{ "llm": { "conf": 0.99305165, "grade": "hostile", "model": "Qwen/Qwen3.8-27B", "before": { "lvl": -1, "prob": 0.9896293, "class": "benign" }, "outcome": "hostile", "interpretation": "Steals Minecraft credentials, executes code" }, "ml": { "v": "7", "eng": "2.12.0-beta.1", "lvl": 25, "conf": 92, "mods": [ { "cls": 0, "raw": 0.9896293, "rte": "az", "prob": 0.9896293 }, { "cls": 0, "raw": 0.9977545, "rte": "az/jar", "prob": 0.9977545 } ], "prob": 0.99305165, "files": [ { "id": 0, "lvl": 25, "conf": 92, "prob": 0.9930516481399536, "type": "jar" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00003317992013762705, "type": "java_class" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.000016202529877773486, "type": "java_class" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.00003059704977204092, "type": "java_class" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.0020614266395568848, "type": "java_class" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.000032822292268974707, "type": "java_class" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.00003317992013762705, "type": "java_class" }, { "id": 11, "lvl": -1, "conf": 0, "prob": 0.000016083320588222705, "type": "java_class" }, { "id": 12, "lvl": -1, "conf": 0, "prob": 0.000030040740966796875, "type": "java_class" }, { "id": 13, "lvl": -1, "conf": 0, "prob": 0.0019935767631977797, "type": "java_class" }, { "id": 14, "lvl": -1, "conf": 0, "prob": 0.000032822292268974707, "type": "java_class" }, { "id": 16, "lvl": -1, "conf": 0, "prob": 0.000012715657248918433, "type": "json" } ], "version": "v18.18", "analyzed_at": "2026-10-03T21:15:11Z" }, "path": "mod-injected.jar", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "p!H([6Awak2MSNVhEf7Q^x-t3004@:0SS#o003IEz7/KoBzb/aff%C\u0026CwF)wy*?ya+!edEtV(FlD$L{S-\u003cildKDq-\u003ea\u0026E37R7MsJ9=b=hYiYz*tF-^]mZ^a\u003cTgj#$q-hm6X#9!!DHA-InNjT?y-}WWfN8WMhCV)PpX78c*GO5eY.Pi\u0026Y.U1\u0026=n\u0026U*F9?Qd[7X-VZ14-T\u003e!]\u003eU0nPVEVuk\u003cpG]DFf\u003eK7KsBN!UQbQrw?7Ix[{*}tXNEe-L7=S#^XzCiwv0RBVs^jRJ7es$Z=uP$%c[XcJ%xu[+eE/", "ln": 0 } ], "mol": "K₂(McGa)O₆(CaEuAlAs₃ErI)H₆(Cm₅Db₅F₃Os₂Po₅Ti)Md₂(Pa)", "sha": "e4deb6dd6a9aac86361c0008cff81e92c6e03cf1d2b1b8989f5441cb243ee80f", "path": "mod-injected.jar", "risk": 300, "size": 4734567, "type": "jar", "facts": { "metrics": { "jar": { "class_count": 14, "entry_count": 20, "index_count": 0, "service_count": 0, "signature_count": 0, "native_lib_count": 0, "embedded_jar_count": 0, "manifest.entry_count": 0, "manifest.digest_count": 0, "signature_block_count": 0, "versioned_class_count": 0, "manifest.section_count": 0, "manifest.attribute_count": 13, "manifest.class_path_count": 0, "manifest.boot_class_path_count": 0 }, "file": { "size": 4734567, "entropy": 8 }, "binary": { "peak_region_bytes": 4732928, "peak_region_entropy": 7.87 }, "archive": { "file_count": 20, "member_count": 20, "script_count": 0, "zip_bomb_ratio": 3.96, "compressed_size": 4731931, "directory_count": 0, "executable_count": 0, "extra_field_size": 0, "noise_file_count": 0, "compression.ratio": 0.94, "hidden_file_count": 0, "uncompressed_size": 5055064, "crc_collision_count": 0, "entry_comment_count": 0, "max_filename_length": 38, "rtlo_filename_count": 0, "format.regular_count": 20, "nested_archive_count": 0, "path_traversal_count": 0, "symlink_escape_count": 0, "security.setgid_count": 0, "security.setuid_count": 0, "security.sticky_count": 0, "double_extension_count": 0, "duplicate_member_count": 0, "security.symlink_count": 0, "unicode_filename_count": 0, "homoglyph_filename_count": 0, "security.encrypted_count": 0, "timing.mtime_unique_count": 2, "timing.mtime_unique_ratio": 0.1, "misplaced_executable_count": 0, "timing.mtime_outlier_count": 9, "timing.mtime_dominant_count": 11, "timing.mtime_spread_seconds": 16, "timing.sentinel_mtime_count": 0, "security.world_writable_count": 0, "timing.mtime_dominant_fraction": 0.55, "compression.method_counts.stored": 1, "compression.method_counts.deflate": 19 } } }, "traits": [ { "id": "micro-behaviors/process/info/current::touri-ref", "conf": 0.82, "crit": 3, "desc": "Java toURI call reference" }, { "id": "micro-behaviors/data/archive/extract/zip::jvm-zip-entry-read-bytecode", "conf": 0.9, "crit": 3, "desc": "JVM reads ZIP archive entry data", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/info/current::protection-domain-class", "conf": 0.85, "crit": 3, "desc": "Java ProtectionDomain class reference" }, { "id": "micro-behaviors/process/thread/lifecycle::jvm-thread-start-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM starts a thread", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/communications/socket/create::java-socket-slash-reference", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "Java slash-form socket reference", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-output", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard output", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirected-stdio", "conf": 0.96, "crit": 3, "desc": "Java ProcessBuilder redirects all standard streams", "from": [ { "off": 15204, "file": 1 }, { "off": 5835, "file": 6 }, { "off": 3019, "file": 7 }, { "off": 15427, "file": 8 }, { "off": 5982, "file": 13 }, { "off": 3111, "file": 14 } ], "uses": [ 5, 22, 33 ] }, { "id": "micro-behaviors/communications/socket/framing::data-stream-transport", "atk": "T1573", "conf": 1.0, "crit": 3, "desc": "Java data-stream transport type", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/fs/read/file/handle::jvm-nio-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM NIO file API reference" }, { "id": "micro-behaviors/process/info/current::getlocation-ref", "conf": 0.82, "crit": 3, "desc": "Java getLocation call reference" }, { "id": "micro-behaviors/os/env/gate::jvm-system-getenv-import", "conf": 0.94, "crit": 1, "desc": "JVM class imports System getenv", "from": [ { "file": 1 } ] }, { "id": "well-known/game/mod::minecraft-client-class-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft client singleton class reference", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-x509trustmanager-class-ref", "conf": 0.94, "crit": 3, "desc": "JVM X509 trust-manager interface reference" }, { "id": "micro-behaviors/os/env/gate::jvm-opaque-environment-key", "conf": 0.94, "crit": 1, "desc": "JVM class has generated gate value" }, { "id": "micro-behaviors/data/decode/base64::java-base64-decoding-bytecode", "conf": 0.94, "crit": 3, "desc": "Java bytecode Base64 decoding", "from": [ { "off": 19201, "file": 1 }, { "off": 19439, "file": 8 } ], "uses": [ 32, 73 ] }, { "id": "micro-behaviors/os/env/gate::jvm-string-equals-import", "conf": 0.94, "crit": 1, "desc": "JVM class imports String equals", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/info/current::codesource-class", "conf": 0.85, "crit": 3, "desc": "Java CodeSource class reference" }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/create::jvm-socket-class-ref", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "JVM socket class reference" }, { "id": "micro-behaviors/data/archive/extract/zip::jvm-zip-entry-iteration-bytecode", "conf": 0.92, "crit": 3, "desc": "JVM iterates ZIP archive entries", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/write/file/full::jvm-files-writestring-bytecode", "conf": 0.9, "crit": 3, "desc": "JVM bytecode Files.writeString", "from": [ { "file": 6 } ] }, { "id": "well-known/game/mod::minecraft-name-getter-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft profile name getter reference", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-input", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard input", "from": [ { "file": 1 } ] }, { "id": "objectives/credential-access/gaming/minecraft::minecraft-token-child-process-stage", "atk": "T1528, T1059", "mbc": "B0006", "conf": 0.99, "crit": 5, "desc": "Minecraft token access alongside redirected child launch", "from": [ { "off": 692, "file": 1 }, { "off": 10449, "file": 5 }, { "off": 1993, "file": 6 }, { "off": 4104, "file": 7 }, { "off": 671, "file": 8 }, { "off": 10178, "file": 12 }, { "off": 1938, "file": 13 }, { "off": 4168, "file": 14 } ], "uses": [ 6, 46, 61, 75 ] }, { "id": "micro-behaviors/communications/http/lib/urlconnection::jvm-url-class-ref", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "JVM URL class reference" }, { "id": "micro-behaviors/communications/socket/ssl::jvm-custom-x509trustmanager", "conf": 0.95, "crit": 3, "desc": "Class implements a custom X509 trust manager", "from": [ { "file": 4 }, { "file": 11 } ], "uses": [ 12, 54, 65 ] }, { "id": "micro-behaviors/process/info/selfpath::java-protection-domain", "conf": 0.82, "crit": 3, "desc": "Java getProtectionDomain self-path lookup" }, { "id": "micro-behaviors/data/decode/base64::java-base64-decoder-class", "conf": 0.92, "crit": 3, "desc": "JVM Base64 decoder class reference", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/buffer/transfer::bytearrayinputstream-ref", "conf": 0.88, "crit": 3, "desc": "Java ByteArrayInputStream class" }, { "id": "well-known/game/mod::minecraft-uuid-getter-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft profile UUID getter reference", "from": [ { "file": 6 } ] }, { "id": "objectives/anti-static/obfuscation/string/control-prefix::java-character-digit-bytecode", "atk": "T1027", "mbc": "F0001", "conf": 0.9, "crit": 3, "desc": "Java bytecode calls Character.digit", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/sysinfo/hostname::jvm-hostname-command-literal", "atk": "T1082", "mbc": "E1082", "conf": 0.9, "crit": 3, "desc": "JVM hostname command literal" }, { "id": "micro-behaviors/data/decode/base64::java-base64-decoder-bytecode-call", "conf": 0.94, "crit": 3, "desc": "Java Base64 decoder accessor call", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-errors", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder merges standard error", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/proxy/tunnel::byte-output-stream", "atk": "T1090", "mbc": "C0003", "conf": 0.5, "crit": 3, "desc": "Java ByteArrayOutputStream usage", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.95, "crit": 3, "desc": "Java bytecode ProcessBuilder start", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/framing::bytebuffer-transport", "atk": "T1573", "conf": 1.0, "crit": 3, "desc": "Java byte-buffer transport type", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/process/info/current::getpath-ref", "conf": 0.8, "crit": 3, "desc": "Java getPath call reference" }, { "id": "micro-behaviors/data/buffer/transfer::bytearrayoutputstream-ref", "conf": 0.88, "crit": 3, "desc": "Java ByteArrayOutputStream class", "from": [ { "file": 1 } ] }, { "id": "objectives/impact/dos/disk::jvm-megabyte-byte-array-constant", "atk": "T1499.001", "conf": 0.94, "crit": 3, "desc": "JVM one-megabyte allocation constant", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/time/sleep/interval::java-thread-sleep-bytecode", "conf": 0.9, "crit": 3, "desc": "Java bytecode thread sleep", "from": [ { "file": 1 } ] }, { "id": "objectives/anti-static/obfuscation/string/crypto::java-byte-range-copy", "atk": "T1027", "mbc": "F0001", "conf": 0.7, "crit": 3, "desc": "Java byte range copy", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-init-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.92, "crit": 3, "desc": "Java bytecode ProcessBuilder constructor", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/create::java-socket-class-import", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "Java imports the network socket class", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-sslcontext-trustmanager-init-call", "conf": 0.94, "crit": 3, "desc": "JVM SSLContext.init trust-manager call", "from": [ { "file": 5 } ] }, { "id": "objectives/anti-static/obfuscation/string/control-prefix::java-control-prefixed-long-string", "atk": "T1027", "mbc": "F0001", "conf": 0.92, "crit": 3, "desc": "Java string starts with control-length prefix" }, { "id": "objectives/credential-access/gaming/minecraft::minecraft-session-token-access", "atk": "T1528", "mbc": "B0006", "conf": 0.96, "crit": 4, "desc": "Minecraft session token and UUID access", "from": [ { "off": 2130, "file": 6 }, { "off": 2075, "file": 13 } ], "uses": [ 29, 48, 66 ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.88, "crit": 3, "desc": "Java bytecode ProcessBuilder reference", "from": [ { "file": 1 } ] }, { "id": "objectives/credential-access/gaming/minecraft::minecraft-token-getter-ref", "atk": "T1528", "mbc": "B0006", "conf": 0.92, "crit": 3, "desc": "Minecraft access token getter", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/communications/proxy/tunnel::inet-socket-address", "atk": "T1090", "mbc": "C0003", "conf": 0.6, "crit": 3, "desc": "Java InetSocketAddress reference", "from": [ { "file": 5 } ] }, { "id": "well-known/malware/stealer/prefire-shard::prefire-family-literal", "atk": "T1528", "mbc": "B0006", "conf": 0.9, "crit": 1, "desc": "Prefire family name literal", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-trustmanager-class-ref", "conf": 0.9, "crit": 3, "desc": "JVM TrustManager interface reference", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/data/archive/extract/zip::jvm-zip-entry-extraction-to-file", "conf": 0.96, "crit": 3, "desc": "JVM extracts ZIP entries to files", "from": [ { "off": 12801, "file": 1 }, { "off": 12905, "file": 8 } ], "uses": [ 1, 19, 71 ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-sslparameters-set-server-names", "conf": 0.93, "crit": 3, "desc": "JVM sets TLS SNI server name", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-x509trustmanager-issuer-callback", "conf": 0.94, "crit": 3, "desc": "JVM getAcceptedIssuers callback defined" }, { "id": "micro-behaviors/communications/socket/create::java-socket-bytecode-reference", "atk": "T1071", "mbc": "C0001", "conf": 0.86, "crit": 3, "desc": "Java bytecode socket reference", "from": [ { "file": 5 } ] }, { "id": "well-known/game/mod::minecraft-session-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft session object reference", "from": [ { "file": 6 } ] }, { "id": "objectives/impact/dos/disk::jvm-two-backward-goto-branches", "atk": "T1499.001", "conf": 0.9, "crit": 3, "desc": "JVM repeated counter backedges", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/read/file/handle::jvm-io-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM File API class reference" }, { "id": "micro-behaviors/os/env/gate::jvm-opaque-secret-environment-gate", "conf": 0.97, "crit": 3, "desc": "JVM compares opaque environment gate", "from": [ { "file": 1 } ], "uses": [ 10, 13, 15 ] }, { "id": "micro-behaviors/data/buffer/transfer::jvm-outputstream-write", "conf": 0.96, "crit": 2, "desc": "JVM writes bytes to output stream", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.94, "crit": 3, "desc": "Java bytecode ProcessBuilder execution", "from": [ { "off": 15268, "file": 1 }, { "off": 853, "file": 6 }, { "off": 3150, "file": 7 }, { "off": 15491, "file": 8 }, { "off": 871, "file": 13 }, { "off": 3242, "file": 14 } ], "uses": [ 35, 42 ] }, { "id": "metadata/package/config::fabric-mod-metadata", "conf": 0.9, "crit": 3, "desc": "Fabric mod metadata resource", "from": [ { "file": 16 } ] }, { "id": "micro-behaviors/communications/socket/send::java-raw-socket-client-write", "atk": "T1071", "mbc": "C0001", "conf": 0.94, "crit": 3, "desc": "Java socket client writes request bytes through DataOutputStream", "from": [ { "off": 3262, "file": 5 }, { "off": 3285, "file": 12 } ], "uses": [ 43, 60, 69 ] }, { "id": "objectives/anti-analysis/timing/evasion::kotlin-thread-sleep-check", "atk": "T1497.003", "conf": 0.94, "crit": 3, "desc": "Kotlin Thread.sleep call", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-x509trustmanager-server-callback", "conf": 0.94, "crit": 3, "desc": "JVM checkServerTrusted callback defined" }, { "id": "well-known/game/mod::minecraft-session-access", "conf": 0.91, "crit": 3, "desc": "Minecraft session profile access", "from": [ { "file": 6 }, { "file": 13 } ], "uses": [ 11, 21, 56 ] }, { "id": "micro-behaviors/process/create/spawn::child-process-creation-api", "atk": "T1106", "conf": 0.92, "crit": 3, "desc": "Starts a child process through a platform API", "from": [ { "off": 692, "file": 1 }, { "file": 6 }, { "off": 297, "file": 7 }, { "off": 671, "file": 8 }, { "file": 13 }, { "off": 293, "file": 14 } ], "uses": [ 61 ] }, { "id": "objectives/anti-static/obfuscation/reflection/class::java-protectiondomain", "conf": 1.0, "crit": 3, "desc": "Java ProtectionDomain", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/communications/socket/send::java-dataoutputstream-class", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "Java DataOutputStream class reference", "from": [ { "file": 5 } ] }, { "id": "objectives/evasion/self-delete/file/script::java-code-source-location", "atk": "T1070.004", "mbc": "F0007", "conf": 0.78, "crit": 3, "desc": "Java code source location", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/fs/write/file/handle::jvm-fileoutputstream-bytecode", "conf": 0.86, "crit": 3, "desc": "JVM imports FileOutputStream class", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-sslsocket-handshake-call", "conf": 0.94, "crit": 3, "desc": "JVM SSLSocket.startHandshake call", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/data/decode/base64::java-base64-decode-bytecode-call", "conf": 