{ "llm": { "conf": 0.9906789, "grade": "hostile", "model": "Qwen/Qwen3.8-27B", "before": { "lvl": -1, "prob": 0.9860879, "class": "benign" }, "outcome": "hostile", "interpretation": "Steals Minecraft session tokens" }, "ml": { "v": "7", "eng": "2.12.0-beta.2", "lvl": 25, "conf": 92, "mods": [ { "cls": 0, "raw": 0.9860879, "rte": "az", "prob": 0.9860879 }, { "cls": 0, "raw": 0.9916293, "rte": "az/jar", "prob": 0.9916293 } ], "prob": 0.9906789, "files": [ { "id": 0, "lvl": 25, "conf": 92, "prob": 0.9906789064407349, "type": "jar" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00003273288530181162, "type": "java_class" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.0010612010955810547, "type": "java_class" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.00003485878187348135, "type": "java_class" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.00003566344457794912, "type": "java_class" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.000013500452041625977, "type": "java_class" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.000009715557098388672, "type": "java_class" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.000006407499313354492, "type": "java_class" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.000010162591934204102, "type": "java_class" }, { "id": 11, "lvl": -1, "conf": 0, "prob": 0.000009844700798566919, "type": "json" } ], "version": "v18.18", "analyzed_at": "2026-09-28T13:42:40Z" }, "path": "doomsday-1.21-1.21.11.jar", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "p!H([6Awak2MK\u003cHk$HglYh0[La]]NPa]\u00265L001(omPIDAh-SS*p!1gW1WI}0000*s765L)ERBm3{r:u[um^$@arTB?A@u$xD@c3tIMHlu\u0026ft)%ST5[meb?EVvL\u0026Zlodc+ho3%FG2O\u0026d@S:Ey?4oDRjS6#ZZrABuAoikg@n0\u003c*RVIQz}U)KMlkv9)7lMH)I?ExAL{=THTzC/$VzAB4gp-}#vpuh]zZMM+^nTzT0ZXF**R8}A@Zd\u003eS[.Gw+y{8aRG7)Ia?(3LBC2-zE\u003eIsW=]7#9haj)2V-agd!9P-", "ln": 0 } ], "mol": "K₂(McGa)O₆(CaEuAlAs₃ErI)H₆(Cm₅Db₅F₃Os₂Po₅Ti)Md₂(Pa)", "sha": "b2fe4f804a244b2f4847d383acbece0aef597af7cc3865e0fac7a96fb50521b4", "path": "/data/samples/incoming/forager/bad/sha256/bazaar/doomsday-1.21-1.21.11.jar", "risk": 300, "size": 3146655, "type": "jar", "facts": { "metrics": { "jar": { "class_count": 19, "entry_count": 34, "index_count": 0, "service_count": 0, "signature_count": 0, "native_lib_count": 0, "embedded_jar_count": 0, "manifest.entry_count": 0, "manifest.digest_count": 0, "signature_block_count": 0, "versioned_class_count": 0, "manifest.section_count": 0, "manifest.attribute_count": 12, "manifest.class_path_count": 0, "manifest.boot_class_path_count": 0 }, "file": { "size": 3146655, "entropy": 8 }, "binary": { "peak_region_bytes": 3143680, "peak_region_entropy": 7.87 }, "archive": { "file_count": 34, "member_count": 37, "script_count": 0, "zip_bomb_ratio": 4.06, "compressed_size": 3142605, "directory_count": 3, "executable_count": 0, "extra_field_size": 0, "noise_file_count": 0, "compression.ratio": 0.94, "hidden_file_count": 0, "uncompressed_size": 3339584, "crc_collision_count": 0, "entry_comment_count": 0, "max_filename_length": 44, "rtlo_filename_count": 0, "format.regular_count": 34, "nested_archive_count": 0, "path_traversal_count": 0, "symlink_escape_count": 0, "security.setgid_count": 0, "security.setuid_count": 0, "security.sticky_count": 0, "double_extension_count": 0, "duplicate_member_count": 0, "format.directory_count": 3, "security.symlink_count": 0, "unicode_filename_count": 0, "homoglyph_filename_count": 0, "security.encrypted_count": 0, "timing.mtime_unique_count": 5, "timing.mtime_unique_ratio": 0.14, "misplaced_executable_count": 0, "timing.mtime_outlier_count": 13, "timing.mtime_dominant_count": 24, "timing.mtime_spread_seconds": 336245730, "timing.sentinel_mtime_count": 0, "security.world_writable_count": 0, "timing.mtime_dominant_fraction": 0.65, "compression.method_counts.stored": 3, "compression.method_counts.deflate": 34 } } }, "traits": [ { "id": "objectives/anti-static/obfuscation/reflection/class::java-protectiondomain", "conf": 1.0, "crit": 3, "desc": "Java ProtectionDomain", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/fs/write/file/full::jvm-files-writestring-bytecode", "conf": 0.9, "crit": 3, "desc": "JVM bytecode Files.writeString", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/data/buffer/transfer::bytearrayinputstream-ref", "conf": 0.88, "crit": 3, "desc": "Java ByteArrayInputStream class" }, { "id": "micro-behaviors/process/info/selfpath::java-protection-domain", "conf": 0.82, "crit": 3, "desc": "Java getProtectionDomain self-path lookup" }, { "id": "micro-behaviors/communications/socket/create::jvm-socket-class-ref", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "JVM socket class reference" }, { "id": "micro-behaviors/communications/socket/send::java-dataoutputstream-class", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "Java DataOutputStream class reference", "from": [ { "file": 4 } ] }, { "id": "objectives/impact/dos/disk::jvm-megabyte-byte-array-constant", "atk": "T1499.001", "conf": 0.94, "crit": 3, "desc": "JVM one-megabyte allocation constant", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/process/info/current::codesource-class", "conf": 0.85, "crit": 3, "desc": "Java CodeSource class reference" }, { "id": "micro-behaviors/data/archive/extract/zip::jvm-zip-entry-extraction-to-file", "conf": 0.96, "crit": 3, "desc": "JVM extracts ZIP entries to files", "from": [ { "off": 12594, "file": 1 } ], "uses": [ 40, 56, 67 ] }, { "id": "micro-behaviors/data/decode/base64::java-base64-decode-bytecode-call", "conf": 0.96, "crit": 3, "desc": "Java Base64 decode call", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/env/gate::jvm-opaque-secret-environment-gate", "conf": 0.97, "crit": 3, "desc": "JVM compares opaque environment gate", "from": [ { "off": 14263, "file": 1 }, { "off": 2102, "file": 3 }, { "file": 6 }, { "file": 7 } ], "uses": [ 18, 26, 37 ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.94, "crit": 3, "desc": "Java bytecode ProcessBuilder execution", "from": [ { "off": 15115, "file": 1 }, { "off": 863, "file": 2 }, { "off": 3188, "file": 3 } ], "uses": [ 21, 69 ] }, { "id": "well-known/game/mod::minecraft-session-access", "conf": 0.91, "crit": 3, "desc": "Minecraft session profile access", "from": [ { "file": 2 } ], "uses": [ 15, 47, 70 ] }, { "id": "micro-behaviors/os/sysinfo/hostname::jvm-hostname-command-literal", "atk": "T1082", "mbc": "E1082", "conf": 0.9, "crit": 3, "desc": "JVM hostname command literal" }, { "id": "objectives/anti-static/obfuscation/string/control-prefix::java-control-prefixed-long-string", "atk": "T1027", "mbc": "F0001", "conf": 0.92, "crit": 3, "desc": "Java string starts with control-length prefix" }, { "id": "well-known/game/mod::minecraft-name-getter-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft profile name getter reference", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/socket/framing::data-stream-transport", "atk": "T1573", "conf": 1.0, "crit": 3, "desc": "Java data-stream transport type", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-custom-x509trustmanager", "conf": 0.95, "crit": 3, "desc": "Class implements a custom X509 trust manager", "from": [ { "file": 5 } ], "uses": [ 38, 43, 71 ] }, { "id": "micro-behaviors/os/env/gate::jvm-string-equals-import", "conf": 0.94, "crit": 1, "desc": "JVM class imports String equals", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/encode/base64::jvm-base64-encode-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM Base64 encodeToString call", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-trustmanager-class-ref", "conf": 0.9, "crit": 3, "desc": "JVM TrustManager interface reference", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.95, "crit": 3, "desc": "Java bytecode ProcessBuilder start", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/send::java-raw-socket-client-write", "atk": "T1071", "mbc": "C0001", "conf": 0.94, "crit": 3, "desc": "Java socket client writes request bytes through DataOutputStream", "from": [ { "off": 3321, "file": 4 } ], "uses": [ 5, 34, 74 ] }, { "id": "micro-behaviors/process/info/current::protection-domain-class", "conf": 0.85, "crit": 3, "desc": "Java ProtectionDomain class reference" }, { "id": "micro-behaviors/fs/read/file/handle::jvm-io-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM File API class reference" }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/env/gate::jvm-system-getenv-import", "conf": 0.94, "crit": 1, "desc": "JVM class imports System getenv", "from": [ { "file": 1 } ] }, { "id": "objectives/anti-static/obfuscation/string/control-prefix::java-character-digit-bytecode", "atk": "T1027", "mbc": "F0001", "conf": 0.9, "crit": 3, "desc": "Java bytecode calls Character.digit", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-input", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard input", "from": [ { "file": 1 } ] }, { "id": "objectives/evasion/self-delete/file/script::java-code-source-location", "atk": "T1070.004", "mbc": "F0007", "conf": 0.78, "crit": 3, "desc": "Java code source location", "from": [ { "file": 2 } ] }, { "id": "objectives/anti-analysis/timing/evasion::kotlin-thread-sleep-check", "atk": "T1497.003", "conf": 0.94, "crit": 3, "desc": "Kotlin Thread.sleep call", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-sslparameters-set-server-names", "conf": 0.93, "crit": 3, "desc": "JVM sets TLS SNI server name", "from": [ { "file": 4 } ] }, { "id": "objectives/credential-access/gaming/minecraft::minecraft-token-getter-ref", "atk": "T1528", "mbc": "B0006", "conf": 0.92, "crit": 3, "desc": "Minecraft access token getter", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/info/current::getlocation-ref", "conf": 0.82, "crit": 3, "desc": "Java getLocation call reference" }, { "id": "micro-behaviors/communications/socket/create::java-socket-class-import", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "Java imports the network socket class", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirected-stdio", "conf": 0.96, "crit": 3, "desc": "Java ProcessBuilder redirects all standard streams", "from": [ { "off": 15051, "file": 1 }, { "off": 5931, "file": 2 }, { "off": 3057, "file": 3 } ], "uses": [ 28, 42, 48 ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-sslcontext-trustmanager-init-call", "conf": 0.94, "crit": 3, "desc": "JVM SSLContext.init trust-manager call", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/os/env/gate::jvm-opaque-environment-key", "conf": 0.94, "crit": 1, "desc": "JVM class has generated gate value" }, { "id": "micro-behaviors/communications/socket/ssl::jvm-x509trustmanager-issuer-callback", "conf": 0.94, "crit": 3, "desc": "JVM getAcceptedIssuers callback defined" }, { "id": "micro-behaviors/data/decode/base64::java-base64-decoder-class", "conf": 0.92, "crit": 3, "desc": "JVM Base64 decoder class reference", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/archive/extract/zip::jvm-zip-entry-read-bytecode", "conf": 0.9, "crit": 3, "desc": "JVM reads ZIP archive entry data", "from": [ { "file": 1 } ] }, { "id": "objectives/credential-access/gaming/minecraft::minecraft-session-token-access", "atk": "T1528", "mbc": "B0006", "conf": 0.96, "crit": 4, "desc": "Minecraft session token and UUID access", "from": [ { "off": 2123, "file": 2 } ], "uses": [ 12, 32, 49 ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-output", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard output", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-x509trustmanager-class-ref", "conf": 0.94, "crit": 3, "desc": "JVM X509 trust-manager interface reference" }, { "id": "micro-behaviors/communications/socket/create::java-socket-bytecode-reference", "atk": "T1071", "mbc": "C0001", "conf": 0.86, "crit": 3, "desc": "Java bytecode socket reference", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/fs/read/file/handle::jvm-nio-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM NIO file API reference" }, { "id": "micro-behaviors/communications/proxy/tunnel::byte-output-stream", "atk": "T1090", "mbc": "C0003", "conf": 0.5, "crit": 3, "desc": "Java ByteArrayOutputStream usage", "from": [ { "file": 1 } ] }, { "id": "well-known/game/mod::minecraft-client-class-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft client singleton class reference", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-errors", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder merges standard error", "from": [ { "file": 1 } ] }, { "id": "well-known/game/mod::minecraft-uuid-getter-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft profile UUID getter reference", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/info/current::touri-ref", "conf": 0.82, "crit": 3, "desc": "Java toURI call reference" }, { "id": "micro-behaviors/communications/socket/create::java-socket-slash-reference", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "Java slash-form socket reference", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/process/create/spawn::java-runtime-class", "atk": "T1059", "mbc": "E1203", "conf": 0.86, "crit": 3, "desc": "Java Runtime class reference", "from": [ { "file": 4 } ] }, { "id": "objectives/credential-access/gaming/minecraft::minecraft-token-child-process-stage", "atk": "T1528, T1059", "mbc": "B0006", "conf": 0.99, "crit": 5, "desc": "Minecraft token access alongside redirected child launch", "from": [ { "off": 702, "file": 1 }, { "off": 1986, "file": 2 }, { "off": 4084, "file": 3 }, { "off": 10528, "file": 4 } ], "uses": [ 11, 19, 35, 41 ] }, { "id": "objectives/impact/dos/disk::jvm-two-backward-goto-branches", "atk": "T1499.001", "conf": 0.9, "crit": 3, "desc": "JVM repeated counter backedges", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/proxy/tunnel::inet-socket-address", "atk": "T1090", "mbc": "C0003", "conf": 0.6, "crit": 3, "desc": "Java InetSocketAddress reference", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/fs/write/file/handle::jvm-fileoutputstream-bytecode", "conf": 0.86, "crit": 3, "desc": "JVM imports FileOutputStream class", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-sslsocket-handshake-call", "conf": 0.94, "crit": 3, "desc": "JVM SSLSocket.startHandshake call", "from": [ { "file": 4 } ] }, { "id": "objectives/anti-static/obfuscation/string/crypto::java-byte-range-copy", "atk": "T1027", "mbc": "F0001", "conf": 0.7, "crit": 3, "desc": "Java byte range copy", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/framing::bytebuffer-transport", "atk": "T1573", "conf": 1.0, "crit": 3, "desc": "Java byte-buffer transport type", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/data/buffer/transfer::bytearrayoutputstream-ref", "conf": 0.88, "crit": 3, "desc": "Java ByteArrayOutputStream class", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/decode/base64::java-base64-decoding-bytecode", "conf": 0.94, "crit": 3, "desc": "Java bytecode Base64 decoding", "from": [ { "off": 19149, "file": 1 } ], "uses": [ 9, 62 ] }, { "id": "micro-behaviors/data/decode/base64::java-base64-decoder-bytecode-call", "conf": 0.94, "crit": 3, "desc": "Java Base64 decoder accessor call", "from": [ { "file": 1 } ] }, { "id": "well-known/malware/stealer/prefire-shard::prefire-family-literal", "atk": "T1528", "mbc": "B0006", "conf": 0.9, "crit": 1, "desc": "Prefire family name literal", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/info/current::getpath-ref", "conf": 0.8, "crit": 3, "desc": "Java getPath call reference" }, { "id": "micro-behaviors/communications/http/lib/urlconnection::java-url-class-bytecode", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Java URL class