e:01qK@Lq/Db3wrG@CrSPb#*Q^CwsS7kG07a9]mPQD{WG6GfWe+w1Y8TY\u003eW/wrEsS7uPC^WPmi:9z8", "ln": 22975 }, { "b": "Ne^WDWG6bo0d{{B1P+?T1?1I\u0026o!l\u0026v5DEu\u00261boM55d(tOyC(qg1EPk$6:b9@5tPpf0Ka9!0dUTYFe5g\u003cxKFmJHb]F/83NCKzAn0l05E:}2c[vVW/!g+o-.D#0SW#QTP", "ln": 158346 }, { "b": "hu:-%E(mGC1}}b\u0026EL}xB1rscod\u003eIFs1-bX71HXq75d(tOH6I@N6:aUEWG5#j5v.\u003c$v3aAw1oLI3U}rfW00066^F%mEc\u0026:zI04d:J2lj/g05BPP00961@@rGd1{Ubf2l", "ln": 158839 } ], "depth": 1, "facts": { "imp": [ [ "", "java/io/ByteArrayInputStream" ], [ "", "java/lang/System" ], [ "", "java/lang/Class" ], [ "", "java/util/ArrayList" ], [ "", "java/util/List" ], [ "", "java/nio/file/Path" ], [ "", "java/lang/InterruptedException" ], [ "", "java/lang/Thread" ], [ "", "java/lang/String" ], [ "", "java/util/zip/ZipInputStream" ], [ "", "java/io/PrintStream" ], [ "", "java/nio/charset/StandardCharsets" ], [ "", "[Ljava/lang/String;" ], [ "", "java/nio/file/LinkOption" ], [ "", "com/github/lv_dvyzvc_bc" ], [ "", "java/io/FileOutputStream" ], [ "", "java/nio/file/Files" ], [ "", "java/util/Map" ], [ "", "java/util/zip/Inflater" ], [ "", "java/lang/Process" ], [ "", "java/io/IOException" ], [ "", "java/lang/Throwable" ], [ "", "java/lang/ProcessBuilder" ], [ "", "com/github/lv_dvyzvc_bc$fjHnPEp" ], [ "", "[C" ], [ "", "java/util/Arrays" ], [ "", "java/util/Base64" ], [ "", "java/lang/StringBuilder" ], [ "", "java/nio/file/attribute/FileAttribute" ], [ "", "[B" ], [ "", "java/util/Base64$Decoder" ], [ "", "java/util/zip/ZipEntry" ], [ "", "java/lang/invoke/MethodHandles" ], [ "", "java/io/ByteArrayOutputStream" ], [ "", "java/io/File" ], [ "", "java/lang/invoke/MethodHandles$Lookup" ], [ "", "java/lang/Integer" ], [ "", "java/lang/Character" ], [ "", "java/io/BufferedOutputStream" ], [ "", "java/lang/Object" ], [ "", "java/lang/Exception" ], [ "", "java/lang/ProcessBuilder$Redirect" ], [ "com/github/wfuP", "com/github/wfuP.rsQIzkT" ], [ "com/github/wfuP", "rsQIzkT" ], [ "com/github/wfuP", "com/github/wfuP.sxdpjxWe" ], [ "com/github/wfuP", "sxdpjxWe" ], [ "java/lang/System", "java/lang/System.arraycopy" ], [ "java/lang/System", "arraycopy" ], [ "java/lang/String", "java/lang/String.startsWith" ], [ "java/lang/String", "startsWith" ], [ "java/io/FileOutputStream", "java/io/FileOutputStream.\u003cinit\u003e" ], [ "java/io/FileOutputStream", "\u003cinit\u003e" ], [ "com/github/wfuP", "com/github/wfuP.JGE9u" ], [ "com/github/wfuP", "JGE9u" ], [ "java/lang/String", "java/lang/String.toCharArray" ], [ "java/lang/String", "toCharArray" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/util/Base64$Decoder", "java/util/Base64$Decoder.decode" ], [ "java/util/Base64$Decoder", "decode" ], [ "java/nio/charset/StandardCharsets", "java/nio/charset/StandardCharsets.UTF_8" ], [ "java/nio/charset/StandardCharsets", "UTF_8" ], [ "java/lang/String", "java/lang/String.substring" ], [ "java/lang/String", "substring" ], [ "com/github/wfuP", "com/github/wfuP.sbdjmql9" ], [ "com/github/wfuP", "sbdjmql9" ], [ "java/lang/System", "java/lang/System.out" ], [ "java/lang/System", "out" ], [ "com/github/lv_dvyzvc_bc", "com/github/lv_dvyzvc_bc.get" ], [ "com/github/lv_dvyzvc_bc", "get" ], [ "java/util/Map", "java/util/Map.of" ], [ "java/util/Map", "of" ], [ "com/github/wfuP", "com/github/wfuP.parseOfwzc" ], [ "com/github/wfuP", "parseOfwzc" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.directory" ], [ "java/lang/ProcessBuilder", "directory" ], [ "com/github/wfuP", "com/github/wfuP.zxf_fbsml_tw" ], [ "com/github/wfuP", "zxf_fbsml_tw" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/util/zip/ZipInputStream", "java/util/zip/ZipInputStream.read" ], [ "java/util/zip/ZipInputStream", "read" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectErrorStream" ], [ "java/lang/ProcessBuilder", "redirectErrorStream" ], [ "java/lang/String", "java/lang/String.indexOf" ], [ "java/lang/String", "indexOf" ], [ "java/nio/file/Path", "java/nio/file/Path.getParent" ], [ "java/nio/file/Path", "getParent" ], [ "java/util/Arrays", "java/util/Arrays.copyOfRange" ], [ "java/util/Arrays", "copyOfRange" ], [ "com/github/wfuP", "com/github/wfuP.awjsceskPtr" ], [ "com/github/wfuP", "awjsceskPtr" ], [ "com/github/wfuP", "com/github/wfuP.P9XHgHbnVCv" ], [ "com/github/wfuP", "P9XHgHbnVCv" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.toByteArray" ], [ "java/io/ByteArrayOutputStream", "toByteArray" ], [ "java/util/Base64", "java/util/Base64.getDecoder" ], [ "java/util/Base64", "getDecoder" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectInput" ], [ "java/lang/ProcessBuilder", "redirectInput" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ], [ "java/lang/Class", "java/lang/Class.getSimpleName" ], [ "java/lang/Class", "getSimpleName" ], [ "java/util/zip/ZipInputStream", "java/util/zip/ZipInputStream.\u003cinit\u003e" ], [ "java/util/zip/ZipInputStream", "\u003cinit\u003e" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.toString" ], [ "java/lang/StringBuilder", "toString" ], [ "com/github/lv_dvyzvc_bc$fjHnPEp", "com/github/lv_dvyzvc_bc$fjHnPEp.bodyString" ], [ "com/github/lv_dvyzvc_bc$fjHnPEp", "bodyString" ], [ "com/github/wfuP", "com/github/wfuP.resolveMehxqkjaz" ], [ "com/github/wfuP", "resolveMehxqkjaz" ], [ "java/util/zip/Inflater", "java/util/zip/Inflater.setInput" ], [ "java/util/zip/Inflater", "setInput" ], [ "com/github/wfuP", "com/github/wfuP.LwoWZdxVPEwivR" ], [ "com/github/wfuP", "LwoWZdxVPEwivR" ], [ "java/lang/String", "java/lang/String.charAt" ], [ "java/lang/String", "charAt" ], [ "com/github/lv_dvyzvc_bc", "com/github/lv_dvyzvc_bc.romXlvmPcTvyvsmd" ], [ "com/github/lv_dvyzvc_bc", "romXlvmPcTvyvsmd" ], [ "com/github/wfuP", "com/github/wfuP.tmpAfbtdudoz" ], [ "com/github/wfuP", "tmpAfbtdudoz" ], [ "java/util/zip/ZipInputStream", "java/util/zip/ZipInputStream.closeEntry" ], [ "java/util/zip/ZipInputStream", "closeEntry" ], [ "java/lang/String", "java/lang/String.format" ], [ "java/lang/String", "format" ], [ "com/github/wfuP", "com/github/wfuP.lkkklvpuSys" ], [ "com/github/wfuP", "lkkklvpuSys" ], [ "java/io/PrintStream", "java/io/PrintStream.println" ], [ "java/io/PrintStream", "println" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectOutput" ], [ "java/lang/ProcessBuilder", "redirectOutput" ], [ "com/github/wfuP", "com/github/wfuP.ngxskLaqqKrMrpnth" ], [ "com/github/wfuP", "ngxskLaqqKrMrpnth" ], [ "java/lang/String", "java/lang/String.isEmpty" ], [ "java/lang/String", "isEmpty" ], [ "java/lang/ProcessBuilder$Redirect", "java/lang/ProcessBuilder$Redirect.appendTo" ], [ "java/lang/ProcessBuilder$Redirect", "appendTo" ], [ "java/util/zip/Inflater", "java/util/zip/Inflater.\u003cinit\u003e" ], [ "java/util/zip/Inflater", "\u003cinit\u003e" ], [ "java/util/List", "java/util/List.add" ], [ "java/util/List", "add" ], [ "java/io/BufferedOutputStream", "java/io/BufferedOutputStream.write" ], [ "java/io/BufferedOutputStream", "write" ], [ "java/io/BufferedOutputStream", "java/io/BufferedOutputStream.\u003cinit\u003e" ], [ "java/io/BufferedOutputStream", "\u003cinit\u003e" ], [ "java/util/zip/Inflater", "java/util/zip/Inflater.inflate" ], [ "java/util/zip/Inflater", "inflate" ], [ "java/nio/file/Path", "java/nio/file/Path.of" ], [ "java/nio/file/Path", "of" ], [ "java/lang/String", "java/lang/String.indexOf" ], [ "java/lang/String", "indexOf" ], [ "java/lang/Throwable", "java/lang/Throwable.addSuppressed" ], [ "java/lang/Throwable", "addSuppressed" ], [ "java/nio/file/Path", "java/nio/file/Path.toFile" ], [ "java/nio/file/Path", "toFile" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "com/github/wfuP", "com/github/wfuP.Zpk_rDvpfvOR" ], [ "com/github/wfuP", "Zpk_rDvpfvOR" ], [ "java/util/zip/Inflater", "java/util/zip/Inflater.end" ], [ "java/util/zip/Inflater", "end" ], [ "com/github/wfuP", "com/github/wfuP.juyjbnFmaqKrzs" ], [ "com/github/wfuP", "juyjbnFmaqKrzs" ], [ "java/nio/file/Files", "java/nio/file/Files.createDirectories" ], [ "java/nio/file/Files", "createDirectories" ], [ "com/github/wfuP", "com/github/wfuP.VFErHDKR0jqGnv" ], [ "com/github/wfuP", "VFErHDKR0jqGnv" ], [ "java/io/ByteArrayInputStream", "java/io/ByteArrayInputStream.\u003cinit\u003e" ], [ "java/io/ByteArrayInputStream", "\u003cinit\u003e" ], [ "java/lang/Character", "java/lang/Character.digit" ], [ "java/lang/Character", "digit" ], [ "java/lang/Exception", "java/lang/Exception.getMessage" ], [ "java/lang/Exception", "getMessage" ], [ "com/github/lv_dvyzvc_bc$fjHnPEp", "com/github/lv_dvyzvc_bc$fjHnPEp.body" ], [ "com/github/lv_dvyzvc_bc$fjHnPEp", "body" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.start" ], [ "java/lang/ProcessBuilder", "start" ], [ "java/nio/file/Path", "java/nio/file/Path.resolve" ], [ "java/nio/file/Path", "resolve" ], [ "java/lang/Thread", "java/lang/Thread.sleep" ], [ "java/lang/Thread", "sleep" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.\u003cinit\u003e" ], [ "java/lang/ProcessBuilder", "\u003cinit\u003e" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/util/zip/ZipEntry", "java/util/zip/ZipEntry.isDirectory" ], [ "java/util/zip/ZipEntry", "isDirectory" ], [ "java/util/Map", "java/util/Map.of" ], [ "java/util/Map", "of" ], [ "com/github/wfuP", "com/github/wfuP.qx9CXojieVEKQ" ], [ "com/github/wfuP", "qx9CXojieVEKQ" ], [ "com/github/lv_dvyzvc_bc", "com/github/lv_dvyzvc_bc.varYoexwc" ], [ "com/github/lv_dvyzvc_bc", "varYoexwc" ], [ "com/github/wfuP", "com/github/wfuP.C4iPZToSjduDAcL" ], [ "com/github/wfuP", "C4iPZToSjduDAcL" ], [ "java/nio/file/Files", "java/nio/file/Files.exists" ], [ "java/nio/file/Files", "exists" ], [ "java/util/zip/ZipInputStream", "java/util/zip/ZipInputStream.getNextEntry" ], [ "java/util/zip/ZipInputStream", "getNextEntry" ], [ "java/util/zip/Inflater", "java/util/zip/Inflater.needsInput" ], [ "java/util/zip/Inflater", "needsInput" ], [ "java/lang/ProcessBuilder$Redirect", "java/lang/ProcessBuilder$Redirect.from" ], [ "java/lang/ProcessBuilder$Redirect", "from" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.write" ], [ "java/io/ByteArrayOutputStream", "write" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "com/github/wfuP", "com/github/wfuP.nht_ua_gbkj" ], [ "com/github/wfuP", "nht_ua_gbkj" ], [ "com/github/wfuP", "com/github/wfuP.ewcvjPkqBziuvrRubwue" ], [ "com/github/wfuP", "ewcvjPkqBziuvrRubwue" ], [ "java/lang/String", "java/lang/String.equals" ], [ "java/lang/String", "equals" ], [ "com/github/wfuP", "com/github/wfuP.jsj" ], [ "com/github/wfuP", "jsj" ], [ "java/lang/System", "java/lang/System.getProperty" ], [ "java/lang/System", "getProperty" ], [ "java/lang/Integer", "java/lang/Integer.valueOf" ], [ "java/lang/Integer", "valueOf" ], [ "com/github/wfuP", "com/github/wfuP.wvfe_evu_nwo_dogpu" ], [ "com/github/wfuP", "wvfe_evu_nwo_dogpu" ], [ "java/lang/String", "java/lang/String.\u003cinit\u003e" ], [ "java/lang/String", "\u003cinit\u003e" ], [ "com/github/wfuP", "com/github/wfuP.cfgTjxqk" ], [ "com/github/wfuP", "cfgTjxqk" ], [ "java/lang/System", "java/lang/System.currentTimeMillis" ], [ "java/lang/System", "currentTimeMillis" ], [ "java/io/BufferedOutputStream", "java/io/BufferedOutputStream.close" ], [ "java/io/BufferedOutputStream", "close" ], [ "java/lang/Process", "java/lang/Process.pid" ], [ "java/lang/Process", "pid" ], [ "java/lang/String", "java/lang/String.length" ], [ "java/lang/String", "length" ], [ "java/util/zip/ZipEntry", "java/util/zip/ZipEntry.getName" ], [ "java/util/zip/ZipEntry", "getName" ], [ "java/nio/file/Path", "java/nio/file/Path.toString" ], [ "java/nio/file/Path", "toString" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.\u003cinit\u003e" ], [ "java/io/ByteArrayOutputStream", "\u003cinit\u003e" ], [ "java/util/ArrayList", "java/util/ArrayList.