0.96, "crit": 3, "desc": "Java Base64 decode call", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/spawn::java-runtime-class", "atk": "T1059", "mbc": "E1203", "conf": 0.86, "crit": 3, "desc": "Java Runtime class reference", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/data/encode/base64::jvm-base64-encode-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM Base64 encodeToString call", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/http/lib/urlconnection::java-url-class-bytecode", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Java URL class reference", "from": [ { "file": 5 } ] }, { "id": "metadata/file/archive::archive-at-least-10-members", "conf": 0.9, "crit": 3, "desc": "Archive contains at least ten members" }, { "id": "metadata/package/entrypoint::jar-main-class", "conf": 0.95, "crit": 2, "desc": "JAR manifest declares an executable Main-Class" }, { "id": "metadata/file/naming::archive-member-under-10kb", "conf": 0.9, "crit": 3, "desc": "Archive has a sub-10KB member" }, { "id": "metadata/package/config::fabric-runnable-mod-archive", "conf": 0.9, "crit": 3, "desc": "Fabric mod JAR is directly runnable", "from": [ { "file": 16 } ], "uses": [ 62, 78 ], "spans": [ [ 0, 15 ] ] }, { "id": "objectives/exfiltration/stealer/credential/token::minecraft-token-http-body-exfil", "atk": "T1041", "mbc": "E1041", "conf": 0.98, "crit": 4, "desc": "Minecraft token access paired with raw socket request write", "from": [ { "off": 6302, "file": 5 }, { "off": 1993, "file": 6 }, { "off": 6227, "file": 12 }, { "off": 1938, "file": 13 } ], "uses": [ 46, 63 ], "spans": [ [ 0, 41 ] ] }, { "id": "well-known/malware/stealer/prefire-shard::prefire-packed-runtime-stealer", "atk": "T1528", "mbc": "B0006", "conf": 0.99, "crit": 5, "desc": "Prefire packed runtime Minecraft stealer", "from": [ { "off": 20649, "file": 1 }, { "file": 5 }, { "off": 1993, "file": 6 }, { "file": 7 }, { "off": 20965, "file": 8 }, { "file": 12 }, { "off": 1938, "file": 13 }, { "file": 14 } ], "uses": [ 1, 19, 30, 45, 46, 50, 71 ] } ] }, { "ctx": [ { "b": "+kO#^0000+1GRR75mYS}fk20vxMW=ql2yvXyZf}v0rrWCvrM6jy*?i]fhD4(wN//!00rl49+fb9fk20vxMW=qx(!ienPXMZvSDMoC5x#.w{EF-00Jx67gRo1fk20vxMW=qx(!ienPXMZvSDL}00-J82x\u003c#UvRf)/0rsoTvrM6jy*?i]fhMXcv}x.5luN0UwmY^bqE%xMA+e:52lk8i02PDVC404uvqYZhp\u0026ZF:wPI]VB.LV5wPw1Q3\u0026{tlqE%xMA+e:50rr%KvrM6jB-.tlfg68*wI#v\u003cl$G\u003eDwmY=^01P8g5nCS%vj#+Bx(2B?vrl0rgZs0)0rru)wN/T?wPv!Kc2c\u003eivj#C9zF7RpzGY@lwIl+?BzbP6nmuyDy?mVkoMa\u0026+B-mM=6AFgPygho]fkL6mxd)$pC5Iecfhl21xM4ALvqYQ(wPF7R76aytoMa\u0026+B-muY320x", "ln": 0 }, { "b": "w[+.00rr*cygho]fk+Gxfj[{mwIl\u003e*Bz9-p00u.fy5[qLoLO0Vvj#C9zF7R3BAh8kxf{-Py?d9$i@]r=jzwXEBuPZ911kQ03\u0026?)Wfa4WZ05aAN5nCS%vj#C9zF7R3BAh8kx9Oz(0rr{JvrM6jy*?i]fh($kx(mMIB.LV5wPw1QgZTju05aANb)AUmW=@\u003cS)WfWhGn5PKSo*NR(5?!fNW02?WD-)z)5EqOKE(^UhVS).v}Yp\u003el39bc1sM?\u003clKS@P06gC!gxoGq00WmJzFa680rri", "ln": 628 }, { "b": "e=XfA05T:y2lkUy00V\u003eJAaJ]$0rs8/lN+YzvrM6jy*?i]fh($kx(mMIB.LV5wPx\u003cv07u(S3ih{-m/-O}Bz\u003e91A+PA70rr/ZdnjF+C404uvqYZhq/)4]zF83t07^e.3ih{-o922Ac}[w:C404uvqYZhq/)4]zF83WoLO0Vvj#C9zF7R3BAh8kxf{-Py?d9$i$89T08i!2h2{wL06*XFRh%\u0026sHVK]9(:hl7Rj^4KX8\u003c3f(:r\u003eQQ{/G^PYIO[", "ln": 873 }, { "b": "m{/.wk$p}Q4p%\u003cbxMdMTAB@@^xla7N1Bj/{zuf.xAb]J4x(W+=07[Ukygho]fkL6mxd)h9A+PA7j4%x$C404uvqYZhq/)4]zF848ygho]fkL6mxd)h9A+PA7j1i\u003crvrM5", "ln": 4078 }, { "b": "S]xLf\u003ec7isIJm1QM*p=R)tlUVZPu\u003cWVf!oq\u0026jk\u0026DOSq\u003cnMfTu?(XgbWTIj7TJn}TO)UN}gQkPuUdGGINxjVf@zGVA?eca-r0ak*V0rt7yLB}6rZ3z]i\u0026Ku8PTFL3oRSK8F\u003c/M2SSGDCdLiw\u003ce(-(YkWU9+BISG+Y\u003e8#p%TDz!DR3Nzdf985k4c14?\u003caq%AK/WJIRrB2z(6):}U+Z-ZT()j8\u0026jT=^IS/}L\u0026?AjdGrsf}G5Kg\u0026\u003e-HCXNZ-", "ln": 5526 }, { "b": "\u003c^R1/Xrb)iUi}^A\u003eC\u003cy6GS0).YZg]?\u003eENL%0YyhZ0000000*\u003cK01-)NC404uvqYZhra{q-vpPPAiSPi:B8kA0z#/}wc}U{?3\u003c5J)jQIlL0ZlR+32Br)x(({*wO?CF3uo6mn\u003cUHmDq#\u003c700U+HC4C330rrvxwQ5q{wO7@y1Bi)Rw=R(vv}]}6uUa4@uUr}YA@=mDuS6{ip\u0026f@C0rr^FvrM6jx(tT@pEPIrwPh:9z/b^Ym/-O{Dtds^vrt]U0269QC404uvqYZhra(", "ln": 12092 }, { "b": "wNPAX0-n%#1T)Owdol\u0026Se=[@U0-x800rr@+oLO0Vvj#tkfg*52B-ZM7A+eV@j1jhs04[sN3iB39r@\u0026pfxjVfWwQ5q=zGG]A0rs2^dnjF+C404DBzkLADtdsKt4}}AzGG]Ai$8f[0:k{jpY:\u0026402xrTC404DBzkLADtdsKt4}}AzGG]A2lFfi00^dFBwumYwEFSE07)O1uijHn01iHZl${WMv@#TfC)\u003c:-0o::\u003euijQq010pHBwMy^wO#O\u003c02u$ioLO0Vvj#Ijz.CZpy?km@vrufA3\u003c6#ww^XR$0+RJl9bn]9vj#tkfg6![w[u0]wkvt\u0026Acln3BAg@3z3HbR0rr%KvrM6jx(tT]x(4uRB-.OBBw)p4wNPAX0=4/p26s=Mx(4tY01ZLcoLO0Vvj#tkfgGU(wJHq4z31O.0x70$0rrYWoLO0Vvj#tkfgGU(wJItw3\u0026?)YAs8+-0=!qw8yOo]vrM6jx(tU2B-.OBBw)p4wNPBqnHWWG04[s{3iB@zBPzEBA+eV\u00263\u003c7ROdgcbM0^B.C1:t03By+EM2pJ!ynL7vi3\u003c7.RDKo*?0^\u003e1G1.hv!B7C:YEGh2d0+}^^0rrNqwmORYAbY\u0026eB8$]60rr@+oLO0Vvj#C9zF7R4xMw3nvpB4:j1jhs0!yA83iA\u003c4G99h78^\u0026^r-S^){wK8\u003e71][S5%k^gK\u003cPLR:00000073\u003e?%nSb/)n#gC019jLz/YFUzGG]A3\u003c8B?fa4", "ln": 12393 }, { "b": "g64v-BZ/umwLuY4v@3190rro?k$sB?0rrvzzF8vCBytnyokY7S01-)NC404DBzkLAl2}0OD2\u003ch(PAb32v@DsipI9HkzF9IY00\u003c#Slp\u003c-$ts5-1Q5}7%0?/W\u003e0rrpwxNakR3\u003c9pc5deys0\u0026D503SxGqvOQ\u0026QA9\u003e[70rr^alp2c?s3YFJuVxgKx\u003cUNJl39bc4rbVSs42?ZuU8#TuVl2C5PA2duV*a8w)Y7)vp\u003caUy\u003cb)W4Ptx6sxfArBv5?-uVGr", "ln": 13178 }, { "b": "YR2HO5m@0B02xrTC404DBzkLADtdsKnP5cRvru732lIWF0(j\u003c\u003c0rryDwPQHYAclmh0(C7r3iF3B.#P\u0026Uygho]fkktTlv0V:l2}0OC#5N8Acln3BAg@3z3HcZ3iFlFlid5(w[=c%B7/b}3\u003caJJ\u003eN4yc0)gJz2wF6/y*?A%3\u003caSOdgcc)0)H-C3t%A^wogsWAclmh0)Z(g3iF3B=\u003cx\u0026{0^\u003e1G17=vX3\u003ca(Tfa4=%0[mkJ3V{qND30Q-A=LPl0rrlJdo/aE0[EC83iFlH/z$%=mp!\u003eOuRKZvlTJkUoL4NHx\u0026G3L01rvUze9PQvp%7oxk)}L7!!WMC404DBzkLADtdsKnP5cRvru73i@]r=xGol.oM6}ia53ATC404rz.BC5By^:UA::k?B-.OBBw)p4wNPBq0rr)SBz2-uuUK1?D0+o8z/P-5x)sAqw=R(oADaD\u003czdS!G24zZ!q/#{T019HYDu\u003cNsC5}wj18TKAToiw$97*thq)6)p07vv=U8zs#Pyntq)WZ\u0026NU+giiKM0\u003c6\u003c^\u002618JI#3GQU8d5PnIN3Jpi%Z\u003cbf-5OtkIxPx@/", "ln": 13509 }, { "b": "2(\u003e2d@S90O4EQE3)5l/7V*T@(\u003cHyckGpq5cUizaU\u003e:^m?H]66%ZW3][(B0XXV4.LzLGPP!S!}5:00967wPq\u003c3y\u0026Z0!0S@9605BYV0rs8x\u0026I.Q@W6]mJO8*t}\u0026I-NnW43uhUJhBJ\u0026I\u0026%=0%G8kaPJF*00ilc0rsIO(:9RRI[XFDPZ5k5\u0026IJWzPoef6V*LDr\u0026HDRcWv3lsV*acv(y$A!0%[#df6Y)z\u003e.+C*WsW\u003eDMeX:E(Yw\u003cAG}^\u003ewS{f", "ln": 14374 }, { "b": "c}[w:C404rz.BN]y?kWSoLO0Vvj#C9zF7R0A=kD0B8%V\u003cx(4r\u003eAWjK]wnc6}v@%^v10N*(3igCobMN(OA+e=}A+e:5nP5G\u0026Bo8wac}[w:C404uvqYZhp\u0026ZF:wPI]VB.LV5wPx4]wN]H}wN/*zdnjF+C404uvqYZhp\u0026ZF:wPI]VB.LV5wPx\u003cv1119$3igIqc\u0026\u003cr11Nr4T\u003cDLqUH}H%7(z/G$M9xwbH%rJ@S\u003eEFUUJpRe=8{oiVGdpO\u003c+YhCXcJf^0rrylAbYxawk)EQ11TK03igCoeDC?YA+e=}A+e:5pJZ+#B-X2]f9rNe01x2:0rr^NwN]H}wN/*JA=M8sq/)4\u003evqM2B9vL8uoLO0Vvj#C9zF7R0A=kD0B8%V\u003cx(4r\u003eAYTWig6ort01x2!0rrpAByxii0rr\u0026.dnjF+C404uvqYZhp\u0026ZF:wPI]O3\u003cex\u0026hWPJ]12{qY5O+-$vj#C9zF7R0A=kD0B8}M*iSPi.Aa@?-00sR#n^\u003e!:13D$[i%dUE0a35@TfQ@uGY^)2(wI1}NZI7GO9d5N+8bO}R%paA)YSwFT+C$\u003cXAwEt(wSmtOt1(qFAKna+bK\u003ctN^c/9)Y?AcT/pJoVh", "ln": 14949 }, { "b": "00WaZDp8*[0rrNrvrl0rg^=h0By/Ys0@#:!}Vu?qtv[3s0000F2v3o[000000000R1POJ505e#X?#J/+xjVfMwN/T?wPv!K94imfygho]flIwJy+Fa-B7El^bT=iNz!9B1i$8k-1n9035^d?d00V$Bv@C)?0rr(-oLO0Vvj#C9zF7R3BAh8kxfdLDljr$\u003e1nJo75cI+f03M8=C404wx(tUmxKL}5wPPO7Byx5$vrb)CxKL}5wPR$#1n\u0026f11YXI\u003euPn5^8CB)OC404wx(tUmxKL}5wPPN)xKL}5wPQ0x1o5A52)pbe0096wc%G2iygho]fk+GxfjOW7A=U/lfgfzYA=U/li@", "ln": 19083 }, { "b": "x(9\u003eJ3tB0YAC/CVwOl2:00u[CCMVj.jbs0E:5o2w{m:gc0rr^FvrM6jy*?i]fgfzYA:-E1wPw1Uwb#VlwnbW\u003cBo8vBc{{MPnEL-l1zn5AwDVVE01r:.C4tnUB5MQ^xlsjP1.}WSxLmzD4R*i0uV{HkDsyI]B7n[+010Hti7N4fw\u003e\u003e[#01ivOvq{p0wncc%z2\u003cRsyH}+[zk5IV1ea3F9S]?[ssBmJ5cR6-Is3TY\u0026Kjv0Pn?{3S%w\u0026H0rsqH(4=z9T!UozO:7-](-D9bG8", "ln": 20585 }, { "b": "1gwg(j$KbxkM\u003eQrwhTO505W)]1H!v#iT2Qz1@dsS1FL(x83IL]9BGP^v734$ecDW(9Dkz{06B!PWG5\u003c1GA.EP%jOs]WG61f08DVD5(yW@83{zN06AdD840.KkM\u003eQj3s(45Y8TY\u003e6:}FJlPLRThvQxg6:{-odh-Ki2)p$Iu\u003e\u003cbUWG5Ac2)p$L6:![/WG5BwLc$uYsa?1-R#Lr=47ldfWG698e4bBKq=%mn05W]*05=\u003eH84WAVWG6w\u00265G8g{1y@wZuO\u003cUN84\u003cN$5[zbQhwl/sYAHtg12Z(e6+}yR03Ac[6+}O#6+@Ly5FU@]6+}v2u]iE#rFh7/R#LU^05E:}6T[6EWG69884WA!WG6w\u00267-sd)g=ui?7}{b-6=yKu8wKg61V^O8hxrIM6=J!DbPdKo9t]W%6=yx]9BHYw7Z7M]6=y%#g\u003eH(\u003cGDg8\u003e%jXnbYAHto85\u0026U}90l]]XbZ6K05E:}9jC]MWG69884WA)WG6w\u00269#Md5g=uD]aheEjwcuB3aR=fk1V^?fhx@}Y6^opKbPd^vbn?NraoV6!bvAtC9%rr66^dE6g\u003eH(\u003cGD*I}%j+c=gG+OtW/xWw08DVl5e5Uqck!cjWG5AFcMant06*V$6^)JId7YEpsRSu]07e^@12.RzdITwa04w^m872F3cTWVsv734$872F3dITsIv734$wrKw3nlpD]0Jk$G87z#]oTT{%r#zNT08cr]1RLNU09qik87+}Ehzb\u003e0Z7\u0026nh1y%zz6!^i6iXQT]f+(zTfqnB(888^W87=NQ1yI%0u]e-M1qJTae]UhPF%6b!f-!iL*Q^CwsS5{509\u0026D92d\u003c\u003c)s*[w?iY4Zh5]s#Rs2@hRhnfi788U+Thz#BgZ7\u0026Lp1y%zH6/S=eiYEj1itBK?h\u003e*o{88@u\u003e88Sc?g-nd=hX!s/hGi4XF%6b!iru5T?[5\u003eAsS6id09(@jpGFz\u003c5]LbTs2@CYjoEz#jScw@1y@lgwhVQ^kd?4Wknuu+whVW/k:}:089X\u003c389w3pjZY0\u0026u]e--1qKfpj-B^=F%6b!k(W+Z?mAUysS6Dk09(@jpGFz\u003c5]+nVs2@X^l+SXl8ad:/hBFAIZ7\u003c4D1y%y", "ln": 21720 }, { "b": "Ne^WDWG5M80d{{B1P+?T1?1IFo!l\u0026v5DEu\u002617$vX5d(tOr5K\u003c]1EPk$6:b9@5tPpf0Ka9!0dUTYFe5g\u003cxKFmJxf3hC83NCKs2{L$05E:}2c[vjW/=\u0026ro-.D#0SXO/Z5", "ln": 129731 }, { "b": "1Um1YkS{7\u003cy}H3G12Zn%1rscod\u003eIFs1-bX71HXp)5d(tOx:n(k6:aUEWG5A35v.\u003cSv3aAw1oLI3!H!0900066RVlX%cJBnG02$$y2lj/g05BPP00961@@rGd1{Ubf2l", "ln": 130177 } ], "depth": 1, "facts": { "imp": [ [ "", "java/util/zip/ZipEntry" ], [ "", "java/lang/Throwable" ], [ "", "java/io/ByteArrayInputStream" ], [ "", "java/io/FileOutputStream" ], [ "", "java/io/File" ], [ "", "java/nio/file/Files" ], [ "", "com/github/isolItfnbrt" ], [ "", "java/lang/Class" ], [ "", "java/lang/Process" ], [ "", "java/lang/Thread" ], [ "", "java/io/IOException" ], [ "", "java/lang/Character" ], [ "", "[B" ], [ "", "java/nio/file/attribute/FileAttribute" ], [ "", "java/lang/invoke/MethodHandles$Lookup" ], [ "", "java/util/Base64$Decoder" ], [ "", "java/lang/invoke/MethodHandles" ], [ "", "java/lang/String" ], [ "", "java/util/zip/Inflater" ], [ "", "java/util/List" ], [ "", "java/lang/Integer" ], [ "", "java/util/Map" ], [ "", "java/lang/Exception" ], [ "", "java/util/ArrayList" ], [ "", "java/nio/charset/StandardCharsets" ], [ "", "com/github/isolItfnbrt$vnLbfyX" ], [ "", "[Ljava/lang/String;" ], [ "", "java/nio/file/Path" ], [ "", "java/nio/file/LinkOption" ], [ "", "java/lang/StringBuilder" ], [ "", "java/lang/System" ], [ "", "java/io/ByteArrayOutputStream" ], [ "", "java/io/PrintStream" ], [ "", "java/util/Arrays" ], [ "", "java/lang/ProcessBuilder$Redirect" ], [ "", "[C" ], [ "", "java/util/Base64" ], [ "", "java/io/BufferedOutputStream" ], [ "", "java/lang/InterruptedException" ], [ "", "java/util/zip/ZipInputStream" ], [ "", "java/lang/ProcessBuilder" ], [ "", "java/lang/Object" ], [ "java/lang/Thread", "java/lang/Thread.sleep" ], [ "java/lang/Thread", "sleep" ], [ "java/lang/System", "java/lang/System.currentTimeMillis" ], [ "java/lang/System", "currentTimeMillis" ], [ "com/github/isolItfnbrt$vnLbfyX", "com/github/isolItfnbrt$vnLbfyX.statusCode" ], [ "com/github/isolItfnbrt$vnLbfyX", "statusCode" ], [ "java/util/zip/ZipInputStream", "java/util/zip/ZipInputStream.close" ], [ "java/util/zip/ZipInputStream", "close" ], [ "java/util/ArrayList", "java/util/ArrayList.\u003cinit\u003e" ], [ "java/util/ArrayList", "\u003cinit\u003e" ], [ "java/nio/charset/StandardCharsets", "java/nio/charset/StandardCharsets.UTF_8" ], [ "java/nio/charset/StandardCharsets", "UTF_8" ], [ "java/nio/file/Path", "java/nio/file/Path.getParent" ], [ "java/nio/file/Path", "getParent" ], [ "com/github/Amjwl", "com/github/Amjwl.byNbeaolqc" ], [ "com/github/Amjwl", "byNbeaolqc" ], [ "java/lang/System", "java/lang/System.arraycopy" ], [ "java/lang/System", "arraycopy" ], [ "java/io/PrintStream", "java/io/PrintStream.println" ], [ "java/io/PrintStream", "println" ], [ "com/github/Amjwl", "com/github/Amjwl.llyfMpjicPmgtmWv" ], [ "com/github/Amjwl", "llyfMpjicPmgtmWv" ], [ "com/github/Amjwl", "com/github/Amjwl.avTumFIP" ], [ "com/github/Amjwl", "avTumFIP" ], [ "java/util/zip/Inflater", "java/util/zip/Inflater.inflate" ], [ "java/util/zip/Inflater", "inflate" ], [ "com/github/Amjwl", "com/github/Amjwl.fDlfxbz" ], [ "com/github/Amjwl", "fDlfxbz" ], [ "java/util/zip/Inflater", "java/util/zip/Inflater.needsInput" ], [ "java/util/zip/Inflater", "needsInput" ], [ "java/lang/String", "java/lang/String.isEmpty" ], [ "java/lang/String", "isEmpty" ], [ "java/nio/file/Path", "java/nio/file/Path.of" ], [ "java/nio/file/Path", "of" ], [ "com/github/Amjwl", "com/github/Amjwl.cSj" ], [ "com/github/Amjwl", "cSj" ], [ "java/util/zip/ZipInputStream", "java/util/zip/ZipInputStream.\u003cinit\u003e" ], [ "java/util/zip/ZipInputStream", "\u003cinit\u003e" ], [ "java/io/BufferedOutputStream", "java/io/BufferedOutputStream.write" ], [ "java/io/BufferedOutputStream", "write" ], [ "java/lang/Integer", "java/lang/Integer.parseInt" ], [ "java/lang/Integer", "parseInt" ], [ "com/github/Amjwl", "com/github/Amjwl.qu_wl" ], [ "com/github/Amjwl", "qu_wl" ], [ "java/util/Map", "java/util/Map.of" ], [ "java/util/Map", "of" ], [ "com/github/Amjwl", "com/github/Amjwl.zaIaxfvytWwohWjofibx" ], [ "com/github/Amjwl", "zaIaxfvytWwohWjofibx" ], [ "java/util/zip/ZipInputStream", "java/util/zip/ZipInputStream.closeEntry" ], [ "java/util/zip/ZipInputStream", "closeEntry" ], [ "java/util/zip/Inflater", "java/util/zip/Inflater.\u003cinit\u003e" ], [ "java/util/zip/Inflater", "\u003cinit\u003e" ], [ "java/lang/Class", "java/lang/Class.getSimpleName" ], [ "java/lang/Class", "getSimpleName" ], [ "java/util/Base64$Decoder", "java/util/Base64$Decoder.decode" ], [ "java/util/Base64$Decoder", "decode" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ], [ "com/github/Amjwl", "com/github/Amjwl.runDetached" ], [ "com/github/Amjwl", "runDetached" ], [ "com/github/Amjwl", "com/github/Amjwl.Ysz5P5bandfk" ], [ "com/github/Amjwl", "Ysz5P5bandfk" ], [ "java/lang/Character", "java/lang/Character.digit" ], [ "java/lang/Character", "digit" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.start" ], [ "java/lang/ProcessBuilder", "start" ], [ "java/nio/file/Files", "java/nio/file/Files.readString" ], [ "java/nio/file/Files", "readString" ], [ "com/github/Amjwl", "com/github/Amjwl.xctDHQ_2blaP" ], [ "com/github/Amjwl", "xctDHQ_2blaP" ], [ "com/github/Amjwl", "com/github/Amjwl.tuljiXwEpsflw" ], [ "com/github/Amjwl", "tuljiXwEpsflw" ], [ "java/lang/ProcessBuilder$Redirect", "java/lang/ProcessBuilder$Redirect.appendTo" ], [ "java/lang/ProcessBuilder$Redirect", "appendTo" ], [ "java/util/zip/ZipInputStream", "java/util/zip/ZipInputStream.getNextEntry" ], [ "java/util/zip/ZipInputStream", "getNextEntry" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "java/util/Arrays", "java/util/Arrays.copyOfRange" ], [ "java/util/Arrays", "copyOfRange" ], [ "java/lang/Throwable", "java/lang/Throwable.addSuppressed" ], [ "java/lang/Throwable", "addSuppressed" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.\u003cinit\u003e" ], [ "java/io/ByteArrayOutputStream", "\u003cinit\u003e" ], [ "com/github/Amjwl", "com/github/Amjwl.wwwkhwxsCache" ], [ "com/github/Amjwl", "wwwkhwxsCache" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "com/github/isolItfnbrt", "com/github/isolItfnbrt.get" ], [ "com/github/isolItfnbrt", "get" ], [ "java/io/File", "java/io/File.\u003cinit\u003e" ], [ "java/io/File", "\u003cinit\u003e" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/lang/String", "java/lang/String.indexOf" ], [ "java/lang/String", "indexOf" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "com/github/Amjwl", "com/github/Amjwl.hWGG_LvME" ], [ "com/github/Amjwl", "hWGG_LvME" ], [ "java/util/List", "java/util/List.add" ], [ "java/util/List", "add" ], [ "java/io/FileOutputStream", "java/io/FileOutputStream.\u003cinit\u003e" ], [ "java/io/FileOutputStream", "\u003cinit\u003e" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "com/github/Amjwl", "com/github/Amjwl.ohygA" ], [ "com/github/Amjwl", "ohygA" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.toByteArray" ], [ "java/io/ByteArrayOutputStream", "toByteArray" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.directory" ], [ "java/lang/ProcessBuilder", "directory" ], [ "com/github/Amjwl", "com/github/Amjwl.pqehmnIdmrpDsgpcb" ], [ "com/github/Amjwl", "pqehmnIdmrpDsgpcb" ], [ "java/io/ByteArrayInputStream", "java/io/ByteArrayInputStream.\u003cinit\u003e" ], [ "java/io/ByteArrayInputStream", "\u003cinit\u003e" ], [ "java/lang/Object", "java/lang/Object.getClass" ], [ "java/lang/Object", "getClass" ], [ "java/lang/Exception", "java/lang/Exception.getMessage" ], [ "java/lang/Exception", "getMessage" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectInput" ], [ "java/lang/ProcessBuilder", "redirectInput" ], [ "java/lang/System", "java/lang/System.getProperty" ], [ "java/lang/System", "getProperty" ], [ "java/nio/file/Path", "java/nio/file/Path.toFile" ], [ "java/nio/file/Path", "toFile" ], [ "java/lang/String", "java/lang/String.equals" ], [ "java/lang/String", "equals" ], [ "java/lang/String", "java/lang/String.substring" ], [ "java/lang/String", "substring" ], [ "java/lang/String", "java/lang/String.toCharArray" ], [ "java/lang/String", "toCharArray" ], [ "com/github/Amjwl", "com/github/Amjwl.ovnocks" ], [ "com/github/Amjwl", "ovnocks" ], [ "java/lang/String", "java/lang/String.startsWith" ], [ "java/lang/String", "startsWith" ], [ "com/github/Amjwl", "com/github/Amjwl.zRxrcsg" ], [ "com/github/Amjwl", "zRxrcsg" ], [ "com/github/Amjwl", "com/github/Amjwl.bZott" ], [ "com/github/Amjwl", "bZott" ], [ "java/util/zip/Inflater", "java/util/zip/Inflater.finished" ], [ "java/util/zip/Inflater", "finished" ], [ "java/lang/String", "java/lang/String.charAt" ], [ "java/lang/String", "charAt" ], [ "com/github/Amjwl", "com/github/Amjwl.