reference", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/thread/lifecycle::jvm-thread-start-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM starts a thread", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/data/archive/extract/zip::jvm-zip-entry-iteration-bytecode", "conf": 0.92, "crit": 3, "desc": "JVM iterates ZIP archive entries", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/lib/urlconnection::jvm-url-class-ref", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "JVM URL class reference" }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-init-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.92, "crit": 3, "desc": "Java bytecode ProcessBuilder constructor", "from": [ { "file": 1 } ] }, { "id": "well-known/game/mod::minecraft-session-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft session object reference", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-x509trustmanager-server-callback", "conf": 0.94, "crit": 3, "desc": "JVM checkServerTrusted callback defined" }, { "id": "micro-behaviors/time/sleep/interval::java-thread-sleep-bytecode", "conf": 0.9, "crit": 3, "desc": "Java bytecode thread sleep", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/spawn::child-process-creation-api", "atk": "T1106", "conf": 0.92, "crit": 3, "desc": "Starts a child process through a platform API", "from": [ { "off": 702, "file": 1 }, { "file": 2 }, { "off": 291, "file": 3 } ], "uses": [ 11 ] }, { "id": "micro-behaviors/data/buffer/transfer::jvm-outputstream-write", "conf": 0.96, "crit": 2, "desc": "JVM writes bytes to output stream", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.88, "crit": 3, "desc": "Java bytecode ProcessBuilder reference", "from": [ { "file": 1 } ] }, { "id": "metadata/package/config::fabric-mod-metadata", "conf": 0.9, "crit": 3, "desc": "Fabric mod metadata resource", "from": [ { "file": 11 } ] }, { "id": "metadata/file/archive::archive-at-least-10-members", "conf": 0.9, "crit": 3, "desc": "Archive contains at least ten members" }, { "id": "metadata/package/config::forge-mods-toml-archive-member", "conf": 0.98, "crit": 3, "desc": "JAR contains Forge mods.toml metadata" }, { "id": "metadata/file/naming::archive-member-over-200kb", "conf": 0.9, "crit": 3, "desc": "Archive has member larger than 200 KB" }, { "id": "metadata/file/naming::archive-member-under-10kb", "conf": 0.9, "crit": 3, "desc": "Archive has a sub-10KB member" }, { "id": "objectives/exfiltration/stealer/credential/token::minecraft-token-http-body-exfil", "atk": "T1041", "mbc": "E1041", "conf": 0.98, "crit": 4, "desc": "Minecraft token access paired with raw socket request write", "from": [ { "off": 1986, "file": 2 }, { "off": 6460, "file": 4 } ], "uses": [ 22, 41 ], "spans": [ [ 0, 41 ] ] }, { "id": "well-known/malware/stealer/prefire-shard::prefire-packed-runtime-stealer", "atk": "T1528", "mbc": "B0006", "conf": 0.99, "crit": 5, "desc": "Prefire packed runtime Minecraft stealer", "from": [ { "off": 20795, "file": 1 }, { "off": 1986, "file": 2 }, { "file": 3 }, { "file": 4 } ], "uses": [ 14, 27, 40, 41, 56, 63, 67 ] } ] }, { "ctx": [ { "b": "+kO#^0000+1G?+97?mG3fk20vxMW=qBZ]u9v}/L0r://!wD@ho0rrWCvrM6jy*?i]fhD4(wN//!00rl4bv+Uefk20vxMW=qo?W#An[z3YswI)wv}Gg\u0026m@Q}zDt^Ck2lj]d02x6.z7/KoBzb/afhkbemm}b(hDS:O2lj#f01rvHvSs[SmTxx0xkEUHa.\u003eCevj#C9zF7R0A=kD0B8%V\u003cx(4r\u003eAWjK]wnc6}v@}}Q3ipbzygho]fkL6mxd)84z!0v1B3+1-y?d9$2lkek00(Flwnc6}v@}.K7\u00260G5vj#+Bx(2B?vrl0rg:CF2v@C)?AT8NP0rrWCvrM6jB-.tlfg68*wI#vI01/ki2sJckz!9B10rsAXvrM6jy*?i]fkkrEz!\u0026]qo\u003ewAWz!8yEzE^M{B0KB$z!\u003cGm2lkCs03k(-C404uvqYZhx(n9jyH]d[wPRQ7wjQcDwnC*#2lkIu00Vbnz!\u003cGm0rrjjzV", "ln": 0 }, { "b": "02eawvrM6jzFs2xw[=6)fhM80xGDj{6k8P5Du-!uA=c2dvQBs[ze%xb0rs0hygho]fkL6mxd)h9A+PA7luN0UwmY^y0rrr^x(mTbj]\u003eS=c[eg904[m83ighefAzd+ygho]fkL6mxd)h9A+PA72llHW02GxUC404uvqYZhq/)4]zF8pUx(4r\u003eAT8O33ih{-fAzev)2ma]X2enBU\u0026?KL)vZ0rJHeUkVfu[K)2wQyWVY:fGY![\u003c)v*-LJJIiGP6p([\u003cg*ooLEG$qTk]On\u0026\u003c1a5G1hu%05\u003c]U3V{qOxKL{EA=LPl0rrlJdo/dF0673u3ih\u003cZi@]r.tseR}jQg%90rroKtsf\u0026u3\u0026?)WkNEGE06{R=24qE\u0026wO#2V04/P)ygho]fkL6mxd)h9A+PA7j1i\u003crvrM6jy*?i]fh($kx(mMIB.LV5wPx\u003cv07c-O3ih{-mf9x\u003c)TP\u0026NPm=DZQVxaU\u0026jj*hX}xgcNE3ur\u003c!5EnVBPmRNcQ(U(y1skFs(e1P6I3c)T.RdO#?mfKl0%I\u0026jb\u0026LYr7gTX9PJv\u003c^}a?VY1a9SoZKG(y0Uw2MNu}00)W+q/)4]zF5$I6EUz7ygho]fkL6mxd)h9A+PA7i$89X07)N#h2{nI043-@YZqXL\u003cI4wJRm\u003e#WR%QBv\u003cIem/Q[V$tL\u003cLAO\u003cId2yQ(tG.08iE]ead$F\u0026/{[kFU?^!W=:x$\u003eCLJKFS]8UWc\u0026ET\u0026*2}[Fb", "ln": 627 }, { "b": "00WmJzFa680rriIdm\u003c{Fve%:z05BQ+0rrlJnHWWG04[m.3ih{-w=R(Kc{]BSygho]fkL6mxd)h9A+PA7luN0UwmY^y3\u0026\u0026S{xBj.%0bhDlj(@Gc\u0026\u003ckJAI[ebQX8B0m\u003casV6NUo.jV*TcP\u003c!YlwVxBvcJQ0Z5\u0026I0WtF@Yb+Tk*^Y[0fm4KBVqNWf)luyxjz#(4T]KWu/%RIsdjh\u003eZ{z", "ln": 1692 }, { "b": "By[G^wQm!^025BEyG1Ofv[oNaAa\u003cl9uRUlEnc5X}Ab]J4x(W+=07[Ukygho]fkL6mxd)h9A+PA7j4%x$C404uvqYZhq/)4]zF848ygho]fkL6mxd)h9A+PA7j1i\u003crvrM5", "ln": 4072 }, { "b": "05$nCO$shT)s*C^Te:*l\u003e:wacQLd{gZVz8J+-q7zIsmEB/{}n[Q3ekn(zy=DPpi#O)s.81S\u0026DyaeDC?QxjVf@zGVA?f96Mg0i(LU0rtO0(.6:oWyks}GxO.T\u0026*lk8T?9I$K)mNO\u003cai0HZprQkQ2z=O\u003ezLbUTdnHHMHzhM(7$6pN6+\u003esVHs(K\u0026\u003clw:F$.jPVJ{N!0rs!W)y5LwQ35?G[2hJpXS#iUHWyk3(v(O8OricEV/4Hl\u003eEl9jSKS", "ln": 5568 }, { "b": "KC\u0026FuYX]=X)VBa8Pn.ZaNbS%P\u003e-z1{ZQA71Lj1D\u0026\u003e:[g1RKmX\u003cW/DEGc}L\u003cYygho]fkL6mxd)h9A+PA7luN0UwmY^y3\u0026\u0026S}XE5r]0LepihX1(dKNnyx[2r5GTB/VtRr\u003cRy)yO+GRKMOePx\u0026\u003e:\u0026KKQbW2KjyGxn9c)u\u003c\u003cvS/VRHU\u0026@rP2M.ND03}Q+2(\u003e2cZ5Xi\u003c3e{}}\u003c!dg=T=}#", "ln": 8549 }, { "b": "[0x0#I\u003eom4XAH8V(YmX8TG.eVZuQSf(ZtA(0WX6J0000000*\u003cK01-)NC404uvqYZhra{q-vpPPAdGGIMB8kA0z#/}wc}U{?3\u003c4%YeEzLf0XKM[tT0ihZH#Z{1kSiEM\u0026Ng0CvCA4uVfK^uWuN4B8UGez2\u003cRty?mGw0rrTAw{4NeAyj.GyhcyIz*ho.2Xv*XAc2P3fAzdSyHp%syxjzrlp:T=0rrBtz!@@}AZB[X0rr^FvrM6jx(tT@pEPIrwPh:9z/b^YiSPi=Dt9", "ln": 11833 }, { "b": "wNPAX0.SK]1T)Owdol\u0026Se=[-O0.-U\u003c0rr@+oLO0Vvj#tkfg*52B-ZM7A+eV@j1jhs04[sH3iA*3q2{U9xjVfWwQ5q=zGG]A0rs2^dnjF+C404DBzkLADtdsKt4}}AzGG]Ai$8f?0-PHdn=?#[02xrTC404DBzkLADtdsKt4}}AzGG]A2lE%c00^dFBwumYwEFSy07)O1soqUb01iHZl${WMv@#TfC)\u003c:V0nm+Ysoq+e010pHBwMy^wO#O\u003c02u$ioLO0Vvj#Ijz.CZpy?km@vrufA3\u003c6=qu\u003c=#}0:#9f9bn]9vj#tkfg6![w[u0]wkvt\u0026Acln3BAg@3z3HbL0rr%KvrM6jx(tT]x(4uRB-.OBBw)p4wNPAX0+zxj26s=Mx(4tY01ZLcoLO0Vvj#tkfgGU(wJHq4x98-O0xyi}0rrYWoLO0Vvj#tkfgGU(wJItw3\u0026?)YyygbP0=d(q8yOo]vrM6jx(tU2B-.OBBw)p4wNPBqnHWWG04[s\u003c3iB-tzVG?vA+eV\u00263\u003c7zI843Bq0=!qw1:t03By+EM2pJ!ynL7vi3\u003c7ILBQwgX0^jOA1.hv!B7C:YCMox70+qvT0rrNqwmORYAbY\u0026eB8$]60rr@+oLO0Vvj#C9zF7R4xMw3nvpB4:j1jhs0^:#@3iAx)Ee%rPv@c78wKQGUA^n5{E/Ibe0.JJA17=LNQ6m3*PU^\u003c.FG$zW-4hf?\u003c^G/=uJ", "ln": 12186 }, { "b": "l3mzM00)gPB-7.^BAdxZ2xjM[l$7gC1h6oSzV.y4!\u003cxJ\u003egH?Tg01-)NC404DBzkLAl2}0OD2\u003ch(NGix@v@DsipI9HkzF9IY00\u003c#Slp\u003c-$ts5-1Oc2k*0?fm.0rrNqv@VT9A+d{/x(!Dm3\u003c9763jl+m0?/R{1:ro*uR{?74T8#swO1!jh^Xspp*Xhy00)azByv:Uw]vXI4qE?3C5{UwA^y.TuVDeE2Y\u003cW2zF\u0026u[x-OhJC5?2fyir($w]}-]AbGm", "ln": 12962 }, { "b": "y\u0026Axmq2{U7v@Dj6A+frkwN\u003e]w=LLmr{UWqqxbnYK1:{!J5H83xi0B{RMr\u003e[/\u003cj\u003c-wUq(K:@rQQL0rr)IvrM6jB-.tlfm4tKfg*4[y*?A%AT8VO3iEWpfAzdVB7GC+zG6-u3\u003c9%vo:Q%h0\u003eFGGSw6Rs03b/.C404rz.BC5By^:UA::k?B-.OBBw)p4wNPAX0\u003e!{xZ5R:C00)gJzFsf9wN(hJZYr6}0\u003eelE0rrvszF0Y[By+\u003cZ.VyX.0\u003eelH0rrEAwO2y[nP5G\u0026Bpnk\u003c0nm+YW/TOS0\u003e[.V0rrjkzE:dS:]B740\u003eelO0rrHHz:F.\u003ewKguSvr?\u003eN1sLZ6ljr}u0)RbOZ5(QY026fVqBs/hy?#)Ok$1vluVo1Pz2\u003cRyn\u0026fyXx)r#]lJEf7oLO0Vvj#+Bx(2CGx(CZ%zF0Y[By/FO0rrmhAS", "ln": 13205 }, { "b": "0{o)(\u003eM0pA0xycM0rrQAvrM6jB-.tlfhc83Bo.)k0rrjgwmLYv6^#:\u003cvrM6jy*?i]fhD4(wN/*zdoWbY)e(X-0{*0S0rs+qTb=zTRrUaR\u003e!AkEOrS3eF-?#!(A(9dMB(vnLKjP((A3SxR2", "ln": 14002 }, { "b": "c}[w:C404rz.BN]y?kWSoLO0Vvj#C9zF7R0A=kD0B8%V\u003cx(4r\u003eAWjK]wnc6}v@%^v0#RgV3igCo8VY{FA+e=}A+e:5nP5G\u0026Bo8wac}[w:C404uvqYZhp\u0026ZF:wPI]VB.LV5wPx4]wN]H}wN/*zdnjF+C404uvqYZhp\u0026ZF:wPI]VB.LV5wPx\u003cv104E+3igIq9@#v22jm!q)vPWfW6n!$GYm%8)$v7}Nxk!HI0IHB(948CJ?t={GZChk)v/s3WvVS^U\u0026pXB)$FHZ10EWB2W}W\u003ewO#3TzWVZ)0#.HD3J?TP01K3Xwnc6}v@$H?Bz#wA3\u003cd*U9TR(R11a9H6lmU{x(W={Bvyj\u003cz/O=#A+eV@0rsb*s$9cWvrM6jy*?i]fhMXcv}x.5luN0UwmY^y3\u003cd{XdHDd+11KxL1-[=]A=.rZ6^$I8ygho]fkL6mxd)84z!0v1B2%^jeDWQj01x2-0rrZDvrM6jy*?i]fhMXcv}x.52lMWY00vgOwb#Vjc[d:%12y3o3iJ3=h30X/4c\u003ef?)sz!jOT5SlQ2SCl(A3VrG@\u003cHeHWG}J(8qt-UEi?{WD+5U)speXOuRBKFA9#p(Ab^1GR4y#R%YqG(8xZgU9ww", "ln": 14786 }, { "b": "ph\u003cnn026P(xjCK/uU%W[zeKh$ACfDhv/VMsvQTs?hz^^tzGGDmBoqI2fMm9]W99:$VLv)o1h3$=NGix}xjVfMwN/T?wPv!K94imfygho]flIwJy+Fa-B7El^bT=iNz!9B1i$8kM1lG{\u003c5^dp$00V$Bv@C)?0rr(-oLO0Vvj#C9zF7R3BAh8kxfdLDljr$X1l{i[5cIk003M8=C404wx(tUmxKL}5wPPO7Byx5$vrb)CxKL}5wPR$#1ml9?1YXI\u003euPn5^8CB)OC404wx(tUmxKL}5wPPN)xKL}5wPQ0x1mDuY2)oO$[C@Ric%G2iygho]fk+GxfjOW7A=U/lfgfzYA=U/li@", "ln": 19031 }, { "b": "1?.Olk+i)ln^hE\u003eZm1rmOwkrZZ9V:w@c]v-hYF75*2?)g0rr^FvrM6jy*?i]fgfzYA:-E1wPw1Uvf3uiwnbW\u003cBo8vBc{{MPnEL-i1y}\u0026xvGZly01K0]w\u003e45\u003eCxW22w]8j40rrBEByxo5nPXJX0rrTPvSu3WyhDmHzdWiDB.}cV26ao%nO05D024?0y\u0026\u003c2Lx(D)QzB4DpuR+Gnr@\u0026p6yH}+[0+1/c1POJ501VLy=\u0026\u003cyH0047bLB.^Pe98OZ\u003cCFGMX1.(HZVSti\u0026\u0026GoBL(", "ln": 20731 }, { "b": "0rs.Lf8#1QR#M/qtl26iM\u0026E9\u003eL}6lyf!9Ex05E:WY8TY\u003eW/wrWd?T?I06A$bZ64%$uO\u003c}$Z8Z.!whTM91Is[01P{T!6:txQQ5VhK1R?j)6:uGC6:blQ9DkyyF%6b!1{7U4\u0026\u003e2gDsS4yL07a9]mPR8MnvwHXiTDVgZ64%:312IE3k\u003ce:6:!EOwhT/g3+MT73\u003cex%6+7(=Q5VqN3(6i?2]9[a83}2=6+7(+A9$IOL2WeA0Jk$PY8TS\u002684r$OlBD\u003e-s1yYVoJb6%Y8TY\u003eW/wrE5e=2(pppc+iUrkwZ64%:5NNvM5/zp}6+U3WwhU8o6taGf6AZld6+}C%Q5VqN6CRu25FV3q84^O%6+}C@A9$IOL2WeI0Jk$PY8TS\u002685fKWlBD\u003e-r#zLZp{{u^iV5.KZ64%:7*/9T85Tp96=yJ+whUtv8Oukm8V}#r6=W@bQ5VqN8X\u003ctg7.[2E85K8b6=W@aA9$IOL2WeP0Jk$PY8TS\u002685{3+lBD\u003e-r#zLZqNMM/iV/jY12I[U86uM}wecj$hx-!UYAHtu6^iY\u003chx@}YN/BYKa@8su9%rr3u\u003e\u003c[]g-mwr6^BCoA9$IOL2WeW%ek[MY8TS\u002686VJ\u0026lBD", "ln": 21908 }, { "b": "eXR@LwcuB3fbldM1V!sthzC}36!=oYaq(\u003cFf=qLTf/f+16!ZpR6!TDkg\u003eH(\u003cGFrI9%kgA*gG+OHW/w-[sQ8FrhcEx*hAAVjg.J{006Aq188RHMhz#BgZ64%YhE[Z86/S=eiYEj1itBK?h\u003e*o$88@u\u003e88RKihEEmWu]e-U1qJ{ihGi4XwrG@Ciru5T*Q^CwsS6id07a9]mPQD:5)zZzjutOxjoEz#jScw@1y@lgwhVQ^kd?4WklA/e89X\u003c389w3pjZY0\u0026u]e--1qKfpj-B^=F%6b!kMIP+6*wt\u003e?N-+zsS6Dk07a9]mPQD:5)NE+8aaIm0amYM8ag?jwcuATl$whAY8TY\u003e6?bOixf5G:hB!GL6?a?%dh+O)lJ!b(u\u003e(gtWG6XMlJ!b]6?01GWG6YCLc$v9sa\u003c6AR#Lr=mZ-p\u003cWG5=#88O=4oJb70Y8TY\u003eW/wrEn/pkly{\u003csai.Ht-Z64%:oj6IloC{Hq6?\u0026cvwhWc%o$QS\u003cp6iyI6\u0026bMsQ5VqNp8cLxobgkV8a$Ys6\u0026bMrA9$IOL2Wfh0Jk$PY8TS\u00268bvTvlBD\u003e-r#BQyzNGKci-l?[Z64%:qEqmsqYeGE6\u0026OSCwhWy4rj\u0026w}rrCcW6\u0026(5GQ5VqNrtwKLqwAj?8b.hG6\u0026(5FA9$IOL2Wfo0Jk$PY8TS\u00268cacClBD", "ln": 22508 }, { "b": "1Ghq20UULp00\u0026M80s]?BMO]6-2nmf9wsrGt69sKV2nEEQ0jMt]2nEES0?1S#2nEEECS2^SZ7pNA00Jzc5d2]OsPYj(r9otnp/HN35kDhc1}Tp7sQbGEr9oFr3rgdt1}RXLsR7/H3rf.4j@\u003eguQ5U(T9wYk!gOjTJ0KdjV0Jk$:5c$Du5c#U]Zm$W-d\u0026*zT0rmGV7\u003cELK1yK1$0rmGV5o@ZQ9r/?b5DI\u0026W5d0Jhd\u0026!?4gz6S!ET\u003crVd\u0026!\u003e59s@G:Xb@o-1SmECgz1k)05+X#1tZPXPA3LY1QcW[ws@]F83Hj25oBGA8.h{u2W!U:2W!wIv7logiTd5K2dsPcUPjn-6:d]LkbXB70Kbo0UMa!adf8763\u0026)^qg5#v@3\u0026)^qBo8pv3\u0026)^q@@AGd3\u0026)^q0TbF5003%r2(", "ln": 93739 }, { "b": "D]qD+WG6?I0d{{B1P+?T1?1Iso!l\u0026v5DEu\u002616OCK5d(tOkSe-W1EPk$6:b9@5tPpf0Ka9!0dUTYFe5g\u003cxKFmJs#(*p83NCKlPLB-05E:}2c[v4W/=rco-.D#0SZyz[C", "ln": 142414 }, { "b": "6A?S02nNKU1ylHo2nNKU1yDZs2q3U[1-bX71HXqr5d(tOw^rMh6:aUEWG6XD5v.\u003cPv3aAw1oLI3NK$-z00066Sq([#4/=.S@S0xd2lCzp}V5(e1GzC405KVV05jE/1o", "ln": 142915 } ], "depth": 1, "facts": { "imp": [ [ "", "java/lang/Object" ], [ "", "com/github/MLEEJeV6XOT$cfbqGpFzzogm" ], [ "", "com/github/MLEEJeV6XOT" ], [ "", "java/lang/ProcessBuilder$Redirect" ], [ "", "java/lang/ProcessBuilder" ], [ "", "java/util/Base64$Decoder" ], [ "", "java/util/Base64" ], [ "", "java/lang/invoke/MethodHandles$Lookup" ], [ "", "java/lang/invoke/MethodHandles" ], [ "", "java/lang/String" ], [ "", "java/lang/StringBuilder" ], [ "", "[C" ], [ "", "[Ljava/lang/String;" ], [ "", "java/lang/System" ], [ "", "java/lang/Exception" ], [ "", "java/util/Map" ], [ "", "java/nio/file/Path" ], [ "", "java/nio/file/attribute/FileAttribute" ], [ "", "java/nio/file/Files" ], [ "", "java/nio/file/LinkOption" ], [ "", "java/lang/Class" ], [ "", "java/lang/InterruptedException" ], [ "", "[B" ], [ "", "java/lang/Thread" ], [ "", "java/io/IOException" ], [ "", "java/lang/Throwable" ], [ "", "java/util/zip/ZipInputStream" ], [ "", "java/io/ByteArrayInputStream" ], [ "", "java/util/zip/ZipEntry" ], [ "", "java/io/BufferedOutputStream" ], [ "", "java/io/FileOutputStream" ], [ "", "java/util/Arrays" ], [ "", "java/util/zip/Inflater" ], [ "", "java/io/ByteArrayOutputStream" ], [ "", "java/util/ArrayList" ], [ "", "java/util/List" ], [ "", "java/io/File" ], [ "", "java/lang/Process" ], [ "", "java/io/PrintStream" ], [ "", "java/nio/charset/StandardCharsets" ], [ "", "java/lang/Integer" ], [ "", "java/lang/Character" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.toCharArray" ], [ "java/lang/String", "toCharArray" ], [ "java/lang/String", "java/lang/String.\u003cinit\u003e" ], [ "java/lang/String", "\u003cinit\u003e" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.toString" ], [ "java/lang/StringBuilder", "toString" ], [ "java/lang/String", "java/lang/String.charAt" ], [ "java/lang/String", "charAt" ], [ "java/lang/String", "java/lang/String.length" ], [ "java/lang/String", "length" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "com/github/ucokcifwValue", "com/github/ucokcifwValue.doV" ], [ "com/github/ucokcifwValue", "doV" ], [ "com/github/ucokcifwValue", "com/github/ucokcifwValue.svtrtfGlmglna" ], [ "com/github/ucokcifwValue", "svtrtfGlmglna" ], [ "com/github/ucokcifwValue", "com/github/ucokcifwValue.klurp_ukigsm" ], [ "com/github/ucokcifwValue", "klurp_ukigsm" ], [ "com/github/ucokcifwValue", "com/github/ucokcifwValue.numjfF" ], [ "com/github/ucokcifwValue", "numjfF" ], [ "com/github/ucokcifwValue", "com/github/ucokcifwValue.pdjtot_jqgpup_glkrdl" ], [ "com/github/ucokcifwValue", "pdjtot_jqgpup_glkrdl" ], [ "com/github/ucokcifwValue", "com/github/ucokcifwValue.xomxot" ], [ "com/github/ucokcifwValue", "xomxot" ], [ "com/github/ucokcifwValue", "com/github/ucokcifwValue.