\u003cinit\u003e" ], [ "java/util/ArrayList", "\u003cinit\u003e" ], [ "java/io/File", "java/io/File.\u003cinit\u003e" ], [ "java/io/File", "\u003cinit\u003e" ], [ "com/github/lv_dvyzvc_bc$fjHnPEp", "com/github/lv_dvyzvc_bc$fjHnPEp.statusCode" ], [ "com/github/lv_dvyzvc_bc$fjHnPEp", "statusCode" ], [ "com/github/wfuP", "com/github/wfuP.xtdcorImpl" ], [ "com/github/wfuP", "xtdcorImpl" ], [ "java/nio/file/Files", "java/nio/file/Files.readString" ], [ "java/nio/file/Files", "readString" ], [ "java/lang/String", "java/lang/String.\u003cinit\u003e" ], [ "java/lang/String", "\u003cinit\u003e" ], [ "com/github/wfuP", "com/github/wfuP.zdldkosing" ], [ "com/github/wfuP", "zdldkosing" ], [ "com/github/wfuP", "com/github/wfuP.tpx_bv_fobdg" ], [ "com/github/wfuP", "tpx_bv_fobdg" ], [ "com/github/wfuP", "com/github/wfuP.\u003cinit\u003e" ], [ "com/github/wfuP", "\u003cinit\u003e" ], [ "java/lang/System", "java/lang/System.getenv" ], [ "java/lang/System", "getenv" ], [ "java/lang/String", "java/lang/String.substring" ], [ "java/lang/String", "substring" ], [ "com/github/wfuP", "com/github/wfuP.Hzjpb7I" ], [ "com/github/wfuP", "Hzjpb7I" ], [ "com/github/wfuP", "com/github/wfuP.jgs" ], [ "com/github/wfuP", "jgs" ], [ "java/util/zip/ZipInputStream", "java/util/zip/ZipInputStream.close" ], [ "java/util/zip/ZipInputStream", "close" ], [ "java/util/zip/Inflater", "java/util/zip/Inflater.finished" ], [ "java/util/zip/Inflater", "finished" ], [ "com/github/wfuP", "com/github/wfuP.jFtBvlU" ], [ "com/github/wfuP", "jFtBvlU" ], [ "com/github/wfuP", "com/github/wfuP.runDetached" ], [ "com/github/wfuP", "runDetached" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/lang/Integer", "java/lang/Integer.parseInt" ], [ "java/lang/Integer", "parseInt" ], [ "java/lang/Object", "java/lang/Object.getClass" ], [ "java/lang/Object", "getClass" ], [ "com/github/wfuP", "com/github/wfuP.rpYSAA" ], [ "com/github/wfuP", "rpYSAA" ] ], "metrics": { "file": { "size": 162102, "entropy": 4.07 }, "class": { "major_version": 65, "interface_count": 0, "method_ref_count": 120, "constant_pool_size": 1239, "external_class_count": 42 }, "binary": { "peak_region_bytes": 16384, "peak_region_entropy": 7.14 }, "imports": { "count": 162 }, "functions": { "count": 20 } } }, "id": 1, "mol": "O₃(AlAs₂I)H₅(Db₄F₂OsPo₂Ti)", "path": "dupe-2.jar!!com/github/wfuP.class", "pid": 0, "risk": 13, "sha": "d7978988a9549837048d45ae14a37b2e84810201a70e1ea4b61e3b64836fe641", "size": 162102, "traits": [ { "id": "micro-behaviors/communications/proxy/tunnel::byte-output-stream", "atk": "T1090", "mbc": "C0003", "conf": 0.5, "crit": 3, "desc": "Java ByteArrayOutputStream usage", "spans": [ [ 703, 21 ], [ 12803, 21 ], [ 13490, 21 ], [ 13615, 21 ], [ 13702, 21 ] ] }, { "id": "micro-behaviors/data/archive/extract/zip::jvm-zip-entry-iteration-bytecode", "conf": 0.92, "crit": 3, "desc": "JVM iterates ZIP archive entries", "spans": [ [ 12434, 41 ] ] }, { "id": "micro-behaviors/data/archive/extract/zip::jvm-zip-entry-read-bytecode", "conf": 0.9, "crit": 3, "desc": "JVM reads ZIP archive entry data", "spans": [ [ 12778, 33 ] ] }, { "id": "micro-behaviors/data/buffer/transfer::bytearrayinputstream-ref", "conf": 0.88, "crit": 3, "desc": "Java ByteArrayInputStream class" }, { "id": "micro-behaviors/data/buffer/transfer::bytearrayoutputstream-ref", "conf": 0.88, "crit": 3, "desc": "Java ByteArrayOutputStream class", "spans": [ [ 13482, 29 ] ] }, { "id": "micro-behaviors/data/decode/base64::java-base64-decode-bytecode-call", "conf": 0.96, "crit": 3, "desc": "Java Base64 decode call", "spans": [ [ 19330, 31 ] ] }, { "id": "micro-behaviors/data/decode/base64::java-base64-decoder-bytecode-call", "conf": 0.94, "crit": 3, "desc": "Java Base64 decoder accessor call", "spans": [ [ 19276, 27 ] ] }, { "id": "micro-behaviors/data/decode/base64::java-base64-decoder-class", "conf": 0.92, "crit": 3, "desc": "JVM Base64 decoder class reference", "spans": [ [ 212, 24 ], [ 19289, 28 ] ] }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method", "spans": [ [ 1178, 8 ] ] }, { "id": "micro-behaviors/fs/read/file/handle::jvm-io-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM File API class reference" }, { "id": "micro-behaviors/fs/read/file/handle::jvm-nio-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM NIO file API reference" }, { "id": "micro-behaviors/fs/write/file/handle::jvm-fileoutputstream-bytecode", "conf": 0.86, "crit": 3, "desc": "JVM imports FileOutputStream class", "spans": [ [ 12641, 24 ] ] }, { "id": "micro-behaviors/os/env/gate::jvm-opaque-environment-key", "conf": 0.94, "crit": 1, "desc": "JVM class has generated gate value" }, { "id": "micro-behaviors/os/env/gate::jvm-string-equals-import", "conf": 0.94, "crit": 1, "desc": "JVM class imports String equals", "spans": [ [ 14317, 0 ] ] }, { "id": "micro-behaviors/os/env/gate::jvm-system-getenv-import", "conf": 0.94, "crit": 1, "desc": "JVM class imports System getenv", "spans": [ [ 5757, 0 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.88, "crit": 3, "desc": "Java bytecode ProcessBuilder reference", "spans": [ [ 132, 71 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-init-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.92, "crit": 3, "desc": "Java bytecode ProcessBuilder constructor", "spans": [ [ 695, 31 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.95, "crit": 3, "desc": "Java bytecode ProcessBuilder start", "spans": [ [ 15216, 30 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-errors", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder merges standard error", "spans": [ [ 15152, 44 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-input", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard input", "spans": [ [ 14939, 38 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-output", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard output", "spans": [ [ 15125, 39 ] ] }, { "id": "micro-behaviors/time/sleep/interval::java-thread-sleep-bytecode", "conf": 0.9, "crit": 3, "desc": "Java bytecode thread sleep", "spans": [ [ 12082, 22 ] ] }, { "id": "objectives/anti-analysis/timing/evasion::kotlin-thread-sleep-check", "atk": "T1497.003", "conf": 0.94, "crit": 3, "desc": "Kotlin Thread.sleep call", "spans": [ [ 12092, 12 ] ] }, { "id": "objectives/anti-static/obfuscation/string/control-prefix::java-character-digit-bytecode", "atk": "T1027", "mbc": "F0001", "conf": 0.9, "crit": 3, "desc": "Java bytecode calls Character.digit", "spans": [ [ 20892, 25 ] ] }, { "id": "objectives/anti-static/obfuscation/string/control-prefix::java-control-prefixed-long-string", "atk": "T1027", "mbc": "F0001", "conf": 0.92, "crit": 3, "desc": "Java string starts with control-length prefix" }, { "id": "objectives/anti-static/obfuscation/string/crypto::java-byte-range-copy", "atk": "T1027", "mbc": "F0001", "conf": 0.7, "crit": 3, "desc": "Java byte range copy", "spans": [ [ 13205, 11 ] ] }, { "id": "objectives/impact/dos/disk::jvm-two-backward-goto-branches", "atk": "T1499.001", "conf": 0.9, "crit": 3, "desc": "JVM repeated counter backedges", "spans": [ [ 22179, 8 ], [ 22276, 8 ], [ 22459, 8 ], [ 22547, 8 ], [ 22640, 8 ], [ 22752, 8 ], [ 23039, 8 ], [ 23123, 8 ] ] }, { "id": "well-known/malware/stealer/prefire-shard::prefire-family-literal", "atk": "T1528", "mbc": "B0006", "conf": 0.9, "crit": 1, "desc": "Prefire family name literal", "spans": [ [ 4253, 7 ] ] }, { "id": "micro-behaviors/data/archive/extract/zip::jvm-zip-entry-extraction-to-file", "conf": 0.96, "crit": 3, "desc": "JVM extracts ZIP entries to files", "uses": [ 1, 2, 11 ], "spans": [ [ 12434, 41 ], [ 12641, 24 ], [ 12778, 33 ] ] }, { "id": "micro-behaviors/data/decode/base64::java-base64-decoding-bytecode", "conf": 0.94, "crit": 3, "desc": "Java bytecode Base64 decoding", "uses": [ 5, 6 ], "spans": [ [ 19276, 27 ], [ 19330, 31 ] ] }, { "id": "micro-behaviors/os/env/gate::jvm-opaque-secret-environment-gate", "conf": 0.97, "crit": 3, "desc": "JVM compares opaque environment gate", "uses": [ 12, 13, 14 ], "spans": [ [ 5757, 6 ], [ 14317, 6 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.94, "crit": 3, "desc": "Java bytecode ProcessBuilder execution", "uses": [ 16, 17 ], "spans": [ [ 695, 31 ], [ 15216, 30 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirected-stdio", "conf": 0.96, "crit": 3, "desc": "Java ProcessBuilder redirects all standard streams", "uses": [ 18, 19, 20 ], "spans": [ [ 14939, 38 ], [ 15125, 39 ], [ 15152, 44 ] ] }, { "id": "micro-behaviors/process/create/spawn::child-process-creation-api", "atk": "T1106", "conf": 0.92, "crit": 3, "desc": "Starts a child process through a platform API", "uses": [ 31 ], "spans": [ [ 695, 31 ], [ 15216, 30 ] ] } ], "type": "java_class" }, { "ctx": [ { "b": "+kO#^0000+05sMPbv+Uefk20vxMW=qy\u003c6e@C6OySv{-XPbY(Q?nJxdIlu(Qm2lj=901-)NC404uvqYZhpHX6Iv@}}Q0%5xrv@Diqxk8E3BZ^1uC3!^6D3TTzuT^HI00Jx63V[@", "ln": 0 } ], "depth": 1, "facts": { "imp": [ [ "", "com/github/lv_dvyzvc_bc" ], [ "", "java/lang/Object" ], [ "", "java/lang/System" ], [ "com/github/lv_dvyzvc_bc$tIeI9CfBxXX", "com/github/lv_dvyzvc_bc$tIeI9CfBxXX.ip" ], [ "com/github/lv_dvyzvc_bc$tIeI9CfBxXX", "ip" ], [ "java/lang/System", "java/lang/System.currentTimeMillis" ], [ "java/lang/System", "currentTimeMillis" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ], [ "com/github/lv_dvyzvc_bc$tIeI9CfBxXX", "com/github/lv_dvyzvc_bc$tIeI9CfBxXX.expiresAt" ], [ "com/github/lv_dvyzvc_bc$tIeI9CfBxXX", "expiresAt" ] ], "metrics": { "file": { "size": 824, "entropy": 5.76 }, "class": { "major_version": 65, "interface_count": 0, "method_ref_count": 4, "constant_pool_size": 50, "external_class_count": 3 }, "binary": { "peak_region_bytes": 824, "peak_region_entropy": 5.76 }, "imports": { "count": 7 }, "functions": { "count": 2 } } }, "id": 2, "path": "dupe-2.jar!!com/github/lv_dvyzvc_bc$tIeI9CfBxXX.class", "pid": 0, "risk": 1, "sha": "b97b350ff26faf8afc050c807d8e231a4d1d3581b0bd4298f10636ddcf354294", "size": 824, "traits": [ { "id": "metadata/binary/code/complexity::functions-at-most-24", "conf": 1.0, "crit": 2, "desc": "Binary has 24 or fewer functions" }, { "id": "metadata/binary/code/complexity::functions-at-most-32", "conf": 1.0, "crit": 2, "desc": "Binary has 32 or fewer functions" }, { "id": "metadata/file/magic/identity::cafebabe-magic", "conf": 1.0, "crit": 2, "desc": "CAFEBABE magic at file start", "spans": [ [ 0, 0 ] ] }, { "id": "micro-behaviors/os/env/gate::jvm-opaque-environment-key", "conf": 0.94, "crit": 1, "desc": "JVM class has generated gate value" } ], "type": "java_class" }, { "ctx": [ { "b": "+kO#^0000+09og3a7Gkafk20vxMW=qy\u003c6e@C6OySv{-XPbXy^ZzCS=v2lj=901-)NC404uvqYZhpHX6Iv@}}Q0%5xrv@Diqxk8E3BZ^1uC3!^6D3TTzuT^HI00Jx62wdZwzCS+", "ln": 0 }, { "b": "aPI/G0rr918up@Y3JHkd000]qbleeM0@@r38uq2.5c8?kpYHE}0SS(lqVD^$5D\u00267t0000a0000c0000f0000103}Q(0096%0000%00Ao60000E5*]^X5*@hxc.HCJ5?2\u003cY5d\u003c7G8Xrs6jI7OysT{=U9\u003cL=1W/wj*0000208@{#00SA7}#vPn08-^%01n\u0026d", "ln": 1253 } ], "depth": 1, "facts": { "imp": [ [ "", "com/github/lv_dvyzvc_bc" ], [ "", "java/lang/String" ], [ "", "java/nio/charset/StandardCharsets" ], [ "", "java/util/Map" ], [ "", "java/lang/Object" ], [ "com/github/lv_dvyzvc_bc$fjHnPEp", "com/github/lv_dvyzvc_bc$fjHnPEp.statusLine" ], [ "com/github/lv_dvyzvc_bc$fjHnPEp", "statusLine" ], [ "com/github/lv_dvyzvc_bc$fjHnPEp", "com/github/lv_dvyzvc_bc$fjHnPEp.statusCode" ], [ "com/github/lv_dvyzvc_bc$fjHnPEp", "statusCode" ], [ "java/lang/String", "java/lang/String.toLowerCase" ], [ "java/lang/String", "toLowerCase" ], [ "java/util/Map", "java/util/Map.get" ], [ "java/util/Map", "get" ], [ "com/github/lv_dvyzvc_bc$fjHnPEp", "com/github/lv_dvyzvc_bc$fjHnPEp.body" ], [ "com/github/lv_dvyzvc_bc$fjHnPEp", "body" ], [ "java/lang/String", "java/lang/String.