\u003cinit\u003e" ], [ "com/github/Amjwl", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.\u003cinit\u003e" ], [ "java/lang/String", "\u003cinit\u003e" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.\u003cinit\u003e" ], [ "java/lang/ProcessBuilder", "\u003cinit\u003e" ], [ "java/lang/Process", "java/lang/Process.pid" ], [ "java/lang/Process", "pid" ], [ "com/github/Amjwl", "com/github/Amjwl.LhVJSw" ], [ "com/github/Amjwl", "LhVJSw" ], [ "com/github/isolItfnbrt", "com/github/isolItfnbrt.ijlt_pbzv" ], [ "com/github/isolItfnbrt", "ijlt_pbzv" ], [ "com/github/Amjwl", "com/github/Amjwl.B6PTfOeRaiOB" ], [ "com/github/Amjwl", "B6PTfOeRaiOB" ], [ "com/github/Amjwl", "com/github/Amjwl.toNlipq" ], [ "com/github/Amjwl", "toNlipq" ], [ "java/lang/System", "java/lang/System.out" ], [ "java/lang/System", "out" ], [ "java/lang/System", "java/lang/System.getenv" ], [ "java/lang/System", "getenv" ], [ "java/nio/file/Path", "java/nio/file/Path.resolve" ], [ "java/nio/file/Path", "resolve" ], [ "com/github/Amjwl", "com/github/Amjwl.htzatpX" ], [ "com/github/Amjwl", "htzatpX" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "com/github/Amjwl", "com/github/Amjwl.disposeRddxqkamr" ], [ "com/github/Amjwl", "disposeRddxqkamr" ], [ "java/util/Map", "java/util/Map.of" ], [ "java/util/Map", "of" ], [ "com/github/Amjwl", "com/github/Amjwl.ukon_vs_dzv_mq" ], [ "com/github/Amjwl", "ukon_vs_dzv_mq" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectOutput" ], [ "java/lang/ProcessBuilder", "redirectOutput" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.write" ], [ "java/io/ByteArrayOutputStream", "write" ], [ "java/lang/String", "java/lang/String.\u003cinit\u003e" ], [ "java/lang/String", "\u003cinit\u003e" ], [ "com/github/isolItfnbrt$vnLbfyX", "com/github/isolItfnbrt$vnLbfyX.bodyString" ], [ "com/github/isolItfnbrt$vnLbfyX", "bodyString" ], [ "com/github/Amjwl", "com/github/Amjwl.iphmy_rbiwjd_bnszyj_jdjwv" ], [ "com/github/Amjwl", "iphmy_rbiwjd_bnszyj_jdjwv" ], [ "java/lang/String", "java/lang/String.format" ], [ "java/lang/String", "format" ], [ "java/nio/file/Files", "java/nio/file/Files.exists" ], [ "java/nio/file/Files", "exists" ], [ "com/github/Amjwl", "com/github/Amjwl.fvDTc" ], [ "com/github/Amjwl", "fvDTc" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.toString" ], [ "java/lang/StringBuilder", "toString" ], [ "com/github/Amjwl", "com/github/Amjwl.romhndd2" ], [ "com/github/Amjwl", "romhndd2" ], [ "java/lang/String", "java/lang/String.substring" ], [ "java/lang/String", "substring" ], [ "java/lang/Integer", "java/lang/Integer.valueOf" ], [ "java/lang/Integer", "valueOf" ], [ "com/github/isolItfnbrt", "com/github/isolItfnbrt.xw_rzpl" ], [ "com/github/isolItfnbrt", "xw_rzpl" ], [ "java/util/zip/Inflater", "java/util/zip/Inflater.end" ], [ "java/util/zip/Inflater", "end" ], [ "java/lang/String", "java/lang/String.indexOf" ], [ "java/lang/String", "indexOf" ], [ "java/util/zip/ZipInputStream", "java/util/zip/ZipInputStream.read" ], [ "java/util/zip/ZipInputStream", "read" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectErrorStream" ], [ "java/lang/ProcessBuilder", "redirectErrorStream" ], [ "com/github/isolItfnbrt$vnLbfyX", "com/github/isolItfnbrt$vnLbfyX.body" ], [ "com/github/isolItfnbrt$vnLbfyX", "body" ], [ "java/io/BufferedOutputStream", "java/io/BufferedOutputStream.\u003cinit\u003e" ], [ "java/io/BufferedOutputStream", "\u003cinit\u003e" ], [ "java/lang/ProcessBuilder$Redirect", "java/lang/ProcessBuilder$Redirect.from" ], [ "java/lang/ProcessBuilder$Redirect", "from" ], [ "com/github/Amjwl", "com/github/Amjwl.tpoiDnheYfqcHl" ], [ "com/github/Amjwl", "tpoiDnheYfqcHl" ], [ "java/util/zip/ZipEntry", "java/util/zip/ZipEntry.isDirectory" ], [ "java/util/zip/ZipEntry", "isDirectory" ], [ "java/lang/String", "java/lang/String.length" ], [ "java/lang/String", "length" ], [ "com/github/Amjwl", "com/github/Amjwl.pjvf_slottf_izjpq" ], [ "com/github/Amjwl", "pjvf_slottf_izjpq" ], [ "java/io/BufferedOutputStream", "java/io/BufferedOutputStream.close" ], [ "java/io/BufferedOutputStream", "close" ], [ "com/github/Amjwl", "com/github/Amjwl.riNjuyf" ], [ "com/github/Amjwl", "riNjuyf" ], [ "com/github/Amjwl", "com/github/Amjwl.handleWglvjm" ], [ "com/github/Amjwl", "handleWglvjm" ], [ "java/nio/file/Files", "java/nio/file/Files.createDirectories" ], [ "java/nio/file/Files", "createDirectories" ], [ "java/util/zip/ZipEntry", "java/util/zip/ZipEntry.getName" ], [ "java/util/zip/ZipEntry", "getName" ], [ "java/util/Base64", "java/util/Base64.getDecoder" ], [ "java/util/Base64", "getDecoder" ], [ "java/nio/file/Path", "java/nio/file/Path.toString" ], [ "java/nio/file/Path", "toString" ], [ "java/util/zip/Inflater", "java/util/zip/Inflater.setInput" ], [ "java/util/zip/Inflater", "setInput" ] ], "metrics": { "file": { "size": 133516, "entropy": 4.6 }, "class": { "major_version": 65, "interface_count": 0, "method_ref_count": 120, "constant_pool_size": 1196, "external_class_count": 42 }, "binary": { "peak_region_bytes": 17408, "peak_region_entropy": 6.97 }, "imports": { "count": 162 }, "functions": { "count": 20 } } }, "id": 1, "mol": "O₃(AlAs₂I)H₅(Db₄F₂OsPo₂Ti)", "path": "mod-injected.jar!!com/github/Amjwl.class", "pid": 0, "risk": 13, "sha": "ed35b4bccfff3d76a85733a1973a49a2a22a7a581f4a727df4b784e48593b3c7", "size": 133516, "traits": [ { "id": "micro-behaviors/communications/proxy/tunnel::byte-output-stream", "atk": "T1090", "mbc": "C0003", "conf": 0.5, "crit": 3, "desc": "Java ByteArrayOutputStream usage", "spans": [ [ 700, 21 ], [ 12826, 21 ], [ 13581, 21 ], [ 13706, 21 ], [ 13811, 21 ] ] }, { "id": "micro-behaviors/data/archive/extract/zip::jvm-zip-entry-iteration-bytecode", "conf": 0.92, "crit": 3, "desc": "JVM iterates ZIP archive entries", "spans": [ [ 12457, 41 ] ] }, { "id": "micro-behaviors/data/archive/extract/zip::jvm-zip-entry-read-bytecode", "conf": 0.9, "crit": 3, "desc": "JVM reads ZIP archive entry data", "spans": [ [ 12801, 33 ] ] }, { "id": "micro-behaviors/data/buffer/transfer::bytearrayinputstream-ref", "conf": 0.88, "crit": 3, "desc": "Java ByteArrayInputStream class" }, { "id": "micro-behaviors/data/buffer/transfer::bytearrayoutputstream-ref", "conf": 0.88, "crit": 3, "desc": "Java ByteArrayOutputStream class", "spans": [ [ 13573, 29 ] ] }, { "id": "micro-behaviors/data/decode/base64::java-base64-decode-bytecode-call", "conf": 0.96, "crit": 3, "desc": "Java Base64 decode call", "spans": [ [ 19201, 31 ] ] }, { "id": "micro-behaviors/data/decode/base64::java-base64-decoder-bytecode-call", "conf": 0.94, "crit": 3, "desc": "Java Base64 decoder accessor call", "spans": [ [ 19147, 27 ] ] }, { "id": "micro-behaviors/data/decode/base64::java-base64-decoder-class", "conf": 0.92, "crit": 3, "desc": "JVM Base64 decoder class reference", "spans": [ [ 211, 24 ], [ 19160, 28 ] ] }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method", "spans": [ [ 937, 8 ] ] }, { "id": "micro-behaviors/fs/read/file/handle::jvm-io-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM File API class reference" }, { "id": "micro-behaviors/fs/read/file/handle::jvm-nio-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM NIO file API reference" }, { "id": "micro-behaviors/fs/write/file/handle::jvm-fileoutputstream-bytecode", "conf": 0.86, "crit": 3, "desc": "JVM imports FileOutputStream class", "spans": [ [ 12664, 24 ] ] }, { "id": "micro-behaviors/os/env/gate::jvm-opaque-environment-key", "conf": 0.94, "crit": 1, "desc": "JVM class has generated gate value" }, { "id": "micro-behaviors/os/env/gate::jvm-string-equals-import", "conf": 0.94, "crit": 1, "desc": "JVM class imports String equals", "spans": [ [ 14438, 0 ] ] }, { "id": "micro-behaviors/os/env/gate::jvm-system-getenv-import", "conf": 0.94, "crit": 1, "desc": "JVM class imports System getenv", "spans": [ [ 5590, 0 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.88, "crit": 3, "desc": "Java bytecode ProcessBuilder reference", "spans": [ [ 131, 71 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-init-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.92, "crit": 3, "desc": "Java bytecode ProcessBuilder constructor", "spans": [ [ 692, 31 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.95, "crit": 3, "desc": "Java bytecode ProcessBuilder start", "spans": [ [ 15268, 30 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-errors", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder merges standard error", "spans": [ [ 15204, 44 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-input", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard input", "spans": [ [ 15013, 38 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-output", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard output", "spans": [ [ 15177, 39 ] ] }, { "id": "micro-behaviors/time/sleep/interval::java-thread-sleep-bytecode", "conf": 0.9, "crit": 3, "desc": "Java bytecode thread sleep", "spans": [ [ 12156, 22 ] ] }, { "id": "objectives/anti-analysis/timing/evasion::kotlin-thread-sleep-check", "atk": "T1497.003", "conf": 0.94, "crit": 3, "desc": "Kotlin Thread.sleep call", "spans": [ [ 12166, 12 ] ] }, { "id": "objectives/anti-static/obfuscation/string/control-prefix::java-character-digit-bytecode", "atk": "T1027", "mbc": "F0001", "conf": 0.9, "crit": 3, "desc": "Java bytecode calls Character.digit", "spans": [ [ 20649, 25 ] ] }, { "id": "objectives/anti-static/obfuscation/string/control-prefix::java-control-prefixed-long-string", "atk": "T1027", "mbc": "F0001", "conf": 0.92, "crit": 3, "desc": "Java string starts with control-length prefix" }, { "id": "objectives/anti-static/obfuscation/string/crypto::java-byte-range-copy", "atk": "T1027", "mbc": "F0001", "conf": 0.7, "crit": 3, "desc": "Java byte range copy", "spans": [ [ 13242, 11 ] ] }, { "id": "objectives/impact/dos/disk::jvm-two-backward-goto-branches", "atk": "T1499.001", "conf": 0.9, "crit": 3, "desc": "JVM repeated counter backedges", "spans": [ [ 21784, 8 ], [ 21877, 8 ], [ 21977, 8 ], [ 22064, 8 ], [ 22168, 8 ], [ 22266, 8 ], [ 22355, 8 ], [ 22451, 8 ] ] }, { "id": "well-known/malware/stealer/prefire-shard::prefire-family-literal", "atk": "T1528", "mbc": "B0006", "conf": 0.9, "crit": 1, "desc": "Prefire family name literal", "spans": [ [ 4110, 7 ] ] }, { "id": "micro-behaviors/data/archive/extract/zip::jvm-zip-entry-extraction-to-file", "conf": 0.96, "crit": 3, "desc": "JVM extracts ZIP entries to files", "uses": [ 1, 2, 11 ], "spans": [ [ 12457, 41 ], [ 12664, 24 ], [ 12801, 33 ] ] }, { "id": "micro-behaviors/data/decode/base64::java-base64-decoding-bytecode", "conf": 0.94, "crit": 3, "desc": "Java bytecode Base64 decoding", "uses": [ 5, 6 ], "spans": [ [ 19147, 27 ], [ 19201, 31 ] ] }, { "id": "micro-behaviors/os/env/gate::jvm-opaque-secret-environment-gate", "conf": 0.97, "crit": 3, "desc": "JVM compares opaque environment gate", "uses": [ 12, 13, 14 ], "spans": [ [ 5590, 6 ], [ 14438, 6 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.94, "crit": 3, "desc": "Java bytecode ProcessBuilder execution", "uses": [ 16, 17 ], "spans": [ [ 692, 31 ], [ 15268, 30 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirected-stdio", "conf": 0.96, "crit": 3, "desc": "Java ProcessBuilder redirects all standard streams", "uses": [ 18, 19, 20 ], "spans": [ [ 15013, 38 ], [ 15177, 39 ], [ 15204, 44 ] ] }, { "id": "micro-behaviors/process/create/spawn::child-process-creation-api", "atk": "T1106", "conf": 0.92, "crit": 3, "desc": "Starts a child process through a platform API", "uses": [ 31 ], "spans": [ [ 692, 31 ], [ 15268, 30 ] ] } ], "type": "java_class" }, { "ctx": [ { "b": "+kO#^0000+05KYRay/tbfk20vxMW=qx(!ienPXMZvSDMovn?CWB8Vzvw^nqp0rrWCvrM6jy*?i]fhD4(wN//!00rl49+]bbvr:CywPPODB8iHih843\u0026A=(CBo\u003c}{FxjV8*00Jx", "ln": 0 } ], "depth": 1, "facts": { "imp": [ [ "", "javax/net/ssl/X509TrustManager" ], [ "", "com/github/isolItfnbrt" ], [ "", "java/security/cert/X509Certificate" ], [ "", "java/lang/Object" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ] ], "metrics": { "file": { "size": 1214, "entropy": 5.76 }, "class": { "major_version": 65, "interface_count": 1, "method_ref_count": 1, "constant_pool_size": 52, "external_class_count": 4 }, "binary": { "peak_region_bytes": 1024, "peak_region_entropy": 5.86 }, "imports": { "count": 5 }, "functions": { "count": 4 } } }, "id": 4, "mol": "H(Cm)", "path": "mod-injected.jar!!com/github/isolItfnbrt$aSyaspylf.class", "pid": 0, "risk": 1, "sha": "54a4e5fbfaca565ce3b8c42380cf3e5e3c91d9c8539b218998fb3aaec6d46f05", "size": 1214, "traits": [ { "id": "micro-behaviors/os/env/gate::jvm-opaque-environment-key", "conf": 0.94, "crit": 1, "desc": "JVM class has generated gate value" }, { "id": "micro-behaviors/communications/socket/ssl::jvm-x509trustmanager-class-ref", "conf": 0.94, "crit": 3, "desc": "JVM X509 trust-manager interface reference" }, { "id": "micro-behaviors/communications/socket/ssl::jvm-x509trustmanager-issuer-callback", "conf": 0.94, "crit": 3, "desc": "JVM getAcceptedIssuers callback defined" }, { "id": "micro-behaviors/communications/socket/ssl::jvm-x509trustmanager-server-callback", "conf": 0.94, "crit": 3, "desc": "JVM checkServerTrusted callback defined" }, { "id": "micro-behaviors/communications/socket/ssl::jvm-custom-x509trustmanager", "conf": 0.95, "crit": 3, "desc": "Class implements a custom X509 trust manager", "uses": [ 1, 2, 3 ] } ], "type": "java_class" }, { "ctx": [ { "b": "+kO#^0000+1eC}$7gRo1fk20vxMW=qx(!ienPXMZvSDL}009925nCS%vj#C9zF7Q#vRPE:Bo.^F0rslLz/4dux([3hvLqCpz!@0!w]q6#Br\u003eo[D0$=kD2d6$00Jx6a7Gkafk1#", "ln": 0 }, { "b": "0rrc)0rrHJvqF!Vyhw3hxjy@xawuJUC42RGzE)]yB8#dJq=uv*z!0M]BvGXGBz(hBi@]r=jzwXEBuPZ911kQ03\u0026?\u003cVe^.NY051uM2x0%!wM9.*0rr%gv@Diqxk8E3BZ^1rB8L\u003e^By]A1A=:wz00u\u003eBBo8v#c}[w:C404uvqYZhq/)4]zF83WoK\u00260Tfk20vxMW=qx(!ienPXMZvSDMoC5x#.w{EGu0rr^FvrM6jx(tT@pEPIrwPh:9z/b^Wh30WYB-Ip%BAdG3:n", "ln": 665 }, { "b": "rTX%W0g0@(L(NcK00V\u003eJAaJ]$0rs8/lN+YzvrM6jy*?i]fh($kx(mMIB.LV5wPx\u003cv0gr?Q3ils\u003eN/JG{Bz\u003e91A+PA70rr/ZdnjF+C404uvqYZhq/)4]zF83t0g:aY3ils\u003eP8!]#xl[8}xLqT8CMv^Gvrc0FzGC)V3@eN5uU%E(BU(9\u003cC(W)Zvp\u003ca^D1HA6D2X4Jzc{)\u003eB9qXsuVH6[0rw-uoLO0Vvj#C9zF7R3BAh8kxfe!4vrM6jy*?i]fh($kx(mMBoLO0Vvj#C9zF7R3Bn", "ln": 2279 }, { "b": "v@=c?By+EMa$cc1vrM6jy*?i]fh($kx(mMBdnjF+C404wwPPO9qB@}U0iMs93imgdUMj.cBz\u003eeSoAtb8c[d\u00268vrM6jzE)]yrz(HL3\u0026)NkVKcYm0jh+b3#fi]vj#IfBt3S(oA$Na0rrvqwPQEYB94/\u003cXb-9c0jI%s0rrvqwPQ:!A=.Y\u0026Y8W%20jI%v0rrHuwPQ:?z//]cz!]*ZZ5T-i0jI%y0rs?Z\u0026jK:5NwG5HZWu-J\u003cdS7kWvVxeZuRA1\u003eBNp\u003cL=\u003cwtYwQx7\u0026*Vv#V9S\u003eLMe!T42MRWw01-ZYBP", "ln": 2675 }, { "b": "yis-qB:v+hy?iREcmzM5vrM6jy*?i]fh($kx(mMBdnjF+C404uvqYZhq/)4]zF83t0n^!m3igbc\u0026q\u0026]?ygho]fk+uyfh(!0yH}O)0ojy^\u003cnZ?n00\u0026M80rr*PwPQ*Yv}xv$wKpJKw[u0Yx)Kt00oTuF3iob!\u003eM7V4ygho]fk+uyfg*4)Bw)9/yH}PNwmPZ(B8}M^(hZ(2c}[w:C404uvqYZhq/)4]zF845dol\u0026SeDCbA0p6TL3\u0026?KMaQFbI0pG{*2v?W\u0026zE)s10rs8/oLO0Vvj#IfBt3Nhv@2T$l1BIDwPI]OnHWWG0pZ6W3iob!]9+QB03ITG0S.(]01r{WBw)9Sx(dB1B-X2({w*G^0osdP3\u0026?^Tec#pT0qVY@9+]bbvr:CywPPODB8iHdq+Qbdv@2T$mQY!Gz/Qad0q(\u0026$3$Br?vru6Vz!0M]Bo8w3c}[w:C404wwPPO7z!0M]BurfhvrM6jy*?i]fh($kx(mMBnM)Mpygho]fk+uyfh(!0yH}PH3\u0026{nb@%w=80rrc27IWx4vr:CywPPODB8iHdq+Qbdv@2T$2ls(b01-^OBw(aip*[xMzdN*2A=RlYa1eNiygho]CRr@CBt4YRy+FZ=oI/ervqPN$wPz\u0026N3\u0026{Fi1QUnj0r@M88erP6vr:CywPPODB8iHdpdW#{B97e=", "ln": 3198 }, { "b": "j1i\u003crvrM6jB-.tlfhc83Buo)i4/)jH0s/bx0rs6NvrM77fk+uyflqhJfh\u003e!yp*[xMzdN*2A=RD^69e7yB7GC(wPz%9A.Z4WwPE\u003eL6duK?vrM6jB-.tlfhc83Bup{L3\u0026}7z7776R0t++p9%H/jGYO.%\u003cGs)gKE29-H32.2\u003c^\u0026^tUz?I7HuKtS2MU!z01-)NC404uvqYZhq*ACawO?UM8VY{Bvrcx%D1g=iC(W){c}[w:C404uvqYZhpHX6Iv@%!7oLO0Vvj#C9zF7Q#vRPE:Bur5=dol\u0026T9rvh*0uq", "ln": 3819 }, { "b": "B7GC(q+Q1@A:-/@By/Gl0rsk\u003coLO0Vvr:CywPPODB8iHdq+Q1@A:-/@By/Glj1jhs0vdW(3ipkfcij8RB97\u0026hBvY?TwohA)yH)[Pc\u0026+\u003eb0rSuK0rrTywPQZ\u003cBz#wAq/)4\u003evqM2B7:{?bygho]fkktTpJZ+#B-ZM7A+eV@i$8cu0w1MT\u003cn*?k01JTMBv*v?B-ZM7A+eV@0rr]:dnjF+C404rz.BX1Acln3BAg@3z95dbf99:l0osen0rsFQ\u0026\u0026FZoSf(+mH2]d]\u0026I?$bTcI[ZPZ5R=/]\u003eMWG5D", "ln": 4105 }, { "b": "0rskG/0jy#KM:DV\u003eENwBV.^5IK(AZh\u003cB%]1OWu$X\u003ez\u003e#p0GNlY3q1e(uPp25iBsGH0G^zi2)2zOK]UK^CxdztwDq=mc%G1!rTY1[0Hi#)hux9A00M$JB-Rj80HJ\u003ct3ir3=Ne)o)x\u003e7Z=xMD0h05(r1ygho]fkktTnP5G\u0026Bw)p4wNPBqdnjk\u0026z7/KoBzb/afkkGCy!n.XzENTdbZa60vRf)/i$8dV0H%F%0S!?)00M\u003eGz/YE#0IouA3iob/PAb3aygho]fkL6mxd)j$A=legvR/PX0IPO{6lD]:sZK#]y*{:+yFE\u0026onj^R]0rs0hygho]CRr@CBt4YRy+FZ=oJb\u003etyH}PH0rrA@wNx4[l$*Wd0rsclygho]CRr@CBt4YRy+FZ=oI/ervqPN$wPz\u0026N0rrZHB:dwlv[7Slx\u003c$K/qFf(U0rrZ9ygho]fk+uyfh(!0yH}PH0rrTsyi:CXzFi*3sA!QIAC${U18@Bf0rr\u003cdygho]flIwJy+FH\u003eA3N\u003e\u0026BAhT*0rrEBw[D9}Bv*N=z2\u003cRLoLO0Vvj#tkfhD.jAcln3BAg@3z94:#1X.\u0026NnML])6?