\u003cinit\u003e" ], [ "com/github/ucokcifwValue", "\u003cinit\u003e" ], [ "com/github/ucokcifwValue", "com/github/ucokcifwValue.runDetached" ], [ "com/github/ucokcifwValue", "runDetached" ], [ "java/lang/System", "java/lang/System.arraycopy" ], [ "java/lang/System", "arraycopy" ], [ "com/github/MLEEJeV6XOT", "com/github/MLEEJeV6XOT.runJymmjod" ], [ "com/github/MLEEJeV6XOT", "runJymmjod" ], [ "com/github/MLEEJeV6XOT$cfbqGpFzzogm", "com/github/MLEEJeV6XOT$cfbqGpFzzogm.statusCode" ], [ "com/github/MLEEJeV6XOT$cfbqGpFzzogm", "statusCode" ], [ "com/github/MLEEJeV6XOT$cfbqGpFzzogm", "com/github/MLEEJeV6XOT$cfbqGpFzzogm.bodyString" ], [ "com/github/MLEEJeV6XOT$cfbqGpFzzogm", "bodyString" ], [ "com/github/ucokcifwValue", "com/github/ucokcifwValue.skhzabuFouxSu" ], [ "com/github/ucokcifwValue", "skhzabuFouxSu" ], [ "java/lang/String", "java/lang/String.isEmpty" ], [ "java/lang/String", "isEmpty" ], [ "com/github/ucokcifwValue", "com/github/ucokcifwValue.pvmy" ], [ "com/github/ucokcifwValue", "pvmy" ], [ "java/util/Map", "java/util/Map.of" ], [ "java/util/Map", "of" ], [ "com/github/MLEEJeV6XOT", "com/github/MLEEJeV6XOT.xDyqrky" ], [ "com/github/MLEEJeV6XOT", "xDyqrky" ], [ "com/github/ucokcifwValue", "com/github/ucokcifwValue.cjqjb_uf_gfl" ], [ "com/github/ucokcifwValue", "cjqjb_uf_gfl" ], [ "java/lang/System", "java/lang/System.getenv" ], [ "java/lang/System", "getenv" ], [ "java/nio/file/Path", "java/nio/file/Path.of" ], [ "java/nio/file/Path", "of" ], [ "com/github/ucokcifwValue", "com/github/ucokcifwValue.kcrmjuaImpl" ], [ "com/github/ucokcifwValue", "kcrmjuaImpl" ], [ "com/github/ucokcifwValue", "com/github/ucokcifwValue.gyfzx_vrnuab_wimrjk" ], [ "com/github/ucokcifwValue", "gyfzx_vrnuab_wimrjk" ], [ "java/nio/file/Files", "java/nio/file/Files.createDirectories" ], [ "java/nio/file/Files", "createDirectories" ], [ "com/github/ucokcifwValue", "com/github/ucokcifwValue.KonTvbYhmycxP" ], [ "com/github/ucokcifwValue", "KonTvbYhmycxP" ], [ "com/github/ucokcifwValue", "com/github/ucokcifwValue.ELCZUFWq" ], [ "com/github/ucokcifwValue", "ELCZUFWq" ], [ "com/github/ucokcifwValue", "com/github/ucokcifwValue.WtiPuaEW4YJBM" ], [ "com/github/ucokcifwValue", "WtiPuaEW4YJBM" ], [ "com/github/ucokcifwValue", "com/github/ucokcifwValue.vpFeoPFTagYTnnT" ], [ "com/github/ucokcifwValue", "vpFeoPFTagYTnnT" ], [ "com/github/ucokcifwValue", "com/github/ucokcifwValue.saveUnshx" ], [ "com/github/ucokcifwValue", "saveUnshx" ], [ "java/nio/file/Path", "java/nio/file/Path.resolve" ], [ "java/nio/file/Path", "resolve" ], [ "java/nio/file/Files", "java/nio/file/Files.exists" ], [ "java/nio/file/Files", "exists" ], [ "com/github/ucokcifwValue", "com/github/ucokcifwValue.emitSgfq" ], [ "com/github/ucokcifwValue", "emitSgfq" ], [ "com/github/ucokcifwValue", "com/github/ucokcifwValue.vrfjfbbDkdkbu" ], [ "com/github/ucokcifwValue", "vrfjfbbDkdkbu" ], [ "java/lang/Object", "java/lang/Object.getClass" ], [ "java/lang/Object", "getClass" ], [ "java/lang/Class", "java/lang/Class.getSimpleName" ], [ "java/lang/Class", "getSimpleName" ], [ "java/lang/Exception", "java/lang/Exception.getMessage" ], [ "java/lang/Exception", "getMessage" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "com/github/ucokcifwValue", "com/github/ucokcifwValue.objFvuk" ], [ "com/github/ucokcifwValue", "objFvuk" ], [ "java/util/Map", "java/util/Map.of" ], [ "java/util/Map", "of" ], [ "com/github/MLEEJeV6XOT", "com/github/MLEEJeV6XOT.get" ], [ "com/github/MLEEJeV6XOT", "get" ], [ "com/github/MLEEJeV6XOT$cfbqGpFzzogm", "com/github/MLEEJeV6XOT$cfbqGpFzzogm.body" ], [ "com/github/MLEEJeV6XOT$cfbqGpFzzogm", "body" ], [ "com/github/ucokcifwValue", "com/github/ucokcifwValue.ovgcm_gi_dz_nsz" ], [ "com/github/ucokcifwValue", "ovgcm_gi_dz_nsz" ], [ "com/github/ucokcifwValue", "com/github/ucokcifwValue.ujgf_ymbph_mi" ], [ "com/github/ucokcifwValue", "ujgf_ymbph_mi" ], [ "java/lang/Thread", "java/lang/Thread.sleep" ], [ "java/lang/Thread", "sleep" ], [ "java/io/ByteArrayInputStream", "java/io/ByteArrayInputStream.\u003cinit\u003e" ], [ "java/io/ByteArrayInputStream", "\u003cinit\u003e" ], [ "java/util/zip/ZipInputStream", "java/util/zip/ZipInputStream.\u003cinit\u003e" ], [ "java/util/zip/ZipInputStream", "\u003cinit\u003e" ], [ "java/util/zip/ZipInputStream", "java/util/zip/ZipInputStream.getNextEntry" ], [ "java/util/zip/ZipInputStream", "getNextEntry" ], [ "java/util/zip/ZipEntry", "java/util/zip/ZipEntry.getName" ], [ "java/util/zip/ZipEntry", "getName" ], [ "java/util/zip/ZipEntry", "java/util/zip/ZipEntry.isDirectory" ], [ "java/util/zip/ZipEntry", "isDirectory" ], [ "java/nio/file/Path", "java/nio/file/Path.getParent" ], [ "java/nio/file/Path", "getParent" ], [ "java/nio/file/Path", "java/nio/file/Path.toFile" ], [ "java/nio/file/Path", "toFile" ], [ "java/io/FileOutputStream", "java/io/FileOutputStream.\u003cinit\u003e" ], [ "java/io/FileOutputStream", "\u003cinit\u003e" ], [ "java/io/BufferedOutputStream", "java/io/BufferedOutputStream.\u003cinit\u003e" ], [ "java/io/BufferedOutputStream", "\u003cinit\u003e" ], [ "java/util/zip/ZipInputStream", "java/util/zip/ZipInputStream.read" ], [ "java/util/zip/ZipInputStream", "read" ], [ "java/io/BufferedOutputStream", "java/io/BufferedOutputStream.write" ], [ "java/io/BufferedOutputStream", "write" ], [ "java/io/BufferedOutputStream", "java/io/BufferedOutputStream.close" ], [ "java/io/BufferedOutputStream", "close" ], [ "java/lang/Throwable", "java/lang/Throwable.addSuppressed" ], [ "java/lang/Throwable", "addSuppressed" ], [ "java/util/zip/ZipInputStream", "java/util/zip/ZipInputStream.closeEntry" ], [ "java/util/zip/ZipInputStream", "closeEntry" ], [ "java/util/zip/ZipInputStream", "java/util/zip/ZipInputStream.close" ], [ "java/util/zip/ZipInputStream", "close" ], [ "java/util/Arrays", "java/util/Arrays.copyOfRange" ], [ "java/util/Arrays", "copyOfRange" ], [ "com/github/ucokcifwValue", "com/github/ucokcifwValue.acquireLvisvm" ], [ "com/github/ucokcifwValue", "acquireLvisvm" ], [ "java/util/zip/Inflater", "java/util/zip/Inflater.\u003cinit\u003e" ], [ "java/util/zip/Inflater", "\u003cinit\u003e" ], [ "java/util/zip/Inflater", "java/util/zip/Inflater.setInput" ], [ "java/util/zip/Inflater", "setInput" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.\u003cinit\u003e" ], [ "java/io/ByteArrayOutputStream", "\u003cinit\u003e" ], [ "java/util/zip/Inflater", "java/util/zip/Inflater.finished" ], [ "java/util/zip/Inflater", "finished" ], [ "java/util/zip/Inflater", "java/util/zip/Inflater.inflate" ], [ "java/util/zip/Inflater", "inflate" ], [ "java/util/zip/Inflater", "java/util/zip/Inflater.needsInput" ], [ "java/util/zip/Inflater", "needsInput" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.write" ], [ "java/io/ByteArrayOutputStream", "write" ], [ "java/util/zip/Inflater", "java/util/zip/Inflater.end" ], [ "java/util/zip/Inflater", "end" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.toByteArray" ], [ "java/io/ByteArrayOutputStream", "toByteArray" ], [ "java/util/ArrayList", "java/util/ArrayList.\u003cinit\u003e" ], [ "java/util/ArrayList", "\u003cinit\u003e" ], [ "java/nio/file/Path", "java/nio/file/Path.toString" ], [ "java/nio/file/Path", "toString" ], [ "java/util/List", "java/util/List.add" ], [ "java/util/List", "add" ], [ "com/github/ucokcifwValue", "com/github/ucokcifwValue.abwyel9" ], [ "com/github/ucokcifwValue", "abwyel9" ], [ "java/lang/String", "java/lang/String.equals" ], [ "java/lang/String", "equals" ], [ "com/github/ucokcifwValue", "com/github/ucokcifwValue.LRjyNg4RPyjoAla" ], [ "com/github/ucokcifwValue", "LRjyNg4RPyjoAla" ], [ "com/github/ucokcifwValue", "com/github/ucokcifwValue.pUb_Ii_A" ], [ "com/github/ucokcifwValue", "pUb_Ii_A" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.\u003cinit\u003e" ], [ "java/lang/ProcessBuilder", "\u003cinit\u003e" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.directory" ], [ "java/lang/ProcessBuilder", "directory" ], [ "java/io/File", "java/io/File.\u003cinit\u003e" ], [ "java/io/File", "\u003cinit\u003e" ], [ "java/lang/ProcessBuilder$Redirect", "java/lang/ProcessBuilder$Redirect.from" ], [ "java/lang/ProcessBuilder$Redirect", "from" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectInput" ], [ "java/lang/ProcessBuilder", "redirectInput" ], [ "java/lang/ProcessBuilder$Redirect", "java/lang/ProcessBuilder$Redirect.appendTo" ], [ "java/lang/ProcessBuilder$Redirect", "appendTo" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectOutput" ], [ "java/lang/ProcessBuilder", "redirectOutput" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectErrorStream" ], [ "java/lang/ProcessBuilder", "redirectErrorStream" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.start" ], [ "java/lang/ProcessBuilder", "start" ], [ "java/lang/Process", "java/lang/Process.pid" ], [ "java/lang/Process", "pid" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "com/github/ucokcifwValue", "com/github/ucokcifwValue.YDGCP" ], [ "com/github/ucokcifwValue", "YDGCP" ], [ "java/nio/file/Files", "java/nio/file/Files.readString" ], [ "java/nio/file/Files", "readString" ], [ "java/lang/String", "java/lang/String.substring" ], [ "java/lang/String", "substring" ], [ "java/lang/String", "java/lang/String.substring" ], [ "java/lang/String", "substring" ], [ "java/lang/System", "java/lang/System.getProperty" ], [ "java/lang/System", "getProperty" ], [ "com/github/ucokcifwValue", "com/github/ucokcifwValue.yeiccxqsHelper" ], [ "com/github/ucokcifwValue", "yeiccxqsHelper" ], [ "com/github/ucokcifwValue", "com/github/ucokcifwValue.duq_rrpa" ], [ "com/github/ucokcifwValue", "duq_rrpa" ], [ "java/lang/System", "java/lang/System.currentTimeMillis" ], [ "java/lang/System", "currentTimeMillis" ], [ "java/lang/System", "java/lang/System.out" ], [ "java/lang/System", "out" ], [ "java/io/PrintStream", "java/io/PrintStream.println" ], [ "java/io/PrintStream", "println" ], [ "java/util/Base64", "java/util/Base64.getDecoder" ], [ "java/util/Base64", "getDecoder" ], [ "java/util/Base64$Decoder", "java/util/Base64$Decoder.decode" ], [ "java/util/Base64$Decoder", "decode" ], [ "java/nio/charset/StandardCharsets", "java/nio/charset/StandardCharsets.UTF_8" ], [ "java/nio/charset/StandardCharsets", "UTF_8" ], [ "java/lang/String", "java/lang/String.\u003cinit\u003e" ], [ "java/lang/String", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.indexOf" ], [ "java/lang/String", "indexOf" ], [ "java/lang/String", "java/lang/String.indexOf" ], [ "java/lang/String", "indexOf" ], [ "com/github/ucokcifwValue", "com/github/ucokcifwValue.getTgvivlulu" ], [ "com/github/ucokcifwValue", "getTgvivlulu" ], [ "java/lang/String", "java/lang/String.startsWith" ], [ "java/lang/String", "startsWith" ], [ "java/lang/Integer", "java/lang/Integer.parseInt" ], [ "java/lang/Integer", "parseInt" ], [ "com/github/ucokcifwValue", "com/github/ucokcifwValue.sOFyhc" ], [ "com/github/ucokcifwValue", "sOFyhc" ], [ "java/lang/Character", "java/lang/Character.digit" ], [ "java/lang/Character", "digit" ], [ "java/lang/Integer", "java/lang/Integer.valueOf" ], [ "java/lang/Integer", "valueOf" ], [ "java/lang/String", "java/lang/String.format" ], [ "java/lang/String", "format" ] ], "metrics": { "file": { "size": 145646, "entropy": 4.28 }, "class": { "major_version": 65, "interface_count": 0, "method_ref_count": 120, "constant_pool_count": 1198, "external_class_count": 42 }, "binary": { "peak_region_bytes": 17408, "peak_region_entropy": 6.99 }, "imports": { "count": 162 }, "functions": { "count": 20 } } }, "id": 1, "mol": "O(As₂)H₅(Db₈FOsPo₂Ti)Md₃(BiIn)", "path": "/data/samples/incoming/forager/bad/sha256/bazaar/doomsday-1.21-1.21.11.jar!!com/github/ucokcifwValue.class", "pid": 0, "risk": 54, "sha": "4c23c610c5689bf0944e313ad3beb9cd0cbe1d5bfbb783dee28ab902dc374226", "size": 145646, "traits": [ { "id": "objectives/anti-static/obfuscation/steganography/image::obfuscated-png-archive-staging", "atk": "T1027.003", "conf": 0.94, "crit": 4, "desc": "Obfuscated class pairs PNG inflation, ZIP writes and process launch", "uses": [ 1, 7, 21 ], "spans": [ [ 702, 31 ], [ 12250, 41 ], [ 12457, 24 ], [ 12594, 33 ], [ 13301, 31 ], [ 13388, 30 ], [ 15115, 30 ], [ 22004, 8 ] ] }, { "id": "objectives/anti-static/obfuscation/string/reconstruct::jvm-many-xor-character-stores", "atk": "T1027", "conf": 0.96, "crit": 4, "desc": "Many XOR-derived character array stores", "spans": [ [ 22004, 8 ] ] }, { "id": "metadata/binary/symbols/descriptor::jvm-byte-slice-void-descriptor", "conf": 0.98, "crit": 3, "desc": "JVM byte-array slice method descriptor" }, { "id": "metadata/file/encoded::java-control-prefixed-long-string", "conf": 0.92, "crit": 3, "desc": "Long JVM constant with control prefix" }, { "id": "metadata/import/jvm::jvm-io-file-class-reference", "conf": 0.86, "crit": 3, "desc": "JVM references the Java IO File class" }, { "id": "metadata/import/jvm::jvm-nio-file-class-reference", "conf": 0.86, "crit": 3, "desc": "JVM references Java NIO file classes" }, { "id": "micro-behaviors/data/archive/extract/zip::jvm-control-prefixed-zip-process-apis", "conf": 0.96, "crit": 3, "desc": "Control-prefixed constants with ZIP extraction and process APIs", "uses": [ 3, 7, 18, 28 ], "spans": [ [ 702, 31 ], [ 12250, 41 ], [ 12457, 24 ], [ 12594, 33 ], [ 15115, 30 ], [ 19095, 27 ], [ 19149, 31 ] ] }, { "id": "micro-behaviors/data/archive/extract/zip::jvm-zip-entry-extraction-to-file", "conf": 0.96, "crit": 3, "desc": "JVM extracts ZIP entries to files", "uses": [ 8, 9, 24 ], "spans": [ [ 12250, 41 ], [ 12457, 24 ], [ 12594, 33 ] ] }, { "id": "micro-behaviors/data/archive/extract/zip::jvm-zip-entry-iteration-bytecode", "conf": 0.92, "crit": 3, "desc": "JVM iterates ZIP archive entries", "spans": [ [ 12250, 41 ] ] }, { "id": "micro-behaviors/data/archive/extract/zip::jvm-zip-entry-read-bytecode", "conf": 0.9, "crit": 3, "desc": "JVM reads ZIP archive entry data", "spans": [ [ 12594, 33 ] ] }, { "id": "micro-behaviors/data/arithmetic::jvm-subtract-character-array-store", "conf": 0.95, "crit": 3, "desc": "Difference narrowed and stored as JVM character", "spans": [ [ 22648, 8 ] ] }, { "id": "micro-behaviors/data/arithmetic::jvm-xor-character-array-store", "conf": 0.95, "crit": 3, "desc": "XOR result stored as JVM character", "spans": [ [ 22004, 8 ] ] }, { "id": "micro-behaviors/data/buffer/transfer::bytearrayinputstream-ref", "conf": 0.88, "crit": 3, "desc": "Java ByteArrayInputStream class" }, { "id": "micro-behaviors/data/buffer/transfer::bytearrayoutputstream-ref", "conf": 0.88, "crit": 3, "desc": "Java ByteArrayOutputStream class", "spans": [ [ 13327, 29 ] ] }, { "id": "micro-behaviors/data/buffer/transfer::jvm-array-copy-of-range", "conf": 0.7, "crit": 3, "desc": "JVM class calls Arrays.copyOfRange", "spans": [ [ 13026, 11 ] ] }, { "id": "micro-behaviors/data/decode/base64::java-base64-decode-bytecode-call", "conf": 0.96, "crit": 3, "desc": "Java Base64 decode call", "spans": [ [ 19149, 31 ] ] }, { "id": "micro-behaviors/data/decode/base64::java-base64-decoder-bytecode-call", "conf": 0.94, "crit": 3, "desc": "Java Base64 decoder accessor call", "spans": [ [ 19095, 27 ] ] }, { "id": "micro-behaviors/data/decode/base64::java-base64-decoder-class", "conf": 0.92, "crit": 3, "desc": "JVM Base64 decoder class reference", "spans": [ [ 229, 24 ], [ 19108, 28 ] ] }, { "id": "micro-behaviors/data/decode/base64::java-base64-decoding-bytecode", "conf": 0.94, "crit": 3, "desc": "Java bytecode Base64 decoding", "uses": [ 15, 16 ], "spans": [ [ 19095, 27 ], [ 19149, 31 ] ] }, { "id": "micro-behaviors/data/decompress/zlib::java-inflater-inflate", "conf": 0.98, "crit": 3, "desc": "JVM Inflater decompresses bytes", "spans": [ [ 13388, 30 ] ] }, { "id": "micro-behaviors/data/decompress/zlib::java-inflater-set-input", "conf": 0.98, "crit": 3, "desc": "JVM Inflater receives compressed bytes", "spans": [ [ 13301, 31 ] ] }, { "id": "micro-behaviors/data/embedded/payload/image::png-inflate-process-class", "conf": 0.96, "crit": 3, "desc": "JVM class combines PNG signature, inflation and process launch", "uses": [ 19, 20, 22, 28 ], "spans": [ [ 702, 31 ], [ 13301, 31 ], [ 13388, 30 ], [ 15115, 30 ], [ 93803, 137 ] ] }, { "id": "micro-behaviors/data/format/media/raster::jvm-png-signature-byte-array", "conf": 0.98, "crit": 3, "desc": "JVM constructs the eight-byte PNG signature", "spans": [ [ 93803, 137 ] ] }, { "id": "micro-behaviors/data/string/conversion::java-character-digit-bytecode", "conf": 0.9, "crit": 3, "desc": "Java bytecode calls Character.digit", "spans": [ [ 20795, 25 ] ] }, { "id": "micro-behaviors/fs/write/file/handle::jvm-fileoutputstream-bytecode", "conf": 0.86, "crit": 3, "desc": "JVM imports FileOutputStream class", "spans": [ [ 12457, 24 ] ] }, { "id": "micro-behaviors/os/env/read::jvm-getenv-method", "conf": 0.9, "crit": 3, "desc": "JVM getenv method reference", "spans": [ [ 5632, 6 ] ] }, { "id": "micro-behaviors/process/create/subprocess::java-processbuilder-bytecode", "conf": 0.88, "crit": 3, "desc": "Java bytecode ProcessBuilder reference", "spans": [ [ 149, 71 ] ] }, { "id": "micro-behaviors/process/create/subprocess::java-processbuilder-init-bytecode-reference", "conf": 0.92, "crit": 3, "desc": "JVM ProcessBuilder constructor reference", "spans": [ [ 702, 31 ] ] }, { "id": "micro-behaviors/process/create/subprocess::java-processbuilder-start-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM ProcessBuilder constructor and start references", "uses": [ 27, 29 ], "spans": [ [ 702, 31 ], [ 15115, 30 ] ] }, { "id": "micro-behaviors/process/create/subprocess::java-processbuilder-start-bytecode-reference", "conf": 0.95, "crit": 3, "desc": "JVM ProcessBuilder.start method reference", "spans": [ [ 15115, 30 ] ] }, { "id": "micro-behaviors/process/fd/stdio::java-processbuilder-redirect-errors", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder merges standard error", "spans": [ [ 15051, 44 ] ] }, { "id": "micro-behaviors/process/fd/stdio::java-processbuilder-redirect-input", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard input", "spans": [ [ 14850, 38 ] ] }, { "id": "micro-behaviors/process/fd/stdio::java-processbuilder-redirect-output", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard output", "spans": [ [ 15024, 39 ] ] }, { "id": "micro-behaviors/process/fd/stdio::java-processbuilder-redirected-stdio", "conf": 0.96, "crit": 3, "desc": "Java child input/output and merged error options", "uses": [ 30, 31, 32 ], "spans": [ [ 14850, 38 ], [ 15024, 39 ], [ 15051, 44 ] ] }, { "id": "micro-behaviors/time/sleep/interval::java-thread-sleep-bytecode", "conf": 0.9, "crit": 3, "desc": "Java bytecode thread sleep", "spans": [ [ 11897, 22 ] ] }, { "id": "metadata/binary/symbols/count::many-imports", "conf": 0.8, "crit": 2, "desc": "High number of imported symbols (\u003e80)" }, { "id": "micro-behaviors/data/decode/hex::java-radix-16-static-call", "atk": "T1027", "conf": 0.88, "crit": 1, "desc": "Java pushes radix 16 before static call", "spans": [ [ 142947, 0 ] ] }, { "id": "well-known/malware/stealer/prefire-shard::prefire-campaign-marker", "atk": "T1528", "mbc": "B0006", "conf": 0.97, "crit": 1, "desc": "Prefire shard campaign identifier in code", "uses": [ 38 ], "spans": [ [ 4104, 7 ] ] }, { "id": "well-known/malware/stealer/prefire-shard::prefire-family-literal", "atk": "T1528", "mbc": "B0006", "conf": 0.9, "crit": 1, "desc": "Prefire family name literal", "spans": [ [ 4104, 7 ] ] }, { "id": "well-known/malware/stealer/prefire-shard::prefire-payload-string-obfuscation", "atk": "T1528", "mbc": "B0006", "conf": 0.95, "crit": 1, "desc": "Prefire hides strings with UTF-16 control bytes or XOR char builders", "uses": [ 3, 10, 11 ], "spans": [ [ 22004, 0 ] ] } ], "type": "java_class" }, { "ctx": [ { "b": "+kO#^0000+0Mk0s4R6A]fk20vxMW=qx\u003epDM009925nCS%vj#C9zF7Q#vRPE:Bo.^F0rsiVwPPOqvpBm\u003ev@kZevq]{lo(BMlzFsibvqGU7wPw1Q1PXPuygho]flIwJy+Fa-B7El^bT(PXz!9B12lj#f01-)NC404DBzkLAlsB}Dhz+Ts2($2hmq=QNwmY=Z03M8=C404uvqYZhp\u0026ZF:wPI]VB.LV5wPx4]wN]H}wN//!01n(d7\u00260G5vj#C9zF7R0A=kD0B8%V\u003cx(4r\u003eAT8NO0rry6wN]H}wN//.03#w*C404uvqYZhx(n9jyH]d[wPRQ7wjQcDwnC*#bUSb{yJTO301/ki9+]bbvj#C9zF7RpzGY@lwIl+?BzbP6nmuyDy?mU)022wk225@NyJTN%00UM1zFshR0rriIdol\u0026S762cT00Aos0rrE9pe=assYG6Brri7hoK\u00260Tfk20vxMW=qx\u003epEf0rrKDzB[.WBzkf1x)Ks]ND)Lma++nT1gCxqf:1wmH[s\u003cQF\u0026AW4q=n!Y7E0s/1e2?w7xW\u003c}Jc$!s\u003eGWli01-)NC404uvqYZhra{q-vpPPycLcm]0rrHwy\u0026jMjAD=U4xl1yXdGym(00icJ4*q}:0rsrUvrM6jy*?i]fkkrEz!\u0026]qoKR^EwmnhzByw=\u0026v@#TfC)ss40rrHAwPRu)vpKy$A^mV=+Que1vrM6jy*?i]fkkrEz!\u0026]qo\u003ewAWz!8yEzE^M{B0KB$z!\u003cGmj4%x$C404uvqYZhq/)4]zF848y5", "ln": 0 }, { "b": "xd)$pC5Iecfgfe:y/t4\u0026wJHq2fAr*m051sc4*A1\u00260rrjxB-4iWcmzL$z/4dux([3hvLqCbt01fbygho]fkL6mxd)e9zF\u0026((y?kWp05T:m5=.[ihVS){c}[w:C404uvqYZhqGV\u003e{vpB4:j1jhs02tL{3ihEOiSPi:B97\u0026hBpndi02C$xc\u0026=yh00NmUwmWN#00u!ByxjzZc}[w:C404uvqYZhq/)4]zF83WoLO0Vvj#C9zF7R3BAh8kxfca]0DOtJF#YH^a1\u003cYo1ehGcd*t+Ed8}{8x88Ql7h/Le}7XluBpqbuA{*Vx0rrWCvrM6jy*?i]fh($kx(mL*089y[00\u0026N10rr{JvrM6jy*?i]fh($kx(mMIB.LV5wPw1QpZNh102L.p3V{qOxKL{EA=LPl0rrlJdo/dF08\u0026\u003e%3ii^2rri73tseR}r@\u0026pv(a8#zI[ne.J{IW\u003e)uJv?WvufIRrK?k\u0026!%\u0026x2MO0d00K=PlN=4A02tMs3ii^2tMB*evq{f%zE-+FeHTqcvrM6jy*?i]fh($kx(mMBdnjF+C404uvqYZhq/)4]zF8pUx(4r\u003eAYTWfui1st08S-70rr[#NtQy9I07d\u003e)vYZ8YO2EgH3$\u003e41QC9q0rs!-(W\u003e[\u003cI)zAdZrj4QS\u0026UM$PxqJp)YAqHWxwRMQ#vw=(wSsyQNg50R0AVF\u0026FKch0aV9g5c", "ln": 735 }, { "b": "00WmJzFa680rriIdm\u003c{FCMr0@08iDt0rrlJnHWWG02tMZ3ii{6Ee%r/c{]BSygho]fkL6mxd)h9A+PA7luN0UwmY^y3\u0026\u003cPlE*MfM0dU7I2Y%#-BAh8kx8}#Dc[d\u00268vrM6jy*?i]fh($kx(mMB3\u0026\u003e\u003eVG9?PQ0e7vMjR3ILIR$qh)ZYKXKFgQxJPNZF(:8-nQkm=:TMWlR(6wa9F@]i8JoDzp\u003ceXH7RjNa=ISf.W\u0026jctWWX0*9H5?n^ygho]fkL6m", "ln": 1486 }, { "b": "00EgFfH=6y2#1o8s7Ko-x*z+15\u003e)4GC404uvqYZhq/)4]zF83i00m0{0rs0hygho]fkL6mxd)h9A+PA7luN0UwmY^y0rr^FvrM6jy*?i]fgya}wPh:9z/b^WNf9B]=kV]^AMZlv01\u0026Z-A=L-eBw#%\u003ewLD(Py?W}\u003e00sR#n^\u003eY\u003c0g\u003cI$x8[L802GJ:Bt4GBzE)r#vp\u003cQmv@bN{B6*ZTfB4PK0rrHAwPRQ7wm45Gh8bai8Z)dezE)]yze0)0v@=0\u0026Bt4cuvrlG%gCHNB3\u0026)45QZv9@0hPX@3VfD%xM4A*f/p^E0rs5!dnjR\u003cBt4GBzE)r#vp\u003cQmv@bN{B6*ZUfGPWyRVrU50hoE)0rr{NwPPOxx(mG(A:-N4fjO*bB8$XAgb5}kS@ShdzdN*5z!9ifhA9D30iDlN3imdcT]OIgzdN*5z!9ifhA9J50i=DQ3imdcU(K?kzdN*5z!9iig=EcF0rr-XdnjF+C404DBzkLArAhQUi$8a}0ji7kTn]Te01J:LC404DBzkLArAhQU2lqju0jS2Z0rrg9n^tvc0rtv{\u0026iwm7R[7*2X:1^T\u003cGukXH[9Z]Q3e}^)UNH@Hj!(!Z2+S\u0026)Yr!UV6%QPX-Y\u0026R\u0026\u003egDtGoUD2K)4U5(6mqn0k5sj7?mG3fk20vxMW=qBZ]u9v}/L0r://!wD@jH0rrE5t1r:Ak$2fHo:?3q0d$QUZw#7J01:9.w].6{r+2]Px\u0026Pp!xlT*+.Vkq@0kwJL", "ln": 1840 }, { "b": "0mInPZw]8K010pHBvp4:vqfP/0m?d53im*v/8U\u003cRAb]J4x(W+=07[Ukygho]fkL6mxd)h9A+PA7j4%x$C404uvqYZhq/)4]zF848ygho]fkL6mxd)h9A+PA7j1i\u003crvrM6jy*?i]fh($kx(mMB3\u0026[@X*6N?{0nvIO", "ln": 2631 }, { "b": "A=U/lfh($3zE^f@wj73sA=U/lA%zZh0rrp6r7pjO0rs3iygho]fk+GxfjOW7A=U/lfgfzYA=U/li$8bR0pyc[(\u0026uFP00)jGBv7m{wPE\u003eL9W\u003cY%vrM6jzFs2xv}Yp\u003eB7GCDlUG[GB7GCPdo/aE0pZ6W3ii^2]8O?3wO#0@wmX.Uq/)4]zF5$I7arxNdnjF+C404uvqYZhq/)4]zF83t0qcu=3igti{w\u003emx3g1^K\u0026Hl!hG]\u003e=2Zt\u003eGg\u003e-qw0HNWm?U\u003cnDO(-^\u003eSOs/52YZI/02MTVd0mp!10rtX2(a0eCS/DtCYx(O?\u003eBdp*SFf=0OAV\u0026A(.o*iGOF{aR0tyx\u0026/GF\u003cXUwt*TM=*L)5E!.N$G+1Tl$$U(7%v8QpYVyYZAv=2MT=608B3IZu8\u003e(\u0026\u003ccb.FTL]9RrsXK)ZodSVA@V8L\u0026eHF\u0026iF%jY{l%m\u003c*.XSVyyojSQl:M\u003eCiT@W2i}JN=RbT\u0026hI*@VZoQ.VcY35Xt4#*N*o2[0rtTOKgaeeO6)C.Ps:G-Pw+sj)tWC0WX\u0026zRUKeE", "ln": 3077 }, { "b": "H[K1lN*o3x0rrTBvrM6jy*?i]fgfL:B8}M!dffzZxjVfYA=l5hv@#B6zBwzWvqfPW03S*uoLO0Vvj#Xkv%8*aBA]JoA=l5hv@#B6zBwzWvqfQv3\u0026}\u003cVed8zc0warL9+]bbvj#Xkv%8*aBA]JoA=l5hv@#B6zBwzWvqfP:0wsDN4qfl]lVlHDq/u/0v}tVv94imfygho]flpYmB-IhrC}RK6wmXXTB-H#6i$8cA0wT#.fAA%g02PC", "ln": 4505 }, { "b": "G]J%e)5dkvZ3QJk.H}iMR}4)oG[Wx@)5cSeZ3QG7.?dlLX754[2MWr]01rQJC404wwPPO9qB}8]mGAF[xjVf@zGVA?nb${.0a#s70rty{(BKB^V+kOiJO/-VSefJCPX#/R\u003c^@%IMa(gVK(qd+\u003ed=(uP{UbSYxlz:(Bi}MZV.U{\u003cHZSlSgh[vK)!J(2MWN006?4UQnNsCNcPoZ(zf)qPs\u003cu{SPfI8\u003cCPw\u003cQnu}7X8s@Y\u0026K2/MN#VJ(YxG", "ln": 4877 }, { "b": "c}[w:C404rz.BN]y?kWSoLO0Vvj#C9zF7R0A=kD0B8%V\u003cx(4r\u003eAWjK]wnc6}v@%^v0ChvB3igIoxAn8xA+e=}A+e:5nP5G\u0026Bo8wac}[w:C404uvqYZhp\u0026ZF:wPI]VB.LV5wPx4]wN]H}wN/*zdnjF+C404uvqYZhp\u0026ZF:wPI]VB.LV5wPx\u003cv0CRTJ3igOqyYKI}3fc@h(zpVBSJbB4GxdMF\u003e-ytOK^$ThYxDU#\u003cbyFjR\u003eJjMNK3%CJoDzb\u0026/Yh.RL\u0026T!LJdRp2MX/z00^KQB8L(rwDq=Vc}\u003c", "ln": 5564 }, { "b": "0DFhv26s=Mx(4tY01ZLcoLO0Vvj#tkfgGU(wJHq3BocH(0mp*\u003c0rrylAbYxawk)EQ0EaST3igIoC(W)PA+e=}A+e:5pJZ+#B-X2)DJv)?01P9T0rr^NwN]H}wN/*JA=M8sq/)4\u003evqM2B9vL8uoLO0Vvj#C9zF7R0A=kD0B8%V\u003cx(4r\u003eAYTWgEGs{901P9X0rrBpx(W={Bz(hB0rsO$oLO0Vvj#tkfgGU(wJItmygho]fkL6mxd)84z!0v1B3+1-y?d9$i$8dw0FpZV4/}s:02l[hoLO0Vvj#C9zF7R0A=kD0B8%zK06ypp3igOqHxdxy\u003cfB%gS\u003edJ", "ln": 5840 }, { "b": "VB/d$NE4L)\u003e=*\u0026CFvj3^\u0026h@vfFt8t9PYJ5O)T{+\u003cWV])aFEI\u003e=I2^O@c}U{Zygho]fkL6mxd)h9A+PA7luN0UwmY^y3\u0026\u003cPmIWxCY0Gm3V5^vp6FArfk=.fy5JP(L7\u0026\u003cL]]0GEfX9TQ$!P#}]JRjV}6MfkYN\u0026ix@MV.uxOSooUi\u003e8to90GWrZdclD3\u003c=bw:P{j}$LI@9=)$[78WXJo", "ln": 6126 }, { "b": "M/Br%(WUt/P$xl%Irf.Z)76mYTdwmgGYP?e2MZd\u003c02PDVC404wx(tUpx(4ulpJf(.pJgz\u0026z/b^XMh{%[CxdztwM9X\u003ex(mL:09}0Dygho]fk+Gxfj[{mwIl\u003e*Bz9:fygho]fkL6mxd(R=vrbpTADL\u0026gv}v-aoLO0Vvj#Ijz.CZpy?km}AaJ].Acb/jzAxpvygho]fk+Gxfj[{mwIl\u003e*Bz9-A0HJ[Q3iqmINGiy0Ab]VgBw)o\u0026v@24:vpJ\u003cS0H%ca3ilH}ODeY]A+fq-zuf.PoM1z", "ln": 6326 }, { "b": "000ua008i.000Dd00b%$001hy001?Q003m70053g5)zZzrYQE62FHsK83:I9hv7f9Z7*]:1y%y%6:.IRiTL%E3L:3:38dzx8448^83Z(:g-lJk2]9*.2YKfdF%6b!3JWg9?[5\u003e.sS4NQ0a02kvooud87VzgWG6t?4Jb+\u003c1y@wWuO\u003cUK84Kv}4}C/Nhv{PmYAHtd12Z=b5!$$L03Ac\u003e6+Rw]6+Stv4IYJ\u00265!${@u]iE#rFg$=R#LU^08lPl5W}:CWG6-qRVBK-5[OGKrYQ%k6:3oJ78W\u003e31y@k.whUks7Rx]j7Y#Vm6=E/6Q5VCR7.)@b6:bl!u\u003e\u003cO/g-m2h6=E/5A9$IOL2WeN0Jk$L6=jH^iVe!L0#R%U6=jvWyR6NvsS59^0a02kvooucrtkBH6Az%lNGaotzz\u003cc.faYmlhzk^#5]SvWfblbzCS4ia5]\u003etWrYRir90n2Q9t]\u003ch1y@k/whUFz9\u003eRUq9%jzz6^akjQ5VCR9#b[o90u#%u\u003e\u003c!(g-mno6^akiA9$IOL2WeT0Jk$LY8UMd86ur/ua6-wseM5Lee01+bn?ZdWG7IfbPd\u0026n0da\u0026V6^NrFca:dOsRSl(0dD%Q12.IwcLW@404w^j86Yn0bW.umv735V86Yn0cLW[Cv735VwrKw3FMEHL0Jk$G878=(G%*$\u0026seM4A6:ti(Q5Y0X5@i)}rYRYFdG.H=d\u0026x?J1y@k$whU$New8cEeFP/twhV4Pe$h?^87=NQ87C+7d{%8Au]e-J1qJK7d@X(MF%6b!f8}\u003cH?mAUYsS5*209]-v00DBb6:zeFJz)s!K*Ul#seM39eenw$0d!j81P+L1n?vyJG%gKS00ihp000cT02+!pe=WNg00ix9o-Ld[000000000000000000000000000000000000000000000000000003100-D6696Y\u003e00ix9o:pU}2lm\u003cb0rr9", "ln": 7465 }, { "b": "Xb+Cp83EwF\u0026WL/IWGbqpeW+VsiV{E9iV+)kqcyvdqwe6009hc786G8shx\u003c1ZZ64%Yb4JOR6^Hu{iWs!=b]4ZvbCCe-86/}y86Ga$b48ciu]e-A1qJi$b5*{DwrG@Cb(%}z*Q^CWsS5G]0a02kvhQb{0auJ5WG6t?c(BAng=u^2d82*{6!9VKdITCC1V!dohy]Z@6!yjJ1qJv[6!A-H87kR5eeoQMu]iE#rFh[76!y7HQ5S#Y08lPle4kH:WG6.NagqeT66M+7rYR(Kf9s3?fC#KT1y@l3whVdSf$WVJg6oA\u003c88q{.87#acfKLRKu]e-O1qJZcfMpzRF%6b!gxwjD6!#AZ?N-+ZsS6070a02kvhQh@0auJ9", "ln": 9538 }, { "b": "hOG[+wcuB3i2aA=1V!TChAzNl6/.]/aq)fOiVf*\u003ciY4Zj6/V{?6/Q8tg\u003eH(\u003cGGodi%kgA*o\u003c5t]W/xZx0aAqoG%yZFWGb%d0qFO:84vC(-ScnZ45T8f68BTL89F8g0cZs+89LzdDJW\u003c]k4DMoY8UYh6*GecEMxZ@hBe6z6*Fz)dh+w*jP(G-u\u003e\u003e$nWG7H?", "ln": 9851 } ], "depth": 1, "facts": { "imp": [ [ "", "java/lang/Object" ], [ "", "net/fabricmc/api/ModInitializer" ], [ "", "java/util/Base64$Encoder" ], [ "", "java/util/Base64" ], [ "", "java/lang/ProcessBuilder$Redirect" ], [ "", "java/lang/ProcessBuilder" ], [ "", "java/lang/invoke/MethodHandles$Lookup" ], [ "", "java/lang/invoke/MethodHandles" ], [ "", "java/lang/Thread" ], [ "", "java/lang/invoke/LambdaMetafactory" ], [ "", "java/lang/String" ], [ "", "java/lang/StringBuilder" ], [ "", "[C" ], [ "", "java/lang/System" ], [ "", "java/lang/Integer" ], [ "", "java/lang/Exception" ], [ "", "net/minecraft/class_310" ], [ "", "net/minecraft/class_320" ], [ "", "java/util/UUID" ], [ "", "[J" ], [ "", "com/github/ucokcifwValue" ], [ "", "net/fabricmc/loader/api/FabricLoader" ], [ "", "java/nio/file/Path" ], [ "", "java/nio/charset/StandardCharsets" ], [ "", "[Ljava/lang/String;" ], [ "", "java/nio/file/LinkOption" ], [ "", "java/nio/file/Files" ], [ "", "java/lang/Class" ], [ "", "java/security/ProtectionDomain" ], [ "", "java/security/CodeSource" ], [ "", "java/net/URL" ], [ "", "java/net/URI" ], [ "", "java/nio/file/attribute/FileAttribute" ], [ "", "java/io/File" ], [ "", "java/nio/file/OpenOption" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ], [ "com/github/ieZ", "com/github/ieZ.ilnzhqwxMgr" ], [ "com/github/ieZ", "ilnzhqwxMgr" ], [ "java/lang/invoke/LambdaMetafactory", "java/lang/invoke/LambdaMetafactory.metafactory" ], [ "java/lang/invoke/LambdaMetafactory", "metafactory" ], [ "java/lang/Thread", "java/lang/Thread.\u003cinit\u003e" ], [ "java/lang/Thread", "\u003cinit\u003e" ], [ "java/lang/Thread", "java/lang/Thread.start" ], [ "java/lang/Thread", "start" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.toCharArray" ], [ "java/lang/String", "toCharArray" ], [ "java/lang/String", "java/lang/String.\u003cinit\u003e" ], [ "java/lang/String", "\u003cinit\u003e" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/lang/System", "java/lang/System.arraycopy" ], [ "java/lang/System", "arraycopy" ], [ "java/lang/String", "java/lang/String.charAt" ], [ "java/lang/String", "charAt" ], [ "java/lang/String", "java/lang/String.length" ], [ "java/lang/String", "length" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.toString" ], [ "java/lang/StringBuilder", "toString" ], [ "java/lang/Integer", "java/lang/Integer.valueOf" ], [ "java/lang/Integer", "valueOf" ], [ "java/lang/String", "java/lang/String.format" ], [ "java/lang/String", "format" ], [ "java/lang/System", "java/lang/System.currentTimeMillis" ], [ "java/lang/System", "currentTimeMillis" ], [ "net/minecraft/class_310", "net/minecraft/class_310.method_1551" ], [ "net/minecraft/class_310", "method_1551" ], [ "net/minecraft/class_310", "net/minecraft/class_310.method_1548" ], [ "net/minecraft/class_310", "method_1548" ], [ "net/minecraft/class_320", "net/minecraft/class_320.method_1674" ], [ "net/minecraft/class_320", "method_1674" ], [ "net/minecraft/class_320", "net/minecraft/class_320.method_1676" ], [ "net/minecraft/class_320", "method_1676" ], [ "net/minecraft/class_320", "net/minecraft/class_320.method_44717" ], [ "net/minecraft/class_320", "method_44717" ], [ "java/util/UUID", "java/util/UUID.toString" ], [ "java/util/UUID", "toString" ], [ "com/github/ucokcifwValue", "com/github/ucokcifwValue.OZGvaADbCM" ], [ "com/github/ucokcifwValue", "OZGvaADbCM" ], [ "com/github/ucokcifwValue", "com/github/ucokcifwValue.phfrZqVckciUuegx" ], [ "com/github/ucokcifwValue", "phfrZqVckciUuegx" ], [ "net/fabricmc/loader/api/FabricLoader", "net/fabricmc/loader/api/FabricLoader.getInstance" ], [ "net/fabricmc/loader/api/FabricLoader", "getInstance" ], [ "net/fabricmc/loader/api/FabricLoader", "net/fabricmc/loader/api/FabricLoader.getConfigDir" ], [ "net/fabricmc/loader/api/FabricLoader", "getConfigDir" ], [ "java/nio/file/Path", "java/nio/file/Path.getParent" ], [ "java/nio/file/Path", "getParent" ], [ "com/github/ucokcifwValue", "com/github/ucokcifwValue.\u003cinit\u003e" ], [ "com/github/ucokcifwValue", "\u003cinit\u003e" ], [ "com/github/ucokcifwValue", "com/github/ucokcifwValue.getDomain" ], [ "com/github/ucokcifwValue", "getDomain" ], [ "com/github/ucokcifwValue", "com/github/ucokcifwValue.prefire" ], [ "com/github/ucokcifwValue", "prefire" ], [ "java/util/Base64", "java/util/Base64.getEncoder" ], [ "java/util/Base64", "getEncoder" ], [ "com/github/ieZ", "com/github/ieZ.egk" ], [ "com/github/ieZ", "egk" ], [ "java/nio/charset/StandardCharsets", "java/nio/charset/StandardCharsets.UTF_8" ], [ "java/nio/charset/StandardCharsets", "UTF_8" ], [ "java/lang/String", "java/lang/String.getBytes" ], [ "java/lang/String", "getBytes" ], [ "java/util/Base64$Encoder", "java/util/Base64$Encoder.encodeToString" ], [ "java/util/Base64$Encoder", "encodeToString" ], [ "java/nio/file/Path", "java/nio/file/Path.toString" ], [ "java/nio/file/Path", "toString" ], [ "java/lang/System", "java/lang/System.getProperty" ], [ "java/lang/System", "getProperty" ], [ "java/nio/file/Path", "java/nio/file/Path.of" ], [ "java/nio/file/Path", "of" ], [ "java/nio/file/Files", "java/nio/file/Files.exists" ], [ "java/nio/file/Files", "exists" ], [ "java/lang/Class", "java/lang/Class.getProtectionDomain" ], [ "java/lang/Class", "getProtectionDomain" ], [ "java/security/ProtectionDomain", "java/security/ProtectionDomain.getCodeSource" ], [ "java/security/ProtectionDomain", "getCodeSource" ], [ "java/security/CodeSource", "java/security/CodeSource.getLocation" ], [ "java/security/CodeSource", "getLocation" ], [ "java/net/URL", "java/net/URL.toURI" ], [ "java/net/URL", "toURI" ], [ "java/nio/file/Path", "java/nio/file/Path.of" ], [ "java/nio/file/Path", "of" ], [ "java/lang/System", "java/lang/System.getenv" ], [ "java/lang/System", "getenv" ], [ "java/nio/file/Files", "java/nio/file/Files.createDirectories" ], [ "java/nio/file/Files", "createDirectories" ], [ "java/lang/Class", "java/lang/Class.getName" ], [ "java/lang/Class", "getName" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.