\u003cinit\u003e" ], [ "java/lang/String", "\u003cinit\u003e" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ], [ "java/nio/charset/StandardCharsets", "java/nio/charset/StandardCharsets.UTF_8" ], [ "java/nio/charset/StandardCharsets", "UTF_8" ], [ "com/github/lv_dvyzvc_bc$fjHnPEp", "com/github/lv_dvyzvc_bc$fjHnPEp.headers" ], [ "com/github/lv_dvyzvc_bc$fjHnPEp", "headers" ] ], "metrics": { "file": { "size": 1617, "entropy": 5.84 }, "class": { "major_version": 65, "interface_count": 0, "method_ref_count": 9, "constant_pool_size": 87, "external_class_count": 5 }, "binary": { "peak_region_bytes": 1024, "peak_region_entropy": 5.84 }, "imports": { "count": 14 }, "functions": { "count": 3 } } }, "id": 3, "path": "dupe-2.jar!!com/github/lv_dvyzvc_bc$fjHnPEp.class", "pid": 0, "risk": 1, "sha": "d5b1c544b9d641d8511a3fe3ccdc6d50801f5e6f0077a24a9aaa943a0253821c", "size": 1617, "traits": [ { "id": "metadata/binary/code/complexity::few-functions-3", "conf": 1.0, "crit": 2, "desc": "Binary has 3+ functions" }, { "id": "metadata/binary/code/complexity::functions-at-most-24", "conf": 1.0, "crit": 2, "desc": "Binary has 24 or fewer functions" }, { "id": "metadata/binary/code/complexity::functions-at-most-32", "conf": 1.0, "crit": 2, "desc": "Binary has 32 or fewer functions" }, { "id": "micro-behaviors/os/env/gate::jvm-opaque-environment-key", "conf": 0.94, "crit": 1, "desc": "JVM class has generated gate value" } ], "type": "java_class" }, { "ctx": [ { "b": "+kO#^0000+07u[*a7Gkafk20vxMW=qy\u003c6e@C6OySv{-XPbY)%4x(!rq2lj=901-)NC404uvqYZhpHX6Iv@}}Q0%5xyygho]CRr@CBt4YRy+F)FfGA9MB-RU0vqYH^wPw1Q1PXP", "ln": 0 } ], "depth": 1, "facts": { "imp": [ [ "", "java/security/cert/X509Certificate" ], [ "", "java/lang/Object" ], [ "", "javax/net/ssl/X509TrustManager" ], [ "", "com/github/lv_dvyzvc_bc" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ] ], "metrics": { "file": { "size": 1381, "entropy": 6.03 }, "class": { "major_version": 65, "interface_count": 1, "method_ref_count": 1, "constant_pool_size": 69, "external_class_count": 4 }, "binary": { "peak_region_bytes": 1024, "peak_region_entropy": 6.1 }, "imports": { "count": 5 }, "functions": { "count": 4 } } }, "id": 4, "mol": "H(Cm)", "path": "dupe-2.jar!!com/github/lv_dvyzvc_bc$toQisru.class", "pid": 0, "risk": 1, "sha": "d314dd08996fadcd2542f2f65c148ef2db25297c11de74c3e7b6efe0f0abfa7a", "size": 1381, "traits": [ { "id": "micro-behaviors/os/env/gate::jvm-opaque-environment-key", "conf": 0.94, "crit": 1, "desc": "JVM class has generated gate value" }, { "id": "micro-behaviors/communications/socket/ssl::jvm-x509trustmanager-class-ref", "conf": 0.94, "crit": 3, "desc": "JVM X509 trust-manager interface reference" }, { "id": "micro-behaviors/communications/socket/ssl::jvm-x509trustmanager-issuer-callback", "conf": 0.94, "crit": 3, "desc": "JVM getAcceptedIssuers callback defined" }, { "id": "micro-behaviors/communications/socket/ssl::jvm-x509trustmanager-server-callback", "conf": 0.94, "crit": 3, "desc": "JVM checkServerTrusted callback defined" }, { "id": "micro-behaviors/communications/socket/ssl::jvm-custom-x509trustmanager", "conf": 0.95, "crit": 3, "desc": "Class implements a custom X509 trust manager", "uses": [ 1, 2, 3 ] } ], "type": "java_class" }, { "ctx": [ { "b": "+kO#^0000+1fqI67H}x2fk20vxMW=qy\u003c6e@C6OySv{-XP2lj=901-)NC404uvqYZhpHX6Iv@}}Q0%5xzv@Diqxk8E3BZ^1uC3!^6D3TTzuT^H\u003cBz\u003e2\u003cB8(yd00Jx6bv+Uefk1#", "ln": 0 }, { "b": "m0-JPASDdvn=X[@AAuN\u003ehD*aYawuJUC42RGzE)]yB8#dJq=uv*z!0M]BvGXGBz(hBi@]r=jzwXEBuPZ911kQ03\u0026?\u003cVe^.NY051uM4SVr7zE^(TzFr/Yy?[s$02XEuz/4dux([3hvLqLvuU1t9DuJ!9vQ?F200u\u003eBBo8w0c}[w:C404uvqYZhq/)4]zF83WoK\u00260Tfk20vxMW=qy\u003c6e@C6OySv{-XPbXy^ZzCS=vi@]r{ygho]fkktTnL.^1v}xR3x(v\u003e]05T=S1]", "ln": 640 }, { "b": "rTX%W0e.9-I2-Cm00V\u003eJAaJ]$0rs8/lN+YzvrM6jy*?i]fh($kx(mMIB.LV5wPx\u003cv0f3#s3ik[.J@Yj^Bz\u003e91A+PA70rr/ZdnjF+C404uvqYZhq/)4]zF83t0fEnA3ik[.Lk$T?Byw)1nPXJX0rrpunPXJX0rr\u003cSB:4XwCWB]}z!TrfuUKd@uTWUW0rrEry*?p7wN[LUz2\u003cRsAclm8rlwBS1POJ50dv*7hW6fY000000da[H%nSbrM:$PD02:)ZOzZoG\u003cGC3lL8Os%Rr1!t?#", "ln": 2194 }, { "b": "v@=c?By+EMa$cc1vrM6jy*?i]fh($kx(mMBdnjF+C404wwPPO9qB@}U0iMs93imgdUMj.cBz\u003eeSoAtb8c[d\u00268vrM6jzE)]yrz(HL3\u0026)NkVKcYm0jh+b3#fi]vj#IfBt3S(oA$Na0rrvqwPQEYB94/\u003cXb.W00jI%s0rrvqwPQ:!A=.Y\u0026Y8WJ(0jI%v0rrHuwPQ:?z//]cz!]*ZZ5Tr60jI%y0rsIN)#@\u003e1QP@{.Lie:F\u003ca$8aJIC\u003cAO8YTa)#\u003eiEQj}ZgRSK?c\u003cb5J%0kOWo5m]\u003c7vqH0RxkRTdwD", "ln": 2687 }, { "b": "B76l6o(1YYB94A.cmzM5vrM6jy*?i]fh($kx(mMBdnjF+C404uvqYZhq/)4]zF83t0nNUi3igbc?ViY/ygho]fk+uyfh(!0yH}O)0o1m+\u0026S7Rl00\u0026M80rr*PwPQ*Yv}xv$wKpJKw[u0Yx)Kt00oBir3io5=\u003c]CD2ygho]fk+uyfg*4)Bw)9/yH}PNwmPZ(B8}M^\u003eM7V0c}[w:C404uvqYZhq/)4]zF845dol\u0026SeDC5y0o\u003cHH3\u0026?KMaQFbI0po^!2v?W\u0026zE)s10rs8/oLO0Vvj#IfBt3Nhv@2T$l1BIDwPI]OnHWWG0pG{S3io5=[Ebyz03ITG0S./)01r{WBw)9Sx(dB1B-X2(]-f\u003cR0oa1L3\u0026?^Tec#pT0qDM{9+]bbvr:CywPPODB8iHdq+Qbdv@2T$mQY!Gz/Qad0qVY@3$Br?vru6Vz!0M]Bo8w3c}[w:C404wwPPO7z!0M]BurfhvrM6jy*?i]fh($kx(mMBnM)Mpygho]fk+uyfh(!0yH}PH3\u0026{h9@r-M40r9007IWx4vr:CywPPODB8iHdq+Qbdv@2T$2ls/901-^OBw(aip*[xMzdN*2A=RlYa1eNiygho]CRr@CBt4YRy+FZ=oI/ervqPN$wPz\u0026N3\u0026{zg0$25f0r-A68erP6vr:CywPPODB8iHdpdW#{B97e=", "ln": 3193 }, { "b": "j1i\u003crvrM6jB-.tlfhc83Buo)i4fl}D0sO#t0rs6NvrM77fk+uyflqhJfh\u003e!yp*[xMzdN*2A=RD^5DI\u003ewB7GC(wPz%9A.Z4WwPE\u003eL6duK?vrM6jB-.tlfhc83Bup{L3\u0026}1x6BB\u003cN0tLRnaQvntX9x/=\u0026jlegJQalN7uS5\u003e(9Oj\u003cQ{e^!RO!$\u003cY%XgE7xBHWB7GCZzE^Z8x(n2:wmYU2x\u003ez6?vruj4zB58Kz/PMlxL!dU8370I0tkzK0rrWLwPQ\u003cHoI/ervqPN$wPz?)03AW-ygho]CRr@CBt4YRy+FZ=oI/ervqPN$wPz\u0026Ndol\u0026T9045!0rAix0rrQJByxiinmuyDB7!#$wEFOZ04[PV0rBtA01SZNBwE43Acln3BAg@3z2\u003cRNc[d\u00268vrM6jx(tU2B-.OBBw)p4wNPBq3\u0026}NNbNKLh0vm:D4RGu{nP5G\u0026Bw)p4wNPAR02E4joLO0Vvj#tkfg*52B-ZM7A+eV@i$8cq0vOoP\u0026SgFe02V4eZM)#LSo6}h\u0026ieQgW$J?JO8ZuF)z34m0v[fJ6A", "ln": 3814 }, { "b": "a{)zjH3:X\u0026)2!{sRI\u003cJIYxDDh)W5N\u003eZP3Q\u003cKMJQ1)td!G0GNlY3q1e(uPp25iBsGH0G^zi2)2zOK]UK^CxdztwDq=mc%G1!rTY1[0Hi#)e=?ms00M$JB-Rj80HJ\u003ct3iq:WNe)o[sW=H\u003er.2X?0rt8coLO0Vvj#tkfg*52B-ZM7A+eV@j1i\u003ckz/4dux([3hvLqLvuU1t9DuJ!9vQ*V}ydJksmq$r%0H\u003caW3igbdODeY]v@c78wEFQi04[PU\u0026SkXM0269QC404uvqYZhra{q\u003cCvs@%wD@mg0rrjxiAudX8ba^NC42RGzE)]yB8#dJq=uv*z!0M]BuoH633g6ivQA[[D29GY9zyiRC42RGzE)]yB8#dJq=uv^vrb^[wPRH7B2%y51BsP=g64v!oLO0Vvj#IfBt3Nhv@2T$i@]r+lnrQrnDw!@v%8*kz/NSm02ngxvrM6jB-.tlfhk\u003e]bT(P)A^o.E00^QSze.*:w=R(EoLO0Vvj#tkfhD.jAcln3BAg@3z94:#6if0rnND:lBz\u003eJhsv47pwm/^%0rr\u003cdygho]fkktTnP5G\u0026Bw)p4wNPBq0rrx(uJ", "ln": 6208 }, { "b": "BxrD?q!Q8.uQP0ir@\u0026p9CY)}wgbn\u003eg6gC=ArBnG]CTkXonO}4aC#WHa0rrmCnO05D00^yMCYV?(Cl4WNoLO0Vvj#IfBt3S(oGJmP25XN2y?mF+00EQpDuPw\u00264Slc4xL.]}yi:OYw[bJQ024UnsyCMMnkz/:q=cB^uU9?yBPzEEx(){6oL58x01-TKB8LA2v%zV]xlODgw{agP2YK/}C1DN-zVG?tx(i}Ka8kkcvj#C9zF7Q$B.$P0AZ\u003c$/zddJPCW*", "ln": 6763 }, { "b": "z.BC1w[CQ{wN[wIAcln3BAg@3z3H9/0rr@+oLO0Vvj#tkfg*52B-ZM7A+eV@j1jhs04!l03iwGO^G6s*ygho]fkktTlv0V:l2}0OC#5N8Acln3BAg@3z3H9\u003e3iwVSf984QA+eV\u00263\u003c1@WG:E\u003ec0Ov!YLMlNF0O4k80rrmzx)Kt00O^We3iwVT?2NG-Bz\u003cG\u003eBy^:UA::j]00BY0ts5-0?VqTx0O4kf0rs-2oLO0Vvj#Ijz.CQlvrcB2Bt30{vrcB2Bup{Bygho]fkL6mxd)h9A+PA7i$8aK0PKH/!Da.i022H{LzXv*HWRsC\u0026Gow:Lzwd^Jr/NE0rrpAAbolg0rsF}oLO0Vvj#C9zF7R3BAh8kxfdLDoLO0Vvj#C9zF7R3Bn", "ln": 7019 }, { "b": "xME0\u003cB8?oY87nf[vrM6jx(tT@zG6-uq/)4\u003evqO7Pts5-1blxa$00iiF0rruMts7[Mdm\u003c{G/8^rb0NH(@0@@(j015+S0e*{V0SSi300K=PlmCFm0Omx83iwGPe=+}Sc%G2fnHWWG0H9Tt3iwVUf-.n4c}N9EvrM6jy*?i]fh($kx(mMBoLO0Vvj#+Bx(2B%vq[qjlmC}z04!md3igzmgYWNTvMsC?5P}#1z!r]{D3TvwAcbD0vS.XK3$i1zuTEe.noK", "ln": 8104 }, { "b": "B3:kKq!XZdryP}XuR:K4Bo8vBphBo6k(*@\u003ey?W:2Bu$4]0rrNNwOV9?BAqwcB7w=?0rsinygho]fkktTlv0V:l2}0OC#5N8Acln3BAg@3z94:#2u+LzwOS#y0rrpnz/]@d0rrvbwjHO}g\u003cG9425[0\u003evqN?403a:FvrM6jx(tT\u003eB.kk%A+e=MzG6-uq/)4\u003evqO7b01\u0026TOA^hh6vR/y@v{@.:A+/K[00VL9fGAih0rr^SyK6C$xkZWnuT#]ipHu\u003c^wKMR11BjYXxA", "ln": 8451 }, { "b": "00EdXzeYHQ0yD\u003e/6lcPCsyk=XB9.hirDh}:z/[JV0rrWtA:@{dD0+b}y*Rd1vq](Z38\u003c+C175#*1{1Yvygho]fkktTl$7gCpJZ+#B-ZM7A+eV@2lIKs02WgUygho]fkktTpJZ+#B-ZM7A+eV@j1jhs04!n^3iE)xZx1ruzEEB3rb3hX3\u003calDP:y/W0(t9v000000rr61019{\u003cx()]+xM4{k3\u003caAGIv6A#0(\u003erwa(]Pkuf4#ZBl/B3)T.d(Rlo9:M/\u003c:C(z.bTNz4)Y", "ln": 9612 }, { "b": ")!c*y8vJvZ+\u0026jY/2jp1vgYG+11V0u.C\u003e@qN[ce8nn9R(XG@+pP3u{J8By^^:By/I40]0.Y3iE)x*Ymx[ygho]fkL6mxd)e9zGGPfwKQ\u0026NwPh:9z/b^Y?t)P[c}[w:C404uvqYZhra{q\u003cCvs@%wJItw3\u0026?\u003cX\u00260GLy0]TdW5nC($D2co0q*z\u003e!zC+4.ASDdzv%8*jg64vQqVM\u003ebydJFnBy^*glVuyg0rr\u003cdygho]fkktTnL.^1v}xR3x(v(J0rrmswO%va00", "ln": 9876 }, { "b": "vrM6jB-.tlfg68*wI#v\u003cmq=QNwmY^y3\u003cch9}3E9p0@q]$4ThSexM53np*))Bx(mL(0@Jb}3ig.v@q=)dwO#0@wmX.Uq/)4]zF6vV@@O.#022Cm0rtE()5#=nMx76{Z3*=O\u003ce6iLI?{G6WD$9b\u0026*lXbN3l#}Me!Zg)UXNpW$9?FVF}j-\u003c^p.\u0026H)^q0Lj1j8\u003c*Q0hUC}\u003cg0S-oq\u0026K%)dJFDbz(.g3hYObKdG4uNWP[9sL0%wS8ik}3wQ)HnoSP5G8(8glzL.N\u00267\u003caA0MSFOQb\u003c!XlYVe}*O\u003eBYA", "ln": 10223 }, { "b": "D0+2]o*Jb:xhRVns.8Ox0rryCwPI*ezGxv\u003eTbt}01f-zU@SsS$(HUhf96$wx^/wMW0rr^FvrM6jzFs2xlv0V:luM)LwPw1TgxvEUCxdbh0rr#=ts6=jygho]fk+Gxfg6@awKpJKw[u0A3\u003ceu?hvoKy12*kX2XNZ\u003cq!Q8\u0026Bo8vzc[e76133DA3iJ9!i%bD.Fb/VK0rr6100D}OC0Mce7:@6)vrM6jzFs2xlv0V:luM)LwPx\u003cYrTY6{13^g[0S@", "ln": 11114 }, { "b": "v}tVve*%zdvrM6jy*?i]fh($kx(mMBdnjF+C42RGzE)]yB8#dJq=uvSz/fVdCYV1Q1bWhs3iMa!I#-[%ygho]CRr@CBt4YRy+F+dB-RU0vqYH^wPw1TJTt:\u003c051uM8FSY7vj#Xkv%8*aBA]JrwN/\u003e6wL#@Own=q\u00261cA])K]Nco00E1Nx(\u003cvQs14oDygho]CRr@CBt4YRy+FB)C$?Z+vp%d(j6Lx[vrM77fk+uyflqhJfh#$mB97b+zEEf?AYV%fvrM6jB7F\u003c7A+PSvfh(B(B-I4\u003evqYQ]z96gE3\u003chZ@L)NRI1c@@/5nbM@q/ueYwPQyIv@#TfC(W)?c[d\u00268vrM77fk+uyflqhJfh\u003e!yq/ueYwPQyIv@#R", "ln": 12168 }, { "b": "FJ0]GCd4xqpa:f.wg.dBhuURC6:e4IwhTPa1?U111{l:*6:CDSQ5VkL1@dv{6:DME6:krS6:eF-g\u003eH(\u003cGA?KQ%kyM\u0026jxSKaW/w]Fd\u003ey.h086J@00065RVlX%9rlg3@@sew2Npt(2ll\u003c\u003e06yF^l\u0026^q[07l?/03IDw0000w00riX08@@x03hau05%%T0c!F+0096V08@@z03haw1e(h100Ao505:}U0000d0@$mW003Qh003Ti000r9Dh@o(", "ln": 13500 }, { "b": "1HXq=1y@kJwhTU70eT?[2dBO\u003eiTk:B2O^QW2bh8D83.2Z1qI8F6:OiQ0d#c(1qIgS1-N\u003eT0e1*BWG8y\u003cGA}QR%je4)WG8Kwd\u003eAoZ086J@00065RVlX%irffY02CRx2ll\u003c\u003e06yF^jo\u003e\u0026%0000000961@@stB3i{L[2ll\u003c\u003e06yF^4*J7%0rAA9I2^RS04XkH0000G00Aor0ak!(03hau02CSy0g0Qa0096o0ak![03haw02CSy0gi:l00rt4000040096T1eC[%00idF1e#n201/tlhVJ*Tw=I/hx8?]ipxgv{2({v[DJjfJR2QF}?V9(Y3JHebEg?#b2]9:VNT=3tPA2/y0gL[N76$VPOOp1?76$VPPmY6e5#8/mlokk!1IL1H83Bq6hu:%3Z7*/Z1y%y{6:zqOiTk:B2O^QW2bh8u83Z(Z83yVWg-lAh1@dyU1-N\u003caF%6b!2MZ\u003e6?[5\u003eJsS4EN07OH?eg[viorXx@00in20000w00sFC03?KJ2ll\u003c\u003e06yF^jo\u003e\u0026%2lmc)0s5P)0rr9A1eV4#04E%K03.FE0hxJn0000z09Pw#03hav03.FE0hPVp00icB09Px104d:G1e(h100Ao505:}P000020dj)F0000", "ln": 13751 }, { "b": "WG5SP9t]\u003e1g=ux)9LJmfwcuB39#b)g1V^+dhx-!U6^6dIbPdZtaShpn9T2\u003c=aZ^bA9rW926=}s4g\u003eH(\u003cGDQw]%j+c=jxSKAW/w]V2]J]P0m]c\u0026E\u0026eLg1?1AZiWD*jY8WW\u003cW/C1$b^)Zb65kI{872D]0e0fS878=(HxIc5cUba-Y8WW\u003c6!3J\u003eJ5\u0026x\u0026hyYB\u003e6!2^Rdh:MLciL5hu\u003e\u003ee0WG7{$ciL5k6^)%dWG7}\u003cLc$vLsa\u002647R#Lr=dyGkvWGb20cai*cWG8KM2]J@S0n])BY8Z?[W/CCH3Mfr+\u003cHb6K84j4R\u003e#!(h6:IhF)6lSVWGb\u003eo3:G^8WGc4p2:\u003eWVVh\u003cXr3Mfc-2l.En%g!ToiT(@oWGcK)4Jb+*0s8:B2dBQuXb^eH0tVK.69e@U075Z#87+}Ehzb\u003e0Z7\u0026nh1y%zz6!^i6iXQT]f+(zTfqnB(888^W87=NQ1yI%0u]e-M1qJTae]UhPF%6b!f-!iL*Q^CFsS5{507TD#8Yo854Z(xW84B1Pa@H?J45T7g84eFl84r}OcoqON47lf^iU5+4Icmp//e:AW4\u003et0/*7KGrWG5SPg-naLg=vieg}\u003c966/xIWhwFc.1V!NShuWLGi2aAx03\u0026Bv6/W6/1qJ!46/YOT88IEhi2aq\u0026u]iD", "ln": 14476 }, { "b": "WG5SPi#H9Zg=vDljh7\u0026d6*c1+jRZb)1V!