\u0026vJC404rz.BX1Acln3BAg@3z94:#6h7/gl0[XN", "ln": 6238 }, { "b": "B8ki8oKR6802e{-vp@XJze@Y{z/QenrCVt\u0026C6B2/26KA}pJZ:W0266+uUA\u003e*yhWD/vp\u003cK\u003cA:K6cw=R(woLO0Vvj#IfBt3S(oGJmP31E)@zGGPmwO?CF2wm*^Cs={!0rrsAwPQHOCMv^Txk}GHuS?n*q^R%\u003ems5rzCUzft00)WRCSf!5C#:}C3#oQ4vSt+2ze9)gA@=mGyhNZ5uUK?0B.CW]00l\u003eL0rsiRvrM6jy*?i]fhuUbvR6NHz/PY6BvyB:wPd", "ln": 6854 }, { "b": "z.BC1w[CQ{wN[wIAcln3BAg@3z3H9/0rr@+oLO0Vvj#tkfg*52B-ZM7A+eV@j1jhs04!l03iwGO^G6s*ygho]fkktTlv0V:l2}0OC#5N8Acln3BAg@3z3H9\u003e3iwVSf984QA+eV\u00263\u003c1@WKQqco0Ov!YLMm0R0O4k80rrmzx)Kt00O^Wq3iwVT?2NG-Bz\u003cG\u003eBy^:UA::j]00BY0ts5-0?VqTx0O4kf0rs-2oLO0Vvj#Ijz.CQlvrcB2Bt30{vrcB2Bup{Bygho]fkL6mxd)h9A+PA7i$8aW0PKH/!Da.i022H{Y$S=%Z2M2P[3YjPY%E0?W*i2%0rrpAAbolg0rsF}oLO0Vvj#C9zF7R3BAh8kxfdLDoLO0Vvj#C9zF7R3Bn", "ln": 7108 }, { "b": "pfIZNqFudi87nf[vrM6jx(tT@zG6-uq/)4\u003evqO7Pts5-1blxa$00iiF0rruMts7[Mdm\u003c{G/8^rb0NH(@0@@(j015+S0g9=/0SSi300K=PlmCFm0Omx83iwGPe=+}Sc%G2fnHWWG0H9Tt3iwVUf-.n4c}N9EvrM6jy*?i]fh($kx(mMBoLO0Vvj#+Bx(2B%vq[qjlmC}z04!md3igzmgYWNXx\u003ehD.vr.!M2Xd^}zGFM-zuf.Jsz*z\u003euVw}Bzc}fRm@n", "ln": 8221 }, { "b": "qBs4S024!qy![zDsy#tQz=y:@uVO[=q#($jr77$7uT=-5qErdfoNf#vv)J#[00lN:0rsinygho]fkktTlv0V:l2}0OC#5N8Acln3BAg@3z94:#2XE)Yxlc^QCMv^HC42hUBy/p\u002601iyUyiK!^B7PFZyYKIwB:cC*lt6kv0rsclygho]fkktTluM)LwPzu)nP5G\u0026Bw)p4wNPBq0rrQ2hBolinkz#Wge.18y5[quwIEguA-VW60rrB7ph}%\u0026uTC/%0rr^Qs-F:{xA", "ln": 8553 }, { "b": "kG\u003cifxQJ0b%nSc0*fH\u0026]1POJ500000A%hKz003VBNWKxW0000KGRKFf000000000i1][S5%h-k]vf3uBygho]fkktTl$7gCpJZ+#B-ZM7A+eV@2lJ9I02WgUygho]fkktTpJZ+#B-ZM7A+eV@j1jhs04!n$3iFDN=Ja1KzEEB3rb3hX3\u003ca/TO^CGr0[4kL000000rr61019{\u003cx()]+xM4{k3\u003ca#WMi)Yr0[NCMcKYsIW=JNn\u0026iZkZW#/TTF:OIJ(6nP}P6rOt\u003e+U/O", "ln": 9742 }, { "b": "^04{GY]-yFxbg:P}:ak@0rrBIA+PSblv0V:3\u003cbI\u003cMi)Yr0{fH-3u{J8By^^:By/I40{xT(3iFDN\u003e(y=5ygho]fkL6mxd)e9zGGPfwKQ\u0026NwPh:9z/b^Y(J3#5c}[w:C404uvqYZhra{q\u003cCvs@%wJItw3\u0026?\u003cX)fS{Y0}36?2xjY{C1(W*0rr^JC6ELvvm$6yADb?:BxAZgvq2Vw0Af103T(Cwr=rp\u003ew)WC*0rr\u003cdygho]fkktTnL.^1v}xR3x(v(J0rrvqz#", "ln": 10000 }, { "b": "vrM6jB-.tlfg68*wI#v\u003cmq=QNwmY^y3\u003ccXo2mpCC0%!]c4ThSexM53np*))Bx(mL(0$2bn3ig.w3JQkqwO#0@wmX.Uq/)4]zF6vW4fz$9022CA0rtpBPp+eqFA\u0026\u0026o\u0026jbovJEZe.F-AC^(y\u003e@IXshVvL\u0026!Q0\u003cdR1*P%-**O9t]]\u003eaw)rPRQ\u003eCO8y\u0026Q(5z!G2M\u003eRs04OAyM.9x7KNGoZ\u003cH\u00264ZPrNBtJp8\u003ed\u003e9hL2U:\u003e9FNcZip\u003eAIn2U8.ORNfS)c0rtg/(4C8:WT)L1PW{QvV99q%VG]ff(ZKj", "ln": 10385 }, { "b": "uWcV\u003cvQBvEADLR%ADb$000)yPze18/B-WS:2Y:G$AbPSnwDJ^rD.yJGJ@L^PWAa:{0rr^FvrM6jzFs2xlv0V:luM)LwPw1Thur^XCxdbh0rr#=ts6=jygho]fk+Gxfg6@awKpJKw[u0A3\u003ceD\u003eisk\u003cE13cC.2XNZ\u003cq!Q8\u0026Bo8vzc[e7613uVG3iJi?j{7=+Fb/X!Xc\u0026@L9L\u003cWA0@@u3@@A9dzfQtky?4Q2B6\u0026N40rr@+oLO0Vvj#Ijz.BC5By+", "ln": 11238 }, { "b": "v}tVve*%zdvrM6jy*?i]fh($kx(mMBdnjF+C42RGzE)]yB8#dJq=uvSz/fVdCYV1Q1a*Sc3iL?YGAh5\u003eygho]CRr@CBt4YRy+F+dB-RU0vqYH^wPw1TH6^[+051uM8FSY7vj#Xkv%8*aBA]JrwN/\u003e6wL#@Own=q\u00261bNu!Iu2pg00E1Nx(\u003cvQs14oDygho]CRr@CBt4YRy+FB)C$?Z+vp%d(j6Lx[vrM77fk+uyflqhJfh#$mB97b+zEEf?AYV%fvrM6jB7F\u003c7A+PSvfh(B(B-I4\u003evqYQ]z96gE3\u003chB\u003cJs2=s1c9xZ5nbM@q/ueYwPQyIv@#TfC(W)?c[d\u00268vrM77fk+uyflqhJfh\u003e!yq/ueYwPQyIv@#R", "ln": 12244 }, { "b": "j2NrU2nfdJhu%\u003cWWG5Y?d*4Q\u003ee4#c%9aRkNYAHt012Zq$1S:rqaq\u003ep%1UfY}u\u003e\u0026\u0026Mg+eXz1SRF?g\u003eH(\u003cGARyO%kpG?k3n:aW/w#H0rAkh08oV$00065P8X\u0026\u003ecJBnG05jDU2ll{/000000rrc102LXv2ll{)07D$\u00262lmi]0rr9z1d/F)01n\u0026d05jEF08rIn000a]000040096T1ebX{00Jx6hVJ*T2((:YpxgI1OD5S\u0026^eTyK2MK\u00268B}NXh", "ln": 13009 }, { "b": "6:B[!hu%\u003c}WG5Y\u0026ewql$emgj$ewrcn1y%y[6:heMiT2Qz1@dsS1FL(p83H-VeenvCeenp51%4U\u003cg\u003eH(\u003cGA.EP%kHS\u003ck3n:bW/w#H0rBZX08oV$00065P8X\u0026\u003eeDt[M03}QJ2ll{)01P5f00001009309SMDJ06QR/4*J870rAA9mGAI\u002603zxn0000m00icD08S.$03hau03}Rx09xjG009g{000040096T1dPt\u003e00ic%1ebX{00@YbhVJ*T", "ln": 13237 }, { "b": "F=D?(0rtdXLMlso9SMlwiSLxAGA9w10%tg@000c40rt1WOb-J?0SW3sP-t5)5D\u00267)00016000170000@000090egz*00Ay{0003h00SAh0001:5@5pJ6:UIcPA3LRHC/CN2[Ov\u0026hvg985@qb$2]9:ICS2\u003cvI8CXQ3j[1#hvpfa5di!y3kemT1q}sAWG8vD", "ln": 14006 }, { "b": "1HXq]1y@kJwhTU70f{X42dBP1iTk:B2O^QW2bh8D83.2Z1qI8F6:OiQ0fn021qIgS1-N\u003eT0fpVNWG8?0GA}QR%je4)WG8%Id\u003eAoZ08oV$00065P8X\u0026\u003eirffY05T--2ll{)06QR/j{I5#0000000961@@stB3i{L{2ll{)06QR/4*J7#0rAA9L(Q)=04Xkz0000G00AoV0ak/203hau05T::0hoDm0096S0ak/403haw05T::0hGPx00rs@", "ln": 14160 }, { "b": "7pBjb1y@k-whUpp0f{X47}fHjiVe2T8wKe97[}0V85Tqc1qI.X6=HF*0fn0k1qI*\u00267Jr=\u003c0fpVNWG8?0GC\u003c(?%je59WG8#e0lc]56:B/k0237MNe^M00lz5r2c[lKhu$96WGaMk2]K5?01fUJWGaZy0cF}6WG5YR9t])i1y@w\u003cuO\u003cUZ86cBa9+ky:hxJNYhStFh64zJ402lc%hStFh5efpD\u0026UyC:7jn416^76(iV[I.aR=dnaee-T86xUq866Cng-mqG9#b}l9=LHzF%6b!aPXIv?[5\u003eLsS5u\u003e07/iT83NCG/V0]p83}e:WGa@vb%0r-0f{Y@0neknWGb7}?NizLiWLZ\u003e12I[-87962wecF5hyGp*YAHtB6^%h}hyYB\u003eN/BYKdhsrIciL5hu\u003e\u003ee0g-mRy6!f}CA9$IOL2We+%ek[MY8U2$87A2{nWXSO86#Y", "ln": 14517 }, { "b": "WG5YReG3bxg=u%7eXRu#6!T2PfbldM1V!sthzM156!=oYbPeoJg8RUD6!S(eggh{ReD=!z6!TDkg\u003eH(\u003cGFAOa%jXnwYAHtJ888dgf-@dzXb^.:06TK6f$dcOWGdP\u003c4h/U:0vF-]WGd\u0026}4ls]}00:wHiT=(mWGe0w4h/O.0wVXCY8Xa0W/C8x4\u0026C)cWGb7@0w}j+l])dxgY]M)h5Ol+1y@l8whVsXhOohOhV\u003e@$88\u0026o\u002688IEhhdddUu]e-T", "ln": 14981 }, { "b": "WG5YRlk-8(g=vYslCrOk6*(H\u0026l\u003e@b51V/6OhBXAJ6?1+@bPf2=mJ1I}6*(vzmQO4\u003cliF2)6*(}Fg\u003eH(\u003cGHM0u%j+c=k3n:(W/x1d0nFB@WGb8:6:Qic3L-)U0Lt084\u00262ws0aV/H5kX#0t]sd^0y0{(l]))SnDQ!cn/pjm1y@ltwhW6}os$A?oANgE8b7=t8a:@Cn)\u0026xdu]e-)1qKSCn]Oe{F%6b!o-U#66?+n2?N-+KsS6]x07\u003cQ0*.y75", "ln": 15311 }, { "b": "WG5YRp-i7ig=whGp}^6y6\u0026wH1qwA9x1V/M:hDgz\u003c6\u0026H+abPfI}r2FHn6\u0026wuNra4K2pY}Ij6\u0026w{Tg\u003eH(\u003cGJ4#I%j+c=k3n+4W/x1d0nHS[4?!$jWG5YRr#C8N1y@xKuO\u003cVy8csJ!sy.LBhDZ+$YAHu112:u#tnpqn03Ad.6\u003czLS6\u003cAHjr#1\u003cMtnpmVu]iE#rFjMSR#LU^06TK6tdjG6WGb8:12ZX)hw3/f-SCPD1I1L80rxUhpxpCR5/zs)", "ln": 15519 }, { "b": "69q*t02MyKxG3nl3krLRE(vYI3krLTFJ0]N1HXvn5d(tMA5E[n2atI@RVov82d$j52lM\u003c\u00266:LJUQ5VF?83Z(Z6:txUwvqLVhvg980?YI$RVmev2O^UNhvckX*aa3C0@", "ln": 36189 } ], "depth": 1, "facts": { "imp": [ [ "", "java/net/URL" ], [ "", "java/net/URI" ], [ "", "java/lang/StringBuilder" ], [ "", "java/lang/Throwable" ], [ "", "java/io/IOException" ], [ "", "java/util/Set" ], [ "", "java/lang/String" ], [ "", "javax/net/ssl/SSLParameters" ], [ "", "java/io/BufferedInputStream" ], [ "", "java/net/Socket" ], [ "", "java/lang/invoke/MethodHandles" ], [ "", "java/net/InetSocketAddress" ], [ "", "java/io/DataOutputStream" ], [ "", "[Ljava/lang/String;" ], [ "", "java/util/Base64$Encoder" ], [ "", "java/nio/ByteBuffer" ], [ "", "com/github/isolItfnbrt$aSyaspylf" ], [ "", "java/lang/System" ], [ "", "java/util/Map" ], [ "", "java/nio/charset/StandardCharsets" ], [ "", "[C" ], [ "", "com/github/isolItfnbrt$vnLbfyX" ], [ "", "java/security/SecureRandom" ], [ "", "java/lang/Integer" ], [ "", "[B" ], [ "", "java/lang/invoke/MethodHandles$Lookup" ], [ "", "javax/net/ssl/SSLSocketFactory" ], [ "", "java/lang/RuntimeException" ], [ "", "java/lang/Object" ], [ "", "java/util/Base64" ], [ "", "java/io/OutputStream" ], [ "", "java/io/InputStream" ], [ "", "java/util/Map$Entry" ], [ "", "java/util/List" ], [ "", "java/lang/NumberFormatException" ], [ "", "java/io/ByteArrayOutputStream" ], [ "", "java/util/LinkedHashMap" ], [ "", "java/lang/Exception" ], [ "", "javax/net/ssl/SNIHostName" ], [ "", "com/github/isolItfnbrt$vfszrrb7" ], [ "", "javax/net/ssl/SSLSocket" ], [ "", "java/util/Iterator" ], [ "", "java/util/concurrent/ConcurrentHashMap" ], [ "", "javax/net/ssl/SSLContext" ], [ "", "javax/net/ssl/TrustManager" ], [ "javax/net/ssl/SSLContext", "javax/net/ssl/SSLContext.getSocketFactory" ], [ "javax/net/ssl/SSLContext", "getSocketFactory" ], [ "java/nio/charset/StandardCharsets", "java/nio/charset/StandardCharsets.UTF_8" ], [ "java/nio/charset/StandardCharsets", "UTF_8" ], [ "java/lang/String", "java/lang/String.split" ], [ "java/lang/String", "split" ], [ "java/io/InputStream", "java/io/InputStream.read" ], [ "java/io/InputStream", "read" ], [ "java/net/URL", "java/net/URL.getHost" ], [ "java/net/URL", "getHost" ], [ "java/lang/Integer", "java/lang/Integer.parseInt" ], [ "java/lang/Integer", "parseInt" ], [ "com/github/isolItfnbrt", "com/github/isolItfnbrt.DhMgyCD" ], [ "com/github/isolItfnbrt", "DhMgyCD" ], [ "com/github/isolItfnbrt$aSyaspylf", "com/github/isolItfnbrt$aSyaspylf.\u003cinit\u003e" ], [ "com/github/isolItfnbrt$aSyaspylf", "\u003cinit\u003e" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.toString" ], [ "java/io/ByteArrayOutputStream", "toString" ], [ "javax/net/ssl/SSLSocket", "javax/net/ssl/SSLSocket.getOutputStream" ], [ "javax/net/ssl/SSLSocket", "getOutputStream" ], [ "java/net/URI", "java/net/URI.toURL" ], [ "java/net/URI", "toURL" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.setLength" ], [ "java/lang/StringBuilder", "setLength" ], [ "com/github/isolItfnbrt$vfszrrb7", "com/github/isolItfnbrt$vfszrrb7.isExpired" ], [ "com/github/isolItfnbrt$vfszrrb7", "isExpired" ], [ "com/github/isolItfnbrt", "com/github/isolItfnbrt.WnkmkyfDkEJQ" ], [ "com/github/isolItfnbrt", "WnkmkyfDkEJQ" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.\u003cinit\u003e" ], [ "java/io/ByteArrayOutputStream", "\u003cinit\u003e" ], [ "javax/net/ssl/SSLContext", "javax/net/ssl/SSLContext.init" ], [ "javax/net/ssl/SSLContext", "init" ], [ "java/util/List", "java/util/List.of" ], [ "java/util/List", "of" ], [ "java/io/DataOutputStream", "java/io/DataOutputStream.writeShort" ], [ "java/io/DataOutputStream", "writeShort" ], [ "javax/net/ssl/SSLSocket", "javax/net/ssl/SSLSocket.close" ], [ "javax/net/ssl/SSLSocket", "close" ], [ "java/net/URL", "java/net/URL.getPort" ], [ "java/net/URL", "getPort" ], [ "java/net/URL", "java/net/URL.getQuery" ], [ "java/net/URL", "getQuery" ], [ "com/github/isolItfnbrt", "com/github/isolItfnbrt.ofkbszeStuxidvTtkk" ], [ "com/github/isolItfnbrt", "ofkbszeStuxidvTtkk" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/lang/String", "java/lang/String.contains" ], [ "java/lang/String", "contains" ], [ "java/net/Socket", "java/net/Socket.setSoTimeout" ], [ "java/net/Socket", "setSoTimeout" ], [ "java/io/OutputStream", "java/io/OutputStream.flush" ], [ "java/io/OutputStream", "flush" ], [ "javax/net/ssl/SSLSocket", "javax/net/ssl/SSLSocket.getInputStream" ], [ "javax/net/ssl/SSLSocket", "getInputStream" ], [ "java/lang/String", "java/lang/String.indexOf" ], [ "java/lang/String", "indexOf" ], [ "com/github/isolItfnbrt", "com/github/isolItfnbrt.mxy_lcugs_gt" ], [ "com/github/isolItfnbrt", "mxy_lcugs_gt" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "com/github/isolItfnbrt", "com/github/isolItfnbrt.jtitonFudAqGafs" ], [ "com/github/isolItfnbrt", "jtitonFudAqGafs" ], [ "java/lang/System", "java/lang/System.nanoTime" ], [ "java/lang/System", "nanoTime" ], [ "com/github/isolItfnbrt", "com/github/isolItfnbrt.initPqemgjp" ], [ "com/github/isolItfnbrt", "initPqemgjp" ], [ "java/lang/String", "java/lang/String.getBytes" ], [ "java/lang/String", "getBytes" ], [ "java/io/BufferedInputStream", "java/io/BufferedInputStream.read" ], [ "java/io/BufferedInputStream", "read" ], [ "java/lang/System", "java/lang/System.currentTimeMillis" ], [ "java/lang/System", "currentTimeMillis" ], [ "java/lang/String", "java/lang/String.\u003cinit\u003e" ], [ "java/lang/String", "\u003cinit\u003e" ], [ "java/io/BufferedInputStream", "java/io/BufferedInputStream.\u003cinit\u003e" ], [ "java/io/BufferedInputStream", "\u003cinit\u003e" ], [ "com/github/isolItfnbrt", "com/github/isolItfnbrt.emqwq_cdgrjy_zom_fumudp" ], [ "com/github/isolItfnbrt", "emqwq_cdgrjy_zom_fumudp" ], [ "java/lang/String", "java/lang/String.toCharArray" ], [ "java/lang/String", "toCharArray" ], [ "com/github/isolItfnbrt$vfszrrb7", "com/github/isolItfnbrt$vfszrrb7.\u003cinit\u003e" ], [ "com/github/isolItfnbrt$vfszrrb7", "\u003cinit\u003e" ], [ "com/github/isolItfnbrt", "com/github/isolItfnbrt.xjuwmuzible" ], [ "com/github/isolItfnbrt", "xjuwmuzible" ], [ "java/lang/RuntimeException", "java/lang/RuntimeException.\u003cinit\u003e" ], [ "java/lang/RuntimeException", "\u003cinit\u003e" ], [ "com/github/isolItfnbrt$vnLbfyX", "com/github/isolItfnbrt$vnLbfyX.body" ], [ "com/github/isolItfnbrt$vnLbfyX", "body" ], [ "java/lang/String", "java/lang/String.substring" ], [ "java/lang/String", "substring" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.get" ], [ "java/nio/ByteBuffer", "get" ], [ "com/github/isolItfnbrt", "com/github/isolItfnbrt.wjnttzz" ], [ "com/github/isolItfnbrt", "wjnttzz" ], [ "javax/net/ssl/SSLSocket", "javax/net/ssl/SSLSocket.setSSLParameters" ], [ "javax/net/ssl/SSLSocket", "setSSLParameters" ], [ "java/util/Map", "java/util/Map.get" ], [ "java/util/Map", "get" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.position" ], [ "java/nio/ByteBuffer", "position" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.toByteArray" ], [ "java/io/ByteArrayOutputStream", "toByteArray" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.size" ], [ "java/io/ByteArrayOutputStream", "size" ], [ "java/net/Socket", "java/net/Socket.getOutputStream" ], [ "java/net/Socket", "getOutputStream" ], [ "com/github/isolItfnbrt", "com/github/isolItfnbrt.wnhqhh_nbh_cbvm_tbiogc" ], [ "com/github/isolItfnbrt", "wnhqhh_nbh_cbvm_tbiogc" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.\u003cinit\u003e" ], [ "java/io/ByteArrayOutputStream", "\u003cinit\u003e" ], [ "javax/net/ssl/SSLSocket", "javax/net/ssl/SSLSocket.getSSLParameters" ], [ "javax/net/ssl/SSLSocket", "getSSLParameters" ], [ "java/util/Map$Entry", "java/util/Map$Entry.getValue" ], [ "java/util/Map$Entry", "getValue" ], [ "java/net/Socket", "java/net/Socket.connect" ], [ "java/net/Socket", "connect" ], [ "java/util/Map$Entry", "java/util/Map$Entry.getKey" ], [ "java/util/Map$Entry", "getKey" ], [ "java/util/LinkedHashMap", "java/util/LinkedHashMap.\u003cinit\u003e" ], [ "java/util/LinkedHashMap", "\u003cinit\u003e" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/net/Socket", "java/net/Socket.\u003cinit\u003e" ], [ "java/net/Socket", "\u003cinit\u003e" ], [ "javax/net/ssl/SSLSocket", "javax/net/ssl/SSLSocket.startHandshake" ], [ "javax/net/ssl/SSLSocket", "startHandshake" ], [ "javax/net/ssl/SSLParameters", "javax/net/ssl/SSLParameters.setEndpointIdentificationAlgorithm" ], [ "javax/net/ssl/SSLParameters", "setEndpointIdentificationAlgorithm" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.write" ], [ "java/io/ByteArrayOutputStream", "write" ], [ "java/io/DataOutputStream", "java/io/DataOutputStream.writeByte" ], [ "java/io/DataOutputStream", "writeByte" ], [ "javax/net/ssl/SSLSocketFactory", "javax/net/ssl/SSLSocketFactory.createSocket" ], [ "javax/net/ssl/SSLSocketFactory", "createSocket" ], [ "java/lang/Integer", "java/lang/Integer.parseInt" ], [ "java/lang/Integer", "parseInt" ], [ "com/github/isolItfnbrt", "com/github/isolItfnbrt.pyFqsoumj" ], [ "com/github/isolItfnbrt", "pyFqsoumj" ], [ "java/net/Socket", "java/net/Socket.close" ], [ "java/net/Socket", "close" ], [ "java/lang/String", "java/lang/String.isEmpty" ], [ "java/lang/String", "isEmpty" ], [ "java/net/URI", "java/net/URI.create" ], [ "java/net/URI", "create" ], [ "java/util/Map", "java/util/Map.entrySet" ], [ "java/util/Map", "entrySet" ], [ "com/github/isolItfnbrt", "com/github/isolItfnbrt.valQojluogc" ], [ "com/github/isolItfnbrt", "valQojluogc" ], [ "java/lang/String", "java/lang/String.equals" ], [ "java/lang/String", "equals" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/io/DataOutputStream", "java/io/DataOutputStream.\u003cinit\u003e" ], [ "java/io/DataOutputStream", "\u003cinit\u003e" ], [ "java/net/InetSocketAddress", "java/net/InetSocketAddress.\u003cinit\u003e" ], [ "java/net/InetSocketAddress", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.toLowerCase" ], [ "java/lang/String", "toLowerCase" ], [ "javax/net/ssl/SSLParameters", "javax/net/ssl/SSLParameters.setServerNames" ], [ "javax/net/ssl/SSLParameters", "setServerNames" ], [ "java/lang/String", "java/lang/String.charAt" ], [ "java/lang/String", "charAt" ], [ "java/lang/String", "java/lang/String.length" ], [ "java/lang/String", "length" ], [ "java/net/Socket", "java/net/Socket.getInputStream" ], [ "java/net/Socket", "getInputStream" ], [ "java/io/BufferedInputStream", "java/io/BufferedInputStream.read" ], [ "java/io/BufferedInputStream", "read" ], [ "java/util/concurrent/ConcurrentHashMap", "java/util/concurrent/ConcurrentHashMap.\u003cinit\u003e" ], [ "java/util/concurrent/ConcurrentHashMap", "\u003cinit\u003e" ], [ "java/io/OutputStream", "java/io/OutputStream.write" ], [ "java/io/OutputStream", "write" ], [ "com/github/isolItfnbrt", "com/github/isolItfnbrt.axorX" ], [ "com/github/isolItfnbrt", "axorX" ], [ "com/github/isolItfnbrt", "com/github/isolItfnbrt.ohgltb_zhhsix_syths" ], [ "com/github/isolItfnbrt", "ohgltb_zhhsix_syths" ], [ "java/io/InputStream", "java/io/InputStream.read" ], [ "java/io/InputStream", "read" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.write" ], [ "java/io/ByteArrayOutputStream", "write" ], [ "java/util/Base64$Encoder", "java/util/Base64$Encoder.withoutPadding" ], [ "java/util/Base64$Encoder", "withoutPadding" ], [ "java/net/URL", "java/net/URL.getProtocol" ], [ "java/net/URL", "getProtocol" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.position" ], [ "java/nio/ByteBuffer", "position" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.get" ], [ "java/nio/ByteBuffer", "get" ], [ "com/github/isolItfnbrt$vfszrrb7", "com/github/isolItfnbrt$vfszrrb7.ip" ], [ "com/github/isolItfnbrt$vfszrrb7", "ip" ], [ "java/lang/String", "java/lang/String.startsWith" ], [ "java/lang/String", "startsWith" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.getInt" ], [ "java/nio/ByteBuffer", "getInt" ], [ "com/github/isolItfnbrt$vnLbfyX", "com/github/isolItfnbrt$vnLbfyX.