\u003cinit\u003e" ], [ "java/lang/ProcessBuilder", "\u003cinit\u003e" ], [ "java/io/File", "java/io/File.\u003cinit\u003e" ], [ "java/io/File", "\u003cinit\u003e" ], [ "java/lang/ProcessBuilder$Redirect", "java/lang/ProcessBuilder$Redirect.from" ], [ "java/lang/ProcessBuilder$Redirect", "from" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectInput" ], [ "java/lang/ProcessBuilder", "redirectInput" ], [ "java/nio/file/Path", "java/nio/file/Path.resolve" ], [ "java/nio/file/Path", "resolve" ], [ "java/nio/file/Path", "java/nio/file/Path.toFile" ], [ "java/nio/file/Path", "toFile" ], [ "java/lang/ProcessBuilder$Redirect", "java/lang/ProcessBuilder$Redirect.appendTo" ], [ "java/lang/ProcessBuilder$Redirect", "appendTo" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectOutput" ], [ "java/lang/ProcessBuilder", "redirectOutput" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectErrorStream" ], [ "java/lang/ProcessBuilder", "redirectErrorStream" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.directory" ], [ "java/lang/ProcessBuilder", "directory" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.start" ], [ "java/lang/ProcessBuilder", "start" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/nio/file/Files", "java/nio/file/Files.writeString" ], [ "java/nio/file/Files", "writeString" ], [ "java/lang/Exception", "java/lang/Exception.printStackTrace" ], [ "java/lang/Exception", "printStackTrace" ] ], "metrics": { "file": { "size": 34769, "entropy": 4.39 }, "class": { "major_version": 65, "interface_count": 1, "method_ref_count": 63, "constant_pool_count": 452, "external_class_count": 35 }, "binary": { "peak_region_bytes": 6144, "peak_region_entropy": 6.75 }, "imports": { "count": 98 }, "functions": { "count": 4 } } }, "id": 2, "mol": "K(Ga)O(Ca)H₅(Po₆CmDb₂FOs)Md₂(In₂)", "path": "/data/samples/incoming/forager/bad/sha256/bazaar/doomsday-1.21-1.21.11.jar!!com/github/ieZ.class", "pid": 0, "risk": 169, "sha": "cb9fa8dabfc641930a7ebedcfaeb308de465c4ed416a8ad4dae5b683b7acad07", "size": 34769, "traits": [ { "id": "objectives/credential-access/gaming/minecraft::minecraft-session-child-handoff", "atk": "T1528,T1059,T1027", "mbc": "B0006", "conf": 0.97, "crit": 5, "desc": "Client session access encoded into spawned child process", "uses": [ 14, 19, 25, 34 ], "spans": [ [ 322, 31 ], [ 863, 30 ], [ 1986, 23 ], [ 2123, 23 ], [ 2176, 35 ], [ 3205, 39 ], [ 5628, 38 ], [ 5904, 39 ] ] }, { "id": "objectives/credential-access/gaming/minecraft::minecraft-token-child-process-stage", "atk": "T1528, T1059", "mbc": "B0006", "conf": 0.99, "crit": 5, "desc": "Session token handed to spawned child process", "uses": [ 4, 14, 19, 25 ], "spans": [ [ 322, 31 ], [ 863, 30 ], [ 1986, 23 ], [ 2123, 23 ], [ 2152, 35 ], [ 2176, 35 ], [ 2200, 36 ], [ 3205, 39 ] ] }, { "id": "micro-behaviors/process/lifecycle/respawn::java-encoded-command-self-jar-launch", "atk": "T1059,T1027", "conf": 0.92, "crit": 4, "desc": "Own JAR spawns process with hidden command", "uses": [ 5, 20, 29 ], "spans": [ [ 863, 30 ] ] }, { "id": "micro-behaviors/process/lifecycle/respawn::java-xor-char-obfuscated-self-jar-relaunch", "conf": 0.95, "crit": 4, "desc": "XOR-built strings relaunch own JAR via ProcessBuilder", "uses": [ 12, 13, 20, 29 ], "spans": [ [ 863, 30 ], [ 7561, 8 ], [ 9634, 8 ] ] }, { "id": "objectives/credential-access/gaming/minecraft::minecraft-session-token-access", "atk": "T1528", "mbc": "B0006", "conf": 0.96, "crit": 4, "desc": "Minecraft session token and UUID access", "uses": [ 31, 34, 36 ], "spans": [ [ 1986, 23 ], [ 2123, 23 ], [ 2152, 35 ], [ 2176, 35 ], [ 2200, 36 ] ] }, { "id": "metadata/file/encoded::java-control-prefixed-long-string", "conf": 0.92, "crit": 3, "desc": "Long JVM constant with control prefix" }, { "id": "metadata/import/framework::jvm-security-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM security package reference" }, { "id": "metadata/import/framework::jvm-url-class-ref", "conf": 0.9, "crit": 3, "desc": "JVM URL class reference" }, { "id": "metadata/import/framework::minecraft-token-getter-ref", "conf": 0.92, "crit": 3, "desc": "JVM references Minecraft access-token getter", "spans": [ [ 2152, 35 ] ] }, { "id": "metadata/import/jvm::jvm-io-file-class-reference", "conf": 0.86, "crit": 3, "desc": "JVM references the Java IO File class" }, { "id": "metadata/import/jvm::jvm-nio-file-class-reference", "conf": 0.86, "crit": 3, "desc": "JVM references Java NIO file classes" }, { "id": "micro-behaviors/communications/url/parse::jvm-touri-name-reference", "conf": 0.82, "crit": 3, "desc": "Java toURI call reference" }, { "id": "micro-behaviors/data/arithmetic::jvm-subtract-character-array-store", "conf": 0.95, "crit": 3, "desc": "Difference narrowed and stored as JVM character", "spans": [ [ 9634, 8 ] ] }, { "id": "micro-behaviors/data/arithmetic::jvm-xor-character-array-store", "conf": 0.95, "crit": 3, "desc": "XOR result stored as JVM character", "spans": [ [ 7561, 8 ] ] }, { "id": "micro-behaviors/data/encode/base64::jvm-base64-encode-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM Base64 encodeToString call", "spans": [ [ 3205, 39 ] ] }, { "id": "micro-behaviors/fs/write/file/full::jvm-files-writestring-bytecode", "conf": 0.9, "crit": 3, "desc": "JVM bytecode Files.writeString", "spans": [ [ 6390, 31 ] ] }, { "id": "micro-behaviors/os/env/read::jvm-getenv-method", "conf": 0.9, "crit": 3, "desc": "JVM getenv method reference", "spans": [ [ 4941, 6 ] ] }, { "id": "micro-behaviors/process/create/subprocess::java-processbuilder-bytecode", "conf": 0.88, "crit": 3, "desc": "Java bytecode ProcessBuilder reference", "spans": [ [ 154, 71 ] ] }, { "id": "micro-behaviors/process/create/subprocess::java-processbuilder-init-bytecode-reference", "conf": 0.92, "crit": 3, "desc": "JVM ProcessBuilder constructor reference", "spans": [ [ 322, 31 ] ] }, { "id": "micro-behaviors/process/create/subprocess::java-processbuilder-start-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM ProcessBuilder constructor and start references", "uses": [ 18, 20 ], "spans": [ [ 322, 31 ], [ 863, 30 ] ] }, { "id": "micro-behaviors/process/create/subprocess::java-processbuilder-start-bytecode-reference", "conf": 0.95, "crit": 3, "desc": "JVM ProcessBuilder.start method reference", "spans": [ [ 863, 30 ] ] }, { "id": "micro-behaviors/process/create/thread::jvm-thread-start-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM starts a thread", "spans": [ [ 863, 22 ] ] }, { "id": "micro-behaviors/process/fd/stdio::java-processbuilder-redirect-errors", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder merges standard error", "spans": [ [ 5931, 44 ] ] }, { "id": "micro-behaviors/process/fd/stdio::java-processbuilder-redirect-input", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard input", "spans": [ [ 5628, 38 ] ] }, { "id": "micro-behaviors/process/fd/stdio::java-processbuilder-redirect-output", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard output", "spans": [ [ 5904, 39 ] ] }, { "id": "micro-behaviors/process/fd/stdio::java-processbuilder-redirected-stdio", "conf": 0.96, "crit": 3, "desc": "Java child input/output and merged error options", "uses": [ 22, 23, 24 ], "spans": [ [ 5628, 38 ], [ 5904, 39 ], [ 5931, 44 ] ] }, { "id": "micro-behaviors/process/info/current::codesource-class", "conf": 0.85, "crit": 3, "desc": "Java CodeSource class reference" }, { "id": "micro-behaviors/process/info/current::getlocation-ref", "conf": 0.82, "crit": 3, "desc": "Java getLocation call reference" }, { "id": "micro-behaviors/process/info/current::protection-domain-class", "conf": 0.85, "crit": 3, "desc": "Java ProtectionDomain class reference" }, { "id": "micro-behaviors/process/info/current::protection-domain-self-path", "conf": 0.9, "crit": 3, "desc": "Resolves own path via ProtectionDomain", "uses": [ 11, 26, 27, 28 ] }, { "id": "micro-behaviors/process/info/selfpath::java-protection-domain", "conf": 0.82, "crit": 3, "desc": "Java getProtectionDomain self-path lookup" }, { "id": "objectives/credential-access/gaming/minecraft::minecraft-token-getter-ref", "atk": "T1528", "mbc": "B0006", "conf": 0.92, "crit": 3, "desc": "Minecraft access token getter", "spans": [ [ 2152, 35 ] ] }, { "id": "well-known/game/mod::minecraft-client-class-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft client singleton class reference", "spans": [ [ 1986, 23 ] ] }, { "id": "well-known/game/mod::minecraft-name-getter-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft profile name getter reference", "spans": [ [ 2176, 35 ] ] }, { "id": "well-known/game/mod::minecraft-session-access", "conf": 0.91, "crit": 3, "desc": "Minecraft session profile access", "uses": [ 32, 33, 35 ], "spans": [ [ 1986, 23 ], [ 2123, 23 ], [ 2176, 35 ] ] }, { "id": "well-known/game/mod::minecraft-session-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft session object reference", "spans": [ [ 2123, 23 ] ] }, { "id": "well-known/game/mod::minecraft-uuid-getter-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft profile UUID getter reference", "spans": [ [ 2200, 36 ] ] }, { "id": "metadata/binary/symbols/count::many-imports", "conf": 0.8, "crit": 2, "desc": "High number of imported symbols (\u003e80)" }, { "id": "well-known/malware/stealer/prefire-shard::prefire-campaign-marker", "atk": "T1528", "mbc": "B0006", "conf": 0.97, "crit": 1, "desc": "Prefire shard campaign identifier in code", "uses": [ 39 ], "spans": [ [ 2688, 7 ] ] }, { "id": "well-known/malware/stealer/prefire-shard::prefire-family-literal", "atk": "T1528", "mbc": "B0006", "conf": 0.9, "crit": 1, "desc": "Prefire family name literal", "spans": [ [ 2663, 7 ] ] }, { "id": "well-known/malware/stealer/prefire-shard::prefire-payload-string-obfuscation", "atk": "T1528", "mbc": "B0006", "conf": 0.95, "crit": 1, "desc": "Prefire hides strings with UTF-16 control bytes or XOR char builders", "uses": [ 5, 12, 13 ], "spans": [ [ 7561, 0 ] ] }, { "id": "well-known/malware/stealer/prefire-shard::prefire-session-access-surface", "atk": "T1528", "mbc": "B0006", "conf": 0.96, "crit": 1, "desc": "Prefire reads the live Minecraft session for exfiltration", "uses": [ 4 ], "spans": [ [ 2152, 0 ] ] } ], "type": "java_class" }, { "ctx": [ { "b": "+kO#^0000+0yW1?6K#5#fk20vxMW=qCU8WVxj=vgzWcmy0rrWCvrM6jy*?i]fhD4(wN//!00rl4a.\u003eCevj#C9zF7R0A=kD0B8%V\u003cx(4r\u003eAWjK]wnc6}v@}}Q1PXPuygho]fkL6mxd)84z!0v1B3+1-y?d9$2lj#f00(Flwnc6}v@}.K7\u00260G5vj#+Bx(2B?vrl0rg:CIcv@C)?AT8NK0rrWCvrM6jB-.tlfg68*wI#vI01n(d2sSJuz!9B10rsAXvrM6jy*?i]fkkrEz!\u0026]qo\u003ewAWz!8yEzE^M{B0KB$z!\u003cGm2lknn03k(-C404uvqYZhx(n9jyH]d[wPRQ7wjQcDwnC*#2lktp00Vbnz!\u003cGm0rrr^x(mTbj]\u003eS=c[eg902bzF3ighe76ayzB-7(9C4:]\u003eAaTl90rr)ev@Diqxk8E3BZ^1GnO.:Ew{nxoi@]r:zddc@0rr(-tte^uC404uvqYZhq/)4]zF83WrSJg6vrc140rr^FvrM6jy*?i]fgya}wPh:9z/b^W9rOO?0[)+CJ{=indrlkb0rr^qoLO0Vvj#C9zF7R3BAd", "ln": 0 }, { "b": "AZs^F00BYwdmjHzpYKu104d+A0rrsuwO#d5xAn8nc[dZ@08@}#3ihBNrSJgpygho]fkL6mxd)h9A+PA7luN0UwmY=^09xm41sM?\u003crTX%x09PZfsPzUb00V\u003eJAaJ]$0rs8/lN+YzvrM6jy*?i]fh($kx(mMIB.LV5wPx\u003cv09]Oh3ijieuJycjBz\u003e91A+PA70rr/ZdnjF+C404uvqYZhq/)4]zF83t0at\u003ep3ijiev/VMxygho]fk+Gxfj[{mwIl\u003e*Bz7)VwDq=jz!o1Ij19^qvrM6jy*?i]fh($kx(mMBtte^uC404uvqYZhq/)4]zF83WoLO0Vvj#G", "ln": 1099 }, { "b": "fgGU(wD@iV0rrTBvrM6jy*?i]fgfL:B8}M^C(W)UxjVfYA=l5hv@#B6zBwzWvqfPW03S*uoLO0Vvj#Xkv%8*aBA]JoA=l5hv@#B6zBwzWvqfQv3\u0026\u003eROD\u003cP\u003e10ds\u003eF9+]bbvj#Xkv%8*aBA]JoA=l5hv@#B6zBwzWvqfP:0dL1H4qfl]lVlHDq/u/0v}tVv94imfygho]flpYmB-IhrC}RK6wmXXTB-H#6i$8au0d\u003eKTFb\u003ei502PC", "ln": 1643 }, { "b": "GxG!r(B0FKKB(?SQuX!W\u0026iXKaPRy.tGxv(*)YSFNK/EuwKls9F(Baa-K=]6\u0026RS$m:\u0026i/rvP}.\u003e[MJm6\u003cxjVf@zGVA*Ne/!=07c:P0rsRN\u003cCw-QOVRd*Li4nf\u003cfsZbH\u003eK]XGZ37M\u003c:-uJU!PmPY5]Jm(ajm-FqTWkOb\u0026Qu2JhIF\u003cdR!5O#7XiJQAZE\u003cdrmnPqyFyJ]M!E\u003e+0^$Ke.MAF-Aw](yKpE0g\u003ch\u003elKrdNFAT7=\u003cE-QpMa=dYWDv", "ln": 2038 }, { "b": "c}[w:C404rz.BN]y?kWSoLO0Vvj#C9zF7R0A=kD0B8%V\u003cx(4r\u003eAWjK]wnc6}v@%^v0jI%r3igngXD8WtA+e=}A+e:5nP5G\u0026Bo8wac}[w:C404uvqYZhp\u0026ZF:wPI]VB.LV5wPx4]wN]H}wN/*zdnjF+C404uvqYZhp\u0026ZF:wPI]VB.LV5wPx\u003cv0j@lz3igtiY-wa2\u003c+Ge^PPnGtJ{\u0026{l)1}B{L-$m9TlC+W)yoK!K=[*XIrQ.E[2s4\u0026SK.wKMF[ax\u003ea)Z}KDF}vO9k%w)UEF6PT\u003eKq0kwKm2xx", "ln": 2679 }, { "b": "0k!*q26s=Mx(4tY01ZLcoLO0Vvj#tkfgGU(wJHq2-q))=0a(kK0rrylAbYxawk)EQ0lCkJ3igng:]IFLA+e=}A+e:5pJZ+#B-X2(+Mbo.00\u0026OH0rr^NwN]H}wN/*JA=M8sq/)4\u003evqM2B9vL8uoLO0Vvj#C9zF7R0A=kD0B8%V\u003cx(4r\u003eAYTWf=J8r000\u0026OL0rrBpx(W={Bz(hB0rsO$oLO0Vvj#tkfgGU(wJItmygho]fkL6mxd)84z!0v1B3+1-y?d9$i$8br0mRtQ2MSxQ00NB=vrcC\u003c02l[hoLO0Vvj#C9zF7R0A=kD0B8%zK0m}k63igti/-q6=xjtj^A=\u003e/ouVfv\u003euV6W\u003cwmCSu5\u003e)4GC404uvqYZhq/)4]zF83i026xHm]S\u00269qcdsox)iVHuR(5Xzuf.yzfy5DyFn$\u003c0rr*cygho]fk+Gxfj[{mwIl\u003e*Bz9-p019KuB537BlUx+d0rrvFvqFIMw]vXI1A[i\u0026gxvE:Ab]J3xHlfDraFvo0rs3iygho]fkL6mxd)84z!0v1B3+1-y?d9$i@]r!v%8*jnPXJX", "ln": 2966 }, { "b": "\u003e8CtXG]a(BX8Svl)$W$hO}b*^QZc${0rsY1oLO0Vvj#C9zF7R3BAh8kxfdLoygho]fkL6mxd)h9A+PA7luN0UwmY^y3\u0026\u003cMk}3Ea80qVY@d*BRs\u003cai@[TDz?oY6([\u003c[0y/wPw$J-[2S\u003eYNY=a+XBk\u0026./Q}hQOBrL=2MT=607daSG01u}RqO2G(4%@IK*:IZMf\u003eYK\u003e8#1)IK0qlMGS]", "ln": 3592 }, { "b": "0so5k2ltej00)jGBv7m{wPE\u003eL9W\u003cY%vrM6jzFs2xv}Yp\u003eB7GCDlUG[GB7GCPdo/aE0sO#r3ihBO4GMLtwO#0@wmX.Uq/)4]zF5$I7arxNdnjF+C404uvqYZhq/)4]zF83t0t2nz3igCm5=?$zBAh27v{:L1ADUY9C4+\u0026d0rs3iv@Diqxk8E3BZ^1Dv@Dc)x\u003ezM\u0026vqH6$i@]r{wL3GCuUiC.zc}K8yJ0MQwO+(T01\u003cA\u0026x(4l@uU0?-A:JD(uWl8Y00(XfC4-QguSc$94SV34xKUsZCY)CfxM^!", "ln": 4020 }, { "b": "iro9+yd8YKAwYPO00bB/00\u003e}}strSQf?RJE4}H0izF@({w)Y7-AcC\u0026r0rs0hygho]fkL6mxd)h9A+PA7luN0UwmY^y0rrl\u0026z!9zW01}$zv{%gOvrc6\u003cvR/QPvpB4:0rrNcBywV{o\u003c@0uvpB4:0rrW9wPRQ7wkDYPvqPN$wPz?)01qCpzE)\u0026Qy*?yawPE?{00ic60000000Ao502bz", "ln": 4680 }, { "b": "8w9M4hF%mE5j.gczw16IzXWg6a+hE?d..FOv\u003e4No5*:%^d()[M2lM!v2Pi(Y1y@kMwhT-e3a{B53kA\u003cIwhT/g3.4bw8448^83ZoV2W!wPu]e-a1qIpV2YKfdF%6b!3\u0026^d8?mAUmsS4NQ05g?Yg[1yId.2ErU{@A$Zc8MZ5\u0026?\u003c/6(BTAFd:(n02c5bhF%mE26-4z6(BN3D]t\u003c.9hiBHd\u0026*xa1q}sPjHLkuiU02qZ64%:4QR4J4\u0026C\u003e\u003e6+s*TwhT#l5wefc5D:{76+Rk)Q5VqN5FU]@4IYQk84Ew)6+Rk(A9$IOL2WeF0Jk$PY8TiY84\u003csTfTZ%rNe^G406^-w0%bt1B}N9H04Q8B85ilghwNeBZ64%Y7gYrt6=jH^iV4@S8wKe97OQ)P85K8b85in?7gm\u003c}u]e-o1qI*\u00267i0UrF%6b!8uD=o*z7Kq1V^Is7Y$S[0#hSZ07TT3cS}r8W/wa(0830o1?:)-sPYphWG4*s92P:g1y@w\u0026uO\u003cUY863v99B]p-hxAOOYAHtr12.npaqC@(03Ad36^awl6^bsJ92fIfaqC]ou]iE#rFhE}R#LU^04g[!agzk7q=%kopDxZrblLvOq-k)sbENON1y@k)whU:C09JCtcar\u003eViWK}!cLX0zc87w*873jC1qJg\u00266^)y$08\u003c:W1qJp0bYEe108)A\u003eWG6YpGEl!#%je5mWG6\u0026pXbZnrecAM=y}6E=NGf#J1?:)-sPYpUiW#0%1gwhdhy/T{WG6wiwecR9hy#DusY(E\u003cW/xU]eDW)-6!QjLQ5VRWeG32v6!rVbe)#9/qYd4/6!QjKAa39Oq!h610an(Ye=?)I!!{6F0aY2h1qk)^04Q8+88n\u0026dweNaeg=v9bf$[wTwcuB3gzIZU1V!Exhz(jb6/hM:aq)0Jh5Oa-h8Dg96/cNZ6/6-og\u003eH(\u003cGF-!d%kgA*cS}rzW/w9XXbZnrY8W7U5^2GwEZPlfWG8h[0fBU\u0026LEpESp7\u0026@504Q8\u002688}ZPhAqTmZ64%YiB\u003e3e6/@#hiY^B4jqx%[i?