*HhA}{v6*nn\u003ebPe=Xkn=J=6*b\u003eskvuq=i%lo.6*cCyg?q+HGG/Hn%j+c=jxSK=W/w}b0npG(4?!$2iZKYJ1gwhZhBwuGWG86=wedExhBLdSIcgMYW/zvFmftCq6?e{aQ5VRWmhXz{6*(vzmQSU8GbD#U6?e{9Aa39OGjHdN0fyonmGGB!!!{]+0f\u003c[(*8ga60npG?2:\u003eV26:CrKYpYcm6:QldCOHC{p[E-c84NwYhNSPLi.phX12I]d8a?KBwedZEhCj=TYAHt\u002612-)?p8cA@03\u0026BQ6\u00262Sr1qKKp6\u00265c[8a:@Cp8cxuu]iE#rFj9FR#LG^os$A?o=lRb8bghFosL0", "ln": 15019 }, { "b": "1R?ig01x!G0#h0F0SLg-83EwF^u%$sRVre61HXvn5d(tMx/leg2atI@RVqC^2d$j52lM\u003c\u00266:LJUQ5XNJ83Z(Z6:txUwvqLOhvg2#yC(Im3kiFRPA3XW0=f+46:+GRCM", "ln": 36193 } ], "depth": 1, "facts": { "imp": [ [ "", "java/lang/NumberFormatException" ], [ "", "java/net/URL" ], [ "", "javax/net/ssl/SSLParameters" ], [ "", "java/lang/Throwable" ], [ "", "java/security/SecureRandom" ], [ "", "java/io/BufferedInputStream" ], [ "", "java/lang/Object" ], [ "", "javax/net/ssl/SSLSocket" ], [ "", "javax/net/ssl/SNIHostName" ], [ "", "java/util/Map$Entry" ], [ "", "java/util/Base64" ], [ "", "javax/net/ssl/SSLSocketFactory" ], [ "", "java/util/List" ], [ "", "java/lang/System" ], [ "", "com/github/lv_dvyzvc_bc$toQisru" ], [ "", "[B" ], [ "", "[Ljava/lang/String;" ], [ "", "java/io/DataOutputStream" ], [ "", "java/lang/Exception" ], [ "", "com/github/lv_dvyzvc_bc$fjHnPEp" ], [ "", "java/util/Map" ], [ "", "java/io/ByteArrayOutputStream" ], [ "", "java/net/Socket" ], [ "", "java/lang/RuntimeException" ], [ "", "javax/net/ssl/SSLContext" ], [ "", "java/nio/charset/StandardCharsets" ], [ "", "[C" ], [ "", "javax/net/ssl/TrustManager" ], [ "", "java/lang/StringBuilder" ], [ "", "java/io/OutputStream" ], [ "", "java/util/Set" ], [ "", "java/lang/invoke/MethodHandles" ], [ "", "java/net/InetSocketAddress" ], [ "", "java/lang/invoke/MethodHandles$Lookup" ], [ "", "java/lang/Integer" ], [ "", "java/lang/String" ], [ "", "java/util/LinkedHashMap" ], [ "", "java/util/concurrent/ConcurrentHashMap" ], [ "", "java/nio/ByteBuffer" ], [ "", "java/util/Base64$Encoder" ], [ "", "java/net/URI" ], [ "", "java/util/Iterator" ], [ "", "java/io/IOException" ], [ "", "com/github/lv_dvyzvc_bc$tIeI9CfBxXX" ], [ "", "java/io/InputStream" ], [ "java/net/URL", "java/net/URL.getPath" ], [ "java/net/URL", "getPath" ], [ "java/io/BufferedInputStream", "java/io/BufferedInputStream.read" ], [ "java/io/BufferedInputStream", "read" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.getInt" ], [ "java/nio/ByteBuffer", "getInt" ], [ "com/github/lv_dvyzvc_bc", "com/github/lv_dvyzvc_bc.uGIFYWdDGW" ], [ "com/github/lv_dvyzvc_bc", "uGIFYWdDGW" ], [ "java/lang/String", "java/lang/String.indexOf" ], [ "java/lang/String", "indexOf" ], [ "com/github/lv_dvyzvc_bc", "com/github/lv_dvyzvc_bc.gqvA" ], [ "com/github/lv_dvyzvc_bc", "gqvA" ], [ "java/lang/String", "java/lang/String.getBytes" ], [ "java/lang/String", "getBytes" ], [ "javax/net/ssl/SSLSocket", "javax/net/ssl/SSLSocket.setSSLParameters" ], [ "javax/net/ssl/SSLSocket", "setSSLParameters" ], [ "java/util/concurrent/ConcurrentHashMap", "java/util/concurrent/ConcurrentHashMap.\u003cinit\u003e" ], [ "java/util/concurrent/ConcurrentHashMap", "\u003cinit\u003e" ], [ "java/lang/Integer", "java/lang/Integer.parseInt" ], [ "java/lang/Integer", "parseInt" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.toByteArray" ], [ "java/io/ByteArrayOutputStream", "toByteArray" ], [ "javax/net/ssl/SSLSocket", "javax/net/ssl/SSLSocket.getSSLParameters" ], [ "javax/net/ssl/SSLSocket", "getSSLParameters" ], [ "com/github/lv_dvyzvc_bc", "com/github/lv_dvyzvc_bc.jrOqnurhDzhar" ], [ "com/github/lv_dvyzvc_bc", "jrOqnurhDzhar" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "javax/net/ssl/SSLSocketFactory", "javax/net/ssl/SSLSocketFactory.createSocket" ], [ "javax/net/ssl/SSLSocketFactory", "createSocket" ], [ "java/net/Socket", "java/net/Socket.getInputStream" ], [ "java/net/Socket", "getInputStream" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.getShort" ], [ "java/nio/ByteBuffer", "getShort" ], [ "java/security/SecureRandom", "java/security/SecureRandom.\u003cinit\u003e" ], [ "java/security/SecureRandom", "\u003cinit\u003e" ], [ "javax/net/ssl/SSLSocket", "javax/net/ssl/SSLSocket.close" ], [ "javax/net/ssl/SSLSocket", "close" ], [ "java/util/Map", "java/util/Map.get" ], [ "java/util/Map", "get" ], [ "java/util/Map$Entry", "java/util/Map$Entry.getKey" ], [ "java/util/Map$Entry", "getKey" ], [ "java/util/List", "java/util/List.of" ], [ "java/util/List", "of" ], [ "java/io/BufferedInputStream", "java/io/BufferedInputStream.read" ], [ "java/io/BufferedInputStream", "read" ], [ "java/net/URL", "java/net/URL.getProtocol" ], [ "java/net/URL", "getProtocol" ], [ "com/github/lv_dvyzvc_bc$tIeI9CfBxXX", "com/github/lv_dvyzvc_bc$tIeI9CfBxXX.\u003cinit\u003e" ], [ "com/github/lv_dvyzvc_bc$tIeI9CfBxXX", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.toCharArray" ], [ "java/lang/String", "toCharArray" ], [ "com/github/lv_dvyzvc_bc", "com/github/lv_dvyzvc_bc.handlePcxgd" ], [ "com/github/lv_dvyzvc_bc", "handlePcxgd" ], [ "java/io/BufferedInputStream", "java/io/BufferedInputStream.read" ], [ "java/io/BufferedInputStream", "read" ], [ "java/lang/RuntimeException", "java/lang/RuntimeException.\u003cinit\u003e" ], [ "java/lang/RuntimeException", "\u003cinit\u003e" ], [ "java/io/OutputStream", "java/io/OutputStream.write" ], [ "java/io/OutputStream", "write" ], [ "com/github/lv_dvyzvc_bc$toQisru", "com/github/lv_dvyzvc_bc$toQisru.\u003cinit\u003e" ], [ "com/github/lv_dvyzvc_bc$toQisru", "\u003cinit\u003e" ], [ "java/util/Base64$Encoder", "java/util/Base64$Encoder.encodeToString" ], [ "java/util/Base64$Encoder", "encodeToString" ], [ "com/github/lv_dvyzvc_bc$fjHnPEp", "com/github/lv_dvyzvc_bc$fjHnPEp.\u003cinit\u003e" ], [ "com/github/lv_dvyzvc_bc$fjHnPEp", "\u003cinit\u003e" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.toString" ], [ "java/io/ByteArrayOutputStream", "toString" ], [ "java/util/Map", "java/util/Map.entrySet" ], [ "java/util/Map", "entrySet" ], [ "java/lang/String", "java/lang/String.startsWith" ], [ "java/lang/String", "startsWith" ], [ "java/util/LinkedHashMap", "java/util/LinkedHashMap.\u003cinit\u003e" ], [ "java/util/LinkedHashMap", "\u003cinit\u003e" ], [ "javax/net/ssl/SSLContext", "javax/net/ssl/SSLContext.getInstance" ], [ "javax/net/ssl/SSLContext", "getInstance" ], [ "java/lang/String", "java/lang/String.\u003cinit\u003e" ], [ "java/lang/String", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.equals" ], [ "java/lang/String", "equals" ], [ "java/lang/String", "java/lang/String.length" ], [ "java/lang/String", "length" ], [ "javax/net/ssl/SSLSocket", "javax/net/ssl/SSLSocket.getOutputStream" ], [ "javax/net/ssl/SSLSocket", "getOutputStream" ], [ "java/io/InputStream", "java/io/InputStream.read" ], [ "java/io/InputStream", "read" ], [ "java/nio/charset/StandardCharsets", "java/nio/charset/StandardCharsets.UTF_8" ], [ "java/nio/charset/StandardCharsets", "UTF_8" ], [ "java/io/InputStream", "java/io/InputStream.read" ], [ "java/io/InputStream", "read" ], [ "java/net/Socket", "java/net/Socket.getOutputStream" ], [ "java/net/Socket", "getOutputStream" ], [ "java/net/URI", "java/net/URI.create" ], [ "java/net/URI", "create" ], [ "java/lang/String", "java/lang/String.charAt" ], [ "java/lang/String", "charAt" ], [ "java/lang/String", "java/lang/String.trim" ], [ "java/lang/String", "trim" ], [ "com/github/lv_dvyzvc_bc", "com/github/lv_dvyzvc_bc.saveMkphst" ], [ "com/github/lv_dvyzvc_bc", "saveMkphst" ], [ "java/net/Socket", "java/net/Socket.setSoTimeout" ], [ "java/net/Socket", "setSoTimeout" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.\u003cinit\u003e" ], [ "java/io/ByteArrayOutputStream", "\u003cinit\u003e" ], [ "com/github/lv_dvyzvc_bc$tIeI9CfBxXX", "com/github/lv_dvyzvc_bc$tIeI9CfBxXX.ip" ], [ "com/github/lv_dvyzvc_bc$tIeI9CfBxXX", "ip" ], [ "com/github/lv_dvyzvc_bc", "com/github/lv_dvyzvc_bc.fsipTscwEakfhsPrsr" ], [ "com/github/lv_dvyzvc_bc", "fsipTscwEakfhsPrsr" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.setLength" ], [ "java/lang/StringBuilder", "setLength" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.hasRemaining" ], [ "java/nio/ByteBuffer", "hasRemaining" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.write" ], [ "java/io/ByteArrayOutputStream", "write" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.\u003cinit\u003e" ], [ "java/io/ByteArrayOutputStream", "\u003cinit\u003e" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.toString" ], [ "java/lang/StringBuilder", "toString" ], [ "javax/net/ssl/SSLSocket", "javax/net/ssl/SSLSocket.startHandshake" ], [ "javax/net/ssl/SSLSocket", "startHandshake" ], [ "java/net/URL", "java/net/URL.getPort" ], [ "java/net/URL", "getPort" ], [ "com/github/lv_dvyzvc_bc", "com/github/lv_dvyzvc_bc.buildTbjcitx" ], [ "com/github/lv_dvyzvc_bc", "buildTbjcitx" ], [ "java/lang/String", "java/lang/String.substring" ], [ "java/lang/String", "substring" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.position" ], [ "java/nio/ByteBuffer", "position" ], [ "java/lang/System", "java/lang/System.arraycopy" ], [ "java/lang/System", "arraycopy" ], [ "com/github/lv_dvyzvc_bc", "com/github/lv_dvyzvc_bc.ypdY_J" ], [ "com/github/lv_dvyzvc_bc", "ypdY_J" ], [ "javax/net/ssl/SSLContext", "javax/net/ssl/SSLContext.init" ], [ "javax/net/ssl/SSLContext", "init" ], [ "java/lang/String", "java/lang/String.indexOf" ], [ "java/lang/String", "indexOf" ], [ "java/net/Socket", "java/net/Socket.connect" ], [ "java/net/Socket", "connect" ], [ "java/lang/String", "java/lang/String.split" ], [ "java/lang/String", "split" ], [ "java/util/Iterator", "java/util/Iterator.hasNext" ], [ "java/util/Iterator", "hasNext" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.size" ], [ "java/io/ByteArrayOutputStream", "size" ], [ "java/lang/String", "java/lang/String.substring" ], [ "java/lang/String", "substring" ], [ "com/github/lv_dvyzvc_bc", "com/github/lv_dvyzvc_bc.gh_gfhf_njgti_obaors" ], [ "com/github/lv_dvyzvc_bc", "gh_gfhf_njgti_obaors" ], [ "java/io/DataOutputStream", "java/io/DataOutputStream.writeByte" ], [ "java/io/DataOutputStream", "writeByte" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.get" ], [ "java/nio/ByteBuffer", "get" ], [ "java/lang/String", "java/lang/String.toLowerCase" ], [ "java/lang/String", "toLowerCase" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.write" ], [ "java/io/ByteArrayOutputStream", "write" ], [ "com/github/lv_dvyzvc_bc", "com/github/lv_dvyzvc_bc.cw_hgbenp_clhqw_ndy" ], [ "com/github/lv_dvyzvc_bc", "cw_hgbenp_clhqw_ndy" ], [ "com/github/lv_dvyzvc_bc", "com/github/lv_dvyzvc_bc.wzRzD" ], [ "com/github/lv_dvyzvc_bc", "wzRzD" ], [ "java/net/URL", "java/net/URL.getQuery" ], [ "java/net/URL", "getQuery" ], [ "java/lang/System", "java/lang/System.currentTimeMillis" ], [ "java/lang/System", "currentTimeMillis" ], [ "javax/net/ssl/SSLSocket", "javax/net/ssl/SSLSocket.getInputStream" ], [ "javax/net/ssl/SSLSocket", "getInputStream" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ], [ "java/util/Map", "java/util/Map.put" ], [ "java/util/Map", "put" ], [ "com/github/lv_dvyzvc_bc$tIeI9CfBxXX", "com/github/lv_dvyzvc_bc$tIeI9CfBxXX.isExpired" ], [ "com/github/lv_dvyzvc_bc$tIeI9CfBxXX", "isExpired" ], [ "com/github/lv_dvyzvc_bc", "com/github/lv_dvyzvc_bc.vcUlsoq" ], [ "com/github/lv_dvyzvc_bc", "vcUlsoq" ], [ "javax/net/ssl/SSLParameters", "javax/net/ssl/SSLParameters.setServerNames" ], [ "javax/net/ssl/SSLParameters", "setServerNames" ], [ "java/util/Base64", "java/util/Base64.getUrlEncoder" ], [ "java/util/Base64", "getUrlEncoder" ], [ "javax/net/ssl/SNIHostName", "javax/net/ssl/SNIHostName.