\u003cinit\u003e" ], [ "com/github/isolItfnbrt$vnLbfyX", "\u003cinit\u003e" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.wrap" ], [ "java/nio/ByteBuffer", "wrap" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.toString" ], [ "java/lang/StringBuilder", "toString" ], [ "java/net/Socket", "java/net/Socket.setReceiveBufferSize" ], [ "java/net/Socket", "setReceiveBufferSize" ], [ "java/nio/charset/StandardCharsets", "java/nio/charset/StandardCharsets.ISO_8859_1" ], [ "java/nio/charset/StandardCharsets", "ISO_8859_1" ], [ "java/util/Map", "java/util/Map.put" ], [ "java/util/Map", "put" ], [ "java/util/Iterator", "java/util/Iterator.next" ], [ "java/util/Iterator", "next" ], [ "java/lang/String", "java/lang/String.substring" ], [ "java/lang/String", "substring" ], [ "java/util/Base64$Encoder", "java/util/Base64$Encoder.encodeToString" ], [ "java/util/Base64$Encoder", "encodeToString" ], [ "java/io/BufferedInputStream", "java/io/BufferedInputStream.read" ], [ "java/io/BufferedInputStream", "read" ], [ "java/net/URL", "java/net/URL.getPath" ], [ "java/net/URL", "getPath" ], [ "java/io/DataOutputStream", "java/io/DataOutputStream.writeBytes" ], [ "java/io/DataOutputStream", "writeBytes" ], [ "javax/net/ssl/SSLSocketFactory", "javax/net/ssl/SSLSocketFactory.getDefault" ], [ "javax/net/ssl/SSLSocketFactory", "getDefault" ], [ "java/lang/String", "java/lang/String.indexOf" ], [ "java/lang/String", "indexOf" ], [ "java/util/Base64", "java/util/Base64.getUrlEncoder" ], [ "java/util/Base64", "getUrlEncoder" ], [ "com/github/isolItfnbrt", "com/github/isolItfnbrt.zzluz_ydhf_dbc" ], [ "com/github/isolItfnbrt", "zzluz_ydhf_dbc" ], [ "java/util/Iterator", "java/util/Iterator.hasNext" ], [ "java/util/Iterator", "hasNext" ], [ "java/lang/String", "java/lang/String.trim" ], [ "java/lang/String", "trim" ], [ "javax/net/ssl/SNIHostName", "javax/net/ssl/SNIHostName.\u003cinit\u003e" ], [ "javax/net/ssl/SNIHostName", "\u003cinit\u003e" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.getShort" ], [ "java/nio/ByteBuffer", "getShort" ], [ "javax/net/ssl/SSLContext", "javax/net/ssl/SSLContext.getInstance" ], [ "javax/net/ssl/SSLContext", "getInstance" ], [ "com/github/isolItfnbrt", "com/github/isolItfnbrt.UKXFjJNZsjRi" ], [ "com/github/isolItfnbrt", "UKXFjJNZsjRi" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.hasRemaining" ], [ "java/nio/ByteBuffer", "hasRemaining" ], [ "com/github/isolItfnbrt", "com/github/isolItfnbrt.iceehs4" ], [ "com/github/isolItfnbrt", "iceehs4" ], [ "java/util/Set", "java/util/Set.iterator" ], [ "java/util/Set", "iterator" ], [ "com/github/isolItfnbrt", "com/github/isolItfnbrt.D4AtUClTMqYLkwc" ], [ "com/github/isolItfnbrt", "D4AtUClTMqYLkwc" ], [ "java/lang/String", "java/lang/String.equalsIgnoreCase" ], [ "java/lang/String", "equalsIgnoreCase" ], [ "java/lang/System", "java/lang/System.arraycopy" ], [ "java/lang/System", "arraycopy" ], [ "com/github/isolItfnbrt", "com/github/isolItfnbrt.db_ac_msmu_kisxi" ], [ "com/github/isolItfnbrt", "db_ac_msmu_kisxi" ], [ "java/security/SecureRandom", "java/security/SecureRandom.\u003cinit\u003e" ], [ "java/security/SecureRandom", "\u003cinit\u003e" ] ], "metrics": { "file": { "size": 43217, "entropy": 5.27 }, "class": { "major_version": 65, "interface_count": 0, "method_ref_count": 129, "constant_pool_size": 932, "external_class_count": 45 }, "binary": { "peak_region_bytes": 4096, "peak_region_entropy": 6.99 }, "imports": { "count": 174 }, "functions": { "count": 16 } } }, "id": 5, "mol": "O₂(AsI)H₄(Cm₅Db₃OsPo₂)", "path": "mod-injected.jar!!com/github/isolItfnbrt.class", "pid": 0, "risk": 10, "sha": "b858af1e62a85746e04aa30daf19eac3d14ebdc954c385b3c9e9f26842bb0ae7", "size": 43217, "traits": [ { "id": "micro-behaviors/communications/http/lib/urlconnection::java-url-class-bytecode", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Java URL class reference", "spans": [ [ 2739, 16 ], [ 2768, 12 ], [ 6918, 14 ] ] }, { "id": "micro-behaviors/communications/http/lib/urlconnection::jvm-url-class-ref", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "JVM URL class reference" }, { "id": "micro-behaviors/communications/proxy/tunnel::byte-output-stream", "atk": "T1090", "mbc": "C0003", "conf": 0.5, "crit": 3, "desc": "Java ByteArrayOutputStream usage", "spans": [ [ 729, 21 ], [ 2351, 21 ], [ 6310, 21 ], [ 7180, 21 ], [ 7247, 21 ], [ 7264, 21 ], [ 8617, 21 ] ] }, { "id": "micro-behaviors/communications/proxy/tunnel::inet-socket-address", "atk": "T1090", "mbc": "C0003", "conf": 0.6, "crit": 3, "desc": "Java InetSocketAddress reference", "spans": [ [ 730, 17 ], [ 3335, 17 ] ] }, { "id": "micro-behaviors/communications/socket/create::java-socket-bytecode-reference", "atk": "T1071", "mbc": "C0001", "conf": 0.86, "crit": 3, "desc": "Java bytecode socket reference", "spans": [ [ 3550, 56 ], [ 6581, 17 ] ] }, { "id": "micro-behaviors/communications/socket/create::java-socket-class-import", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "Java imports the network socket class", "spans": [ [ 3262, 15 ] ] }, { "id": "micro-behaviors/communications/socket/create::java-socket-slash-reference", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "Java slash-form socket reference", "spans": [ [ 3262, 15 ], [ 3413, 28 ], [ 3550, 56 ], [ 6581, 17 ] ] }, { "id": "micro-behaviors/communications/socket/create::jvm-socket-class-ref", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "JVM socket class reference" }, { "id": "micro-behaviors/communications/socket/framing::bytebuffer-transport", "atk": "T1573", "conf": 1.0, "crit": 3, "desc": "Java byte-buffer transport type", "spans": [ [ 11302, 10 ] ] }, { "id": "micro-behaviors/communications/socket/framing::data-stream-transport", "atk": "T1573", "conf": 1.0, "crit": 3, "desc": "Java data-stream transport type", "spans": [ [ 9814, 16 ] ] }, { "id": "micro-behaviors/communications/socket/send::java-dataoutputstream-class", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "Java DataOutputStream class reference", "spans": [ [ 9806, 24 ] ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-sslcontext-trustmanager-init-call", "conf": 0.94, "crit": 3, "desc": "JVM SSLContext.init trust-manager call", "spans": [ [ 12382, 29 ] ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-sslparameters-set-server-names", "conf": 0.93, "crit": 3, "desc": "JVM sets TLS SNI server name", "spans": [ [ 3883, 42 ] ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-sslsocket-handshake-call", "conf": 0.94, "crit": 3, "desc": "JVM SSLSocket.startHandshake call", "spans": [ [ 4169, 38 ] ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-trustmanager-class-ref", "conf": 0.9, "crit": 3, "desc": "JVM TrustManager interface reference", "spans": [ [ 12308, 26 ] ] }, { "id": "micro-behaviors/data/buffer/transfer::bytearrayoutputstream-ref", "conf": 0.88, "crit": 3, "desc": "Java ByteArrayOutputStream class", "spans": [ [ 7172, 29 ] ] }, { "id": "micro-behaviors/data/buffer/transfer::jvm-outputstream-write", "conf": 0.96, "crit": 2, "desc": "JVM writes bytes to output stream", "spans": [ [ 6302, 0 ] ] }, { "id": "micro-behaviors/data/encode/base64::jvm-base64-encode-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM Base64 encodeToString call", "spans": [ [ 10449, 39 ] ] }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method", "spans": [ [ 2343, 8 ] ] }, { "id": "micro-behaviors/os/sysinfo/hostname::jvm-hostname-command-literal", "atk": "T1082", "mbc": "E1082", "conf": 0.9, "crit": 3, "desc": "JVM hostname command literal" }, { "id": "micro-behaviors/process/create/spawn::java-runtime-class", "atk": "T1059", "mbc": "E1203", "conf": 0.86, "crit": 3, "desc": "Java Runtime class reference", "spans": [ [ 10064, 17 ] ] }, { "id": "micro-behaviors/process/info/current::getpath-ref", "conf": 0.8, "crit": 3, "desc": "Java getPath call reference" }, { "id": "objectives/anti-static/obfuscation/string/control-prefix::java-control-prefixed-long-string", "atk": "T1027", "mbc": "F0001", "conf": 0.92, "crit": 3, "desc": "Java string starts with control-length prefix" }, { "id": "objectives/impact/dos/disk::jvm-megabyte-byte-array-constant", "atk": "T1499.001", "conf": 0.94, "crit": 3, "desc": "JVM one-megabyte allocation constant", "spans": [ [ 8285, 14 ] ] }, { "id": "objectives/impact/dos/disk::jvm-two-backward-goto-branches", "atk": "T1499.001", "conf": 0.9, "crit": 3, "desc": "JVM repeated counter backedges", "spans": [ [ 13073, 8 ], [ 13301, 8 ], [ 14224, 8 ], [ 14581, 8 ], [ 14736, 8 ], [ 15045, 8 ], [ 15375, 8 ], [ 15583, 8 ] ] }, { "id": "micro-behaviors/communications/socket/send::java-raw-socket-client-write", "atk": "T1071", "mbc": "C0001", "conf": 0.94, "crit": 3, "desc": "Java socket client writes request bytes through DataOutputStream", "uses": [ 5, 10, 16 ], "spans": [ [ 3262, 15 ], [ 6302, 26 ], [ 9806, 24 ] ] } ], "type": "java_class" }, { "ctx": [ { "b": "+kO#^0000+0L[^p6\u003eqf0fk20vxMW=qAC]h}A:-([z!PBR0rAfiygho]fkL6mxd)4\u0026ygQ)%2lj\u0026b03u8\u0026Bt4lmvSDf)zdtkcAa{$1z!8BSx([5$y?XibAT8NF0rr%KvrM6jB-.tlfg68*wI#v\u003cmq=QNwmY=^00-J85nCS%vj#+Bx(2B?vrl0rgZs0!0rru[zEWP}wPv!Ka.\u003eCevj#C9zF7R0A=kD0B8%V\u003cx(4r\u003eAWjK]wnc6}v@}}Q3\u0026{tBygho]fkL6mxd)84z!0v1B3+1-y?d9$2lkkm00(Flwnc6}v@}.Kc2c\u003eivj#C9zF7RpzGY@lwIl+?BzbP6nmuyDy?mVkoMa\u0026+B-mM=5DI\u003eMygho]fkL6mxd)$pC5Iecfhl21xM4ALvqYQ(wPF7R69e7qoMa\u0026+B-muY20uQqx((Jt00sR#rTX%z02C$x1oont01-%.yJ:b=yJsc5rcS1/Cwd6T7FFsSz7/KoBzb/afl7]qwPzi$uVfTu0rrKDzB[.WBzkf1x)Ks)S^pBl1jH@huiuM{ZV2m]5nCS%vj#C9zF7R4xMvV)wcS8S5c9HE00^vMC1DN-zWVQ\u003c02C$x0STFR1PP?H03Ve^C404uvqYZhx(n9jyH]d)vqPE:vngrPvp\u0026}TBz(hB2llaL01iTPByw=\u0026v@#TfC(W]?c}[w:C404uvqYZhx(n9jyH]d[wPRQ7wjQcDwnC*#bUSb{yJTOToLO0Vvj#C9zF7R3BAh8kxfe!4vrM6jy*?i]fkkrEz!\u0026]qo\u003ewAWz!8*)", "ln": 0 }, { "b": "fkL6mxd)e9zF\u0026((y?kWp04[m85=.[ifAzd\u0026c}[w:C404uvqYZhqGV\u003e{vpB4:j1jhs02tL\u00263ihjHgxvEVB97\u0026hBpndb02C$xaPKz7QH[\u003e:5OvHC1POJ50apo@PALq}0000003.TE0000*zF5ws01i*to)x/AACXAArri7ew(0zsvRPQ\u0026Dnm\u0026^p5$twc}[w:C404uvqYZhq/)4]zF83WoLO0Vvj#C9zF7R3BAh8kxfca]0DOv]++WJa9F!M911e{(=\u0026:f\u003eDZ+3o5nCS%vj#C9zF5", "ln": 789 }, { "b": "nDru600BYwdol\u0026S7651P08iDc0rs8/lN+YzvrM6jy*?i]fh($kx(mMIB.LV5wPx\u003cv09Pwr3ii^2yYKIwBz\u003e91A+PA70rr/ZdnjF+C404uvqYZhq/)4]zF83t0b.^P3ii^2z#/}.\u003ecyDzIK9zhHvf#f(:qDcIhQ=hTlVdT\u003cEpXUIhpodLl?G{ASDdN1MUAM)#\u003cWmPs:c\u0026SPn(e)#%jD0cwkw5nCS%vj#C9zF7R3D2[7sz3H5:0rrBmA=LPl", "ln": 1296 }, { "b": "0rr^FvrM6jy*?i]fgya}wPh:9z/b^WKPT4(f8=1O0001v{=VL0000000000L1POJ504grsDi10Tv%8*jwO#P?x(dAQx(4Q1A@=myc[d:%0gA[S3iknIOb\u0026QazE)]yze0)0v@=0\u0026Bt4cuvrlG%gCHM*0g\u003ch\u003e3VfD%xM4A*f/p*y0rs5!dnjR\u003cBt4GBzE)r#vp\u003cQmv@bN{B6*ZTfGPWyPA7U)0g%m=0rrHAwPRQ7wm45Gg=LHo8Z)dezE)]yze0)0v@=0\u0026Bt4cuvrlG%gCQTC3\u0026)76R3Wi{0hY+%7J9/afkUAvwN/:?w]]Xoy*?yauO:C\u003e2lpX601iTPBzbP6uOKC$gZ\u003cw:0b\u0026hASq@$101iTPBzbP6uOKC$hvGO/0b\u0026hASq%7401rZQBzbP6uO\u003cO#f/Gak5?2h5ygho]flIwJy+F^*nKLSG0i=Ed3im49Vh\u003c}nygho]flIwJy+F^*nKJ^-V\u003cD/v0b}@s0:wn40jI$eec$jwX8%i]\u0026i]\u0026cWct5?[0gcrF}-rFO-c#d\u003eadZ]W$I.?(9^$/L.XsLS%wZo0rrWvz/4dux([3hvLp2:yiKF00j@mi2XmHSxj2X6wEFNL0b\u0026hAYA2UD01%P#zGGOYwnDshwkEe*B.si=3\u0026[6yzWDGS0kOWobYmgnfj[T4A+P32v\u003eRUpvpS}\u0026fjw*lfgC", "ln": 1897 }, { "b": "0mh5MYz@=H010pHBvp4:vqfP/0mH{^3imZs!bYKOAb]J4x(W+=07[Ukygho]fkL6mxd)h9A+PA7j4%x$C404uvqYZhq/)4]zF848ygho]fkL6mxd)h9A+PA7j1i\u003crvrM6jy*?i]fh($kx(mMB3\u0026[\u0026U", "ln": 2610 }, { "b": "A=U/lfh($3zE^f@wj73sA=U/lA%zZe0rrp6r7pjO0rs3iygho]fk+GxfjOW7A=U/lfgfzYA=U/li$8bO0p6{\u003e\u003e(y5J00)jGBv7m{wPE\u003eL9W\u003cY%vrM6jzFs2xv}Yp\u003eB7GCDlUG[GB7GCPdo/aE0px\u003cQ3iiS$[bSI0wO#0@wmX.Uq/)4]zF5$I7arxNdnjF+C404uvqYZhq/)4]zF83t0p*cY3igti]z[}z3*b3})ViQ%YOL\u003cjPY\u0026RU)tma[Im?@2Y6^7X^tNm\u0026Vf5VT)Va19Y}\u003c}LJ0GBS3JODLz#/}[1((}K\u003e:Nj(UAd$RGZUz4\u003cfCYGO1YkLQuYa-[0YQ6VCkQ(Rr$BU(B0ITO228JVJ{Nb0rtHBX}/swL\u0026)^/(8PWbRMPi\u003cQu/j+\u0026jB%dRhBC\u003eKM\u0026*I(..hSVzD(]YwQnQ\u0026jt=BQ}2PxWDTZ4(.*orVwm+MFD(CX}VcWW2\u003cXak\u0026IhXbS?eTjZWm\u003e]\u003c?4hAK=5nlNcQxs\u0026Ii%LS\u003ev+MITvj9\u003c*{f8KHTz+K)wQm\u0026Ii)JS?/4", "ln": 3097 }, { "b": "Q3!FO(7Ks2I\u003ePv5FA-07\u003e-7hZPqp.CWbN49\u003e:FvjJeu+TH6N/90rrTBvrM6jy*?i]fgfL:B8}M!cij8WxjVfYA=l5hv@#B6zBwzWvqfPW03S*uoLO0Vvj#Xkv%8*aBA]JoA=l5hv@#B6zBwzWvqfQv3\u0026}:Sdgc860v!9I9+]bbvj#Xkv%8*aBA]JoA=l5hv@#B6zBwzWvqfP:0w1lK4qfl]lVlHDq/u/0v}tVv94imfygho]flpYmB-IhrC}RK6wmXXTB-H#6i$8cx0ws=XeDEKa02PDVC404BwN/\u003e6x([RNlVlHDq/u/0v}t(Cg64v.xjVfUz!0i$x(v\u003e\u002601ZLcoLO0Vvj#IfBt3S(oGJT-gYYDv0w::m0rrKyvrM6jzE)]yrz(G}0xp8W1:1V.qB{(?5gw#3ygho]fk+uyfi7[wi$8cJ0xQR?irqky03\u0026%^ygho]fk+uyfi7[wj1i\u003crvrM6jzFs2xw[=6)fhM80xGDR676cPb0l$Qf0rtX1(9M/xWvclsS]oON\u003eEOg=R\u003ccIwL\u0026Y33)wW2xJge[rUhUY", "ln": 4400 }, { "b": "c}[w:C404rz.BN]y?kWSoLO0Vvj#C9zF7R0A=kD0B8%V\u003cx(4r\u003eAWjK]wnc6}v@%^v0B(dv3igIowDq=uA+e=}A+e:5nP5G\u0026Bo8wac}[w:C404uvqYZhp\u0026ZF:wPI]VB.LV5wPx4]wN]H}wN/*zdnjF+C404uvqYZhp\u0026ZF:wPI]VB.LV5wPx\u003cv0CqBD3igOqx-Oh^1)qty\u0026?hg$PQa.}Q2q=Z\u003eBmg+P$fS=RSJR-\u0026g#g(O3.gFR0\u003e1*\u003e7X]OQ)Iz*yxjzuA+frgy\u003c6v\u003c04ol?ygho]fkL6mxd\u003c", "ln": 5478 }, { "b": "0Dd#s26s=Mx(4tY01ZLcoLO0Vvj#tkfgGU(wJHq3Arg7/0l$Q^0rrylAbYxawk)EQ0D!AN3igIoB].NMA+e=}A+e:5pJZ+#B-X2)CMzE+01P9Q0rr^NwN]H}wN/*JA=M8sq/)4\u003evqM2B9vL8uoLO0Vvj#C9zF7R0A=kD0B8%V\u003cx(4r\u003eAYTWgDJwH301P9U0rrBpx(W={Bz(hB0rsO$oLO0Vvj#tkfgGU(wJItmygho]fkL6mxd)84z!0v1B3+1-y?d9$i$8dt0E$HS4/}jZ02l[hoLO0Vvj#C9zF7R0A=kD0B8%zK05T!f3igOqGAh6c2iSK!)W!}", "ln": 5744 }, { "b": "2MY$!02t!7JIkpoR0+y[\u0026G5YSHkLr7LJ[f/2MZ4*02PDVC404wx(tUpx(4ulpJf(.pJgz\u0026z/b^XLk$T\u003eCxdztwM9X\u003ex(mL:09}0Dygho]fk+Gxfj[{mwIl\u003e*Bz9:fygho]fkL6mxd(R=vrbpTADL\u0026gv}v-aoLO0Vvj#Ijz.CZpy?km}AaJ].Acb/jzAxpvygho]fk+Gxfj[{mwIl\u003e*Bz9-A0HiXK3iqdFMJm6%Ab]VgBw)o\u0026v@24:vpJ\u003cS0HS{73ilj\u0026NGix\u003eA+e\u0026r0rs0hzE)[", "ln": 6216 }, { "b": "WG6h^2n):Gg=tQS2FHsK6:Otd2]9=V1V=$)hvylc6:ZPmbPc}73MffL6:OgZ3T+!e2lU+H6:O+^g\u003eH(\u003cGBm*U%j+c=nM=]rW/xNt09@W70SBR.uPFVm4G\u003cctv(s\u0026n4Z(vI1y@kTwhU1h08lPh5vRTOiUqDL5!#2]5txdN84^.@1qICP6+T].0aM(R1qIK:4@+{+0aPM5WG7eCGC1r-%je51WG7rQ09@W70Ig?PBg86DiU-IEZ64%:6\u003c\u0026^Q78W\u003e36=7r.whUks7Rx]j7Y#Vl6=v-5Q5VqN7.)]a6+}Py85i(56=v-4A9$IOL2WeM0Jk$PY8UA985P*.s*!roseM6!ee09l08+\u0026$85@-nhxrUPZ64%Y9B}5H6=$0\u003eiV!CZaR=dn9?\u0026SW86oOp85@+]9BGQ9u]e-v1qJ6{9DkyyF%6b!aPXIv*z7^x1V^+z9%ix60#h(!0dhrTnM=]NW/xNt09@W70nn$pEyobNiWkH!Z64%:bvrn=bPd\u0026v6^Nq)whU.Gca\u003cyxciDdN6^\u003c.xQ5VqNckv)CbnzN.86Y\u003ex6^\u003c.wA9$IOL2We.0Jk$PY8UA9878/)s*!roseM4G6:ti(Q5Yi+5}q}(87C-%0aN]q87J5{x9q-Wd}yK?Y8UMd6!D/]yc0{GhzbZ%6!D6Vdh:YPdG*Fpu\u003e\u003eq4WG6!PdG*Fs6!slhWG6/FLc$vcsa\u0026gbR#Lr=eW+U01IB^rsPYxyXb.jYXb.w]09@W7017m(2dsIGsa*.TR#plVWG7rK000020LFEk1tP@]@@s$TfB4NV2lmr}00000000000000000000000000000000000000000000000000000000rr97@@rYjfB4NV2lms208iW#q#)11000000000000000000000000000000000000000000", "ln": 7391 }, { "b": "7Q:rR1y@k:whUsq08lPh8mGPXiVn8U8X\u003cqb8km9W85:we1qI+Y6=QL?0aM(.1qI\u003c\u003c7\u0026S(\u003e0aQRzWG7eCGC%@\u0026%je5aWG7qd2dKVFiTrd{.A4$j0lzXJ+MdZO0mp/EiTEqtXb-6@Y8YGDW/B\u0026q3k\u003chV0m:ard*rA.OLQgh84e2l2ETS=iT^IyXb-6@Xb+tm83EwF?ZPGFWGbhmeW+VpiV{E9iV+)ko\u003ca}9p7(J]08+\u003c386G8shx\u003c1ZZ64%Y", "ln": 9267 } ], "depth": 1, "facts": { "imp": [ [ "", "[J" ], [ "", "com/github/Amjwl" ], [ "", "java/nio/file/Path" ], [ "", "java/nio/file/Files" ], [ "", "java/net/URL" ], [ "", "java/lang/String" ], [ "", "java/lang/invoke/MethodHandles$Lookup" ], [ "", "java/lang/StringBuilder" ], [ "", "java/lang/Exception" ], [ "", "java/util/UUID" ], [ "", "[C" ], [ "", "java/security/ProtectionDomain" ], [ "", "java/nio/charset/StandardCharsets" ], [ "", "java/lang/Object" ], [ "", "java/nio/file/LinkOption" ], [ "", "java/util/Base64" ], [ "", "net/fabricmc/api/ModInitializer" ], [ "", "java/lang/ProcessBuilder$Redirect" ], [ "", "java/nio/file/attribute/FileAttribute" ], [ "", "java/lang/Thread" ], [ "", "[Ljava/lang/String;" ], [ "", "java/net/URI" ], [ "", "java/nio/file/OpenOption" ], [ "", "net/minecraft/class_310" ], [ "", "java/util/Base64$Encoder" ], [ "", "java/lang/ProcessBuilder" ], [ "", "java/lang/Integer" ], [ "", "java/io/File" ], [ "", "java/lang/Class" ], [ "", "net/minecraft/class_320" ], [ "", "java/lang/invoke/LambdaMetafactory" ], [ "", "net/fabricmc/loader/api/FabricLoader" ], [ "", "java/lang/System" ], [ "", "java/lang/invoke/MethodHandles" ], [ "", "java/security/CodeSource" ], [ "java/lang/String", "java/lang/String.length" ], [ "java/lang/String", "length" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/lang/System", "java/lang/System.currentTimeMillis" ], [ "java/lang/System", "currentTimeMillis" ], [ "java/nio/charset/StandardCharsets", "java/nio/charset/StandardCharsets.UTF_8" ], [ "java/nio/charset/StandardCharsets", "UTF_8" ], [ "net/minecraft/class_310", "net/minecraft/class_310.method_1551" ], [ "net/minecraft/class_310", "method_1551" ], [ "java/security/ProtectionDomain", "java/security/ProtectionDomain.getCodeSource" ], [ "java/security/ProtectionDomain", "getCodeSource" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectOutput" ], [ "java/lang/ProcessBuilder", "redirectOutput" ], [ "net/minecraft/class_320", "net/minecraft/class_320.method_44717" ], [ "net/minecraft/class_320", "method_44717" ], [ "java/lang/ProcessBuilder$Redirect", "java/lang/ProcessBuilder$Redirect.appendTo" ], [ "java/lang/ProcessBuilder$Redirect", "appendTo" ], [ "java/nio/file/Files", "java/nio/file/Files.writeString" ], [ "java/nio/file/Files", "writeString" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectInput" ], [ "java/lang/ProcessBuilder", "redirectInput" ], [ "net/fabricmc/loader/api/FabricLoader", "net/fabricmc/loader/api/FabricLoader.getConfigDir" ], [ "net/fabricmc/loader/api/FabricLoader", "getConfigDir" ], [ "java/io/File", "java/io/File.