=Q189nM}88}:liBAN:u]e-X1qK3liDev.wrG@CjoqwW*Q^CksS6rg05g[.N*cLacS{J:OWFIGiZjGD12I]389+?rwedvuhBe6zYAHt.12-H:lkq\u003c9klIY^u\u003e(4pg-nHX6*\u0026Z3A9$IOL2Wf50tN%pl81tnY8TiY8a7!jfJh9S5$=Pjd({cqmGUF9m\u0026s!g1y@lqwhV%[nw29!nDQ\u003ez6?YojQ5VCRnFK(omG:C@u\u003e(sxg-n:=6?YoiA9$IOL2Wfd0Jk$L6?C$vi.ynY0#TYk6?C?mn4O:G", "ln": 4924 } ], "depth": 1, "facts": { "imp": [ [ "", "java/lang/Object" ], [ "", "java/lang/ProcessBuilder$Redirect" ], [ "", "java/lang/ProcessBuilder" ], [ "", "java/util/Base64$Encoder" ], [ "", "java/util/Base64" ], [ "", "java/lang/invoke/MethodHandles$Lookup" ], [ "", "java/lang/invoke/MethodHandles" ], [ "", "java/lang/Exception" ], [ "", "[Ljava/lang/String;" ], [ "", "java/lang/String" ], [ "", "[C" ], [ "", "com/github/ucokcifwValue" ], [ "", "java/lang/System" ], [ "", "java/lang/StringBuilder" ], [ "", "java/nio/file/Path" ], [ "", "java/nio/file/LinkOption" ], [ "", "java/nio/file/Files" ], [ "", "java/io/File" ], [ "", "java/lang/Class" ], [ "", "java/security/ProtectionDomain" ], [ "", "java/security/CodeSource" ], [ "", "java/net/URL" ], [ "", "java/nio/file/attribute/FileAttribute" ], [ "", "java/nio/charset/StandardCharsets" ], [ "", "java/lang/Integer" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.toCharArray" ], [ "java/lang/String", "toCharArray" ], [ "java/lang/String", "java/lang/String.\u003cinit\u003e" ], [ "java/lang/String", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.equals" ], [ "java/lang/String", "equals" ], [ "com/github/ucokcifwValue", "com/github/ucokcifwValue.main" ], [ "com/github/ucokcifwValue", "main" ], [ "com/github/xIkagfwuo", "com/github/xIkagfwuo.run" ], [ "com/github/xIkagfwuo", "run" ], [ "java/lang/System", "java/lang/System.arraycopy" ], [ "java/lang/System", "arraycopy" ], [ "java/lang/System", "java/lang/System.getProperty" ], [ "java/lang/System", "getProperty" ], [ "java/lang/String", "java/lang/String.charAt" ], [ "java/lang/String", "charAt" ], [ "java/lang/String", "java/lang/String.length" ], [ "java/lang/String", "length" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.toString" ], [ "java/lang/StringBuilder", "toString" ], [ "java/nio/file/Path", "java/nio/file/Path.of" ], [ "java/nio/file/Path", "of" ], [ "java/nio/file/Files", "java/nio/file/Files.exists" ], [ "java/nio/file/Files", "exists" ], [ "java/lang/Class", "java/lang/Class.getProtectionDomain" ], [ "java/lang/Class", "getProtectionDomain" ], [ "java/security/ProtectionDomain", "java/security/ProtectionDomain.getCodeSource" ], [ "java/security/ProtectionDomain", "getCodeSource" ], [ "java/security/CodeSource", "java/security/CodeSource.getLocation" ], [ "java/security/CodeSource", "getLocation" ], [ "java/net/URL", "java/net/URL.toURI" ], [ "java/net/URL", "toURI" ], [ "java/io/File", "java/io/File.\u003cinit\u003e" ], [ "java/io/File", "\u003cinit\u003e" ], [ "java/io/File", "java/io/File.getAbsolutePath" ], [ "java/io/File", "getAbsolutePath" ], [ "java/lang/System", "java/lang/System.getenv" ], [ "java/lang/System", "getenv" ], [ "java/nio/file/Files", "java/nio/file/Files.createDirectories" ], [ "java/nio/file/Files", "createDirectories" ], [ "java/lang/Class", "java/lang/Class.getName" ], [ "java/lang/Class", "getName" ], [ "java/nio/file/Path", "java/nio/file/Path.toString" ], [ "java/nio/file/Path", "toString" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.\u003cinit\u003e" ], [ "java/lang/ProcessBuilder", "\u003cinit\u003e" ], [ "java/io/File", "java/io/File.\u003cinit\u003e" ], [ "java/io/File", "\u003cinit\u003e" ], [ "java/lang/ProcessBuilder$Redirect", "java/lang/ProcessBuilder$Redirect.from" ], [ "java/lang/ProcessBuilder$Redirect", "from" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectInput" ], [ "java/lang/ProcessBuilder", "redirectInput" ], [ "java/nio/file/Path", "java/nio/file/Path.resolve" ], [ "java/nio/file/Path", "resolve" ], [ "java/nio/file/Path", "java/nio/file/Path.toFile" ], [ "java/nio/file/Path", "toFile" ], [ "java/lang/ProcessBuilder$Redirect", "java/lang/ProcessBuilder$Redirect.appendTo" ], [ "java/lang/ProcessBuilder$Redirect", "appendTo" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectOutput" ], [ "java/lang/ProcessBuilder", "redirectOutput" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectErrorStream" ], [ "java/lang/ProcessBuilder", "redirectErrorStream" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.directory" ], [ "java/lang/ProcessBuilder", "directory" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.start" ], [ "java/lang/ProcessBuilder", "start" ], [ "com/github/ucokcifwValue", "com/github/ucokcifwValue.\u003cinit\u003e" ], [ "com/github/ucokcifwValue", "\u003cinit\u003e" ], [ "com/github/ucokcifwValue", "com/github/ucokcifwValue.getDomain" ], [ "com/github/ucokcifwValue", "getDomain" ], [ "com/github/ucokcifwValue", "com/github/ucokcifwValue.OZGvaADbCM" ], [ "com/github/ucokcifwValue", "OZGvaADbCM" ], [ "com/github/ucokcifwValue", "com/github/ucokcifwValue.phfrZqVckciUuegx" ], [ "com/github/ucokcifwValue", "phfrZqVckciUuegx" ], [ "com/github/xIkagfwuo", "com/github/xIkagfwuo.ypUafoUAddJy" ], [ "com/github/xIkagfwuo", "ypUafoUAddJy" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/util/Base64", "java/util/Base64.getEncoder" ], [ "java/util/Base64", "getEncoder" ], [ "java/nio/charset/StandardCharsets", "java/nio/charset/StandardCharsets.UTF_8" ], [ "java/nio/charset/StandardCharsets", "UTF_8" ], [ "java/lang/String", "java/lang/String.getBytes" ], [ "java/lang/String", "getBytes" ], [ "java/util/Base64$Encoder", "java/util/Base64$Encoder.encodeToString" ], [ "java/util/Base64$Encoder", "encodeToString" ], [ "java/lang/Integer", "java/lang/Integer.valueOf" ], [ "java/lang/Integer", "valueOf" ], [ "java/lang/String", "java/lang/String.format" ], [ "java/lang/String", "format" ] ], "metrics": { "file": { "size": 13683, "entropy": 5.48 }, "class": { "major_version": 65, "interface_count": 0, "method_ref_count": 49, "constant_pool_count": 325, "external_class_count": 25 }, "binary": { "peak_region_bytes": 4096, "peak_region_entropy": 6.69 }, "imports": { "count": 74 }, "functions": { "count": 4 } } }, "id": 3, "mol": "H₄(Po₅CmDb₂Os)Md₂(In₂)", "path": "/data/samples/incoming/forager/bad/sha256/bazaar/doomsday-1.21-1.21.11.jar!!com/github/xIkagfwuo.class", "pid": 0, "risk": 48, "sha": "769c3c7d74d64a2f18e142d6fefe11c6f087b6cef465ab1cbaeed5910d6a5110", "size": 13683, "traits": [ { "id": "micro-behaviors/process/lifecycle/respawn::java-encoded-command-self-jar-launch", "atk": "T1059,T1027", "conf": 0.92, "crit": 4, "desc": "Own JAR spawns process with hidden command", "uses": [ 2, 15, 23 ], "spans": [ [ 3188, 30 ] ] }, { "id": "micro-behaviors/process/lifecycle/respawn::java-xor-char-obfuscated-self-jar-relaunch", "conf": 0.95, "crit": 4, "desc": "XOR-built strings relaunch own JAR via ProcessBuilder", "uses": [ 8, 9, 15, 23 ], "spans": [ [ 3188, 30 ], [ 5020, 8 ], [ 5768, 8 ] ] }, { "id": "metadata/file/encoded::java-control-prefixed-long-string", "conf": 0.92, "crit": 3, "desc": "Long JVM constant with control prefix" }, { "id": "metadata/import/framework::jvm-security-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM security package reference" }, { "id": "metadata/import/framework::jvm-url-class-ref", "conf": 0.9, "crit": 3, "desc": "JVM URL class reference" }, { "id": "metadata/import/jvm::jvm-io-file-class-reference", "conf": 0.86, "crit": 3, "desc": "JVM references the Java IO File class" }, { "id": "metadata/import/jvm::jvm-nio-file-class-reference", "conf": 0.86, "crit": 3, "desc": "JVM references Java NIO file classes" }, { "id": "micro-behaviors/communications/url/parse::jvm-touri-name-reference", "conf": 0.82, "crit": 3, "desc": "Java toURI call reference" }, { "id": "micro-behaviors/data/arithmetic::jvm-subtract-character-array-store", "conf": 0.95, "crit": 3, "desc": "Difference narrowed and stored as JVM character", "spans": [ [ 5768, 8 ] ] }, { "id": "micro-behaviors/data/arithmetic::jvm-xor-character-array-store", "conf": 0.95, "crit": 3, "desc": "XOR result stored as JVM character", "spans": [ [ 5020, 8 ] ] }, { "id": "micro-behaviors/data/encode/base64::jvm-base64-encode-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM Base64 encodeToString call", "spans": [ [ 4084, 39 ] ] }, { "id": "micro-behaviors/os/env/read::jvm-getenv-method", "conf": 0.9, "crit": 3, "desc": "JVM getenv method reference", "spans": [ [ 2102, 6 ] ] }, { "id": "micro-behaviors/process/create/subprocess::java-processbuilder-bytecode", "conf": 0.88, "crit": 3, "desc": "Java bytecode ProcessBuilder reference", "spans": [ [ 61, 71 ] ] }, { "id": "micro-behaviors/process/create/subprocess::java-processbuilder-init-bytecode-reference", "conf": 0.92, "crit": 3, "desc": "JVM ProcessBuilder constructor reference", "spans": [ [ 291, 31 ] ] }, { "id": "micro-behaviors/process/create/subprocess::java-processbuilder-start-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM ProcessBuilder constructor and start references", "uses": [ 13, 15 ], "spans": [ [ 291, 31 ], [ 3188, 30 ] ] }, { "id": "micro-behaviors/process/create/subprocess::java-processbuilder-start-bytecode-reference", "conf": 0.95, "crit": 3, "desc": "JVM ProcessBuilder.start method reference", "spans": [ [ 3188, 30 ] ] }, { "id": "micro-behaviors/process/fd/stdio::java-processbuilder-redirect-errors", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder merges standard error", "spans": [ [ 3057, 44 ] ] }, { "id": "micro-behaviors/process/fd/stdio::java-processbuilder-redirect-input", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard input", "spans": [ [ 2743, 38 ] ] }, { "id": "micro-behaviors/process/fd/stdio::java-processbuilder-redirect-output", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard output", "spans": [ [ 3030, 39 ] ] }, { "id": "micro-behaviors/process/fd/stdio::java-processbuilder-redirected-stdio", "conf": 0.96, "crit": 3, "desc": "Java child input/output and merged error options", "uses": [ 16, 17, 18 ], "spans": [ [ 2743, 38 ], [ 3030, 39 ], [ 3057, 44 ] ] }, { "id": "micro-behaviors/process/info/current::codesource-class", "conf": 0.85, "crit": 3, "desc": "Java CodeSource class reference" }, { "id": "micro-behaviors/process/info/current::getlocation-ref", "conf": 0.82, "crit": 3, "desc": "Java getLocation call reference" }, { "id": "micro-behaviors/process/info/current::protection-domain-class", "conf": 0.85, "crit": 3, "desc": "Java ProtectionDomain class reference" }, { "id": "micro-behaviors/process/info/current::protection-domain-self-path", "conf": 0.9, "crit": 3, "desc": "Resolves own path via ProtectionDomain", "uses": [ 7, 20, 21, 22 ] }, { "id": "micro-behaviors/process/info/selfpath::java-protection-domain", "conf": 0.82, "crit": 3, "desc": "Java getProtectionDomain self-path lookup" }, { "id": "well-known/malware/stealer/prefire-shard::prefire-payload-string-obfuscation", "atk": "T1528", "mbc": "B0006", "conf": 0.95, "crit": 1, "desc": "Prefire hides strings with UTF-16 control bytes or XOR char builders", "uses": [ 2, 8, 9 ], "spans": [ [ 5020, 0 ] ] } ], "type": "java_class" }, { "ctx": [ { "b": "+kO#^0000+1bu)S7gRo1fk20vxMW=qo?W#An[z3YswI)3009925nCS%vj#C9zF7Q#vRPE:Bo.^F0rs3Fz/4dux([3hvLpCHmmx*WrYj5Qr3VyaClX9K0rsDRz/4dux([3hvLpB", "ln": 0 }, { "b": "0rrvBA=L@8r.SO{awuJUC42RGzE)]yB8#dJq=uv*z!0M]BvGXGBz(hBi@]r=jzwXEBuPZ911kQ03\u0026?\u003cVe^.NY051uM2X(!wgEkXYwb#VEoK\u00260Tfk20vxMW=qo?W#An[z3YswI)T0rrjmwPN}MivENovrM6jy*?i]fh($kx(mMBdnjk\u0026z7/KoBzb/afhkbemm}b(hDS:ObX7B}AyT%", "ln": 670 }, { "b": "AZs^F00BYwdmjHzkl9}Q06ylE0rrsuwO#d5xAn8nc[dZ@07c-O3iif*mf9x8ygho]fkL6mxd)h9A+PA7luN0UwmY=^07N4\u00261sM?\u003crTX%W07^H$nb#l.00V\u003eJAaJ]$0rs8/lN+YzvrM6jy*?i]fh($kx(mMIB.LV5wPx\u003cv089w!3iiP%p5$t2Bz\u003e91A+PA70rr/ZdnjF+C404uvqYZhq/)4]zF83t08JU)3iiP%qul+7Ct@)dyi0{ax-Oi.c}[w:C404uvqYZhq/)4]zF848ygho]fkL6mxd)h9A+PA7j4%x$C404uvqYZhq/)4]zF848ygho]fkL4", "ln": 967 }, { "b": "2XNZ\u003cqfuC\u003cC)\u003cYc08T76Z5V{}07W8y0rsY1oLO0Vvj#C9zF7R3BAh8kxfdLoygho]fkL6mxd)h9A+PA7luN0UwmY^y3\u0026\u0026%3?WfuO0n)\u003eT7uZKs\u003ezum#LzOZ$JQBod\u003ebs9{KC:qG0oa1V32aD-CXIboy?%aLcmzM5vrM6jy*?i]fh($kx(mMBdnjF+C404uvqYZhq/)4]zF83t0osdw3igbc\u003c]CC)ygho]fk+uyfh(!0yH}O)0o::\u0026\u003e(rvs00\u0026M80rr*PwPQ*Yv}xv$wKpJKw[u0Yx)Kt00pfXS3ioq\u003c)eWh9ygho]fk+uyfg*4)Bw)9/yH}PNwmPZ(B8}M^)/rz7c}[w:C404uvqYZhq/)4]zF845dol\u0026SeDCqF0pQ0V3\u0026?KMaQFbI0q3o(2v?W\u0026zE)s10rs8/oLO0Vvj#IfBt3Nhv@2T$l1BIDwPI]OnHWWG0qlA!3ioq\u003c{ZvcG03ITG0S-5$01r{WBw)9Sx(dB1B-X2(}#xp}0o\u003cHZ3\u0026?^Tec#pT0ri619+]bbvr:CywPPODB8iHdq+Qbdv@2T$mQY!Gz/Qad0rAi33$Br?vru6Vz!0M]Bo8w3c}[w:C404wwPPO7z!0M]BurfhvrM6jy*?i]fh($kx(mMBnM)Mpygho]fk+uyfh(!0yH}PH3\u0026{Ch1pteh0r\u0026G77IWx4vr:CywPPODB8iHdq+Qbdv@2T$2lt5g01-^OBw(aip*[xMzdN*2A=RlYa1eNiygho]CRr@CBt4YRy+FZ=oI/ervqPN$wPz\u0026N3\u0026{Un3jl!t0sF]d8erP6vr:CywPPODB8iHdpdW#{B97e=", "ln": 3145 }, { "b": "j1i\u003crvrM6jB-.tlfhc83Buo)i6AF{R0ttFH0rs6NvrM77fk+uyflqhJfh\u003e!yp*[xMzdN*2A=RD^7Y:QDB7GC(wPz%9A.Z4WwPE\u003eL6duK?vrM6jB-.tlfhc83Bup{L3\u0026}mE8WVP-0uqauis:#XW=Uc0)V@*[H\u003e$FQWDj*c\u003c/CSBFq@uH)ymY9I((iEKlTr!)vZGqYUrKrYZzbN\u003c+Yw)H]7BU9SVl+B7GCZzE^Z8x(n2:wmYU2x\u003ez6?vruj4zB58Kz/PMlxL!dUaoq#W0t$[Y0rrWLwPQ\u003cHoI/ervqPN$wPz?)03AW-ygho]CRr@CBt4YRy+FZ=oI/ervqPN$wPz\u0026Ndol\u0026Tblo4%0seYL0rrQJByxiinmuyDB7!#$wEFO!04[PV2MVsO01SZNBwE43Acln3BAg@3z2\u003cRNc[d\u00268vrM6jx(tU2B-.OBBw)p4wNPBq3\u0026}*Ud*=pv0w1lK4RGu{nP5G\u0026Bw)p4wNPAR02E4joLO0Vvj#tkfg*52B-ZM7A+eV@i$8cx0ws=W\u003e(AEs01Yq0OsO=pPY@zS[4TIvOv]geg64v?ygho]fkktTpx", "ln": 3878 }, { "b": "nHWWG0x{JG3iro\u003ckMH\u003c22jn4%(ZUltV4RbIJ{\u00261t[1cDAPm^EJlid6ac}L\u003cYygho]fkL6mxd)h9A+PA7luN0UwmY^y3\u0026\u0026%4l\u003c-]+0yW1?bNS?fSQlsB*\u003e\u003ecFYYsZQ)u\u003eGEWvc9zJQhqj\u003e.s@VPTKlWQ6H=\u00260rtW{\u003ezC}#IJ)a]V/Ng6\u003e:l$+I\u003e/P%Gw@V1\u003c=l?lNwYkbGx[FL\u0026?J1", "ln": 4574 }, { "b": "\u003e.Vd{V6%WKLin\u003cA\u0026IRpIMG1an\u003cCOSGHp36SL\u003cVk}\u0026*(!H0HS@*3q1e(uPp25iBsGH0H\u003caC2)2+YOb\u0026P[CxdztwDq=mc%G1!rTY220IoY1h36uJ00M$JB-Rj80IPMD3ir0+Qx7u1B9z5is9O=!06zV6ygho]fkktTnP5G\u0026Bw)p4wNPBqdnjk\u0026z7/KoBzb/afhkbemm}b(hDS:ObX7B}AyT$qDu%Hxz95dbR2^C200ih00rrpky\u0026sxa3\u003c0sce^.Qy0JDe26ky%0vj#C9zF5", "ln": 6396 }, { "b": "0rrmCl3mzM03a:FvrM77fk+uyflqhJfh\u003e!yp*[xMzdN*2A=Tqy024Z=z*bL:q=Nvno(i-}uSh5zo-UkaoLO0Vvj#IfBt3Nhv@2T$i@]r[wn2Q)xKKtwBXljtv}ov{A@=mOw]hgaByf0gy\u003c78xuV{0\u003cyi:W$02ngxvrM6jB-.tlfhk\u003e]bT(P)A^o.E025%SAar\u003c0uWus2uVZD#CXgI%y5[qIoLO0Vvj#tkfhD.jAcln3BAg@3z94:#31[i:ACx8]zFoaK6?\u0026vJC404rz.BX1Acln3BAg@3z94:#24I^@A.gcH02XEBvrM6jy*?i]fh($kx(mMIB.LV5wPx\u003ck00)gPB-7.+B.}cV0A]H719F-A0rrsjA+woYw=R(xDt^+tzcz78BxS)4v@bYS00D!fvrR.L1AeDVCMv^JA=k#hCV5uRx-OhrCw7udD1WiU2YKi)vqOquv/V", "ln": 6664 }, { "b": "z.BC1w[CQ{wN[wIAcln3BAg@3z3H9]0rr@+oLO0Vvj#tkfg*52B-ZM7A+eV@j1jhs04!l93iw/X*w}o{ygho]fkktTlv0V:l2}0OC#5N8Acln3BAg@3z3H9$3iw#-f984QA+eV\u00263\u003c2n^l\u003c-$F0PsB/O=zs?0P0\u003eq0rrmzx)Kt00P:qH3iw#:\u003c]CC\u0026Bz\u003cG\u003eBy^:UA::j]00BY0ts5-0\u003eMf]P0P0\u003ex0rs-2oLO0Vvj#Ijz.CQlvrcB2Bt30{vrcB2Bup{Bygho]fkL6mxd)h9AS", "ln": 7267 }, { "b": "ts5-1f9i*m00iiR0rruMts7[Mdm\u003c{G?#UXw0OEJh0@@(j015+-07)s[0SSi300K=PlmCFm0Pj2t3iw/YiSPi=c%G2fnHWWG0IfuP3iw#+jPLKgc}N9EvrM6jy*?i]fh($kx(mMBoLK", "ln": 8424 }, { "b": "zfZC3Cu5H2m@rDX0rrc/0rrKFp\u0026o]wgfvpivq4I001rsBvpaj?zG6(dAbU{RfE\u003c*t\u003e9D-80%/F5P-Ccgygho]fkktTl$7gCpJZ+#B-ZM7A+eV@2lIvn02WgUygho]fkktTpJZ+#B-ZM7A+eV@j1jhs04!n.3iEZsX=z^pzEEB3rb3hX3\u003ca6yNf\u0026%T0\u003e!:q000000rr63z\u0026Hd41cD)%A%6Uu-rlhw3u{J8By!x:z/P}d0(L7g3iEZs-q]@\u003e4DJ!O\u003e^McgWvDMIZ3-a.", "ln": 9860 }, { "b": "vrM6jB-.tlfg68*wI#v\u003cmq=QNwmY^y3\u003cb?#)*o4f0}li\u003c4ThSexM53np*))Bx(mL(0}DAY3ig.v]8O?3wO#0@wmX.Uq/)4]zF6vV]-yx=022Cc0rt[6(XytPX$enOO:zY6(4K-MXTz=JF-Kp[(BjH\u003eFqAG\u003cKN4X0\u0026jDL/L^x+wYY\u003ecN\u003e^WOSNy84-Q3x7B\u003eZ*27S\u0026$-yT(c*$)V:)wM9HU%{Ygvv(x)?4Kc/gDITNy5(y0\u003e4J/@.yP6@IV\u003ezkwZHkCn@F:nG52NyId0rtZSVZHfSO8Q=-\u0026JFg", "ln": 10464 }, { "b": "vo3V5zcx[CDs.emuQY35l\u0026^o0DsHR\u0026A7s.