\u003cinit\u003e" ], [ "javax/net/ssl/SNIHostName", "\u003cinit\u003e" ], [ "java/io/DataOutputStream", "java/io/DataOutputStream.writeShort" ], [ "java/io/DataOutputStream", "writeShort" ], [ "java/net/URL", "java/net/URL.getHost" ], [ "java/net/URL", "getHost" ], [ "java/lang/String", "java/lang/String.equalsIgnoreCase" ], [ "java/lang/String", "equalsIgnoreCase" ], [ "java/util/Base64$Encoder", "java/util/Base64$Encoder.withoutPadding" ], [ "java/util/Base64$Encoder", "withoutPadding" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "com/github/lv_dvyzvc_bc", "com/github/lv_dvyzvc_bc.rjxEcgaQskpig" ], [ "com/github/lv_dvyzvc_bc", "rjxEcgaQskpig" ], [ "java/io/DataOutputStream", "java/io/DataOutputStream.writeBytes" ], [ "java/io/DataOutputStream", "writeBytes" ], [ "java/net/Socket", "java/net/Socket.\u003cinit\u003e" ], [ "java/net/Socket", "\u003cinit\u003e" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.get" ], [ "java/nio/ByteBuffer", "get" ], [ "java/nio/charset/StandardCharsets", "java/nio/charset/StandardCharsets.ISO_8859_1" ], [ "java/nio/charset/StandardCharsets", "ISO_8859_1" ], [ "javax/net/ssl/SSLParameters", "javax/net/ssl/SSLParameters.setEndpointIdentificationAlgorithm" ], [ "javax/net/ssl/SSLParameters", "setEndpointIdentificationAlgorithm" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.position" ], [ "java/nio/ByteBuffer", "position" ], [ "javax/net/ssl/SSLContext", "javax/net/ssl/SSLContext.getSocketFactory" ], [ "javax/net/ssl/SSLContext", "getSocketFactory" ], [ "java/lang/String", "java/lang/String.isEmpty" ], [ "java/lang/String", "isEmpty" ], [ "java/net/InetSocketAddress", "java/net/InetSocketAddress.\u003cinit\u003e" ], [ "java/net/InetSocketAddress", "\u003cinit\u003e" ], [ "java/util/Iterator", "java/util/Iterator.next" ], [ "java/util/Iterator", "next" ], [ "com/github/lv_dvyzvc_bc", "com/github/lv_dvyzvc_bc.YEZQVGHa" ], [ "com/github/lv_dvyzvc_bc", "YEZQVGHa" ], [ "com/github/lv_dvyzvc_bc", "com/github/lv_dvyzvc_bc.YB_P2CJ" ], [ "com/github/lv_dvyzvc_bc", "YB_P2CJ" ], [ "com/github/lv_dvyzvc_bc$fjHnPEp", "com/github/lv_dvyzvc_bc$fjHnPEp.body" ], [ "com/github/lv_dvyzvc_bc$fjHnPEp", "body" ], [ "javax/net/ssl/SSLSocketFactory", "javax/net/ssl/SSLSocketFactory.getDefault" ], [ "javax/net/ssl/SSLSocketFactory", "getDefault" ], [ "java/lang/Integer", "java/lang/Integer.parseInt" ], [ "java/lang/Integer", "parseInt" ], [ "java/io/BufferedInputStream", "java/io/BufferedInputStream.\u003cinit\u003e" ], [ "java/io/BufferedInputStream", "\u003cinit\u003e" ], [ "java/net/URI", "java/net/URI.toURL" ], [ "java/net/URI", "toURL" ], [ "java/net/Socket", "java/net/Socket.close" ], [ "java/net/Socket", "close" ], [ "java/lang/String", "java/lang/String.contains" ], [ "java/lang/String", "contains" ], [ "java/io/OutputStream", "java/io/OutputStream.flush" ], [ "java/io/OutputStream", "flush" ], [ "java/net/Socket", "java/net/Socket.setReceiveBufferSize" ], [ "java/net/Socket", "setReceiveBufferSize" ], [ "java/lang/System", "java/lang/System.nanoTime" ], [ "java/lang/System", "nanoTime" ], [ "java/util/Map$Entry", "java/util/Map$Entry.getValue" ], [ "java/util/Map$Entry", "getValue" ], [ "com/github/lv_dvyzvc_bc", "com/github/lv_dvyzvc_bc.LdtjMWj" ], [ "com/github/lv_dvyzvc_bc", "LdtjMWj" ], [ "com/github/lv_dvyzvc_bc", "com/github/lv_dvyzvc_bc.pek8SSFeFvxSk" ], [ "com/github/lv_dvyzvc_bc", "pek8SSFeFvxSk" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/util/Set", "java/util/Set.iterator" ], [ "java/util/Set", "iterator" ], [ "com/github/lv_dvyzvc_bc", "com/github/lv_dvyzvc_bc.mExvkzvdc" ], [ "com/github/lv_dvyzvc_bc", "mExvkzvdc" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.wrap" ], [ "java/nio/ByteBuffer", "wrap" ], [ "com/github/lv_dvyzvc_bc", "com/github/lv_dvyzvc_bc.qWau6Z" ], [ "com/github/lv_dvyzvc_bc", "qWau6Z" ], [ "java/io/DataOutputStream", "java/io/DataOutputStream.\u003cinit\u003e" ], [ "java/io/DataOutputStream", "\u003cinit\u003e" ] ], "metrics": { "file": { "size": 44191, "entropy": 5.22 }, "class": { "major_version": 65, "interface_count": 0, "method_ref_count": 129, "constant_pool_size": 940, "external_class_count": 45 }, "binary": { "peak_region_bytes": 4096, "peak_region_entropy": 7.08 }, "imports": { "count": 174 }, "functions": { "count": 16 } } }, "id": 5, "mol": "O₂(AsI)H₄(Cm₅Db₃OsPo₂)", "path": "dupe-2.jar!!com/github/lv_dvyzvc_bc.class", "pid": 0, "risk": 10, "sha": "87913d8477b0a5f2eeea29c1de8bffae0ef0be7642eb49c2d714b7a3a7a253a0", "size": 44191, "traits": [ { "id": "micro-behaviors/communications/http/lib/urlconnection::java-url-class-bytecode", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Java URL class reference", "spans": [ [ 2751, 16 ], [ 2780, 12 ], [ 6827, 14 ] ] }, { "id": "micro-behaviors/communications/http/lib/urlconnection::jvm-url-class-ref", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "JVM URL class reference" }, { "id": "micro-behaviors/communications/proxy/tunnel::byte-output-stream", "atk": "T1090", "mbc": "C0003", "conf": 0.5, "crit": 3, "desc": "Java ByteArrayOutputStream usage", "spans": [ [ 704, 21 ], [ 2266, 21 ], [ 6280, 21 ], [ 7091, 21 ], [ 7158, 21 ], [ 7175, 21 ], [ 8515, 21 ] ] }, { "id": "micro-behaviors/communications/proxy/tunnel::inet-socket-address", "atk": "T1090", "mbc": "C0003", "conf": 0.6, "crit": 3, "desc": "Java InetSocketAddress reference", "spans": [ [ 705, 17 ], [ 3330, 17 ] ] }, { "id": "micro-behaviors/communications/socket/create::java-socket-bytecode-reference", "atk": "T1071", "mbc": "C0001", "conf": 0.86, "crit": 3, "desc": "Java bytecode socket reference", "spans": [ [ 3545, 56 ], [ 6524, 17 ] ] }, { "id": "micro-behaviors/communications/socket/create::java-socket-class-import", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "Java imports the network socket class", "spans": [ [ 3257, 15 ] ] }, { "id": "micro-behaviors/communications/socket/create::java-socket-slash-reference", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "Java slash-form socket reference", "spans": [ [ 3257, 15 ], [ 3408, 28 ], [ 3545, 56 ], [ 6524, 17 ] ] }, { "id": "micro-behaviors/communications/socket/create::jvm-socket-class-ref", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "JVM socket class reference" }, { "id": "micro-behaviors/communications/socket/framing::bytebuffer-transport", "atk": "T1573", "conf": 1.0, "crit": 3, "desc": "Java byte-buffer transport type", "spans": [ [ 11178, 10 ] ] }, { "id": "micro-behaviors/communications/socket/framing::data-stream-transport", "atk": "T1573", "conf": 1.0, "crit": 3, "desc": "Java data-stream transport type", "spans": [ [ 9684, 16 ] ] }, { "id": "micro-behaviors/communications/socket/send::java-dataoutputstream-class", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "Java DataOutputStream class reference", "spans": [ [ 9676, 24 ] ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-sslcontext-trustmanager-init-call", "conf": 0.94, "crit": 3, "desc": "JVM SSLContext.init trust-manager call", "spans": [ [ 12306, 29 ] ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-sslparameters-set-server-names", "conf": 0.93, "crit": 3, "desc": "JVM sets TLS SNI server name", "spans": [ [ 3878, 42 ] ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-sslsocket-handshake-call", "conf": 0.94, "crit": 3, "desc": "JVM SSLSocket.startHandshake call", "spans": [ [ 4077, 38 ] ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-trustmanager-class-ref", "conf": 0.9, "crit": 3, "desc": "JVM TrustManager interface reference", "spans": [ [ 12232, 26 ] ] }, { "id": "micro-behaviors/data/buffer/transfer::bytearrayoutputstream-ref", "conf": 0.88, "crit": 3, "desc": "Java ByteArrayOutputStream class", "spans": [ [ 7083, 29 ] ] }, { "id": "micro-behaviors/data/buffer/transfer::jvm-outputstream-write", "conf": 0.96, "crit": 2, "desc": "JVM writes bytes to output stream", "spans": [ [ 6272, 0 ] ] }, { "id": "micro-behaviors/data/encode/base64::jvm-base64-encode-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM Base64 encodeToString call", "spans": [ [ 10287, 39 ] ] }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method", "spans": [ [ 2258, 8 ] ] }, { "id": "micro-behaviors/os/sysinfo/hostname::jvm-hostname-command-literal", "atk": "T1082", "mbc": "E1082", "conf": 0.9, "crit": 3, "desc": "JVM hostname command literal" }, { "id": "micro-behaviors/process/create/spawn::java-runtime-class", "atk": "T1059", "mbc": "E1203", "conf": 0.86, "crit": 3, "desc": "Java Runtime class reference", "spans": [ [ 9940, 17 ] ] }, { "id": "micro-behaviors/process/info/current::getpath-ref", "conf": 0.8, "crit": 3, "desc": "Java getPath call reference" }, { "id": "objectives/anti-static/obfuscation/string/control-prefix::java-control-prefixed-long-string", "atk": "T1027", "mbc": "F0001", "conf": 0.92, "crit": 3, "desc": "Java string starts with control-length prefix" }, { "id": "objectives/impact/dos/disk::jvm-megabyte-byte-array-constant", "atk": "T1499.001", "conf": 0.94, "crit": 3, "desc": "JVM one-megabyte allocation constant", "spans": [ [ 8168, 14 ] ] }, { "id": "objectives/impact/dos/disk::jvm-two-backward-goto-branches", "atk": "T1499.001", "conf": 0.9, "crit": 3, "desc": "JVM repeated counter backedges", "spans": [ [ 13564, 8 ], [ 13815, 8 ], [ 14114, 8 ], [ 14540, 8 ], [ 14665, 8 ], [ 14855, 8 ], [ 15083, 8 ], [ 15182, 8 ] ] }, { "id": "micro-behaviors/communications/socket/send::java-raw-socket-client-write", "atk": "T1071", "mbc": "C0001", "conf": 0.94, "crit": 3, "desc": "Java socket client writes request bytes through DataOutputStream", "uses": [ 5, 10, 16 ], "spans": [ [ 3257, 15 ], [ 6272, 26 ], [ 9676, 24 ] ] } ], "type": "java_class" }, { "ctx": [ { "b": "+kO#^0000+0L[^p5mYS}fk20vxMW=qBzj3Wzu*dx0rrWCvrM6jy*?i]fhD4(wN//!00rl4a8UUifj[T4A+P32v\u003eRnfx!Jh0wjZVMBzkf1x)Kuh2lj]d02PDVC404DBzkLAlsB}Dhz=WFzEWP}wPw1Q2ls/oygho]flIwJy+Fa-B7El^2lk5h00+@gv@C)?ASDd-ygho]fkL6mxd)84z!0v1B3+1-y?d9$bVnh:x(W={Bo.^O0rr%KvrM6jy*?i]fhMXcv}x.5luN0UwmY=^01G2f2VtkAx(W={Bo8v/ygho]fkL6mxd)$pC5Iecfhl21xM4ALvqYQ(wPGa\u003cz/oAlA0DvP0rsfQvrM6jy*?i]fkkrEz!\u0026]qo\u003ewAWz!8yEzE^M{A%zWU0rrr$z/oAlz#/}yjzwXEBuPZ911kQ03\u0026?4y7yycB02L.p4rCSrvqodvyhuKKs5Pb15\u003e(!Nz7/KoBzb/afly[]AbE-r01r^-nP5l:x\u003c\u003e*(DsWikg.B*k\u003e]zX]y1KAU1*Y+7HlCAK\u0026@$#I^{gXsjz\u003emnnvB/^=NCeF0rrWCvrM6jy*?i]fh#R9wNP9O045lS7xBHxBA@1vyFYg}A%@3$02C$x0STXX1PQ4N03Ve^C404uvqYZhx(n9jyH]d)vqPE:vngrPvp\u0026}TBz(hB2llsR01iTPByw=\u0026v@#TfC(W]?c}[w:C404uvqYZhx(n9jyH]d[wPRQ7wjQcDwnC*#bUSb{yJTOToLO0Vvj#C9zF7R3BAh8kxfe!4vrM5", "ln": 0 }, { "b": "fkL6mxd)e9zF\u0026((y?kWp05KWk5=.[ihur^]c}[w:C404uvqYZhqGV\u003e{vpB4:j1jhs02tL]3ihBNiro9-B97\u0026hBpndh02C$xcJDmf00)azByv:.wO?CF6K=e@yf#f]yHqmczffljuVg11wb#VSc}[w:C404uvqYZhq/)4]zF83WoLO0Vvj#C9zF7R3BAh8kxfca]0DOwcLnScVc!s@OFS$\u0026c1.nNuh7za/s{kOHq^q)m5c\u0026jo00\u0026M@0rr{JvrM6jy*?i]fh($kx(mMIB.LV5wPv", "ln": 800 }, { "b": "pxkeh00BYwdol\u0026S765gU089xg0rs8/lN+YzvrM6jy*?i]fh($kx(mMIB.LV5wPx\u003cv09YCx3ii:1Arc4BBz\u003e91A+PA70rr/ZdnjF+C404uvqYZhq/)4]zF83t0cncZ3ii:1BPzE:2\u003cl]k\u003ezuncRN$\u0026:WD1(])XcMxJjm@QU\u0026*+L\u003ezL@r0cXCzf:^f4JPmD#(7L-MG$MAJG6{16\u0026?h\u003e3L-Uj6M/bMG(58F2X3\u003eK}PY?ci\u0026\u003cc2XWT[++C(W)S", "ln": 1387 }, { "b": "C404uvqYZhmr\u0026rNAcb/jzu*f20$\u0026tb/8}.b6#f{-hTpwA01-)NC404uvqYZhq*ACawO?ULKPtB]v%8*jwO#P?x(dAQx(4Q1A@=myc[d:%0fWzE3ilj?L(Q\u003e3zE)]yze0)0v@=0\u0026Bt4cuvrlG%gCHM*0g9Y^3VfD%xM4A*f/p*y0rs5!dnjR\u003cBt4GBzE)r#vp\u003cQmv@bN{B6*ZTfGPWyNe\u0026V.0gi+Q0rrHAwPRQ7wm45Gg=LHo8Z)dezE)]yze0)0v@=0\u0026Bt4cuvrlG%gCQTC3\u0026(*#O^CE+0g%n(7J9/afkUAvwN/:?w]]Xoy*?yauO:C\u003e2lpB#01iTPBzbP6uOKC$gZ\u003cwV0cwLFQ5Z$\u002601iTPBzbP6uOKC$hvGO.0cwLFQ5.7(01rZQBzbP6uO\u003cO#f/Gak5?2h5ygho]flIwJy+F^*nKLSG0i2%#3il!2S@Shgygho]flIwJy+F^*nKJ^-TQk6h0cFqx0:wn40i=F7cfHS6(6Ny?FrPudFAARS\u003eA\u0026NuN2yc[GxX/2\u003caj-bX31\u003e/UltgiVh\u003c}ov@Diqxk8E3BZ^1Fw{3]P0jh+b25)E^BYJL(0jz(H3imElW/DEqv)Ti*y/\u003cd%vOfWr3\u0026)*rBp52Q0j\u0026ghbYmgnfj[T4A+P32v\u003eRUpvpS}\u0026fjw*lfgGwVA+P2Sz^^f/AT8PS0rr", "ln": 1865 }, { "b": "0lCMFWe.3A010pHBvp4:vqfP/0l+B+3imEl+(E!HAb]J4x(W+=07[Ukygho]fkL6mxd)h9A+PA7j4%x$C404uvqYZhq/)4]zF848ygho]fkL6mxd)h9A+PA7j1i\u003crvrM6jy*?i]fh($kx(mMB3\u0026[P", "ln": 2562 }, { "b": "A=U/lfh($3zE^f@wj73sA=U/lA%zZb0rrp6r7pjO0rs3iygho]fk+GxfjOW7A=U/lfgfzYA=U/li$8bL0o:Z?