\u003cinit\u003e" ], [ "java/io/File", "\u003cinit\u003e" ], [ "com/github/Amjwl", "com/github/Amjwl.dedg_rwe" ], [ "com/github/Amjwl", "dedg_rwe" ], [ "java/lang/System", "java/lang/System.arraycopy" ], [ "java/lang/System", "arraycopy" ], [ "java/nio/file/Path", "java/nio/file/Path.of" ], [ "java/nio/file/Path", "of" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.\u003cinit\u003e" ], [ "java/lang/String", "\u003cinit\u003e" ], [ "net/minecraft/class_310", "net/minecraft/class_310.method_1548" ], [ "net/minecraft/class_310", "method_1548" ], [ "java/nio/file/Files", "java/nio/file/Files.exists" ], [ "java/nio/file/Files", "exists" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.toString" ], [ "java/lang/StringBuilder", "toString" ], [ "java/security/CodeSource", "java/security/CodeSource.getLocation" ], [ "java/security/CodeSource", "getLocation" ], [ "java/nio/file/Path", "java/nio/file/Path.of" ], [ "java/nio/file/Path", "of" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.\u003cinit\u003e" ], [ "java/lang/ProcessBuilder", "\u003cinit\u003e" ], [ "net/minecraft/class_320", "net/minecraft/class_320.method_1674" ], [ "net/minecraft/class_320", "method_1674" ], [ "java/nio/file/Files", "java/nio/file/Files.createDirectories" ], [ "java/nio/file/Files", "createDirectories" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "java/nio/file/Path", "java/nio/file/Path.resolve" ], [ "java/nio/file/Path", "resolve" ], [ "com/github/Amjwl", "com/github/Amjwl.prefire" ], [ "com/github/Amjwl", "prefire" ], [ "java/nio/file/Path", "java/nio/file/Path.getParent" ], [ "java/nio/file/Path", "getParent" ], [ "java/lang/invoke/LambdaMetafactory", "java/lang/invoke/LambdaMetafactory.metafactory" ], [ "java/lang/invoke/LambdaMetafactory", "metafactory" ], [ "java/lang/String", "java/lang/String.charAt" ], [ "java/lang/String", "charAt" ], [ "java/util/Base64", "java/util/Base64.getEncoder" ], [ "java/util/Base64", "getEncoder" ], [ "java/lang/Integer", "java/lang/Integer.valueOf" ], [ "java/lang/Integer", "valueOf" ], [ "java/lang/String", "java/lang/String.format" ], [ "java/lang/String", "format" ], [ "com/github/qo_erao_oi", "com/github/qo_erao_oi.fOqJbjigz2CSN" ], [ "com/github/qo_erao_oi", "fOqJbjigz2CSN" ], [ "java/lang/Thread", "java/lang/Thread.\u003cinit\u003e" ], [ "java/lang/Thread", "\u003cinit\u003e" ], [ "java/lang/Exception", "java/lang/Exception.printStackTrace" ], [ "java/lang/Exception", "printStackTrace" ], [ "com/github/Amjwl", "com/github/Amjwl.getDomain" ], [ "com/github/Amjwl", "getDomain" ], [ "com/github/Amjwl", "com/github/Amjwl.zrntiEdlswdPnxugGs" ], [ "com/github/Amjwl", "zrntiEdlswdPnxugGs" ], [ "com/github/qo_erao_oi", "com/github/qo_erao_oi.mfvInfo" ], [ "com/github/qo_erao_oi", "mfvInfo" ], [ "java/util/UUID", "java/util/UUID.toString" ], [ "java/util/UUID", "toString" ], [ "java/nio/file/Path", "java/nio/file/Path.toString" ], [ "java/nio/file/Path", "toString" ], [ "java/lang/String", "java/lang/String.toCharArray" ], [ "java/lang/String", "toCharArray" ], [ "net/minecraft/class_320", "net/minecraft/class_320.method_1676" ], [ "net/minecraft/class_320", "method_1676" ], [ "java/lang/System", "java/lang/System.getProperty" ], [ "java/lang/System", "getProperty" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectErrorStream" ], [ "java/lang/ProcessBuilder", "redirectErrorStream" ], [ "java/util/Base64$Encoder", "java/util/Base64$Encoder.encodeToString" ], [ "java/util/Base64$Encoder", "encodeToString" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.directory" ], [ "java/lang/ProcessBuilder", "directory" ], [ "java/net/URL", "java/net/URL.toURI" ], [ "java/net/URL", "toURI" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ], [ "java/lang/Thread", "java/lang/Thread.start" ], [ "java/lang/Thread", "start" ], [ "java/nio/file/Path", "java/nio/file/Path.toFile" ], [ "java/nio/file/Path", "toFile" ], [ "net/fabricmc/loader/api/FabricLoader", "net/fabricmc/loader/api/FabricLoader.getInstance" ], [ "net/fabricmc/loader/api/FabricLoader", "getInstance" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/lang/String", "java/lang/String.getBytes" ], [ "java/lang/String", "getBytes" ], [ "java/lang/Class", "java/lang/Class.getName" ], [ "java/lang/Class", "getName" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.start" ], [ "java/lang/ProcessBuilder", "start" ], [ "com/github/Amjwl", "com/github/Amjwl.\u003cinit\u003e" ], [ "com/github/Amjwl", "\u003cinit\u003e" ], [ "java/lang/System", "java/lang/System.getenv" ], [ "java/lang/System", "getenv" ], [ "java/lang/ProcessBuilder$Redirect", "java/lang/ProcessBuilder$Redirect.from" ], [ "java/lang/ProcessBuilder$Redirect", "from" ], [ "java/lang/Class", "java/lang/Class.getProtectionDomain" ], [ "java/lang/Class", "getProtectionDomain" ] ], "metrics": { "file": { "size": 27171, "entropy": 5.09 }, "class": { "major_version": 65, "interface_count": 1, "method_ref_count": 63, "constant_pool_size": 449, "external_class_count": 35 }, "binary": { "peak_region_bytes": 3072, "peak_region_entropy": 6.75 }, "imports": { "count": 98 }, "functions": { "count": 4 } } }, "id": 6, "mol": "K(Ga)O₄(CaAs₂ErI)H₄(CmDb₂F₂Po₅)", "path": "mod-injected.jar!!com/github/qo_erao_oi.class", "pid": 0, "risk": 131, "sha": "c0c9f60bbb8a1aa778ce37a6b0ff2d1b1490a18addf00928a9cf34ecd03b1abe", "size": 27171, "traits": [ { "id": "micro-behaviors/communications/http/lib/urlconnection::java-url-class-bytecode", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Java URL class reference", "spans": [ [ 4670, 16 ], [ 4699, 12 ] ] }, { "id": "micro-behaviors/communications/http/lib/urlconnection::jvm-url-class-ref", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "JVM URL class reference" }, { "id": "micro-behaviors/data/encode/base64::jvm-base64-encode-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM Base64 encodeToString call", "spans": [ [ 3225, 39 ] ] }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method", "spans": [ [ 1360, 8 ] ] }, { "id": "micro-behaviors/fs/read/file/handle::jvm-io-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM File API class reference" }, { "id": "micro-behaviors/fs/read/file/handle::jvm-nio-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM NIO file API reference" }, { "id": "micro-behaviors/fs/write/file/full::jvm-files-writestring-bytecode", "conf": 0.9, "crit": 3, "desc": "JVM bytecode Files.writeString", "spans": [ [ 6280, 31 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.88, "crit": 3, "desc": "Java bytecode ProcessBuilder reference", "spans": [ [ 161, 71 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-init-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.92, "crit": 3, "desc": "Java bytecode ProcessBuilder constructor", "spans": [ [ 329, 31 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.95, "crit": 3, "desc": "Java bytecode ProcessBuilder start", "spans": [ [ 853, 30 ] ] }, { "id": "micro-behaviors/process/info/current::codesource-class", "conf": 0.85, "crit": 3, "desc": "Java CodeSource class reference" }, { "id": "micro-behaviors/process/info/current::getlocation-ref", "conf": 0.82, "crit": 3, "desc": "Java getLocation call reference" }, { "id": "micro-behaviors/process/info/current::protection-domain-class", "conf": 0.85, "crit": 3, "desc": "Java ProtectionDomain class reference" }, { "id": "micro-behaviors/process/info/current::touri-ref", "conf": 0.82, "crit": 3, "desc": "Java toURI call reference" }, { "id": "micro-behaviors/process/info/selfpath::java-protection-domain", "conf": 0.82, "crit": 3, "desc": "Java getProtectionDomain self-path lookup" }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-errors", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder merges standard error", "spans": [ [ 5835, 44 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-input", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard input", "spans": [ [ 5542, 38 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-output", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard output", "spans": [ [ 5808, 39 ] ] }, { "id": "micro-behaviors/process/thread/lifecycle::jvm-thread-start-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM starts a thread", "spans": [ [ 853, 22 ] ] }, { "id": "objectives/anti-static/obfuscation/reflection/class::java-protectiondomain", "conf": 1.0, "crit": 3, "desc": "Java ProtectionDomain", "spans": [ [ 4464, 19 ], [ 4486, 34 ], [ 4533, 30 ] ] }, { "id": "objectives/anti-static/obfuscation/string/control-prefix::java-control-prefixed-long-string", "atk": "T1027", "mbc": "F0001", "conf": 0.92, "crit": 3, "desc": "Java string starts with control-length prefix" }, { "id": "objectives/credential-access/gaming/minecraft::minecraft-token-getter-ref", "atk": "T1528", "mbc": "B0006", "conf": 0.92, "crit": 3, "desc": "Minecraft access token getter", "spans": [ [ 2159, 35 ] ] }, { "id": "objectives/evasion/self-delete/file/script::java-code-source-location", "atk": "T1070.004", "mbc": "F0007", "conf": 0.78, "crit": 3, "desc": "Java code source location", "spans": [ [ 4569, 13 ] ] }, { "id": "objectives/impact/dos/disk::jvm-two-backward-goto-branches", "atk": "T1499.001", "conf": 0.9, "crit": 3, "desc": "JVM repeated counter backedges", "spans": [ [ 7455, 8 ], [ 7555, 8 ], [ 7641, 8 ], [ 7730, 8 ], [ 7837, 8 ], [ 7944, 8 ], [ 7984, 8 ], [ 9331, 8 ] ] }, { "id": "well-known/game/mod::minecraft-client-class-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft client singleton class reference", "spans": [ [ 1993, 23 ] ] }, { "id": "well-known/game/mod::minecraft-name-getter-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft profile name getter reference", "spans": [ [ 2183, 35 ] ] }, { "id": "well-known/game/mod::minecraft-session-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft session object reference", "spans": [ [ 2130, 23 ] ] }, { "id": "well-known/game/mod::minecraft-uuid-getter-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft profile UUID getter reference", "spans": [ [ 2207, 36 ] ] }, { "id": "well-known/malware/stealer/prefire-shard::prefire-family-literal", "atk": "T1528", "mbc": "B0006", "conf": 0.9, "crit": 1, "desc": "Prefire family name literal", "spans": [ [ 2659, 7 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.94, "crit": 3, "desc": "Java bytecode ProcessBuilder execution", "uses": [ 8, 9 ], "spans": [ [ 329, 31 ], [ 853, 30 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirected-stdio", "conf": 0.96, "crit": 3, "desc": "Java ProcessBuilder redirects all standard streams", "uses": [ 15, 16, 17 ], "spans": [ [ 5542, 38 ], [ 5808, 39 ], [ 5835, 44 ] ] }, { "id": "well-known/game/mod::minecraft-session-access", "conf": 0.91, "crit": 3, "desc": "Minecraft session profile access", "uses": [ 24, 25, 26 ], "spans": [ [ 1993, 23 ], [ 2130, 23 ], [ 2183, 35 ] ] }, { "id": "objectives/credential-access/gaming/minecraft::minecraft-session-token-access", "atk": "T1528", "mbc": "B0006", "conf": 0.96, "crit": 4, "desc": "Minecraft session token and UUID access", "uses": [ 21, 27, 31 ], "spans": [ [ 1993, 23 ], [ 2130, 23 ], [ 2159, 35 ], [ 2183, 35 ], [ 2207, 36 ] ] }, { "id": "objectives/credential-access/gaming/minecraft::minecraft-token-child-process-stage", "atk": "T1528, T1059", "mbc": "B0006", "conf": 0.99, "crit": 5, "desc": "Minecraft token access alongside redirected child launch", "uses": [ 2, 29, 30, 32 ], "spans": [ [ 329, 31 ], [ 853, 30 ], [ 1993, 23 ], [ 2130, 23 ], [ 2159, 35 ], [ 2183, 35 ], [ 2207, 36 ], [ 3225, 39 ] ] }, { "id": "micro-behaviors/process/create/spawn::child-process-creation-api", "atk": "T1106", "conf": 0.92, "crit": 3, "desc": "Starts a child process through a platform API", "uses": [ 29 ], "spans": [ [ 329, 31 ], [ 853, 30 ] ] } ], "type": "java_class" }, { "ctx": [ { "b": "+kO#^0000+0Ao718E)Y5fk20vxMW=qnp1DIl#ua3sXhT}C$SbZ009925nCS%vj#C9zF7Q#vRPE:Bo.^F0rsoTvrM6jy*?i]fhMXcv}x.5luN0UwmY^bqE%xMA+e:52lj]d02PDVC404uvqYZhp\u0026ZF:wPI]VB.LV5wPw1Q2ls/gqE%xMA+e:50rr%KvrM6jB-.tlfg68*wI#v\u003cmq=QNwmY=^015-b5nCS%vj#+Bx(2B?vrl0rgZs0?0rru[zEWP}wPv!Kc2c\u003eivj#C9zF7RpzGY@lwIl+?BzbP6nmuyDy?mVkoMa\u0026+B-mM=4/(UKygho]fkL6mxd)$pC5Iecfhl21xM4ALvqYQ(wPF7R5DI\u003eooMa\u0026+B-muY20uQqx((Jt00sR#rTX%x02k?v1oohr0107GvPEz?D2NN2031Wxz/4dux([3hvLpn#t4y3rt1\u00266\u003cr-:MtAxsg31z}NYzuf.Mc%GwWvrM6jy*?i]fh($kx(mMBdolDH1yVs-A@=mOygho]fkL6mxd(X#v}xR3x(v\u003e]038ghaKV}=[J1-11h0rpEe%rYtte^uC404uvqYZh", "ln": 0 }, { "b": "x9Oz-0rrHHz:OhDAZs.^vr?\u003eN1sLZ6lKS@y04wlPcJCQ%00lv(2llpQ00K=PlN=4A02bz=3ihBNf984SwPq\u003c3y\u0026YQS6^#:\u003cvrM6jy*?i]fhD4(wN/*zdoWbWf-S%o04d+50rrWvz/4dux([3hvLp2:yiKF005Ue+8upY-05:*o0rs.Q\u003cbGbYZPM*?R%ft0\u003e^((oJItKGOAVz)(5-poYqjFCUi0x/(6NX0KFp%JV\u003clT(0rrjxB-4P/i@/", "ln": 533 }, { "b": "NDf^B\u0026*^NAG}).cN=H(X\u003cE8\u003eJ0a#rj3#fi]vj#tkfgGU(wD@iH0rrTBvrM6jy*?i]fgfL:B8}M^yxjzGxjVfYA=l5hv@#B6zBwzWvqfPW03S*uoLO0Vvj#Xkv%8*aBA]JoA=l5hv@#B6zBwzWvqfQv3\u0026\u003ebAzvcwW0b?(r9+]bbvj#Xkv%8*aBA]JoA=l5hv@#B6zBwzWvqfP:0c52t4qfl]lVlHDq/u/0v}tVv94imfygho]flpYmB-IhrC}RK6wmXXTB-H#6i$8ag0cwLFASyj.02PDVC404BwN/\u003e6x([RNlVlHDq/u/0v}t(BCl4WKxjVfUz!0i$x(v\u003e\u002601ZLcoLO0Vvj#IfBt3S(oGJT.C(Sc$0c!G\u003c0rrKyvrM6jzE)]yrz(G}0ds\u003eF1:1V.qB{(?5gw#3ygho]fk+uyfi7[wi$8as0dUyREGj{101*RMygho]fk+uyfi7[wj1jhs02bA=3ij/vGAh5-xjVfJvSME7B-.g\u003evrue-02c?goLO0Vvj#C9zF7R3BAh8kxfcI4H5=#o0bqH\u00260rtd=\u003ca@M", "ln": 1325 }, { "b": "rTX%x0g0@(L(NcK00V\u003eJAaJ]$0rs8/lN+YzvrM6jy*?i]fh($kx(mMIB.LV5wPx\u003cv0gr?Q3ils\u003eN/JG{Bz\u003e91A+PA73\u0026(*#Hya3D0g\u003ch\u003e24}H?wO#V10h6rV3iiu(P-CcU4cAg%\u003ebUGIJI=9TO-3=k\u003eBX10N$ZjzV*S*Q\u0026Jf0uPS)EYUJyI4\u003eb\u003c*nKbrpQKkNsS\u003eB)W\u003eOv4WmNEucg2MQR203}*dHn:u\u0026W=jr((Xq\u003eePs\u003cfsZV*DA\u0026\u0026wZqHMZ.\u0026LJ4v\u0026(4K/%0hPX@rsW%", "ln": 1907 }, { "b": "c}[w:C404rz.BN]y?kWSoLO0Vvj#C9zF7R0A=kD0B8%V\u003cx(4r\u003eAWjK]wnc6}v@%^v0kX-N3igng.#P\u0026EA+e=}A+e:5nP5G\u0026Bo8wac}[w:C404uvqYZhp\u0026ZF:wPI]VB.LV5wPx4]wN]H}wN/*zdnjF+C404uvqYZhp\u0026ZF:wPI]VB.LV5wPx\u003cv0lb2V3igti:n(n$2KXjX(z*/GK^kajYx3J5(AWOUNZhvPGZbUd(YW4=U:\u003c^^Q3x1P(ZKNnP][SwM*o*E2MS0F00^KQB8L(rwDq=Vc}[w:C3$", "ln": 2656 }, { "b": "0l$PB26s=Mx(4tY01ZLcoLO0Vvj#tkfgGU(wJHq2=\u0026zD309xlH0rrylAbYxawk)EQ0mR1^3igng!D2TWA+e=}A+e:5pJZ+#B-X2(/8S?#00\u0026OS0rr^NwN]H}wN/*JA=M8sq/)4\u003evqM2B9vL8uoLO0Vvj#C9zF7R0A=kD0B8%V\u003cx(4r\u003eAYTWf*5P\u003em00\u0026OW0rrBpx(W={Bz(hB0rsO$oLO0Vvj#tkfgGU(wJItmygho]fkL6mxd)84z!0v1B3+1-y?d9$i$8bC0n!a-2MS=-00NB=vrcC\u003c02l[hoLO0Vvj#C9zF7R0A=kD0B8%zK0oa1s3igti\u003cn/k.s-vsv01}$uvrM6jy*?i]fh($kx(mMB0rr^7lruDWzGOAouR::5sZM2GzFPsN5QF.zAcs(]vQ%ZTA+5]^Bzy)S6IJmIC404wx(tUpx(4ulp*[DVi@]r{CX.2juT[aCCWBiFzaF2BsXA\u0026q00W1L", "ln": 2928 }, { "b": "0u8mB7Y+MR00)jGBv7m{wPE\u003eL9W\u003cY%vrM6jzFs2xv}Yp\u003eB7GCDlUG[GB7GCPdo/aE0uzgZ3ihBO9@#uKwO#0@wmX.Uq/)4]zF5$I7arxNdnjF+C404uvqYZhq/)4]zF83t0u?E/3igCmblm=GyH}^iwO7@y5\u003e(!Nz7/KoBzb/aff%C\u0026CwGtw00EmVB29*%1Bi*ZA@=mCwO+{{qEK+I00)WRD0+o3A=IfX2w(^%uPhLu0rrdw12CNDa{e4AHfK-V00\u0026PU1jAMe[Dk!BuM]NVsdAQ#02V13GsZd", "ln": 4040 }, { "b": "04Q8n83^\u003eUweLRVg=tQS2FH]UwcuB32]9=V1V=$)hvylc6:ZPmaq\u003eI33Mff:3P5.a6:UP.6:O+^g\u003eH(\u003cGBm*U%kgA*cS}q]W/wa\u003c05QbA2R9s:ii:@be51dGj@\u003eSq0bKeagcbKQ1qi=704Q8u84D:9hv*VnZ64%Y4}ENf6+F1YiUr8r1y%z66+V#obPdge5/zeZ6+sW!5[0Kl4G)HV6+tm\u003eg\u003eH(\u003cGCar.%j$o!cS}r0W/wa\u003c05Q8z2E\u003c:%V4JhWR#J1{kEHLxiU-IEZ64%:6\u003c\u0026^Q78W\u003e36=7r.whUks7Rx]j7Y#Vl6=v-5Q5VqN7.)]a6+}Py85i(56=v-4A9$IOL2WeM0Jk$PY8TiY85P*.fT}9KoCf/Mzwv3(xC9!c04!(+m(Lr3zwi7xx/x]Bzwi7zGeWVZ08ky\u003e7h%@/pIz+b7h%@/qg*/Dd*rP^cS{J:rjh=SiVG1SZ64%:9a7JX9t]\u003ch6=*//whUFz9\u003eRUq9%jzz6^akjQ5VqN9#b[o92fOM85%wj6^akiA9$IOL2WeT0Jk$PY8TiY86ur/fJh9S5(#Bvd([))blG+XbPd\u0026v1y@k)whU.Gca\u003cyxciDdN6^\u003c.xQ5VCRckv)CblO-bu\u003e\u003e4%g-mIv6^\u003c.wA9$IOL2We.0Jk$LY8TiY878/)fJkEYtUM:KY-qxG0a.I#V)#r[04g[K5[XMLd(]c$dG.H=d\u0026x?J1y@k$whU$New8cEeDW)-6!QjLQ5VCReFP(QdG*Fpu\u003e\u003eq4g-m+C6!QjKA9$IkL2We/0Jk$LY8TiY87\u0026q$fJh9S5[[YNd(]y5f-%l\u003cg8R*X1y@l5whVjUgRr(LgY]S[6/uZZQ5VCRg.?\u003e=f:5jDu\u003e\u003eLbg-n1J6/uZYA9$IkL2We)0Jk$LY8TiY88O/5fJkEYtUR*gyfqeJWG7oP0cU^JE6%3bW/zb\u003c0eTC-I-J*ni0lO?K2x0oijn*J1y@lcwhVGX0f{X4i\u003e29RiY^B4jqx%[i?=Q689nY}1qJ}86*b)j0fn0S1qK3liDexm0fq.