\u003cyH?iHzf6=l0rryCwPI*ezGxv\u003et+v8\u00260rr^FvrM6jzFs2xlv0V:luM)LwPw1T9033xCxdbh0rr#=ts6=jygho]fk+Gxfg6@awKpJKw[u0A3\u003cdKM9%@8\u003c10vQA2XNZ\u003cq!Q8\u0026Bo8vzc[e7610N*(3iIpJbM)vT^=Z=p?G-(sUQV?i0@@sK00ri3%nJ9123sYhy/$#-02NaTygho]fk+Gxfg6@awKl", "ln": 11359 }, { "b": "v}tVve*%zdvrM6jy*?i]fh($kx(mMBdnjF+C42RGzE)]yB8#dJq=uvSz/fVdCYV1Q17.ND3iK/vx8}#Jygho]CRr@CBt4YRy+F+dB-RU0vqYH^wPw1Tx:K?A051uM8FSY7vj#Xkv%8*aBA]JrwN/\u003e6wL#@Own=q\u002618FqDz2=i\u002600E1Nx(\u003cvQs14oDygho]CRr@CBt4YRy+FB)C$?Z+vp%d(j6Lx[vrM77fk+uyflqhJfh#$mB97b+zEEf?AYV%fvrM6jB7F\u003c7A+PSvfh(B(B-I4\u003evqYQ]z96gE3\u003cgzIA0=XT191tw5nbM@q/ueYwPQyIv@#TfC(W)?c[d\u00268vrM77fk+uyflqhJfh\u003e!yq/ueYwPQyIv@#R", "ln": 12356 }, { "b": "kdZ!=sSK%Kof9gThu:*09IJJW83zC)9afG+v7354d*cN\u003c9b]q]077jVWG698GARyO%jXy]WG6kQ0rAkh09ux800065F=C=JcJBnG03?KH2ll\u003c^000000rrc103haB2ll\u003c\u003e06yn.2lmo}0rr9E1aZBL01n\u0026d03?Lz09xjx000aN000040096T1b3TO00Jx6", "ln": 13124 }, { "b": "05b8!xG3ei2nveMx/unj2nveOGeT2Fzz?!o2[QYRhvg985]SvW2]9:ICS2\u003cC1R?j)6:uGC6:blQ9DkyyF%6b!1{7U4SK\u0026c)sS4yL0cfK\u00260v$UWsfIV800imO0000J00Jr47xsZC06yF^4/=Of000310ri3u00--ejo\u003e\u0026%2lnup0s5Qp0rr9:83tA\u0026000=m0ST2pIu4X$9SMfu7xxr)Bo0V*0rW@O000c40rt1WE/GDG0SVyaGA7#L2)78=", "ln": 13372 }, { "b": "u]wub3keRQhvpfa1:z{j83.2Z1qI8F6:OiQ074La1qIgS1-N\u003eT078p2WG698GA}QR%dg8kWG6kQd\u003eAoZ09ux800065F=C=JiSGr.02LXy2ll\u003c\u003e06yF^jo\u003e\u0026%0000000961@@stB3i{L[2ll\u003c\u003e06yF^4*J7%0rAA9nc5.\u003e06RXhFDbVIdGxOK7YY{6Mh?%a", "ln": 14004 }, { "b": "MJe6b0rr@pM\u0026JGN9SMlw7YY{6Ne!Pm0%seQ000c40rt1WE/GDG0SXk.GA7#L5D\u00267)0001y0001z00016000090gA[E00AyO0003a00-Gi0001)5$p==6:UIxPA2/y0gU$O76$VPO[Qa\u002676$VPPO2ff5#h(nwi6\u0026h1IL1H83Bq6hu:%3Z7*/Z1y%y{6:zqO", "ln": 14162 }, { "b": "2O^IZu]iE#rt88=2]9:VQ\u003c%8NPA2@AR8wR{2[WfEu]wra2[\u003ca!hvg981:z{iGA}QR%g2VvjxSKbW/yB#d\u003eAoZ09ux800065F=C=Jciae\u003e@@sqA2)QC)2ll\u003c\u003e06yF^4*J8D0rAA9w=R(i}#xa=}tZW3FDbVIdGxOKaol@)RVm+r001bwFDhRG9SMivaol@)", "ln": 14340 }, { "b": "6={)z9#b)g1V^+dhx-!U6^6dIbPdZtaShp66={-$aZ^bA9rW926=}s4g\u003eH(\u003cGDQw]%j+c=jxSKAW/yCf2]J]P0nUS{C]l]a1?1A!iWD*jY8Ux8W/Cn5b^)Zi663z2wi84PcCxQ[875YEhyxv?Z7\u00262a1y%zs6!3Y#iW\u003ed?dITAFd53X:87upI8737Fg-mRPc(1iDcVADIF%6b!dGMEE?[5\u003eJsS5V$0ckHF\u0026tA@I0o7u^q-Uj52dKV@iTSF0\u003e#\u003eE}(n/p\u003c3LI^l0pyZjY8.t68448-W/D390qi=2}56NC0q\u003ch8@UkZb0gp4)02VdZ1@dvCWGcPF0sgZ}84B1", "ln": 14781 }, { "b": "6/xIWhwFc.1V!NAhAhBh6/I=^bPeJQi2KKQ6/xwliaaMXgZ1KM6/x@rg\u003eH(\u003cGG61g%j+c=jxSKXW/yDS0o1!4WGbn10xEN*wi8^\u0026jh7\u0026d89qgZhAR\u003csZ7\u0026+v1y%zN6*ohkiZ9T7knux$j!.{089O^189nM$g-nv\u0026jRZf@jAaW+F%6b!klmXZ?[5\u003eJsS6Aj0ckHF\u0026A3)c69gh60aXbS8a1AZhBwuGZ64%YlU58y6?2XriZ\u003ccem?[Jem4%Vb8atog8a1DvlTQT0u]e-/1qKAwlVuA\u0026F%6b!m//K/*z9b?1V/9\u003cmfsz", "ln": 15228 }, { "b": "69g.l0aXb(8cl[%hDQ?#Z64%Ysy:r)6\u003cnfMi:8RztnpuSs!U)w8cN+V8cl}Qsyq\u003eFu]e:51qLbQsA4U8wrG@CtlgV4*Q^CFsS7zL0ckHF\u0026A3at5cB*583E}Y78Wm=0zST}XDbUg06g-g61F3C0rwI?@UVuV0BkZaZYj*86b.E]0BL{dZYlFT6D4O#0B!8@8d0AN075OJ8d6-KmG^lpuT#65Y8Ux86\u003e1GJofcF-hEWzg6\u003e0:odh=Liuiz0I", "ln": 15708 }, { "b": "1R?ig01x!G0#h0F0TH*\u002683EwF/QhZzRVp6w1HXvw5d(tMyC(wi2atI@RVov82d$j52lM\u003c\u00266:LJUQ5VF?83Z(Z6:txUwvqLQhvg980?YI$RVmev2O^UNhvckX*aa3C0@", "ln": 37498 } ], "depth": 1, "facts": { "imp": [ [ "", "java/lang/Object" ], [ "", "com/github/MLEEJeV6XOT$oww" ], [ "", "com/github/MLEEJeV6XOT$puqFxpbwcKycgie" ], [ "", "com/github/MLEEJeV6XOT$cfbqGpFzzogm" ], [ "", "java/util/Map$Entry" ], [ "", "java/util/Map" ], [ "", "java/util/Base64$Encoder" ], [ "", "java/util/Base64" ], [ "", "java/lang/invoke/MethodHandles$Lookup" ], [ "", "java/lang/invoke/MethodHandles" ], [ "", "java/io/IOException" ], [ "", "java/lang/String" ], [ "", "java/lang/StringBuilder" ], [ "", "[C" ], [ "", "java/net/URI" ], [ "", "java/net/URL" ], [ "", "java/net/Socket" ], [ "", "java/net/InetSocketAddress" ], [ "", "javax/net/ssl/SSLSocketFactory" ], [ "", "javax/net/ssl/SSLSocket" ], [ "", "javax/net/ssl/SNIHostName" ], [ "", "java/util/List" ], [ "", "javax/net/ssl/SSLParameters" ], [ "", "java/io/OutputStream" ], [ "", "java/io/InputStream" ], [ "", "java/lang/System" ], [ "", "java/util/Set" ], [ "", "java/util/Iterator" ], [ "", "java/nio/charset/StandardCharsets" ], [ "", "[B" ], [ "", "java/lang/Throwable" ], [ "", "java/lang/NumberFormatException" ], [ "", "java/io/BufferedInputStream" ], [ "", "java/io/ByteArrayOutputStream" ], [ "", "[Ljava/lang/String;" ], [ "", "java/lang/Integer" ], [ "", "java/util/LinkedHashMap" ], [ "", "java/io/DataOutputStream" ], [ "", "java/lang/RuntimeException" ], [ "", "java/nio/ByteBuffer" ], [ "", "java/lang/Exception" ], [ "", "java/util/concurrent/ConcurrentHashMap" ], [ "", "javax/net/ssl/SSLContext" ], [ "", "javax/net/ssl/TrustManager" ], [ "", "java/security/SecureRandom" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.charAt" ], [ "java/lang/String", "charAt" ], [ "java/lang/String", "java/lang/String.length" ], [ "java/lang/String", "length" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.toString" ], [ "java/lang/StringBuilder", "toString" ], [ "com/github/MLEEJeV6XOT", "com/github/MLEEJeV6XOT.wTzqjrfqi" ], [ "com/github/MLEEJeV6XOT", "wTzqjrfqi" ], [ "java/lang/String", "java/lang/String.toCharArray" ], [ "java/lang/String", "toCharArray" ], [ "java/lang/String", "java/lang/String.\u003cinit\u003e" ], [ "java/lang/String", "\u003cinit\u003e" ], [ "java/net/URI", "java/net/URI.create" ], [ "java/net/URI", "create" ], [ "java/net/URI", "java/net/URI.toURL" ], [ "java/net/URI", "toURL" ], [ "java/net/URL", "java/net/URL.getHost" ], [ "java/net/URL", "getHost" ], [ "java/net/URL", "java/net/URL.getPort" ], [ "java/net/URL", "getPort" ], [ "java/net/URL", "java/net/URL.getProtocol" ], [ "java/net/URL", "getProtocol" ], [ "java/lang/String", "java/lang/String.equalsIgnoreCase" ], [ "java/lang/String", "equalsIgnoreCase" ], [ "com/github/MLEEJeV6XOT", "com/github/MLEEJeV6XOT.fzuidb_zqwhm_gou" ], [ "com/github/MLEEJeV6XOT", "fzuidb_zqwhm_gou" ], [ "com/github/MLEEJeV6XOT", "com/github/MLEEJeV6XOT.GxL_lY3SH_MPq" ], [ "com/github/MLEEJeV6XOT", "GxL_lY3SH_MPq" ], [ "java/net/URL", "java/net/URL.getPath" ], [ "java/net/URL", "getPath" ], [ "java/lang/String", "java/lang/String.isEmpty" ], [ "java/lang/String", "isEmpty" ], [ "java/net/URL", "java/net/URL.getQuery" ], [ "java/net/URL", "getQuery" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "com/github/MLEEJeV6XOT", "com/github/MLEEJeV6XOT.isYxippll" ], [ "com/github/MLEEJeV6XOT", "isYxippll" ], [ "java/net/Socket", "java/net/Socket.\u003cinit\u003e" ], [ "java/net/Socket", "\u003cinit\u003e" ], [ "java/net/Socket", "java/net/Socket.setReceiveBufferSize" ], [ "java/net/Socket", "setReceiveBufferSize" ], [ "java/net/InetSocketAddress", "java/net/InetSocketAddress.\u003cinit\u003e" ], [ "java/net/InetSocketAddress", "\u003cinit\u003e" ], [ "com/github/MLEEJeV6XOT", "com/github/MLEEJeV6XOT.disposeBhbpdt" ], [ "com/github/MLEEJeV6XOT", "disposeBhbpdt" ], [ "java/net/Socket", "java/net/Socket.connect" ], [ "java/net/Socket", "connect" ], [ "com/github/MLEEJeV6XOT", "com/github/MLEEJeV6XOT.nojqeq_ropc_ndih_mkjd" ], [ "com/github/MLEEJeV6XOT", "nojqeq_ropc_ndih_mkjd" ], [ "java/net/Socket", "java/net/Socket.setSoTimeout" ], [ "java/net/Socket", "setSoTimeout" ], [ "com/github/MLEEJeV6XOT", "com/github/MLEEJeV6XOT.rrrkbVM" ], [ "com/github/MLEEJeV6XOT", "rrrkbVM" ], [ "javax/net/ssl/SSLSocketFactory", "javax/net/ssl/SSLSocketFactory.createSocket" ], [ "javax/net/ssl/SSLSocketFactory", "createSocket" ], [ "javax/net/ssl/SSLSocket", "javax/net/ssl/SSLSocket.getSSLParameters" ], [ "javax/net/ssl/SSLSocket", "getSSLParameters" ], [ "javax/net/ssl/SNIHostName", "javax/net/ssl/SNIHostName.\u003cinit\u003e" ], [ "javax/net/ssl/SNIHostName", "\u003cinit\u003e" ], [ "java/util/List", "java/util/List.of" ], [ "java/util/List", "of" ], [ "javax/net/ssl/SSLParameters", "javax/net/ssl/SSLParameters.setServerNames" ], [ "javax/net/ssl/SSLParameters", "setServerNames" ], [ "javax/net/ssl/SSLParameters", "javax/net/ssl/SSLParameters.setEndpointIdentificationAlgorithm" ], [ "javax/net/ssl/SSLParameters", "setEndpointIdentificationAlgorithm" ], [ "javax/net/ssl/SSLSocket", "javax/net/ssl/SSLSocket.setSSLParameters" ], [ "javax/net/ssl/SSLSocket", "setSSLParameters" ], [ "javax/net/ssl/SSLSocket", "javax/net/ssl/SSLSocket.startHandshake" ], [ "javax/net/ssl/SSLSocket", "startHandshake" ], [ "java/net/Socket", "java/net/Socket.getOutputStream" ], [ "java/net/Socket", "getOutputStream" ], [ "java/net/Socket", "java/net/Socket.getInputStream" ], [ "java/net/Socket", "getInputStream" ], [ "java/lang/System", "java/lang/System.arraycopy" ], [ "java/lang/System", "arraycopy" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/util/Map", "java/util/Map.entrySet" ], [ "java/util/Map", "entrySet" ], [ "java/util/Set", "java/util/Set.iterator" ], [ "java/util/Set", "iterator" ], [ "java/util/Iterator", "java/util/Iterator.hasNext" ], [ "java/util/Iterator", "hasNext" ], [ "java/util/Iterator", "java/util/Iterator.next" ], [ "java/util/Iterator", "next" ], [ "java/util/Map$Entry", "java/util/Map$Entry.getKey" ], [ "java/util/Map$Entry", "getKey" ], [ "java/util/Map$Entry", "java/util/Map$Entry.getValue" ], [ "java/util/Map$Entry", "getValue" ], [ "java/nio/charset/StandardCharsets", "java/nio/charset/StandardCharsets.UTF_8" ], [ "java/nio/charset/StandardCharsets", "UTF_8" ], [ "java/lang/String", "java/lang/String.getBytes" ], [ "java/lang/String", "getBytes" ], [ "java/nio/charset/StandardCharsets", "java/nio/charset/StandardCharsets.ISO_8859_1" ], [ "java/nio/charset/StandardCharsets", "ISO_8859_1" ], [ "java/io/OutputStream", "java/io/OutputStream.write" ], [ "java/io/OutputStream", "write" ], [ "java/io/OutputStream", "java/io/OutputStream.flush" ], [ "java/io/OutputStream", "flush" ], [ "com/github/MLEEJeV6XOT", "com/github/MLEEJeV6XOT.swapWxs" ], [ "com/github/MLEEJeV6XOT", "swapWxs" ], [ "java/net/Socket", "java/net/Socket.close" ], [ "java/net/Socket", "close" ], [ "java/io/BufferedInputStream", "java/io/BufferedInputStream.\u003cinit\u003e" ], [ "java/io/BufferedInputStream", "\u003cinit\u003e" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.\u003cinit\u003e" ], [ "java/io/ByteArrayOutputStream", "\u003cinit\u003e" ], [ "java/io/BufferedInputStream", "java/io/BufferedInputStream.read" ], [ "java/io/BufferedInputStream", "read" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.write" ], [ "java/io/ByteArrayOutputStream", "write" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.size" ], [ "java/io/ByteArrayOutputStream", "size" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.toByteArray" ], [ "java/io/ByteArrayOutputStream", "toByteArray" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.toString" ], [ "java/io/ByteArrayOutputStream", "toString" ], [ "java/lang/String", "java/lang/String.split" ], [ "java/lang/String", "split" ], [ "java/lang/String", "java/lang/String.startsWith" ], [ "java/lang/String", "startsWith" ], [ "java/lang/String", "java/lang/String.indexOf" ], [ "java/lang/String", "indexOf" ], [ "java/lang/String", "java/lang/String.indexOf" ], [ "java/lang/String", "indexOf" ], [ "java/lang/String", "java/lang/String.substring" ], [ "java/lang/String", "substring" ], [ "java/lang/String", "java/lang/String.substring" ], [ "java/lang/String", "substring" ], [ "java/lang/String", "java/lang/String.trim" ], [ "java/lang/String", "trim" ], [ "java/lang/Integer", "java/lang/Integer.parseInt" ], [ "java/lang/Integer", "parseInt" ], [ "java/util/LinkedHashMap", "java/util/LinkedHashMap.\u003cinit\u003e" ], [ "java/util/LinkedHashMap", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.toLowerCase" ], [ "java/lang/String", "toLowerCase" ], [ "java/util/Map", "java/util/Map.put" ], [ "java/util/Map", "put" ], [ "java/lang/String", "java/lang/String.equals" ], [ "java/lang/String", "equals" ], [ "java/lang/String", "java/lang/String.contains" ], [ "java/lang/String", "contains" ], [ "com/github/MLEEJeV6XOT", "com/github/MLEEJeV6XOT.FzNWI0n6u" ], [ "com/github/MLEEJeV6XOT", "FzNWI0n6u" ], [ "java/io/BufferedInputStream", "java/io/BufferedInputStream.read" ], [ "java/io/BufferedInputStream", "read" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.\u003cinit\u003e" ], [ "java/io/ByteArrayOutputStream", "\u003cinit\u003e" ], [ "java/io/BufferedInputStream", "java/io/BufferedInputStream.read" ], [ "java/io/BufferedInputStream", "read" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.write" ], [ "java/io/ByteArrayOutputStream", "write" ], [ "com/github/MLEEJeV6XOT$cfbqGpFzzogm", "com/github/MLEEJeV6XOT$cfbqGpFzzogm.\u003cinit\u003e" ], [ "com/github/MLEEJeV6XOT$cfbqGpFzzogm", "\u003cinit\u003e" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.setLength" ], [ "java/lang/StringBuilder", "setLength" ], [ "java/io/InputStream", "java/io/InputStream.read" ], [ "java/io/InputStream", "read" ], [ "java/lang/Integer", "java/lang/Integer.parseInt" ], [ "java/lang/Integer", "parseInt" ], [ "java/io/InputStream", "java/io/InputStream.read" ], [ "java/io/InputStream", "read" ], [ "com/github/MLEEJeV6XOT", "com/github/MLEEJeV6XOT.rhvb" ], [ "com/github/MLEEJeV6XOT", "rhvb" ], [ "com/github/MLEEJeV6XOT", "com/github/MLEEJeV6XOT.sSimebbtvr" ], [ "com/github/MLEEJeV6XOT", "sSimebbtvr" ], [ "java/util/Map", "java/util/Map.get" ], [ "java/util/Map", "get" ], [ "com/github/MLEEJeV6XOT$puqFxpbwcKycgie", "com/github/MLEEJeV6XOT$puqFxpbwcKycgie.isExpired" ], [ "com/github/MLEEJeV6XOT$puqFxpbwcKycgie", "isExpired" ], [ "com/github/MLEEJeV6XOT$puqFxpbwcKycgie", "com/github/MLEEJeV6XOT$puqFxpbwcKycgie.ip" ], [ "com/github/MLEEJeV6XOT$puqFxpbwcKycgie", "ip" ], [ "com/github/MLEEJeV6XOT", "com/github/MLEEJeV6XOT.jAlqzdml" ], [ "com/github/MLEEJeV6XOT", "jAlqzdml" ], [ "com/github/MLEEJeV6XOT", "com/github/MLEEJeV6XOT.psckd_psc_haxak" ], [ "com/github/MLEEJeV6XOT", "psckd_psc_haxak" ], [ "com/github/MLEEJeV6XOT", "com/github/MLEEJeV6XOT.slav_fcgrnl_gzcmcm_jwju" ], [ "com/github/MLEEJeV6XOT", "slav_fcgrnl_gzcmcm_jwju" ], [ "java/lang/System", "java/lang/System.currentTimeMillis" ], [ "java/lang/System", "currentTimeMillis" ], [ "com/github/MLEEJeV6XOT", "com/github/MLEEJeV6XOT.qotmrctMzy" ], [ "com/github/MLEEJeV6XOT", "qotmrctMzy" ], [ "com/github/MLEEJeV6XOT$puqFxpbwcKycgie", "com/github/MLEEJeV6XOT$puqFxpbwcKycgie.\u003cinit\u003e" ], [ "com/github/MLEEJeV6XOT$puqFxpbwcKycgie", "\u003cinit\u003e" ], [ "java/io/DataOutputStream", "java/io/DataOutputStream.\u003cinit\u003e" ], [ "java/io/DataOutputStream", "\u003cinit\u003e" ], [ "java/lang/System", "java/lang/System.nanoTime" ], [ "java/lang/System", "nanoTime" ], [ "java/io/DataOutputStream", "java/io/DataOutputStream.writeShort" ], [ "java/io/DataOutputStream", "writeShort" ], [ "java/io/DataOutputStream", "java/io/DataOutputStream.writeByte" ], [ "java/io/DataOutputStream", "writeByte" ], [ "java/io/DataOutputStream", "java/io/DataOutputStream.writeBytes" ], [ "java/io/DataOutputStream", "writeBytes" ], [ "java/lang/RuntimeException", "java/lang/RuntimeException.