\u003c]BSD00)jGBv7m{wPE\u003eL9W\u003cY%vrM6jzFs2xv}Yp\u003eB7GCDlUG[GB7GCPdo/aE0p6TK3ii\u003c4)eWg%wO#0@wmX.Uq/)4]zF5$I7arxNdnjF+C404uvqYZhq/)4]zF83t0pG{S3igti[DnEiopVg8{+1i4w6Q9W0rsqG\u003eE)\u003eUM5\u003c)YO-#n\u003e)u+9rIN\u0026bRPY:7R\u003e:c$YJeu!ZViQE73JOiEBPzE%1($\u0026F\u003c?4RVXXl%NL\u003c1l@\u003cDMO7YPho?S]nPt\u003e-RR1L:ZZELiPVX\u0026EXJ4L9a*?JTbTX0ru1a\u0026KtcuTc8OLUi@YJ\u003c^g\u003e(XUXXLJn}gP(.6:fK?o[ISPO/6\u0026KuhYTg^Y6Jpa6W\u003c^9BzXpA$aS]HsD(.gruKE\u003e:fPYZ)q\u0026KuhYTe\u003eA\u003cJ0GBX0rs}W\u0026\u003cCPvGPLO$JPlyW\u003cfLGtWUA:]YZqM0\u003cc^HsWuY:XIq:hv)wuf", "ln": 3077 }, { "b": "Y6+x?(B\u0026kpQ}2(SWcT-R\u0026i]inMzK5qMe!0S)Z5LNINR(+VJ{NS0rrTBvrM6jy*?i]fgfL:B8}M!cij8WxjVfYA=l5hv@#B6zBwzWvqfPW03S*uoLO0Vvj#Xkv%8*aBA]JoA=l5hv@#B6zBwzWvqfQv3\u0026}:Sdgc860v!9I9+]bbvj#Xkv%8*aBA]JoA=l5hv@#B6zBwzWvqfP:0w1lK4qfl]lVlHDq/u/0v}tVv94imfygho]flpYmB-IhrC}RK6wmXXTB-H#6i$8cx0ws=XeDEKa02PDVC404BwN/\u003e6x([RNlVlHDq/u/0v}t(Cg64v.xjVfUz!0i$x(v\u003e\u002601ZLcoLO0Vvj#IfBt3S(oGJT-gYYDv0w::m0rrKyvrM6jzE)]yrz(G}0xp8W1:1V.qB{(?5gw#3ygho]fk+uyfi7[wi$8cJ0xQR?irqky03\u0026%^ygho]fk+uyfi7[wj1i\u003crvrM6jzFs2xw[=6)fhM80xGDR676cPb0lka80rtd=\u003c+e=SQo%v6J{B36(ANCIMyWrbYYB\u003cr\u003cFmB%Frxf8Gx/-", "ln": 4419 }, { "b": "c}[w:C404rz.BN]y?kWSoLO0Vvj#C9zF7R0A=kD0B8%V\u003cx(4r\u003eAWjK]wnc6}v@%^v0B(dv3igIowDq=uA+e=}A+e:5nP5G\u0026Bo8wac}[w:C404uvqYZhp\u0026ZF:wPI]VB.LV5wPx4]wN]H}wN/*zdnjF+C404uvqYZhp\u0026ZF:wPI]VB.LV5wPx\u003cv0CqBD3igOqx-Oi44EG?5\u0026J4K=VGO]J(7:TaPRZ?-JPV*\u0026\u003cc\u003eX+X}/m9ZuIqG\u003ezj=TQmHnAWbmRwYRjO^Kk(%#\u003eEXv?OWWTGWcb672MXYw00-", "ln": 5476 }, { "b": "0Dd#s26s=Mx(4tY01ZLcoLO0Vvj#tkfgGU(wJHq3Arg7/0lkaY0rrylAbYxawk)EQ0D!AN3igIoB].NMA+e=}A+e:5pJZ+#B-X2)CMzE+01P9Q0rr^NwN]H}wN/*JA=M8sq/)4\u003evqM2B9vL8uoLO0Vvj#C9zF7R0A=kD0B8%V\u003cx(4r\u003eAYTWgDJwH301P9U0rrBpx(W={Bz(hB0rsO$oLO0Vvj#tkfgGU(wJItmygho]fkL6mxd)84z!0v1B3+1-y?d9$i$8dt0E$HS4/}jZ02l[hoLO0Vvj#C9zF7R0A=kD0B8%zK06pjl3igOqGAh6l3gCc=(9b\u003c", "ln": 5764 }, { "b": "[3!$bYYue*:f$z]S{df-\u003eaO*uQkm\u0026#K)4$n2MZ4*02PDVC404wx(tUpx(4ulpJf(.pJgz\u0026z/b^XLk$T\u003eCxdztwM9X\u003ex(mL:09}0Dygho]fk+Gxfj[{mwIl\u003e*Bz9:fygho]fkL6mxd(R=vrbpTADL\u0026gv}v-aoLO0Vvj#Ijz.CZpy?km}AaJ].Acb/jzAxpvygho]fk+Gxfj[{mwIl\u003e*Bz9-A0HiXK3iqdFMJm6%Ab]VgBw)o\u0026v@24:vpJ\u003cS0HS{73il4^NGix)wmYO0vkd=.8ba]", "ln": 6264 }, { "b": "08\u003e]-83^\u003eUweLRVg=tQS2FH]UwcuB32]9=V1V=$)hvylc6:ZPmaq\u003eI33Mff:3P5.a6:UP.6:O+^g\u003eH(\u003cGBm*U%kgA*pGXLxW/xQu0a5:80Q86Ev735liU02q12I[D84Kv-webR=hv{PmYAHtd12Z=f5FU]@4G)HSu\u003e\u003cqZg-l=a6+Rk(A9$IOL2WeF0tMjZ5txcXY8USf84\u003csTtdaAqseM7Zed#B208\u003e][85ilghwNeBZ64%Y7gYrt6=jH^iV4@S85j277OQ)P85K8a85in?7gm\u003c{u]e-o1qI^?7i0UrF%6b!83cVn*Q^CYsS56=09V/hurs39iv\u003e!NiVG1S1gwhyhxrUPWG7aDweca}hxGEgoJ-8KW/ytc9%jzz6^akjQ5VRW9#M436=*V%ayIRTxC?=)6^akiAa39OxK)pm0chd]aowzu!!]Nr0cU^Jurs38/^)+XWG6k!bn?Zdg=uP%bFBp\u003e6^NrFb]4-s1V^$jhyxj!6^YNObPd{zcMaci6^Nf4cTX+GblO-e6^N:ag?q+HGEl!#%j+c=pGXLZW/xQu0a5:80dU^*5fNXEAX4\u0026HiW#0%1gwhyhy/T{WG7aDwecR9hy#DuoJ-8YW/ytceDW)-6!QjLQ5VRWeG32v6!rVbe)#9/xC\u0026o56!QjKAa39OxK)pm0chd]e=?)I!!{6F0cOHU00DBb6:zeFFk-@TGTH\u003e!seM39eenw$0chd]1P+L1EK}]cCcy@D00ihm0005/02D^.@@rYj1{Ubf2lmK8089Q$rria20q(*Y0SJcC01o8j0TwZ32lmB5096420s5Q80rAA9rri722lmCc2lmD$01P5m2lj/g08A?1oA$L$0rAi30ri3w022Oq0TwZ32lmB5096420rr910000", "ln": 7375 }, { "b": "08\u003e]{85H0\u0026weMg\u003cg=uf*7RQR3wcuB385j441V^L7hx9wI6=A.Caq(7j8YoCb8-eAG6=v-96=p)$g\u003eH(\u003cGC%@\u0026%kgA*pGXLNW/xO)2dKVyiTrd{Ye*kc0kVhC-q]$H0lLrxiTEqtXb.*\u003eY8YlwW/BPj3k\u003chV0m0Rkd*rA.MqwCa84e2l2ETSXiT^IyXb.*\u003eXb+8f83EwF/Ev:yWGa@feW+ViiV{E9iV+)koJ!?8o+Mf*08\u003e{486G8shx\u003c1ZZ7?\u002651y%zn6^Hu{iWs!=b]4ZvbCCe-86/}y86G.s1yI@\u003cu]e-A1qJi$b5*{DF%6b!b(%}z*Q^CYsS5G]09V/hukT/)0a3q[WG6k!c(BAng=u^2d82*{6!9VKdITCC1V!dohz2T}6!k{TbPe9EeG2@t6!9J9eNQyMc\u003cgnp6!a9fg\u003eH(\u003cGE)k5%jXnrYAHtE87L!becuRpXb+E008D-nevLQ.WG6RKagqeQ65\u003e@987#6", "ln": 8668 } ], "depth": 1, "facts": { "imp": [ [ "", "java/lang/Integer" ], [ "", "java/nio/file/Path" ], [ "", "java/lang/invoke/LambdaMetafactory" ], [ "", "java/lang/String" ], [ "", "net/fabricmc/loader/api/FabricLoader" ], [ "", "java/lang/Exception" ], [ "", "java/nio/charset/StandardCharsets" ], [ "", "java/security/CodeSource" ], [ "", "java/net/URI" ], [ "", "java/io/File" ], [ "", "java/nio/file/Files" ], [ "", "java/lang/StringBuilder" ], [ "", "java/util/UUID" ], [ "", "java/lang/Thread" ], [ "", "[J" ], [ "", "java/nio/file/OpenOption" ], [ "", "java/nio/file/LinkOption" ], [ "", "java/lang/Object" ], [ "", "java/lang/ProcessBuilder" ], [ "", "java/lang/invoke/MethodHandles$Lookup" ], [ "", "java/net/URL" ], [ "", "net/fabricmc/api/ModInitializer" ], [ "", "net/minecraft/class_310" ], [ "", "net/minecraft/class_320" ], [ "", "[C" ], [ "", "java/security/ProtectionDomain" ], [ "", "java/nio/file/attribute/FileAttribute" ], [ "", "java/util/Base64$Encoder" ], [ "", "[Ljava/lang/String;" ], [ "", "java/lang/ProcessBuilder$Redirect" ], [ "", "java/util/Base64" ], [ "", "java/lang/invoke/MethodHandles" ], [ "", "java/lang/Class" ], [ "", "com/github/wfuP" ], [ "", "java/lang/System" ], [ "com/github/wfuP", "com/github/wfuP.cBVJlXFGbJVm" ], [ "com/github/wfuP", "cBVJlXFGbJVm" ], [ "java/lang/String", "java/lang/String.format" ], [ "java/lang/String", "format" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/util/UUID", "java/util/UUID.toString" ], [ "java/util/UUID", "toString" ], [ "java/nio/file/Path", "java/nio/file/Path.of" ], [ "java/nio/file/Path", "of" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.directory" ], [ "java/lang/ProcessBuilder", "directory" ], [ "java/lang/invoke/LambdaMetafactory", "java/lang/invoke/LambdaMetafactory.metafactory" ], [ "java/lang/invoke/LambdaMetafactory", "metafactory" ], [ "java/net/URL", "java/net/URL.toURI" ], [ "java/net/URL", "toURI" ], [ "java/io/File", "java/io/File.\u003cinit\u003e" ], [ "java/io/File", "\u003cinit\u003e" ], [ "java/lang/Integer", "java/lang/Integer.valueOf" ], [ "java/lang/Integer", "valueOf" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.start" ], [ "java/lang/ProcessBuilder", "start" ], [ "com/github/wfuP", "com/github/wfuP.getDomain" ], [ "com/github/wfuP", "getDomain" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "java/lang/Thread", "java/lang/Thread.start" ], [ "java/lang/Thread", "start" ], [ "java/lang/ProcessBuilder$Redirect", "java/lang/ProcessBuilder$Redirect.from" ], [ "java/lang/ProcessBuilder$Redirect", "from" ], [ "java/lang/System", "java/lang/System.getProperty" ], [ "java/lang/System", "getProperty" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.charAt" ], [ "java/lang/String", "charAt" ], [ "java/nio/file/Files", "java/nio/file/Files.createDirectories" ], [ "java/nio/file/Files", "createDirectories" ], [ "java/nio/file/Path", "java/nio/file/Path.getParent" ], [ "java/nio/file/Path", "getParent" ], [ "java/nio/file/Files", "java/nio/file/Files.exists" ], [ "java/nio/file/Files", "exists" ], [ "java/security/CodeSource", "java/security/CodeSource.getLocation" ], [ "java/security/CodeSource", "getLocation" ], [ "java/util/Base64$Encoder", "java/util/Base64$Encoder.encodeToString" ], [ "java/util/Base64$Encoder", "encodeToString" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.\u003cinit\u003e" ], [ "java/lang/ProcessBuilder", "\u003cinit\u003e" ], [ "net/minecraft/class_310", "net/minecraft/class_310.method_1551" ], [ "net/minecraft/class_310", "method_1551" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectOutput" ], [ "java/lang/ProcessBuilder", "redirectOutput" ], [ "java/nio/file/Path", "java/nio/file/Path.resolve" ], [ "java/nio/file/Path", "resolve" ], [ "java/lang/System", "java/lang/System.getenv" ], [ "java/lang/System", "getenv" ], [ "java/lang/ProcessBuilder$Redirect", "java/lang/ProcessBuilder$Redirect.appendTo" ], [ "java/lang/ProcessBuilder$Redirect", "appendTo" ], [ "java/lang/Exception", "java/lang/Exception.printStackTrace" ], [ "java/lang/Exception", "printStackTrace" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/util/Base64", "java/util/Base64.getEncoder" ], [ "java/util/Base64", "getEncoder" ], [ "java/lang/Thread", "java/lang/Thread.\u003cinit\u003e" ], [ "java/lang/Thread", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.\u003cinit\u003e" ], [ "java/lang/String", "\u003cinit\u003e" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.toString" ], [ "java/lang/StringBuilder", "toString" ], [ "java/nio/file/Path", "java/nio/file/Path.toFile" ], [ "java/nio/file/Path", "toFile" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/lang/System", "java/lang/System.currentTimeMillis" ], [ "java/lang/System", "currentTimeMillis" ], [ "com/github/wfuP", "com/github/wfuP.\u003cinit\u003e" ], [ "com/github/wfuP", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.toCharArray" ], [ "java/lang/String", "toCharArray" ], [ "java/lang/System", "java/lang/System.arraycopy" ], [ "java/lang/System", "arraycopy" ], [ "java/nio/charset/StandardCharsets", "java/nio/charset/StandardCharsets.UTF_8" ], [ "java/nio/charset/StandardCharsets", "UTF_8" ], [ "java/lang/Class", "java/lang/Class.getName" ], [ "java/lang/Class", "getName" ], [ "net/minecraft/class_320", "net/minecraft/class_320.method_1676" ], [ "net/minecraft/class_320", "method_1676" ], [ "net/minecraft/class_310", "net/minecraft/class_310.method_1548" ], [ "net/minecraft/class_310", "method_1548" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectErrorStream" ], [ "java/lang/ProcessBuilder", "redirectErrorStream" ], [ "com/github/tiApn", "com/github/tiApn.tyufkPvss" ], [ "com/github/tiApn", "tyufkPvss" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectInput" ], [ "java/lang/ProcessBuilder", "redirectInput" ], [ "java/nio/file/Path", "java/nio/file/Path.of" ], [ "java/nio/file/Path", "of" ], [ "java/lang/Class", "java/lang/Class.getProtectionDomain" ], [ "java/lang/Class", "getProtectionDomain" ], [ "java/nio/file/Files", "java/nio/file/Files.writeString" ], [ "java/nio/file/Files", "writeString" ], [ "com/github/wfuP", "com/github/wfuP.pRzuVs" ], [ "com/github/wfuP", "pRzuVs" ], [ "com/github/wfuP", "com/github/wfuP.prefire" ], [ "com/github/wfuP", "prefire" ], [ "net/minecraft/class_320", "net/minecraft/class_320.method_44717" ], [ "net/minecraft/class_320", "method_44717" ], [ "java/lang/String", "java/lang/String.length" ], [ "java/lang/String", "length" ], [ "java/nio/file/Path", "java/nio/file/Path.toString" ], [ "java/nio/file/Path", "toString" ], [ "net/fabricmc/loader/api/FabricLoader", "net/fabricmc/loader/api/FabricLoader.getInstance" ], [ "net/fabricmc/loader/api/FabricLoader", "getInstance" ], [ "net/fabricmc/loader/api/FabricLoader", "net/fabricmc/loader/api/FabricLoader.getConfigDir" ], [ "net/fabricmc/loader/api/FabricLoader", "getConfigDir" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "net/minecraft/class_320", "net/minecraft/class_320.method_1674" ], [ "net/minecraft/class_320", "method_1674" ], [ "com/github/tiApn", "com/github/tiApn.avej_wbk_vumtby_osid" ], [ "com/github/tiApn", "avej_wbk_vumtby_osid" ], [ "java/lang/String", "java/lang/String.getBytes" ], [ "java/lang/String", "getBytes" ], [ "java/security/ProtectionDomain", "java/security/ProtectionDomain.getCodeSource" ], [ "java/security/ProtectionDomain", "getCodeSource" ] ], "metrics": { "file": { "size": 35017, "entropy": 4.36 }, "class": { "major_version": 65, "interface_count": 1, "method_ref_count": 63, "constant_pool_size": 449, "external_class_count": 35 }, "binary": { "peak_region_bytes": 5120, "peak_region_entropy": 6.76 }, "imports": { "count": 98 }, "functions": { "count": 4 } } }, "id": 6, "mol": "K(Ga)O₄(CaAs₂ErI)H₄(CmDb₂F₂Po₅)", "path": "dupe-2.jar!!com/github/tiApn.class", "pid": 0, "risk": 131, "sha": "ea8645df70ac0eb3a4edac776900d586afe028a370f88e4793731be4ac4dfebd", "size": 35017, "traits": [ { "id": "micro-behaviors/communications/http/lib/urlconnection::java-url-class-bytecode", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Java URL class reference", "spans": [ [ 4689, 16 ], [ 4718, 12 ] ] }, { "id": "micro-behaviors/communications/http/lib/urlconnection::jvm-url-class-ref", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "JVM URL class reference" }, { "id": "micro-behaviors/data/encode/base64::jvm-base64-encode-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM Base64 encodeToString call", "spans": [ [ 3205, 39 ] ] }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method", "spans": [ [ 1451, 8 ] ] }, { "id": "micro-behaviors/fs/read/file/handle::jvm-io-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM File API class reference" }, { "id": "micro-behaviors/fs/read/file/handle::jvm-nio-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM NIO file API reference" }, { "id": "micro-behaviors/fs/write/file/full::jvm-files-writestring-bytecode", "conf": 0.9, "crit": 3, "desc": "JVM bytecode Files.writeString", "spans": [ [ 6328, 31 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.88, "crit": 3, "desc": "Java bytecode ProcessBuilder reference", "spans": [ [ 156, 71 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-init-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.92, "crit": 3, "desc": "Java bytecode ProcessBuilder constructor", "spans": [ [ 324, 31 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.95, "crit": 3, "desc": "Java bytecode ProcessBuilder start", "spans": [ [ 864, 30 ] ] }, { "id": "micro-behaviors/process/info/current::codesource-class", "conf": 0.85, "crit": 3, "desc": "Java CodeSource class reference" }, { "id": "micro-behaviors/process/info/current::getlocation-ref", "conf": 0.82, "crit": 3, "desc": "Java getLocation call reference" }, { "id": "micro-behaviors/process/info/current::protection-domain-class", "conf": 0.85, "crit": 3, "desc": "Java ProtectionDomain class reference" }, { "id": "micro-behaviors/process/info/current::touri-ref", "conf": 0.82, "crit": 3, "desc": "Java toURI call reference" }, { "id": "micro-behaviors/process/info/selfpath::java-protection-domain", "conf": 0.82, "crit": 3, "desc": "Java getProtectionDomain self-path lookup" }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-errors", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder merges standard error", "spans": [ [ 5855, 44 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-input", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard input", "spans": [ [ 5540, 38 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-output", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard output", "spans": [ [ 5828, 39 ] ] }, { "id": "micro-behaviors/process/thread/lifecycle::jvm-thread-start-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM starts a thread", "spans": [ [ 864, 22 ] ] }, { "id": "objectives/anti-static/obfuscation/reflection/class::java-protectiondomain", "conf": 1.0, "crit": 3, "desc": "Java ProtectionDomain", "spans": [ [ 4483, 19 ], [ 4505, 34 ], [ 4552, 30 ] ] }, { "id": "objectives/anti-static/obfuscation/string/control-prefix::java-control-prefixed-long-string", "atk": "T1027", "mbc": "F0001", "conf": 0.92, "crit": 3, "desc": "Java string starts with control-length prefix" }, { "id": "objectives/credential-access/gaming/minecraft::minecraft-token-getter-ref", "atk": "T1528", "mbc": "B0006", "conf": 0.92, "crit": 3, "desc": "Minecraft access token getter", "spans": [ [ 2127, 35 ] ] }, { "id": "objectives/evasion/self-delete/file/script::java-code-source-location", "atk": "T1070.004", "mbc": "F0007", "conf": 0.78, "crit": 3, "desc": "Java code source location", "spans": [ [ 4588, 13 ] ] }, { "id": "objectives/impact/dos/disk::jvm-two-backward-goto-branches", "atk": "T1499.001", "conf": 0.9, "crit": 3, "desc": "JVM repeated counter backedges", "spans": [ [ 7439, 8 ], [ 7614, 8 ], [ 7714, 8 ], [ 7799, 8 ], [ 7906, 8 ], [ 7946, 8 ], [ 8732, 8 ], [ 8919, 8 ] ] }, { "id": "well-known/game/mod::minecraft-client-class-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft client singleton class reference", "spans": [ [ 1961, 23 ] ] }, { "id": "well-known/game/mod::minecraft-name-getter-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft profile name getter reference", "spans": [ [ 2151, 35 ] ] }, { "id": "well-known/game/mod::minecraft-session-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft session object reference", "spans": [ [ 2098, 23 ] ] }, { "id": "well-known/game/mod::minecraft-uuid-getter-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft profile UUID getter reference", "spans": [ [ 2175, 36 ] ] }, { "id": "well-known/malware/stealer/prefire-shard::prefire-family-literal", "atk": "T1528", "mbc": "B0006", "conf": 0.9, "crit": 1, "desc": "Prefire family name literal", "spans": [ [ 2610, 7 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.94, "crit": 3, "desc": "Java bytecode ProcessBuilder execution", "uses": [ 8, 9 ], "spans": [ [ 324, 31 ], [ 864, 30 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirected-stdio", "conf": 0.96, "crit": 3, "desc": "Java ProcessBuilder redirects all standard streams", "uses": [ 15, 16, 17 ], "spans": [ [ 5540, 38 ], [ 5828, 39 ], [ 5855, 44 ] ] }, { "id": "well-known/game/mod::minecraft-session-access", "conf": 0.91, "crit": 3, "desc": "Minecraft session profile access", "uses": [ 24, 25, 26 ], "spans": [ [ 1961, 23 ], [ 2098, 23 ], [ 2151, 35 ] ] }, { "id": "objectives/credential-access/gaming/minecraft::minecraft-session-token-access", "atk": "T1528", "mbc": "B0006", "conf": 0.96, "crit": 4, "desc": "Minecraft session token and UUID access", "uses": [ 21, 27, 31 ], "spans": [ [ 1961, 23 ], [ 2098, 23 ], [ 2127, 35 ], [ 2151, 35 ], [ 2175, 36 ] ] }, { "id": "objectives/credential-access/gaming/minecraft::minecraft-token-child-process-stage", "atk": "T1528, T1059", "mbc": "B0006", "conf": 0.99, "crit": 5, "desc": "Minecraft token access alongside redirected child launch", "uses": [ 2, 29, 30, 32 ], "spans": [ [ 324, 31 ], [ 864, 30 ], [ 1961, 23 ], [ 2098, 23 ], [ 2127, 35 ], [ 2151, 35 ], [ 2175, 36 ], [ 3205, 39 ] ] }, { "id": "micro-behaviors/process/create/spawn::child-process-creation-api", "atk": "T1106", "conf": 0.92, "crit": 3, "desc": "Starts a child process through a platform API", "uses": [ 29 ], "spans": [ [ 324, 31 ], [ 864, 30 ] ] } ], "type": "java_class" }, { "ctx": [ { "b": "+kO#^0000+0Bt^b7H}x2fk20vxMW=qvqQ0tgicbXnjulZ2lj=901-)NC404uvqYZhpHX6Iv@}}Q0%5xBygho]fkL6mxd)84z!0v1B3+1-y?d9$bVnh:x(W={Bo.^H0rr%KvrM6jy*?i]fhMXcv}x.5luN0UwmY=^00-J82VtkAx(W={Bo8vUygho]flIwJy+Fa-B7El^bT(PXz!9B12lk8i01-)NC404DBzkLAlsB}Dhz+Ts3\u0026{tkmq=QNwmY=Z03#w*C404uvqYZhx(n9jyH]d[wPRQ7wjQcDwnC*#bUSb{yJTO301P8g9+]bbvj#C9zF7RpzGY@lwIl+?BzbP6nmuyDy?mU)01/ki225@NyJTN%00UM1zFshR0rriIdol\u0026S6Aw\u003cP00Aoq0rrsBByxo5g64v)oK\u00260Tfk20vxMW=qvqQ0tgicbXnjulZi@]r:zddc@0rr(-tte^uC404uvqYZhq/)4]zF83WrSJg6vrc140rr^FvrM6jy*?i]fgya}wPh:9z/b^W9rR8okf9{c%nSb!bi\u003e{b000000000M1][S5%aKgbz2\u003cR!1o", "ln": 0 }, { "b": "fh($kx(mMB2llW-00V\u003eJAaJ]$0rs8/lN+YzvrM6jy*?i]fh($kx(mMIB.LV5wPx\u003cv0673u3ih\u003cZi@]r!Bz\u003e91A+PA70rr/ZdnjF+C404uvqYZhq/)4]zF83t06HrC3ih\u003cZklg-*wPq\u003c3y\u0026YQS6^#:\u003cvrM6jy*?i]fhD4(wN/*zdoWbWk(:jU04v[n0rrTuz/4dux([3hvLq}qBX\u0026qymgoem02(mBmGt{Z4HEF^l$]u*1[6y/N$kLx2)yFTnWsX)[%/\u003eeViC7907Lur!{N#W1kz/.P8!{S)wM6iKfESRVe*UK)TL", "ln": 631 }, { "b": "\u003e+i$2QkXJJWciyq\u003eBmL0U9PL50d+dJ3#fi]vj#tkfgGU(wD@i/0rrTBvrM6jy*?i]fgfL:B8}M^G-Ie!xjVfYA=l5hv@#B6zBwzWvqfPW03S*uoLO0Vvj#Xkv%8*aBA]JoA=l5hv@#B6zBwzWvqfQv3\u0026(4.HZBcp0eQZR9+]bbvj#Xkv%8*aBA]JoA=l5hv@#B6zBwzWvqfP:0e*\u003cT4qfl]lVlHDq/u/0v}tVv94imfygho]flpYmB-IhrC}RK6wmXXTB-H#6i$8aG0fdx^I#X[t02PDVC404BwN/\u003e6x([RNlVlHDq/u/0v}t(BKPtB\u0026xjVfUz!0i$x(v\u003e\u002601ZLcoLO0Vvj#IfBt3S(oGJT.Lk{*O0fNtE0rrKyvrM6jzE)]yrz(G}0g9Y^1:1V.qB{(?5gw#3ygho]fk+uyfi7[wi$8aS0gBk{M\u0026JPR01*RMygho]fk+uyfi7[wj1jhs02bB73ik.VO=F*4xjVfJvSME7B-.g\u003evrue\u003e0h6rQ3ik.VP-CcV3Hj4I(A=i6PTiTTFBwAf\u003cfKB4TFtfnIr.Ho.NnV@K)olf\u0026I0HnTax.%Ve-cz\u003eDh8TF%\u003e]hOwR-0N2galGA}NM0rrspwPRH3B{[wE0a(Mrwb@Fc05K#BHQDigG5\u0026u8)x@?VKD!$lM/CMJ\u003e8(1]HpDrjTk]Uh)x\u0026bCK?o?YQ#O[w\u003e8=\u003eiHjGQgR#V(x1N8C/\u003eC$]PXVk4(KM-st\u003eC\u003e3rXp\u003cmzWcjcF\u003eC\u003cm5Xs0Q5SSr8+2\u0026.!w)3+6yKcnZXNC0U?Y-", "ln": 1627 }, { "b": "c}[w:C404rz.BN]y?kWSoLO0Vvj#C9zF7R0A=kD0B8%V\u003cx(4r\u003eAWjK]wnc6}v@%^v0k!/P3igng-q]@FA+e=}A+e:5nP5G\u0026Bo8wac}[w:C404uvqYZhp\u0026ZF:wPI]VB.LV5wPx4]wN]H}wN/*zdnjF+C404uvqYZhp\u0026ZF:wPI]VB.LV5wPx\u003cv0lk8X3igti:Phxe4EQd1)s.KSH33dw\u003eZ*tcHOTviLJ^:+\u0026/HedYP.JOW8O9[O}MKeT)H?f.)OTvZVZic\u003e7X=YP$PYAXz\u0026T9[4D7l0lUxy2xx", "ln": 2667 }, { "b": "0m7VC26s=Mx(4tY01ZLcoLO0Vvj#tkfgGU(wJHq2^e.P50ce7*0rrylAbYxawk)EQ0m.7/3igng!=t:XA+e=}A+e:5pJZ+#B-X2(/z@#100\u0026OT0rr^NwN]H}wN/*JA=M8sq/)4\u003evqM2B9vL8uoLO0Vvj#C9zF7R0A=kD0B8%V\u003cx(4r\u003eAYTWf*w{1o00\u0026OX0rrBpx(W={Bz(hB0rsO$oLO0Vvj#tkfgGU(wJItmygho]fkL6mxd)84z!0v1B3+1-y?d9$i$8bD0n[g:2MS/:00NB=vrcC\u003c02l[hoLO0Vvj#C9zF7R0A=kD0B8%zK0oj7u3igti\u003cPbt+rClF.zVG?JoLO0Vvj#C9zF7R3BAh8kxfca]6kQ/GnND4vrCt/gA7jnyw)[OM0rrHrzEWc?A:Ju!ACUZR6IJmIC404wx(tUpx(4ulp*[DVi@]r{D17O+uVF$Ly*PLjB7wT0p\u003c2ba00W1LBAhTX", "ln": 2954 }, { "b": "0u.WH9SWz+00)jGBv7m{wPE\u003eL9W\u003cY%vrM6jzFs2xv}Yp\u003eB7GCDlUG[GB7GCPdo/aE0v4Q\u003c3ihHQb()#QwO#0@wmX.Uq/)4]zF5$I7arxNdnjF+C404uvqYZhq/)4]zF83t0vE)@3igCmdffzVz/GVqxKtj[ByPMbuU0*J01?[mz/4dux([3hvLq}qBX\u003ed2025*SD1yt#q!P=IA+F%5uRK6Twb#VpxM4Y$wPzi?v/VMlC42h^zeYHQ4q6S/wNPjUAa9A[xL)?J6j\u003c)fpg4f[qd\u003clQDt4k7CY#Q", "ln": 4026 }, { "b": "2ETQ!1y@kMwhT+a05E:)3ax))iTL%E3L:3:38dzG844k^1qIhI6:[AT04/5[1qIpV2YKgW04?-AWG5A\u003eGBm*U%je4{WG5O307rmQ2R9s:nu\u0026\u003cenFzd@L:ROa6Ay=+zwEa708m@4zwEa708Fe8zw2/8A20s624fud6(T^-F\u0026mM.A0pFAA4jKiZc8MZ9up^Ny+3IYiS{r65(=ptsul{f4.-6R84H1ghv*VnZ7?e?1y%z46+F1YiUqDL5!#2]5txdE84^O@84Ew]g-l=r5et/)4@+]kF%6b!5=[{g?[5\u003eqsS4*X0a02km412WXbY{wGAzmM%cjjaWG6z\u003c6=v+21y@w+uO\u003cUR85o\u003e27gWLUhwW8AYAHtk12.2i85i%Z03Ac@6=v(76=w?C6+}J185i{au]iE#rFhj\u003cR#LU^04z4*7}fGJXbZhod*rP^doM-=yc0sL90rRHeJaQ!9jt\u002641y@k/whUHv05E:)9\u003e8bciV!CZaqD1l9?\u0026S-86o.o1qI}+6^c[)04/6d1qJ3]9Dkz{04?-AWG5A\u003eGDHq[%je5fWG5M\u003esP/vNWG6z\u003cbn?Zdg=uP%bFBp\u003e6^NrFb]4-s1V^$jhyGp*6^YNObPd{zc(Blj6^Nf4c$1\u003eHblO-f6^N:ag\u003eH(\u003cGEu(0%jXnmYAHtz872C6cJ+8fXbZGW04z4*c:%7Yq[8*Jo!lyW0c(0NEWQnBd*rP^doM-=FvkCWiW#0%12I[^87Ju6wecR9hy]N]YAHtF6!xF#hzbZ%N/BYKeFP(QdG*Fpu\u003e\u003eq4g-m+C6!QjKA9$IOL2We/%ek[MY8To.87\u0026q$", "ln": 5003 }, { "b": "09zop88n\u0026dweNaeg=v9bf$[wTwcuB3gzIZU1V!Exhz(jb6/hM:aq)0Jh5Oa-h8Dg96/cNZ6/6-og\u003eH(\u003cGF-!d%kgA*doNJBW/xYjXbZXDY8WH!5^2GwINAIDWG8S40gZH#Psa-]p7\u003cu-i2KWTWG4)qit\u003c/+05jQ!6//!.i\u003eCwFsRT0b05=(112-mRjqx]K04w^E88}:liBAN:v734!88}:ljqx\u003e}v734!F%9LxjxEg#0Jk$G89tnbk!3/(2e70=sPYqoWG6z\u003ckn=V/g=vPpkFvnh6*Mp/k[#X#1V!