{WG8?0GGGpk%je5HWG8@f0hoXh04g[K5#mMM89Xki0fo3689+LfLltzhkX8=sY8Xa06*YqeM]WLohBwiD6*XL]dh+C\u0026klIY^u\u003e(4pWG8vaklIY*6*M.CWG8w0Lc$vXsa\u0026{wR#Lr=lBD(^q=%koRNuEPiZ%#R12I]a8aIsywedQBhB[MN", "ln": 4982 } ], "depth": 1, "facts": { "imp": [ [ "", "java/lang/ProcessBuilder$Redirect" ], [ "", "java/util/Base64$Encoder" ], [ "", "[Ljava/lang/String;" ], [ "", "java/util/Base64" ], [ "", "java/lang/String" ], [ "", "java/nio/file/LinkOption" ], [ "", "com/github/Amjwl" ], [ "", "java/nio/file/Path" ], [ "", "java/nio/file/Files" ], [ "", "java/nio/charset/StandardCharsets" ], [ "", "java/lang/Integer" ], [ "", "java/lang/System" ], [ "", "java/security/ProtectionDomain" ], [ "", "java/security/CodeSource" ], [ "", "[C" ], [ "", "java/net/URL" ], [ "", "java/lang/ProcessBuilder" ], [ "", "java/nio/file/attribute/FileAttribute" ], [ "", "java/lang/invoke/MethodHandles$Lookup" ], [ "", "java/lang/Exception" ], [ "", "java/lang/Class" ], [ "", "java/io/File" ], [ "", "java/lang/StringBuilder" ], [ "", "java/lang/Object" ], [ "", "java/lang/invoke/MethodHandles" ], [ "java/nio/charset/StandardCharsets", "java/nio/charset/StandardCharsets.UTF_8" ], [ "java/nio/charset/StandardCharsets", "UTF_8" ], [ "java/lang/System", "java/lang/System.arraycopy" ], [ "java/lang/System", "arraycopy" ], [ "java/lang/ProcessBuilder$Redirect", "java/lang/ProcessBuilder$Redirect.appendTo" ], [ "java/lang/ProcessBuilder$Redirect", "appendTo" ], [ "java/lang/ProcessBuilder$Redirect", "java/lang/ProcessBuilder$Redirect.from" ], [ "java/lang/ProcessBuilder$Redirect", "from" ], [ "java/lang/String", "java/lang/String.charAt" ], [ "java/lang/String", "charAt" ], [ "com/github/Amjwl", "com/github/Amjwl.zrntiEdlswdPnxugGs" ], [ "com/github/Amjwl", "zrntiEdlswdPnxugGs" ], [ "com/github/HzZdDmZLYIVWyKq", "com/github/HzZdDmZLYIVWyKq.yoxw_nxby_opbqo_rc" ], [ "com/github/HzZdDmZLYIVWyKq", "yoxw_nxby_opbqo_rc" ], [ "java/security/ProtectionDomain", "java/security/ProtectionDomain.getCodeSource" ], [ "java/security/ProtectionDomain", "getCodeSource" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "com/github/HzZdDmZLYIVWyKq", "com/github/HzZdDmZLYIVWyKq.run" ], [ "com/github/HzZdDmZLYIVWyKq", "run" ], [ "java/security/CodeSource", "java/security/CodeSource.getLocation" ], [ "java/security/CodeSource", "getLocation" ], [ "java/net/URL", "java/net/URL.toURI" ], [ "java/net/URL", "toURI" ], [ "java/io/File", "java/io/File.getAbsolutePath" ], [ "java/io/File", "getAbsolutePath" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "java/nio/file/Files", "java/nio/file/Files.exists" ], [ "java/nio/file/Files", "exists" ], [ "com/github/Amjwl", "com/github/Amjwl.dedg_rwe" ], [ "com/github/Amjwl", "dedg_rwe" ], [ "java/lang/String", "java/lang/String.getBytes" ], [ "java/lang/String", "getBytes" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.\u003cinit\u003e" ], [ "java/lang/ProcessBuilder", "\u003cinit\u003e" ], [ "java/lang/Integer", "java/lang/Integer.valueOf" ], [ "java/lang/Integer", "valueOf" ], [ "java/lang/System", "java/lang/System.getProperty" ], [ "java/lang/System", "getProperty" ], [ "java/lang/String", "java/lang/String.toCharArray" ], [ "java/lang/String", "toCharArray" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectOutput" ], [ "java/lang/ProcessBuilder", "redirectOutput" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.start" ], [ "java/lang/ProcessBuilder", "start" ], [ "java/nio/file/Files", "java/nio/file/Files.createDirectories" ], [ "java/nio/file/Files", "createDirectories" ], [ "java/nio/file/Path", "java/nio/file/Path.toFile" ], [ "java/nio/file/Path", "toFile" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.toString" ], [ "java/lang/StringBuilder", "toString" ], [ "java/io/File", "java/io/File.\u003cinit\u003e" ], [ "java/io/File", "\u003cinit\u003e" ], [ "java/lang/Class", "java/lang/Class.getName" ], [ "java/lang/Class", "getName" ], [ "java/util/Base64$Encoder", "java/util/Base64$Encoder.encodeToString" ], [ "java/util/Base64$Encoder", "encodeToString" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.format" ], [ "java/lang/String", "format" ], [ "java/lang/Class", "java/lang/Class.getProtectionDomain" ], [ "java/lang/Class", "getProtectionDomain" ], [ "java/nio/file/Path", "java/nio/file/Path.of" ], [ "java/nio/file/Path", "of" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectErrorStream" ], [ "java/lang/ProcessBuilder", "redirectErrorStream" ], [ "java/lang/System", "java/lang/System.getenv" ], [ "java/lang/System", "getenv" ], [ "java/nio/file/Path", "java/nio/file/Path.resolve" ], [ "java/nio/file/Path", "resolve" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectInput" ], [ "java/lang/ProcessBuilder", "redirectInput" ], [ "java/nio/file/Path", "java/nio/file/Path.toString" ], [ "java/nio/file/Path", "toString" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.directory" ], [ "java/lang/ProcessBuilder", "directory" ], [ "com/github/Amjwl", "com/github/Amjwl.getDomain" ], [ "com/github/Amjwl", "getDomain" ], [ "java/lang/String", "java/lang/String.length" ], [ "java/lang/String", "length" ], [ "java/io/File", "java/io/File.\u003cinit\u003e" ], [ "java/io/File", "\u003cinit\u003e" ], [ "com/github/Amjwl", "com/github/Amjwl.\u003cinit\u003e" ], [ "com/github/Amjwl", "\u003cinit\u003e" ], [ "java/util/Base64", "java/util/Base64.getEncoder" ], [ "java/util/Base64", "getEncoder" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.equals" ], [ "java/lang/String", "equals" ], [ "java/lang/String", "java/lang/String.\u003cinit\u003e" ], [ "java/lang/String", "\u003cinit\u003e" ], [ "com/github/Amjwl", "com/github/Amjwl.main" ], [ "com/github/Amjwl", "main" ] ], "metrics": { "file": { "size": 13338, "entropy": 5.6 }, "class": { "major_version": 65, "interface_count": 0, "method_ref_count": 49, "constant_pool_size": 340, "external_class_count": 25 }, "binary": { "peak_region_bytes": 4096, "peak_region_entropy": 6.72 }, "imports": { "count": 74 }, "functions": { "count": 4 } } }, "id": 7, "mol": "O₃(As₂ErI)H₅(CmDb₂FOsPo₄)", "path": "mod-injected.jar!!com/github/HzZdDmZLYIVWyKq.class", "pid": 0, "risk": 11, "sha": "7a69701be8fdf6245080d9d3c0c161ebcd4222e7e3f967313efc17a81b28e8c0", "size": 13338, "traits": [ { "id": "micro-behaviors/communications/http/lib/urlconnection::java-url-class-bytecode", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Java URL class reference", "spans": [ [ 1595, 16 ], [ 1624, 12 ] ] }, { "id": "micro-behaviors/communications/http/lib/urlconnection::jvm-url-class-ref", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "JVM URL class reference" }, { "id": "micro-behaviors/data/encode/base64::jvm-base64-encode-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM Base64 encodeToString call", "spans": [ [ 4104, 39 ] ] }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method", "spans": [ [ 1971, 8 ] ] }, { "id": "micro-behaviors/fs/read/file/handle::jvm-io-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM File API class reference" }, { "id": "micro-behaviors/fs/read/file/handle::jvm-nio-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM NIO file API reference" }, { "id": "micro-behaviors/os/env/gate::jvm-opaque-environment-key", "conf": 0.94, "crit": 1, "desc": "JVM class has generated gate value" }, { "id": "micro-behaviors/os/env/gate::jvm-string-equals-import", "conf": 0.94, "crit": 1, "desc": "JVM class imports String equals", "spans": [ [ 597, 0 ] ] }, { "id": "micro-behaviors/os/env/gate::jvm-system-getenv-import", "conf": 0.94, "crit": 1, "desc": "JVM class imports System getenv", "spans": [ [ 1992, 0 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.88, "crit": 3, "desc": "Java bytecode ProcessBuilder reference", "spans": [ [ 67, 71 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-init-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.92, "crit": 3, "desc": "Java bytecode ProcessBuilder constructor", "spans": [ [ 297, 31 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.95, "crit": 3, "desc": "Java bytecode ProcessBuilder start", "spans": [ [ 3150, 30 ] ] }, { "id": "micro-behaviors/process/info/current::codesource-class", "conf": 0.85, "crit": 3, "desc": "Java CodeSource class reference" }, { "id": "micro-behaviors/process/info/current::getlocation-ref", "conf": 0.82, "crit": 3, "desc": "Java getLocation call reference" }, { "id": "micro-behaviors/process/info/current::protection-domain-class", "conf": 0.85, "crit": 3, "desc": "Java ProtectionDomain class reference" }, { "id": "micro-behaviors/process/info/current::touri-ref", "conf": 0.82, "crit": 3, "desc": "Java toURI call reference" }, { "id": "micro-behaviors/process/info/selfpath::java-protection-domain", "conf": 0.82, "crit": 3, "desc": "Java getProtectionDomain self-path lookup" }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-errors", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder merges standard error", "spans": [ [ 3019, 44 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-input", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard input", "spans": [ [ 2720, 38 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-output", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard output", "spans": [ [ 2992, 39 ] ] }, { "id": "objectives/anti-static/obfuscation/reflection/class::java-protectiondomain", "conf": 1.0, "crit": 3, "desc": "Java ProtectionDomain", "spans": [ [ 1389, 19 ], [ 1411, 34 ], [ 1458, 30 ] ] }, { "id": "objectives/anti-static/obfuscation/string/control-prefix::java-control-prefixed-long-string", "atk": "T1027", "mbc": "F0001", "conf": 0.92, "crit": 3, "desc": "Java string starts with control-length prefix" }, { "id": "objectives/evasion/self-delete/file/script::java-code-source-location", "atk": "T1070.004", "mbc": "F0007", "conf": 0.78, "crit": 3, "desc": "Java code source location", "spans": [ [ 1494, 13 ] ] }, { "id": "objectives/impact/dos/disk::jvm-two-backward-goto-branches", "atk": "T1499.001", "conf": 0.9, "crit": 3, "desc": "JVM repeated counter backedges", "spans": [ [ 5046, 8 ], [ 5183, 8 ], [ 5256, 8 ], [ 5404, 8 ], [ 5488, 8 ], [ 5592, 8 ], [ 5676, 8 ], [ 5798, 8 ] ] }, { "id": "micro-behaviors/os/env/gate::jvm-opaque-secret-environment-gate", "conf": 0.97, "crit": 3, "desc": "JVM compares opaque environment gate", "uses": [ 6, 7, 8 ], "spans": [ [ 597, 6 ], [ 1992, 6 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.94, "crit": 3, "desc": "Java bytecode ProcessBuilder execution", "uses": [ 10, 11 ], "spans": [ [ 297, 31 ], [ 3150, 30 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirected-stdio", "conf": 0.96, "crit": 3, "desc": "Java ProcessBuilder redirects all standard streams", "uses": [ 17, 18, 19 ], "spans": [ [ 2720, 38 ], [ 2992, 39 ], [ 3019, 44 ] ] }, { "id": "micro-behaviors/process/create/spawn::child-process-creation-api", "atk": "T1106", "conf": 0.92, "crit": 3, "desc": "Starts a child process through a platform API", "uses": [ 25 ], "spans": [ [ 297, 31 ], [ 3150, 30 ] ] } ], "type": "java_class" }, { "ctx": [ { "b": "+kO#^0000+1Kv8G5[t\u0026%fk20vxMW=qxLpywzaNb2009925nCS%vj#C9zF7Q#vRPE:Bo.^F0rsiKz/4dux([3hvLqLfvRf?cwL^z=CZgMUCYVU\u003ezGD9-1PXPtv@Diqxk8E3BZ^1uw[2v@C4BG\u003cz*lKj00-J82x$Amo\u003ewi:0rsoTvrM6jy*?i]fhMXcv}x.5luN0UwmY^bqE%xMA+e:52lk8i02PDVC404uvqYZhp\u0026ZF:wPI]VB.LV5wPw1Q3\u0026{tlqE%xMA+e:50rr%KvrM6jB-.tlfg68*wI#v\u003cl$G\u003eDwmY=^01P8g5nCS%vj#+Bx(2B?vrl0rgZs0)0rru)wN/T?wPv!Kc2c\u003eivj#C9zF7RpzGY@lwIl+?BzbP6nmuyDy?mVkoMa\u0026+B-mM=6AFgPygho]fkL6mxd)$pC5Iecfhl21xM4ALvqYQ(wPF7R76aytoMa\u0026+B-muY2v.S", "ln": 0 }, { "b": "p5$teoLO0Vvj#Ijz.CZpy?km@vrufA0rrsuD2)XjxAn8JoLO0Vvj#C9zF7R3BAh8kxf{-Py?d9$i@]r=jzwXEBuPZ911kQ03\u0026?)Wfa4WZ05aAN5nCS%vj#C9zF7R3BAh8kx9Oz(0rr{JvrM6jy*?i]fh($kx(mMIB.LV5wPw1QgZTju05aANroQ:5(.Y\u003cgNZZH()t^d?Q[3+PHVTCI)u0{]H2[!!)X=#xZQ--}HuM4R\u003e^lPuR(5:GGuZW*Kh6[ORT7E+\u003e82#5K/)Ar\u003c^J{KRK(=", "ln": 607 }, { "b": "y?d9$i$89R07md]h2{5C04n0gIIf#)Me]on\u003ca:R{IMkWsVe\u0026i:\u003ca\u003cb:I(kNrYx3og\u003ca\u003c5.I\u003eZKTm/-O}Bz\u003e91A+PA70rr/ZdnjF+C404uvqYZhq/)4]zF83t07^e.3ih{-o922K2\u0026Z-f\u003caB=1O3?TnRs6LY\u003c*HPuYR%}CK(zq7\u003caq\u003cxNT%\u003cUMf%/{\u003c*H@EYOCQ5Zt+6I\u003carZ908iE]24IsPAZs^F00BYwdmjHzpxjh#05BQL0rrsuwO#d5", "ln": 951 }, { "b": "6iOsEwNw$^s.IeRw[tEVy?lHU0rrsrwoZEVBo8vDAb]J4x(W+=07[Ukygho]fkL6mxd)h9A+PA7j4%x$C404uvqYZhq/)4]zF848ygho]fkL6mxd)h9A+PA7j1i\u003crvrM5", "ln": 4152 }, { "b": "(yaKqY@ZW-N={J1(v\u003eC=W$9[WVH9Tk\u0026\u003cCDDJd*h$Q3!23(yjTsYRa.NO9lPh(v:/NWUj7YVKc%sklg-*xjVf@zGVA?k(*fS0a(l#0rtd/(.QiuTfI5QG73j.)#jvlM5\u003c\u003eqRqWG5\u003e^)CJQ{YJ:LKkxq)ujgiXSuisGx[=m\u0026j\u003efdJ\u003eT.?LN4pT0rsqD\u003cgHYuTGpM\u003cG6[C%\u003cgQ3aT+C]yTNp}4\u003cgS1=T^!EUU)pw10rtm!\u003e7O\u0026.TbVLpRrm", "ln": 5693 }, { "b": ")s}U1NvJl0PY9OU\u003cFf9GU-X4mOA3ck)s{G70.iy]0000000*\u003cK01-)NC404uvqYZhra{q-vpPPAo921@B8kA0z#/}wc}U{?3\u003c6c8p6}4@0-5*%4S=eUC428%m@-\u0026JCXp\u003c]026D:v%8A:vQ-+TrbV\u00261y^\u0026F=CMv^JzAhk=mnMSjDi10KxN106t4*]P0rrBtz!@@}A-MQ+0rrjinP1Le5O#=7woyv^xMNs2w]Ro(ojv]46ky%0vj#tkfg!@dCW\u003er7BzkVh2lF0d00-", "ln": 12142 }, { "b": "wNPAX0+?Vn1T)Owdol\u0026Se=]!}0+}^M0rr@+oLO0Vvj#tkfg*52B-ZM7A+eV@j1jhs04[s\u003c3iB(xzVG?DxjVfWwQ5q=zGG]A0rs2^dnjF+C404DBzkLADtdsKt4}}AzGG]Ai$8gg0=!RHxAAkQ02xrTC404DBzkLADtdsKt4}}AzGG]A2lG2G00^dFBwumYwEFS:07)O1B]()?01iHZl${WMv@#TfC)\u003c+20pyf}B])0\u003e010pHBwMy^wO#O\u003c02u$ioLO0Vvj#Ijz.CZpy?km@vrufA3\u003c7?UEHufH0!gjJ9bn]9vj#tkfg6![w[u0]wkvt\u0026Acln3BAg@3z3Hb[0rr%KvrM6jx(tT]x(4uRB-.OBBw)p4wNPAX0!QHN26s=Mx(4tY01ZLcoLO0Vvj#tkfgGU(wJHq4G-V#p0zrGH0rrYWoLO0Vvj#tkfgGU(wJItw3\u0026?)YI3:rq0/v0U8yOo]vrM6jx(tU2B-.OBBw)p4wNPBqnHWWG04[ti3iC!XJr61ZA+eV\u00263\u003c8E\u003eiTL}40*0A.1:t03By+EM2pJ!ynL7vi3\u003c8N[Ll}wy0*AY=1.hv!B7C:YMh\u0026MB0!HGu0rrNqwmORYAbY\u0026eB8$]60rr@+oLO0Vvj#C9zF7R4xMw3nvpB4:j1jhs0*%aU3iBDlN/JG@v@c78wKQGUA^n5{OD7qI0+.Ub3iB(xMJm6\u003cy?cKUBy\u003eKN232nFs7LFm03j*GvrM6jx(tT\u003eB.g", "ln": 12497 }, { "b": "%nRYJp}M@i00000000Di%nSc0NXxgN0#%K-^GsKrkn:Mpv*g3R01-)NC404DBzkLAl2}0OD2\u003ch(Xb=Nqv@DsipI9HkzF9IY00\u003c#Slp\u003c-$ts5-1X=PFJ0\u003ewxB0rrvpxlN^1s9j]MZ5/!(00ikp0rrmEnO05D01\u003cl}B6\u0026\u0026]A:J%nA=UO@wo.?\u002600vyzhVS)+B.Ct[xMOMqv/VMovp\u003cO5v{:j:z#/}tyxjzwB8Mhwv}xW(w=R(oAcca}B.}cV2ZQ1", "ln": 13307 }, { "b": "0000(vgrhq02xrTC404DBzkLADtdsKnP5cRvru732lJM=0[)Sd0rryDwPQHYAclmh0]9\u0026)3iF].?2NG@ygho]fkktTlv0V:l2}0OC#5N8Acln3BAg@3z3Hd13iGb=sowKQ\u0026edQpx#7!(s\u003elv)12*-)ZxnKwb}e\u0026{2XE^*x(^%0wdeL50pyf}*5*Es00^jQw]7)$wEFU90Y*U\u0026*5*Nv019QPwN]\u003cNzG6-u3\u003cb!@)G%3H0}3x%?#Ybz00u!IwdeLf051VX*5**C01i)!lv0V:l2}0OC(W)Fc[ev!3\u003cc55]:g=U0}(S{3T)Z)zc{%=D2v+y0rrHNB.#qAsB1E#vR=5B7!!WMC404DBzkLADtdsKnP5cRvru73i@]r=zf6t^BAdxZa53ATC404rz.BC5By^:UA::k?B-.OBBw)p4wNPBq0rrP#hf}bNxIHNcn)=Wey5[qzw[$:(w[bg[wP8ydyxjzvwO+^]B7F(s0rrEqoj*{TC3^jorS*Y{*7%})%nSa#wQ^LX000000000E1POJ505@Zk836Z#\u0026/HwePpj@mP6R-d)$WF2M8:8UQWtdo\u003eA@vgKH\u003cClPx-0", "ln": 13585 }, { "b": "10d\u003cJbMF!\u003c00ilB0rsRS\u003cHz[-WWcfUUj4Ny\u003e--ssRg!ckWDBM-)Z/W!K/^YQTk*ZF(8*AyM4/LDa]}VFwPq\u003c3y\u0026Z0!bM![\u003e05BZ60rsqF)Umv[R[8c0KMz\u003e9)X3YCX47\u003cXVF}^D(:9zGNt775Iu\u003cqi3\u0026?BJ90(PD11slJhXa#ISnT8k)4]Q2VZ/%ZLiGcz\u0026hTcFLz!+cQWtR8\u003ca:8!TgvkNTm9W2\u003ebTl}Mz%kDRSt4!2M(NT05T82GYS", "ln": 14525 }, { "b": "c}[w:C404rz.BN]y?kWSoLO0Vvj#C9zF7R0A=kD0B8%V\u003cx(4r\u003eAWjK]wnc6}v@%^v155!\u003e3igCop5$t7A+e=}A+e:5nP5G\u0026Bo8wac}[w:C404uvqYZhp\u0026ZF:wPI]VB.LV5wPx4]wN]H}wN/*zdnjF+C404uvqYZhp\u0026ZF:wPI]VB.LV5wPx\u003cv15G7%3igIqqul+.\u003cGC(RYo.J^YxB*P\u003edV#uT?i[WS]w/d\u003e=IIUUyV8MISzjA\u003cGtSLX#1F%KlzaS\u003ed!d.TE5mkKk+[Q\u003e=H0O2M[3b00)1LAaJ]$rbSfErS=5601e)g0rrQIwN]H}wN/*TB-.OBBpnmO15Py94fG=m026x:wnc6}v@$dWA=k$%BAg@3z2\u003cRSc%w5[ygho]fkL6mxd)84z!0v1B3+1-y?d9$i$8i@16(ll4fG]q00NB=vrcC\u003c02l[hoLO0Vvj#C9zF7R0A=kD0B8%zK17hjt3igIqvGuDvygho]fkL6mxd)84z!0v1A%z!T0rrjvx\u003edkA11kP\u003c3\u003cg8zx9[-L184YnoA:KvJ]Ndd\u003c!GuGS\u003cg-IQ2Skm\u003c!XKhTDI+fY5P\u003ca\u003c!Y0uTc8OeF-A??\u003c!XydTF\u003erBYYl6c\u003c!XHgTe\u003eACUh=Qv\u003c!XWl", "ln": 15153 }, { "b": "CY[4tnnSf.C2-B50rrHsy*?p7wN]sWBytgI25)J@h+v-+01AyCB7El^lVl\u003c:wQ5q004B(90%1HSB].NIxjVfMwN/T?wPv!K94imfygho]flIwJy+Fa-B7El^bT=iNz!9B1i$8le1q}KD5^f9N00V$Bv@C)?0rr(-oLO0Vvj#C9zF7R3BAh8kxfdLDljr#p1rv*H5cK3P03M8=C404wx(tUmxKL}5wPPO7Byx5$vrb)CxKL}5wPR$#1rWZB1YXI\u003euPn5^8CB)OC404wx(tUmxKL}5wPPN)xKL}5wPQ0x1r)%[2)qyObMN(!c%G2iygho]fk+GxfjOW7A=U/lfgfzYA=U/li@", "ln": 19321 }, { "b": "5ZT.g1]DHZpuo]d69Xi1{PUO(JI3DLZgVKd\u003e]QYzSXwoi0rr^FvrM6jy*?i]fgfzYA:-E1wPw1UHxdwUwnbW\u003cBo8vBc{{MPnEL-U1D0J?HY\u0026Rp026A/x\u0026[.fw)61UpH!PJuSRnYqVM\u003e6yHQjYzENnW025)jvRYsFsYv:}x?9qGuS}b-yxjzGAa\u0026xRuWu%wsykPQsvuIqnOIYo019sDrC^4Mz!J:10rrjqwQawAKT*Xr02#phWV/WgFAjw7\u0026/P]0NWrxLKkVn2\u003ezbU}WG", "ln": 20901 }, { "b": "s*[w?oE*-nWG5A:ewql$emgj$ewrcn1y%y[6:heMiT2Qz1@dsS1FL(p83H-VeenvCeenp51%4U\u003cg\u003eH(\u003cGA.EP%kHS\u003cgG+O0W/w+607H3u5\u003eGChjur=^2)i1x3k\u003ce:6:!EOwhT/g3+MT73\u003cex%6+7(=Q5VCR3(6i?2]9^Iu\u003e\u003cbUg-lP56+7(+A9$IOL2WeA0Jk$LY8TS\u002684r$OlBD\u003e-s1yYVoJb6%Y8TY\u003eW/wrE5e=2(pc5$85D/Dwqz]d95W?Wu1y@kWwhUak05W)]6sN%AiURVO6+}C#6qtEQ859@21qILS6+$b+08:WD1qIT^5].l!08!AiWG6MlGCsJ=%je54WG61f07H3c5e5rT06ApV85JDjhw)wHZ64%Y8dUSz6=KZ*iVweV92fCd8LNiS85\u003cqg85JF\u003e8djg0u]e-r1qI)\u003e8e@$uwrG@C908#q*Q^CwsS5f/07a9]mPQDs5[0:x86n%?08+Y$86uo!rS(}Fay)wNY8TY\u003e6^p3^sVN-ehx@}Y6^opKdh:rE9%rr3u\u003e\u003c[]WG6hy9%rr66^dE6WG6ioLc$u}sa?!0R#Lr=bdmFBWG5=#84:jRoJb6$5[noHjus/bciD7.cManB1y@k{whU?Jd7/ZAdfzET6!f}DQ5VCRdhsrIciL5hu\u003e\u003ee0g-mRy6!f}CA9$IkL2We+0Jk$LY8TS\u002687A2{lq}1\u003eY8TY\u003eW/wrEeG3bMwvqF2iXzp512I[?87@Sawec+dhzt\u003e1YAHtJ12.}IgzIQr03\u0026Bp6/cZW1qJN$6/fkO87(4bgzIMZu]iE#rFideR#LG^fUvMIg8R!G88qpefT}9$Y8TS\u002688wV3lBD\u003e-r#AO5y=TA\u003eh3pn!qz{AJhmrG=1y@l9whVxU05W)]h[5=\u0026iYEj1itBK?h\u003e*p388@G\u003e1qJ?56//Wg08:W(1qJ{ihGi6j08!AiWG6MlGGf7h%je5EWG61f07H3ceFq%f06Aq889CRoweNHpg=vGmjIzK[wcuB3j@3n]1V!