\u003cinit\u003e" ], [ "java/lang/RuntimeException", "\u003cinit\u003e" ], [ "com/github/MLEEJeV6XOT", "com/github/MLEEJeV6XOT.iav" ], [ "com/github/MLEEJeV6XOT", "iav" ], [ "com/github/MLEEJeV6XOT", "com/github/MLEEJeV6XOT.qk_anc" ], [ "com/github/MLEEJeV6XOT", "qk_anc" ], [ "com/github/MLEEJeV6XOT", "com/github/MLEEJeV6XOT.ngtcotBl" ], [ "com/github/MLEEJeV6XOT", "ngtcotBl" ], [ "javax/net/ssl/SSLSocket", "javax/net/ssl/SSLSocket.getOutputStream" ], [ "javax/net/ssl/SSLSocket", "getOutputStream" ], [ "javax/net/ssl/SSLSocket", "javax/net/ssl/SSLSocket.getInputStream" ], [ "javax/net/ssl/SSLSocket", "getInputStream" ], [ "java/util/Base64", "java/util/Base64.getUrlEncoder" ], [ "java/util/Base64", "getUrlEncoder" ], [ "java/util/Base64$Encoder", "java/util/Base64$Encoder.withoutPadding" ], [ "java/util/Base64$Encoder", "withoutPadding" ], [ "java/util/Base64$Encoder", "java/util/Base64$Encoder.encodeToString" ], [ "java/util/Base64$Encoder", "encodeToString" ], [ "com/github/MLEEJeV6XOT$cfbqGpFzzogm", "com/github/MLEEJeV6XOT$cfbqGpFzzogm.body" ], [ "com/github/MLEEJeV6XOT$cfbqGpFzzogm", "body" ], [ "javax/net/ssl/SSLSocket", "javax/net/ssl/SSLSocket.close" ], [ "javax/net/ssl/SSLSocket", "close" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.wrap" ], [ "java/nio/ByteBuffer", "wrap" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.getShort" ], [ "java/nio/ByteBuffer", "getShort" ], [ "com/github/MLEEJeV6XOT", "com/github/MLEEJeV6XOT.XPblYx" ], [ "com/github/MLEEJeV6XOT", "XPblYx" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.getInt" ], [ "java/nio/ByteBuffer", "getInt" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.get" ], [ "java/nio/ByteBuffer", "get" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.position" ], [ "java/nio/ByteBuffer", "position" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.position" ], [ "java/nio/ByteBuffer", "position" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.hasRemaining" ], [ "java/nio/ByteBuffer", "hasRemaining" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.get" ], [ "java/nio/ByteBuffer", "get" ], [ "java/util/concurrent/ConcurrentHashMap", "java/util/concurrent/ConcurrentHashMap.\u003cinit\u003e" ], [ "java/util/concurrent/ConcurrentHashMap", "\u003cinit\u003e" ], [ "javax/net/ssl/SSLContext", "javax/net/ssl/SSLContext.getInstance" ], [ "javax/net/ssl/SSLContext", "getInstance" ], [ "com/github/MLEEJeV6XOT$oww", "com/github/MLEEJeV6XOT$oww.\u003cinit\u003e" ], [ "com/github/MLEEJeV6XOT$oww", "\u003cinit\u003e" ], [ "java/security/SecureRandom", "java/security/SecureRandom.\u003cinit\u003e" ], [ "java/security/SecureRandom", "\u003cinit\u003e" ], [ "javax/net/ssl/SSLContext", "javax/net/ssl/SSLContext.init" ], [ "javax/net/ssl/SSLContext", "init" ], [ "javax/net/ssl/SSLContext", "javax/net/ssl/SSLContext.getSocketFactory" ], [ "javax/net/ssl/SSLContext", "getSocketFactory" ], [ "javax/net/ssl/SSLSocketFactory", "javax/net/ssl/SSLSocketFactory.getDefault" ], [ "javax/net/ssl/SSLSocketFactory", "getDefault" ] ], "metrics": { "file": { "size": 44263, "entropy": 5.23 }, "class": { "major_version": 65, "interface_count": 0, "method_ref_count": 129, "constant_pool_count": 903, "external_class_count": 45 }, "binary": { "peak_region_bytes": 5120, "peak_region_entropy": 7.02 }, "imports": { "count": 174 }, "functions": { "count": 16 } } }, "id": 4, "mol": "H₂(Cm₃Db₄)Md₃(Bi₂In)", "path": "/data/samples/incoming/forager/bad/sha256/bazaar/doomsday-1.21-1.21.11.jar!!com/github/MLEEJeV6XOT.class", "pid": 0, "risk": 7, "sha": "6397b08627c1594069fc9abdd4b298df28c07c4f84d99d2b85589797d0c5d7bb", "size": 44263, "traits": [ { "id": "metadata/binary/symbols/descriptor::jvm-byte-slice-void-descriptor", "conf": 0.98, "crit": 3, "desc": "JVM byte-array slice method descriptor" }, { "id": "metadata/binary/symbols/name::jvm-getpath-name-reference", "conf": 0.8, "crit": 3, "desc": "JVM getPath method-name reference" }, { "id": "metadata/file/encoded::java-control-prefixed-long-string", "conf": 0.92, "crit": 3, "desc": "Long JVM constant with control prefix" }, { "id": "metadata/import/framework::jvm-security-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM security package reference" }, { "id": "metadata/import/framework::jvm-url-class-ref", "conf": 0.9, "crit": 3, "desc": "JVM URL class reference" }, { "id": "micro-behaviors/communications/socket/create::java-socket-bytecode-reference", "atk": "T1071", "mbc": "C0001", "conf": 0.86, "crit": 3, "desc": "Java bytecode socket reference", "spans": [ [ 3609, 56 ], [ 6728, 17 ] ] }, { "id": "micro-behaviors/communications/socket/create::java-socket-class-import", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "Java imports the network socket class", "spans": [ [ 3321, 15 ] ] }, { "id": "micro-behaviors/communications/socket/create::java-socket-slash-reference", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "Java slash-form socket reference", "spans": [ [ 3321, 15 ], [ 3472, 28 ], [ 3609, 56 ], [ 6728, 17 ] ] }, { "id": "micro-behaviors/communications/socket/create::jvm-socket-class-ref", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "JVM socket class reference" }, { "id": "micro-behaviors/communications/socket/send::java-socket-stream-write-references", "conf": 0.94, "crit": 3, "desc": "JVM socket and stream-write references", "uses": [ 6, 19, 20 ], "spans": [ [ 3321, 15 ], [ 6460, 26 ], [ 9924, 24 ] ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-sslcontext-trustmanager-init-call", "conf": 0.94, "crit": 3, "desc": "JVM SSLContext.init trust-manager call", "spans": [ [ 12494, 29 ] ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-sslparameters-set-server-names", "conf": 0.93, "crit": 3, "desc": "JVM sets TLS SNI server name", "spans": [ [ 3942, 42 ] ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-sslsocket-handshake-call", "conf": 0.94, "crit": 3, "desc": "JVM SSLSocket.startHandshake call", "spans": [ [ 4165, 38 ] ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-trustmanager-class-ref", "conf": 0.9, "crit": 3, "desc": "JVM TrustManager interface reference", "spans": [ [ 12420, 26 ] ] }, { "id": "micro-behaviors/data/arithmetic::jvm-subtract-character-array-store", "conf": 0.95, "crit": 3, "desc": "Difference narrowed and stored as JVM character", "spans": [ [ 15772, 8 ] ] }, { "id": "micro-behaviors/data/arithmetic::jvm-xor-character-array-store", "conf": 0.95, "crit": 3, "desc": "XOR result stored as JVM character", "spans": [ [ 13436, 8 ] ] }, { "id": "micro-behaviors/data/buffer/alloc::java-bytebuffer-type", "conf": 1.0, "crit": 3, "desc": "Java ByteBuffer storage type reference", "spans": [ [ 11423, 10 ] ] }, { "id": "micro-behaviors/data/buffer/transfer::bytearrayoutputstream-ref", "conf": 0.88, "crit": 3, "desc": "Java ByteArrayOutputStream class", "spans": [ [ 7331, 29 ] ] }, { "id": "micro-behaviors/data/buffer/transfer::java-data-stream-type", "conf": 1.0, "crit": 3, "desc": "Java binary data stream type reference", "spans": [ [ 9932, 16 ] ] }, { "id": "micro-behaviors/data/buffer/transfer::java-dataoutputstream-class", "conf": 0.9, "crit": 3, "desc": "Java DataOutputStream class reference", "spans": [ [ 9924, 24 ] ] }, { "id": "micro-behaviors/data/buffer/transfer::jvm-outputstream-write", "conf": 0.96, "crit": 3, "desc": "JVM OutputStream.write method reference", "spans": [ [ 6460, 26 ] ] }, { "id": "micro-behaviors/data/encode/base64::jvm-base64-encode-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM Base64 encodeToString call", "spans": [ [ 10528, 39 ] ] }, { "id": "metadata/binary/symbols/count::many-imports", "conf": 0.8, "crit": 2, "desc": "High number of imported symbols (\u003e80)" }, { "id": "micro-behaviors/data/decode/hex::java-radix-16-static-call", "atk": "T1027", "conf": 0.88, "crit": 1, "desc": "Java pushes radix 16 before static call", "spans": [ [ 37530, 0 ] ] }, { "id": "well-known/malware/stealer/prefire-shard::prefire-payload-string-obfuscation", "atk": "T1528", "mbc": "B0006", "conf": 0.95, "crit": 1, "desc": "Prefire hides strings with UTF-16 control bytes or XOR char builders", "uses": [ 2, 14, 15 ], "spans": [ [ 13436, 0 ] ] } ], "type": "java_class" }, { "ctx": [ { "b": "+kO#^0000+07u[*8E)Y5fk20vxMW=qo?W#An[z3YswI)wz*cyg009925nCS%vj#C9zF7Q#vRPE:Bo.^F0rsfQvrM77fk+uyflqhJfiy7=iAg3wB97b+zEEf?AT8NF0rr)Bz/4c", "ln": 0 } ], "depth": 1, "facts": { "imp": [ [ "", "java/lang/Object" ], [ "", "javax/net/ssl/X509TrustManager" ], [ "", "com/github/MLEEJeV6XOT" ], [ "", "java/security/cert/X509Certificate" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ] ], "metrics": { "file": { "size": 1277, "entropy": 5.89 }, "class": { "major_version": 65, "interface_count": 1, "method_ref_count": 1, "constant_pool_count": 69, "external_class_count": 4 }, "binary": { "peak_region_bytes": 1024, "peak_region_entropy": 5.96 }, "imports": { "count": 5 }, "functions": { "count": 4 } } }, "id": 5, "mol": "H(Cm₂)Md(In)", "path": "/data/samples/incoming/forager/bad/sha256/bazaar/doomsday-1.21-1.21.11.jar!!com/github/MLEEJeV6XOT$oww.class", "pid": 0, "risk": 3, "sha": "d34d04626bd75cb716a3af90460c7ab98d053808d206cc402d4df7d6aadb2a9b", "size": 1277, "traits": [ { "id": "metadata/import/framework::jvm-security-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM security package reference" }, { "id": "micro-behaviors/communications/socket/ssl::jvm-custom-x509trustmanager", "conf": 0.95, "crit": 3, "desc": "Class implements a custom X509 trust manager", "uses": [ 2, 3, 4 ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-x509trustmanager-class-ref", "conf": 0.94, "crit": 3, "desc": "JVM X509 trust-manager interface reference" }, { "id": "micro-behaviors/communications/socket/ssl::jvm-x509trustmanager-issuer-callback", "conf": 0.94, "crit": 3, "desc": "JVM getAcceptedIssuers callback defined" }, { "id": "micro-behaviors/communications/socket/ssl::jvm-x509trustmanager-server-callback", "conf": 0.94, "crit": 3, "desc": "JVM checkServerTrusted callback defined" }, { "id": "micro-behaviors/communications/tls/verify/disable::java-trust-all-x509trustmanager", "conf": 0.93, "crit": 3, "desc": "Java trust manager accepts every certificate", "uses": [ 1, 6 ] }, { "id": "metadata/file/function::jvm-class-calls-no-methods", "conf": 0.9, "crit": 2, "desc": "Class calls no methods beyond super()" } ], "type": "java_class" }, { "ctx": [ { "b": "+kO#^0000+08S:%bv+Uefk20vxMW=qo?W#An[z3YswI)wv}Gg\u0026m@Q}zDt^Ck2lj=901-)NC404uvqYZhpHX6Iv@}}Q0%5xqv@Diqxk8E3BZ^0#oHRxxwMyY\u003epGdM01PXPiv}Gf", "ln": 0 }, { "b": "aPI/G0rr918up@Y3JHkd000]qbleeM0@@r38uq2.5c8?kn=O?\u003e0SS(lo-Ld[5D\u00267t0000a0000c0000f0000103}Q(0096)0000(00Ao60000x5*]^X5*%sL3\u003eW6Njr1\u0026Ju{843doOdc03nACfsH{pUMaU60SU%}000i60Sh{g0rt^[000Ac0rr-j4/!x=", "ln": 1211 } ], "depth": 1, "facts": { "imp": [ [ "", "com/github/MLEEJeV6XOT" ], [ "", "java/lang/String" ], [ "", "java/nio/charset/StandardCharsets" ], [ "", "java/util/Map" ], [ "", "java/lang/Object" ], [ "com/github/MLEEJeV6XOT$cfbqGpFzzogm", "com/github/MLEEJeV6XOT$cfbqGpFzzogm.body" ], [ "com/github/MLEEJeV6XOT$cfbqGpFzzogm", "body" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ], [ "com/github/MLEEJeV6XOT$cfbqGpFzzogm", "com/github/MLEEJeV6XOT$cfbqGpFzzogm.statusCode" ], [ "com/github/MLEEJeV6XOT$cfbqGpFzzogm", "statusCode" ], [ "com/github/MLEEJeV6XOT$cfbqGpFzzogm", "com/github/MLEEJeV6XOT$cfbqGpFzzogm.statusLine" ], [ "com/github/MLEEJeV6XOT$cfbqGpFzzogm", "statusLine" ], [ "java/lang/String", "java/lang/String.toLowerCase" ], [ "java/lang/String", "toLowerCase" ], [ "com/github/MLEEJeV6XOT$cfbqGpFzzogm", "com/github/MLEEJeV6XOT$cfbqGpFzzogm.headers" ], [ "com/github/MLEEJeV6XOT$cfbqGpFzzogm", "headers" ], [ "java/nio/charset/StandardCharsets", "java/nio/charset/StandardCharsets.UTF_8" ], [ "java/nio/charset/StandardCharsets", "UTF_8" ], [ "java/lang/String", "java/lang/String.\u003cinit\u003e" ], [ "java/lang/String", "\u003cinit\u003e" ], [ "java/util/Map", "java/util/Map.get" ], [ "java/util/Map", "get" ] ], "metrics": { "file": { "size": 1543, "entropy": 5.68 }, "class": { "major_version": 65, "interface_count": 0, "method_ref_count": 9, "constant_pool_size": 81, "external_class_count": 5 }, "binary": { "peak_region_bytes": 1024, "peak_region_entropy": 5.68 }, "imports": { "count": 14 }, "functions": { "count": 3 } } }, "id": 6, "path": "/data/samples/incoming/forager/bad/sha256/bazaar/doomsday-1.21-1.21.11.jar!!com/github/MLEEJeV6XOT$cfbqGpFzzogm.class", "pid": 0, "risk": 1, "sha": "6043121162c962086bbc927b84f31b747566e2e651023e4a42db2751dec87e6b", "size": 1543, "traits": [ { "id": "metadata/binary/code/complexity::few-functions-3", "conf": 1.0, "crit": 2, "desc": "Binary has 3+ functions" }, { "id": "metadata/binary/code/complexity::functions-at-most-24", "conf": 1.0, "crit": 2, "desc": "Binary has 24 or fewer functions" }, { "id": "metadata/binary/code/complexity::functions-at-most-32", "conf": 1.0, "crit": 2, "desc": "Binary has 32 or fewer functions" }, { "id": "micro-behaviors/os/env/gate::jvm-opaque-environment-key", "conf": 0.94, "crit": 1, "desc": "JVM class has generated gate value" } ], "type": "java_class" }, { "ctx": [ { "b": "+kO#^0000+04O6IcsZ$hfk20vxMW=qo?W#An[z3YswI)wAcld\u0026CYmbov[R8Sxk7]Z009925nCS%vj#C9zF7Q#vRPE:Bo.^F0rr)Bz/4dux([3hvLpCHmmx*WrYj5Qr0Jyb0rrS", "ln": 0 } ], "depth": 1, "facts": { "imp": [ [ "", "java/lang/System" ], [ "", "java/lang/Object" ], [ "", "com/github/MLEEJeV6XOT" ], [ "java/lang/System", "java/lang/System.currentTimeMillis" ], [ "java/lang/System", "currentTimeMillis" ], [ "com/github/MLEEJeV6XOT$puqFxpbwcKycgie", "com/github/MLEEJeV6XOT$puqFxpbwcKycgie.ip" ], [ "com/github/MLEEJeV6XOT$puqFxpbwcKycgie", "ip" ], [ "com/github/MLEEJeV6XOT$puqFxpbwcKycgie", "com/github/MLEEJeV6XOT$puqFxpbwcKycgie.expiresAt" ], [ "com/github/MLEEJeV6XOT$puqFxpbwcKycgie", "expiresAt" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ] ], "metrics": { "file": { "size": 741, "entropy": 5.53 }, "class": { "major_version": 65, "interface_count": 0, "method_ref_count": 4, "constant_pool_size": 43, "external_class_count": 3 }, "binary": { "peak_region_bytes": 741, "peak_region_entropy": 5.53 }, "imports": { "count": 7 }, "functions": { "count": 2 } } }, "id": 7, "path": "/data/samples/incoming/forager/bad/sha256/bazaar/doomsday-1.21-1.21.11.jar!!com/github/MLEEJeV6XOT$puqFxpbwcKycgie.class", "pid": 0, "risk": 1, "sha": "9384bf930a2d6fb3673d1a0598237e2fbdd27899d81bac931e56c4070d60b637", "size": 741, "traits": [ { "id": "metadata/binary/code/complexity::functions-at-most-24", "conf": 1.0, "crit": 2, "desc": "Binary has 24 or fewer functions" }, { "id": "metadata/binary/code/complexity::functions-at-most-32", "conf": 1.0, "crit": 2, "desc": "Binary has 32 or fewer functions" }, { "id": "metadata/file/magic/identity::cafebabe-magic", "conf": 1.0, "crit": 2, "desc": "CAFEBABE magic at file start", "spans": [ [ 0, 0 ] ] }, { "id": "micro-behaviors/os/env/gate::jvm-opaque-environment-key", "conf": 0.94, "crit": 1, "desc": "JVM class has generated gate value" } ], "type": "java_class" }, { "id": 8, "mol": "H(Db)", "sha": "a8ba3d0bf1f3639c4113f8519137c64c67f5d0f1861283b6aa174c3a41ac1067", "path": "/data/samples/incoming/forager/bad/sha256/bazaar/doomsday-1.21-1.21.11.jar!!mod_d.class", "risk": 1, "size": 613, "type": "java_class", "depth": 1 }, { "ctx": [ { "b": "DKQr8arR^JB7n({zdcERA=U@kzx.a:atCzR3lQDlar\u003eJgb03??b4Ljdedz}earR^JC4CYnx(v(kiV]K?f!LdjfD@4S3lQDlar\u003exmBAhUCz!T9hB0rT/aBsL8ao", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 300, "entropy": 2.84 }, "json": { "parsed_bytes": 300, "parse_limit_bytes": 76800 }, "binary": { "peak_region_bytes": 300, "peak_region_entropy": 2.84 } } }, "id": 11, "mol": "Md(Pa)", "path": "/data/samples/incoming/forager/bad/sha256/bazaar/doomsday-1.21-1.21.11.jar!!fabric.mod.json", "pid": 0, "risk": 1, "sha": "9dd756de9bb360fb2622e3c7426bc08cc6942dff2bcc037483915518e061fb1e", "size": 300, "traits": [ { "id": "metadata/package/config::fabric-mod-metadata", "conf": 0.9, "crit": 3, "desc": "Fabric mod metadata resource" } ], "type": "json" } ], "omitted_files": 1, "rev": "c1ea9", "v": "8" } }