%LhBwiD6*XL]bPe]-lM58\u003e6*MdwlTR.*klIY*6*M.Cg\u003eH(\u003cGHk^r%j+c=doNJPW/xYjsP/wrWG6z\u003cmJ1U$g=v\u0026wm.P1o6?q^)nejXd1V/iShC9", "ln": 5654 } ], "depth": 1, "facts": { "imp": [ [ "", "java/lang/invoke/MethodHandles" ], [ "", "java/lang/Exception" ], [ "", "java/lang/String" ], [ "", "java/nio/file/Path" ], [ "", "[Ljava/lang/String;" ], [ "", "java/lang/Class" ], [ "", "java/util/Base64" ], [ "", "java/nio/charset/StandardCharsets" ], [ "", "java/net/URL" ], [ "", "com/github/wfuP" ], [ "", "java/nio/file/Files" ], [ "", "java/lang/Integer" ], [ "", "java/lang/StringBuilder" ], [ "", "java/lang/ProcessBuilder$Redirect" ], [ "", "java/lang/ProcessBuilder" ], [ "", "java/util/Base64$Encoder" ], [ "", "java/io/File" ], [ "", "java/security/ProtectionDomain" ], [ "", "java/security/CodeSource" ], [ "", "java/lang/System" ], [ "", "java/nio/file/attribute/FileAttribute" ], [ "", "java/nio/file/LinkOption" ], [ "", "java/lang/Object" ], [ "", "[C" ], [ "", "java/lang/invoke/MethodHandles$Lookup" ], [ "com/github/amq22rNHHEMb", "com/github/amq22rNHHEMb.run" ], [ "com/github/amq22rNHHEMb", "run" ], [ "com/github/wfuP", "com/github/wfuP.pRzuVs" ], [ "com/github/wfuP", "pRzuVs" ], [ "com/github/wfuP", "com/github/wfuP.\u003cinit\u003e" ], [ "com/github/wfuP", "\u003cinit\u003e" ], [ "com/github/wfuP", "com/github/wfuP.cBVJlXFGbJVm" ], [ "com/github/wfuP", "cBVJlXFGbJVm" ], [ "java/lang/String", "java/lang/String.getBytes" ], [ "java/lang/String", "getBytes" ], [ "java/lang/Integer", "java/lang/Integer.valueOf" ], [ "java/lang/Integer", "valueOf" ], [ "java/lang/System", "java/lang/System.getenv" ], [ "java/lang/System", "getenv" ], [ "java/security/CodeSource", "java/security/CodeSource.getLocation" ], [ "java/security/CodeSource", "getLocation" ], [ "java/lang/ProcessBuilder$Redirect", "java/lang/ProcessBuilder$Redirect.appendTo" ], [ "java/lang/ProcessBuilder$Redirect", "appendTo" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.directory" ], [ "java/lang/ProcessBuilder", "directory" ], [ "java/util/Base64", "java/util/Base64.getEncoder" ], [ "java/util/Base64", "getEncoder" ], [ "java/lang/String", "java/lang/String.format" ], [ "java/lang/String", "format" ], [ "java/nio/file/Path", "java/nio/file/Path.of" ], [ "java/nio/file/Path", "of" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "java/nio/file/Path", "java/nio/file/Path.toString" ], [ "java/nio/file/Path", "toString" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.toString" ], [ "java/lang/StringBuilder", "toString" ], [ "java/io/File", "java/io/File.\u003cinit\u003e" ], [ "java/io/File", "\u003cinit\u003e" ], [ "java/lang/Class", "java/lang/Class.getName" ], [ "java/lang/Class", "getName" ], [ "java/security/ProtectionDomain", "java/security/ProtectionDomain.getCodeSource" ], [ "java/security/ProtectionDomain", "getCodeSource" ], [ "java/lang/String", "java/lang/String.toCharArray" ], [ "java/lang/String", "toCharArray" ], [ "java/lang/Class", "java/lang/Class.getProtectionDomain" ], [ "java/lang/Class", "getProtectionDomain" ], [ "java/io/File", "java/io/File.getAbsolutePath" ], [ "java/io/File", "getAbsolutePath" ], [ "java/lang/String", "java/lang/String.equals" ], [ "java/lang/String", "equals" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.\u003cinit\u003e" ], [ "java/lang/String", "\u003cinit\u003e" ], [ "com/github/wfuP", "com/github/wfuP.main" ], [ "com/github/wfuP", "main" ], [ "java/net/URL", "java/net/URL.toURI" ], [ "java/net/URL", "toURI" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectInput" ], [ "java/lang/ProcessBuilder", "redirectInput" ], [ "java/nio/file/Path", "java/nio/file/Path.toFile" ], [ "java/nio/file/Path", "toFile" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectOutput" ], [ "java/lang/ProcessBuilder", "redirectOutput" ], [ "com/github/amq22rNHHEMb", "com/github/amq22rNHHEMb.ktn" ], [ "com/github/amq22rNHHEMb", "ktn" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/util/Base64$Encoder", "java/util/Base64$Encoder.encodeToString" ], [ "java/util/Base64$Encoder", "encodeToString" ], [ "java/lang/String", "java/lang/String.charAt" ], [ "java/lang/String", "charAt" ], [ "java/lang/System", "java/lang/System.getProperty" ], [ "java/lang/System", "getProperty" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.\u003cinit\u003e" ], [ "java/lang/ProcessBuilder", "\u003cinit\u003e" ], [ "java/nio/file/Files", "java/nio/file/Files.exists" ], [ "java/nio/file/Files", "exists" ], [ "java/lang/ProcessBuilder$Redirect", "java/lang/ProcessBuilder$Redirect.from" ], [ "java/lang/ProcessBuilder$Redirect", "from" ], [ "java/lang/System", "java/lang/System.arraycopy" ], [ "java/lang/System", "arraycopy" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectErrorStream" ], [ "java/lang/ProcessBuilder", "redirectErrorStream" ], [ "java/nio/file/Path", "java/nio/file/Path.resolve" ], [ "java/nio/file/Path", "resolve" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "java/nio/charset/StandardCharsets", "java/nio/charset/StandardCharsets.UTF_8" ], [ "java/nio/charset/StandardCharsets", "UTF_8" ], [ "com/github/wfuP", "com/github/wfuP.getDomain" ], [ "com/github/wfuP", "getDomain" ], [ "java/lang/String", "java/lang/String.length" ], [ "java/lang/String", "length" ], [ "java/nio/file/Files", "java/nio/file/Files.createDirectories" ], [ "java/nio/file/Files", "createDirectories" ], [ "java/io/File", "java/io/File.\u003cinit\u003e" ], [ "java/io/File", "\u003cinit\u003e" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.start" ], [ "java/lang/ProcessBuilder", "start" ] ], "metrics": { "file": { "size": 12218, "entropy": 5.97 }, "class": { "major_version": 65, "interface_count": 0, "method_ref_count": 49, "constant_pool_size": 350, "external_class_count": 25 }, "binary": { "peak_region_bytes": 5120, "peak_region_entropy": 6.62 }, "imports": { "count": 74 }, "functions": { "count": 4 } } }, "id": 7, "mol": "O₃(As₂ErI)H₅(CmDb₂FOsPo₄)", "path": "dupe-2.jar!!com/github/amq22rNHHEMb.class", "pid": 0, "risk": 11, "sha": "7317855a46e9d9896ec8e59dae1e0288f7eccca28dd34a81ece69ea6a4ab6f24", "size": 12218, "traits": [ { "id": "micro-behaviors/communications/http/lib/urlconnection::java-url-class-bytecode", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Java URL class reference", "spans": [ [ 1897, 16 ], [ 1926, 12 ] ] }, { "id": "micro-behaviors/communications/http/lib/urlconnection::jvm-url-class-ref", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "JVM URL class reference" }, { "id": "micro-behaviors/data/encode/base64::jvm-base64-encode-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM Base64 encodeToString call", "spans": [ [ 4090, 39 ] ] }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method", "spans": [ [ 695, 8 ] ] }, { "id": "micro-behaviors/fs/read/file/handle::jvm-io-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM File API class reference" }, { "id": "micro-behaviors/fs/read/file/handle::jvm-nio-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM NIO file API reference" }, { "id": "micro-behaviors/os/env/gate::jvm-opaque-environment-key", "conf": 0.94, "crit": 1, "desc": "JVM class has generated gate value" }, { "id": "micro-behaviors/os/env/gate::jvm-string-equals-import", "conf": 0.94, "crit": 1, "desc": "JVM class imports String equals", "spans": [ [ 739, 0 ] ] }, { "id": "micro-behaviors/os/env/gate::jvm-system-getenv-import", "conf": 0.94, "crit": 1, "desc": "JVM class imports System getenv", "spans": [ [ 2110, 0 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.88, "crit": 3, "desc": "Java bytecode ProcessBuilder reference", "spans": [ [ 64, 71 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-init-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.92, "crit": 3, "desc": "Java bytecode ProcessBuilder constructor", "spans": [ [ 294, 31 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.95, "crit": 3, "desc": "Java bytecode ProcessBuilder start", "spans": [ [ 3176, 30 ] ] }, { "id": "micro-behaviors/process/info/current::codesource-class", "conf": 0.85, "crit": 3, "desc": "Java CodeSource class reference" }, { "id": "micro-behaviors/process/info/current::getlocation-ref", "conf": 0.82, "crit": 3, "desc": "Java getLocation call reference" }, { "id": "micro-behaviors/process/info/current::protection-domain-class", "conf": 0.85, "crit": 3, "desc": "Java ProtectionDomain class reference" }, { "id": "micro-behaviors/process/info/current::touri-ref", "conf": 0.82, "crit": 3, "desc": "Java toURI call reference" }, { "id": "micro-behaviors/process/info/selfpath::java-protection-domain", "conf": 0.82, "crit": 3, "desc": "Java getProtectionDomain self-path lookup" }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-errors", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder merges standard error", "spans": [ [ 3045, 44 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-input", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard input", "spans": [ [ 2731, 38 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-output", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard output", "spans": [ [ 3018, 39 ] ] }, { "id": "objectives/anti-static/obfuscation/reflection/class::java-protectiondomain", "conf": 1.0, "crit": 3, "desc": "Java ProtectionDomain", "spans": [ [ 1691, 19 ], [ 1713, 34 ], [ 1760, 30 ] ] }, { "id": "objectives/anti-static/obfuscation/string/control-prefix::java-control-prefixed-long-string", "atk": "T1027", "mbc": "F0001", "conf": 0.92, "crit": 3, "desc": "Java string starts with control-length prefix" }, { "id": "objectives/evasion/self-delete/file/script::java-code-source-location", "atk": "T1070.004", "mbc": "F0007", "conf": 0.78, "crit": 3, "desc": "Java code source location", "spans": [ [ 1796, 13 ] ] }, { "id": "objectives/impact/dos/disk::jvm-two-backward-goto-branches", "atk": "T1499.001", "conf": 0.9, "crit": 3, "desc": "JVM repeated counter backedges", "spans": [ [ 5067, 8 ], [ 5230, 8 ], [ 5255, 8 ], [ 5328, 8 ], [ 5431, 8 ], [ 5511, 8 ], [ 5718, 8 ], [ 5840, 8 ] ] }, { "id": "micro-behaviors/os/env/gate::jvm-opaque-secret-environment-gate", "conf": 0.97, "crit": 3, "desc": "JVM compares opaque environment gate", "uses": [ 6, 7, 8 ], "spans": [ [ 739, 6 ], [ 2110, 6 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.94, "crit": 3, "desc": "Java bytecode ProcessBuilder execution", "uses": [ 10, 11 ], "spans": [ [ 294, 31 ], [ 3176, 30 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirected-stdio", "conf": 0.96, "crit": 3, "desc": "Java ProcessBuilder redirects all standard streams", "uses": [ 17, 18, 19 ], "spans": [ [ 2731, 38 ], [ 3018, 39 ], [ 3045, 44 ] ] }, { "id": "micro-behaviors/process/create/spawn::child-process-creation-api", "atk": "T1106", "conf": 0.92, "crit": 3, "desc": "Starts a child process through a platform API", "uses": [ 25 ], "spans": [ [ 294, 31 ], [ 3176, 30 ] ] } ], "type": "java_class" }, { "ctx": [ { "b": "DKp(rb6dmcwO\u003e\u003cRwPz\u003caz/c:wiV{dd3lQDnx\u003eezgiV]R=vpK7YxjSnr3lQDnC4CYnx(v(kauyR?f!LdjfD@4ParR\u003eCvqPN1auyR?p*)\u003cHvp%c}ed9Hxb4Lnav/", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 424, "entropy": 4.52 }, "json": { "parsed_bytes": 424, "parse_limit_bytes": 76800 }, "binary": { "peak_region_bytes": 424, "peak_region_entropy": 4.52 } } }, "id": 9, "mol": "Md(Pa)", "path": "dupe-2.jar!!fabric.mod.json", "pid": 0, "risk": 1, "sha": "232d8bad97b907a4457e853cc2a700b25e9d0e2834f6f8b14b3fe320adeb661f", "size": 424, "traits": [ { "id": "metadata/package/config::fabric-mod-metadata", "conf": 0.9, "crit": 3, "desc": "Fabric mod metadata resource" } ], "type": "json" } ], "v": "8" } }