\u003cIhB50x6*wt(aq)xUkP8W0kR%uv6*ru$6*lIzg\u003eH(\u003cGG]No%kgA*gG+OWW/w+607H3ceW+TMq=%vq05W]*05=(98ab3QWG5AJl(ww{g=v=u", "ln": 22130 }, { "b": "Ne^WDWG6tu0d{{B1P+?T1?1J8o!l\u0026v5DEu\u00261dJ4q5d(tOAYa4n1EPk$6:b9@5tPpf0Ka9!0dUTYFe5g\u003cxKFmJN(QZ583NCKBVG-s05E:}2c[vTW/!a-o-.D#0SX!(.#", "ln": 139250 }, { "b": "2p)j.rY}Aay}H3G12Zn%1rscod\u003eIFs1-bX71HXqd5d(tOJ0BOT6:aUEWG6hp5v.\u003e4v3aAw1oLI3!H!0900066:]zzw3\u0026*w*@S0xd2lDNWeD\u003ck%001?Q1PQ%\u003ee^ddl\u0026@", "ln": 139723 } ], "depth": 1, "facts": { "imp": [ [ "", "java/nio/file/LinkOption" ], [ "", "java/io/FileOutputStream" ], [ "", "java/lang/invoke/MethodHandles$Lookup" ], [ "", "java/util/zip/ZipEntry" ], [ "", "java/lang/Object" ], [ "", "java/io/IOException" ], [ "", "java/lang/Character" ], [ "", "com/github/lfbfwveProxy$wxtMent" ], [ "", "java/nio/file/Path" ], [ "", "java/util/Map" ], [ "", "java/io/BufferedOutputStream" ], [ "", "java/util/Base64$Decoder" ], [ "", "java/util/List" ], [ "", "java/lang/Integer" ], [ "", "com/github/lfbfwveProxy" ], [ "", "[B" ], [ "", "java/util/ArrayList" ], [ "", "java/lang/ProcessBuilder" ], [ "", "[C" ], [ "", "java/nio/charset/StandardCharsets" ], [ "", "java/lang/StringBuilder" ], [ "", "java/lang/System" ], [ "", "java/io/PrintStream" ], [ "", "java/lang/invoke/MethodHandles" ], [ "", "java/nio/file/Files" ], [ "", "java/util/Base64" ], [ "", "java/io/ByteArrayInputStream" ], [ "", "java/lang/InterruptedException" ], [ "", "java/util/Arrays" ], [ "", "java/io/ByteArrayOutputStream" ], [ "", "java/io/File" ], [ "", "java/lang/ProcessBuilder$Redirect" ], [ "", "java/lang/Exception" ], [ "", "java/util/zip/Inflater" ], [ "", "java/lang/Process" ], [ "", "java/lang/Throwable" ], [ "", "[Ljava/lang/String;" ], [ "", "java/util/zip/ZipInputStream" ], [ "", "java/lang/Thread" ], [ "", "java/lang/Class" ], [ "", "java/nio/file/attribute/FileAttribute" ], [ "", "java/lang/String" ], [ "java/lang/String", "java/lang/String.indexOf" ], [ "java/lang/String", "indexOf" ], [ "java/util/zip/ZipInputStream", "java/util/zip/ZipInputStream.\u003cinit\u003e" ], [ "java/util/zip/ZipInputStream", "\u003cinit\u003e" ], [ "com/github/lfbfwveProxy$wxtMent", "com/github/lfbfwveProxy$wxtMent.body" ], [ "com/github/lfbfwveProxy$wxtMent", "body" ], [ "java/lang/String", "java/lang/String.format" ], [ "java/lang/String", "format" ], [ "com/github/hhUOmID", "com/github/hhUOmID.bpfSBzO" ], [ "com/github/hhUOmID", "bpfSBzO" ], [ "java/lang/String", "java/lang/String.toCharArray" ], [ "java/lang/String", "toCharArray" ], [ "com/github/hhUOmID", "com/github/hhUOmID.lysigh" ], [ "com/github/hhUOmID", "lysigh" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.\u003cinit\u003e" ], [ "java/io/ByteArrayOutputStream", "\u003cinit\u003e" ], [ "com/github/hhUOmID", "com/github/hhUOmID.fgwakWu" ], [ "com/github/hhUOmID", "fgwakWu" ], [ "java/util/Map", "java/util/Map.of" ], [ "java/util/Map", "of" ], [ "java/lang/String", "java/lang/String.startsWith" ], [ "java/lang/String", "startsWith" ], [ "java/lang/System", "java/lang/System.getenv" ], [ "java/lang/System", "getenv" ], [ "java/nio/file/Files", "java/nio/file/Files.exists" ], [ "java/nio/file/Files", "exists" ], [ "java/lang/Object", "java/lang/Object.getClass" ], [ "java/lang/Object", "getClass" ], [ "java/io/File", "java/io/File.\u003cinit\u003e" ], [ "java/io/File", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.substring" ], [ "java/lang/String", "substring" ], [ "java/lang/Integer", "java/lang/Integer.parseInt" ], [ "java/lang/Integer", "parseInt" ], [ "java/util/zip/ZipInputStream", "java/util/zip/ZipInputStream.read" ], [ "java/util/zip/ZipInputStream", "read" ], [ "java/nio/charset/StandardCharsets", "java/nio/charset/StandardCharsets.UTF_8" ], [ "java/nio/charset/StandardCharsets", "UTF_8" ], [ "java/lang/String", "java/lang/String.charAt" ], [ "java/lang/String", "charAt" ], [ "com/github/hhUOmID", "com/github/hhUOmID.\u003cinit\u003e" ], [ "com/github/hhUOmID", "\u003cinit\u003e" ], [ "com/github/lfbfwveProxy", "com/github/lfbfwveProxy.joswaqUlLtvgxdeCqb" ], [ "com/github/lfbfwveProxy", "joswaqUlLtvgxdeCqb" ], [ "java/util/zip/Inflater", "java/util/zip/Inflater.needsInput" ], [ "java/util/zip/Inflater", "needsInput" ], [ "java/util/zip/ZipInputStream", "java/util/zip/ZipInputStream.getNextEntry" ], [ "java/util/zip/ZipInputStream", "getNextEntry" ], [ "com/github/hhUOmID", "com/github/hhUOmID.iem4" ], [ "com/github/hhUOmID", "iem4" ], [ "java/util/zip/Inflater", "java/util/zip/Inflater.inflate" ], [ "java/util/zip/Inflater", "inflate" ], [ "java/lang/ProcessBuilder$Redirect", "java/lang/ProcessBuilder$Redirect.from" ], [ "java/lang/ProcessBuilder$Redirect", "from" ], [ "java/nio/file/Path", "java/nio/file/Path.toFile" ], [ "java/nio/file/Path", "toFile" ], [ "java/util/zip/ZipInputStream", "java/util/zip/ZipInputStream.close" ], [ "java/util/zip/ZipInputStream", "close" ], [ "com/github/hhUOmID", "com/github/hhUOmID.nrIzeohduPvGgbcc" ], [ "com/github/hhUOmID", "nrIzeohduPvGgbcc" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ], [ "java/util/Base64$Decoder", "java/util/Base64$Decoder.decode" ], [ "java/util/Base64$Decoder", "decode" ], [ "com/github/hhUOmID", "com/github/hhUOmID.fhjgamvAkcIh" ], [ "com/github/hhUOmID", "fhjgamvAkcIh" ], [ "java/lang/String", "java/lang/String.indexOf" ], [ "java/lang/String", "indexOf" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "com/github/hhUOmID", "com/github/hhUOmID.maxXfecq" ], [ "com/github/hhUOmID", "maxXfecq" ], [ "java/nio/file/Path", "java/nio/file/Path.resolve" ], [ "java/nio/file/Path", "resolve" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.write" ], [ "java/io/ByteArrayOutputStream", "write" ], [ "com/github/hhUOmID", "com/github/hhUOmID.acquireIag" ], [ "com/github/hhUOmID", "acquireIag" ], [ "java/io/FileOutputStream", "java/io/FileOutputStream.\u003cinit\u003e" ], [ "java/io/FileOutputStream", "\u003cinit\u003e" ], [ "java/lang/Exception", "java/lang/Exception.getMessage" ], [ "java/lang/Exception", "getMessage" ], [ "java/lang/Integer", "java/lang/Integer.valueOf" ], [ "java/lang/Integer", "valueOf" ], [ "com/github/hhUOmID", "com/github/hhUOmID.hADo" ], [ "com/github/hhUOmID", "hADo" ], [ "com/github/hhUOmID", "com/github/hhUOmID.NgSvpKc" ], [ "com/github/hhUOmID", "NgSvpKc" ], [ "java/io/ByteArrayInputStream", "java/io/ByteArrayInputStream.\u003cinit\u003e" ], [ "java/io/ByteArrayInputStream", "\u003cinit\u003e" ], [ "java/util/List", "java/util/List.add" ], [ "java/util/List", "add" ], [ "java/lang/System", "java/lang/System.out" ], [ "java/lang/System", "out" ], [ "java/lang/String", "java/lang/String.length" ], [ "java/lang/String", "length" ], [ "java/util/Base64", "java/util/Base64.getDecoder" ], [ "java/util/Base64", "getDecoder" ], [ "com/github/hhUOmID", "com/github/hhUOmID.KJUBCpMRUg3" ], [ "com/github/hhUOmID", "KJUBCpMRUg3" ], [ "java/io/BufferedOutputStream", "java/io/BufferedOutputStream.close" ], [ "java/io/BufferedOutputStream", "close" ], [ "java/nio/file/Path", "java/nio/file/Path.getParent" ], [ "java/nio/file/Path", "getParent" ], [ "java/util/zip/ZipInputStream", "java/util/zip/ZipInputStream.closeEntry" ], [ "java/util/zip/ZipInputStream", "closeEntry" ], [ "java/util/zip/Inflater", "java/util/zip/Inflater.end" ], [ "java/util/zip/Inflater", "end" ], [ "com/github/hhUOmID", "com/github/hhUOmID.tlGxlbb" ], [ "com/github/hhUOmID", "tlGxlbb" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectErrorStream" ], [ "java/lang/ProcessBuilder", "redirectErrorStream" ], [ "com/github/hhUOmID", "com/github/hhUOmID.jgdkxhiOkmfPk" ], [ "com/github/hhUOmID", "jgdkxhiOkmfPk" ], [ "com/github/hhUOmID", "com/github/hhUOmID.qkLFaltvFP" ], [ "com/github/hhUOmID", "qkLFaltvFP" ], [ "java/lang/Class", "java/lang/Class.getSimpleName" ], [ "java/lang/Class", "getSimpleName" ], [ "java/lang/System", "java/lang/System.arraycopy" ], [ "java/lang/System", "arraycopy" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "java/io/BufferedOutputStream", "java/io/BufferedOutputStream.write" ], [ "java/io/BufferedOutputStream", "write" ], [ "java/util/ArrayList", "java/util/ArrayList.\u003cinit\u003e" ], [ "java/util/ArrayList", "\u003cinit\u003e" ], [ "java/nio/file/Path", "java/nio/file/Path.toString" ], [ "java/nio/file/Path", "toString" ], [ "java/lang/String", "java/lang/String.\u003cinit\u003e" ], [ "java/lang/String", "\u003cinit\u003e" ], [ "java/io/BufferedOutputStream", "java/io/BufferedOutputStream.\u003cinit\u003e" ], [ "java/io/BufferedOutputStream", "\u003cinit\u003e" ], [ "java/util/zip/Inflater", "java/util/zip/Inflater.setInput" ], [ "java/util/zip/Inflater", "setInput" ], [ "com/github/hhUOmID", "com/github/hhUOmID.plv_ke" ], [ "com/github/hhUOmID", "plv_ke" ], [ "java/util/zip/ZipEntry", "java/util/zip/ZipEntry.getName" ], [ "java/util/zip/ZipEntry", "getName" ], [ "java/lang/System", "java/lang/System.currentTimeMillis" ], [ "java/lang/System", "currentTimeMillis" ], [ "java/util/zip/ZipEntry", "java/util/zip/ZipEntry.isDirectory" ], [ "java/util/zip/ZipEntry", "isDirectory" ], [ "com/github/hhUOmID", "com/github/hhUOmID.bicPxin3Lt" ], [ "com/github/hhUOmID", "bicPxin3Lt" ], [ "java/lang/Throwable", "java/lang/Throwable.addSuppressed" ], [ "java/lang/Throwable", "addSuppressed" ], [ "com/github/lfbfwveProxy", "com/github/lfbfwveProxy.gpjulb_jrrf_mdogwt" ], [ "com/github/lfbfwveProxy", "gpjulb_jrrf_mdogwt" ], [ "java/util/zip/Inflater", "java/util/zip/Inflater.\u003cinit\u003e" ], [ "java/util/zip/Inflater", "\u003cinit\u003e" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.toByteArray" ], [ "java/io/ByteArrayOutputStream", "toByteArray" ], [ "com/github/hhUOmID", "com/github/hhUOmID.mdgne_mne_ltghan" ], [ "com/github/hhUOmID", "mdgne_mne_ltghan" ], [ "com/github/hhUOmID", "com/github/hhUOmID.gscdXwJior" ], [ "com/github/hhUOmID", "gscdXwJior" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectOutput" ], [ "java/lang/ProcessBuilder", "redirectOutput" ], [ "java/lang/System", "java/lang/System.getProperty" ], [ "java/lang/System", "getProperty" ], [ "java/lang/String", "java/lang/String.isEmpty" ], [ "java/lang/String", "isEmpty" ], [ "java/lang/ProcessBuilder$Redirect", "java/lang/ProcessBuilder$Redirect.appendTo" ], [ "java/lang/ProcessBuilder$Redirect", "appendTo" ], [ "java/nio/file/Path", "java/nio/file/Path.of" ], [ "java/nio/file/Path", "of" ], [ "java/io/PrintStream", "java/io/PrintStream.println" ], [ "java/io/PrintStream", "println" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.toString" ], [ "java/lang/StringBuilder", "toString" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.start" ], [ "java/lang/ProcessBuilder", "start" ], [ "com/github/hhUOmID", "com/github/hhUOmID.vzZa" ], [ "com/github/hhUOmID", "vzZa" ], [ "java/lang/Character", "java/lang/Character.digit" ], [ "java/lang/Character", "digit" ], [ "java/lang/String", "java/lang/String.\u003cinit\u003e" ], [ "java/lang/String", "\u003cinit\u003e" ], [ "com/github/hhUOmID", "com/github/hhUOmID.JRhse2eqvyXjdZLN" ], [ "com/github/hhUOmID", "JRhse2eqvyXjdZLN" ], [ "com/github/hhUOmID", "com/github/hhUOmID.computeMsfl" ], [ "com/github/hhUOmID", "computeMsfl" ], [ "com/github/hhUOmID", "com/github/hhUOmID.XSdvCAlvBP" ], [ "com/github/hhUOmID", "XSdvCAlvBP" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/util/zip/Inflater", "java/util/zip/Inflater.finished" ], [ "java/util/zip/Inflater", "finished" ], [ "com/github/lfbfwveProxy$wxtMent", "com/github/lfbfwveProxy$wxtMent.statusCode" ], [ "com/github/lfbfwveProxy$wxtMent", "statusCode" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.\u003cinit\u003e" ], [ "java/lang/ProcessBuilder", "\u003cinit\u003e" ], [ "com/github/hhUOmID", "com/github/hhUOmID.x2qVIGRHC__Gr" ], [ "com/github/hhUOmID", "x2qVIGRHC__Gr" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.directory" ], [ "java/lang/ProcessBuilder", "directory" ], [ "java/lang/String", "java/lang/String.substring" ], [ "java/lang/String", "substring" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectInput" ], [ "java/lang/ProcessBuilder", "redirectInput" ], [ "java/lang/Thread", "java/lang/Thread.sleep" ], [ "java/lang/Thread", "sleep" ], [ "com/github/lfbfwveProxy", "com/github/lfbfwveProxy.get" ], [ "com/github/lfbfwveProxy", "get" ], [ "com/github/hhUOmID", "com/github/hhUOmID.sdz_zujbtx_zsafql_rhrgx" ], [ "com/github/hhUOmID", "sdz_zujbtx_zsafql_rhrgx" ], [ "com/github/lfbfwveProxy$wxtMent", "com/github/lfbfwveProxy$wxtMent.bodyString" ], [ "com/github/lfbfwveProxy$wxtMent", "bodyString" ], [ "java/util/Arrays", "java/util/Arrays.copyOfRange" ], [ "java/util/Arrays", "copyOfRange" ], [ "java/nio/file/Files", "java/nio/file/Files.createDirectories" ], [ "java/nio/file/Files", "createDirectories" ], [ "com/github/hhUOmID", "com/github/hhUOmID.snjzVyIu" ], [ "com/github/hhUOmID", "snjzVyIu" ], [ "java/lang/Process", "java/lang/Process.pid" ], [ "java/lang/Process", "pid" ], [ "java/nio/file/Files", "java/nio/file/Files.readString" ], [ "java/nio/file/Files", "readString" ], [ "com/github/hhUOmID", "com/github/hhUOmID.nqjr2" ], [ "com/github/hhUOmID", "nqjr2" ], [ "com/github/hhUOmID", "com/github/hhUOmID.rNS_ipPNSvUl" ], [ "com/github/hhUOmID", "rNS_ipPNSvUl" ], [ "java/lang/String", "java/lang/String.equals" ], [ "java/lang/String", "equals" ], [ "com/github/hhUOmID", "com/github/hhUOmID.runDetached" ], [ "com/github/hhUOmID", "runDetached" ], [ "com/github/hhUOmID", "com/github/hhUOmID.wrJqO" ], [ "com/github/hhUOmID", "wrJqO" ], [ "java/util/Map", "java/util/Map.of" ], [ "java/util/Map", "of" ], [ "com/github/hhUOmID", "com/github/hhUOmID.KdKMAYadFrZi" ], [ "com/github/hhUOmID", "KdKMAYadFrZi" ], [ "com/github/hhUOmID", "com/github/hhUOmID.TdTuXy" ], [ "com/github/hhUOmID", "TdTuXy" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ] ], "metrics": { "file": { "size": 143042, "entropy": 4.41 }, "class": { "major_version": 65, "interface_count": 0, "method_ref_count": 120, "constant_pool_size": 1231, "external_class_count": 42 }, "binary": { "peak_region_bytes": 17408, "peak_region_entropy": 6.98 }, "imports": { "count": 162 }, "functions": { "count": 20 } } }, "id": 8, "mol": "O₃(AlAs₂I)H₅(Db₄F₂OsPo₂Ti)", "path": "mod-injected.jar!!com/github/hhUOmID.class", "pid": 0, "risk": 13, "sha": "d70c7212350da40707e822f1dc731b5f6413d7d5f7b95cf4fcb164b164f9cf8a", "size": 143042, "traits": [ { "id": "micro-behaviors/communications/proxy/tunnel::byte-output-stream", "atk": "T1090", "mbc": "C0003", "conf": 0.5, "crit": 3, "desc": "Java ByteArrayOutputStream usage", "spans": [ [ 679, 21 ], [ 12930, 21 ], [ 13657, 21 ], [ 13807, 21 ], [ 13903, 21 ] ] }, { "id": "micro-behaviors/data/archive/extract/zip::jvm-zip-entry-iteration-bytecode", "conf": 0.92, "crit": 3, "desc": "JVM iterates ZIP archive entries", "spans": [ [ 12561, 41 ] ] }, { "id": "micro-behaviors/data/archive/extract/zip::jvm-zip-entry-read-bytecode", "conf": 0.9, "crit": 3, "desc": "JVM reads ZIP archive entry data", "spans": [ [ 12905, 33 ] ] }, { "id": "micro-behaviors/data/buffer/transfer::bytearrayinputstream-ref", "conf": 0.88, "crit": 3, "desc": "Java ByteArrayInputStream class" }, { "id": "micro-behaviors/data/buffer/transfer::bytearrayoutputstream-ref", "conf": 0.88, "crit": 3, "desc": "Java ByteArrayOutputStream class", "spans": [ [ 13649, 29 ] ] }, { "id": "micro-behaviors/data/decode/base64::java-base64-decode-bytecode-call", "conf": 0.96, "crit": 3, "desc": "Java Base64 decode call", "spans": [ [ 19439, 31 ] ] }, { "id": "micro-behaviors/data/decode/base64::java-base64-decoder-bytecode-call", "conf": 0.94, "crit": 3, "desc": "Java Base64 decoder accessor call", "spans": [ [ 19385, 27 ] ] }, { "id": "micro-behaviors/data/decode/base64::java-base64-decoder-class", "conf": 0.92, "crit": 3, "desc": "JVM Base64 decoder class reference", "spans": [ [ 215, 24 ], [ 19398, 28 ] ] }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method", "spans": [ [ 1015, 8 ] ] }, { "id": "micro-behaviors/fs/read/file/handle::jvm-io-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM File API class reference" }, { "id": "micro-behaviors/fs/read/file/handle::jvm-nio-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM NIO file API reference" }, { "id": "micro-behaviors/fs/write/file/handle::jvm-fileoutputstream-bytecode", "conf": 0.86, "crit": 3, "desc": "JVM imports FileOutputStream class", "spans": [ [ 12768, 24 ] ] }, { "id": "micro-behaviors/os/env/gate::jvm-opaque-environment-key", "conf": 0.94, "crit": 1, "desc": "JVM class has generated gate value" }, { "id": "micro-behaviors/os/env/gate::jvm-string-equals-import", "conf": 0.94, "crit": 1, "desc": "JVM class imports String equals", "spans": [ [ 14589, 0 ] ] }, { "id": "micro-behaviors/os/env/gate::jvm-system-getenv-import", "conf": 0.94, "crit": 1, "desc": "JVM class imports System getenv", "spans": [ [ 5757, 0 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.88, "crit": 3, "desc": "Java bytecode ProcessBuilder reference", "spans": [ [ 135, 71 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-init-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.92, "crit": 3, "desc": "Java bytecode ProcessBuilder constructor", "spans": [ [ 671, 31 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.95, "crit": 3, "desc": "Java bytecode ProcessBuilder start", "spans": [ [ 15491, 30 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-errors", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder merges standard error", "spans": [ [ 15427, 44 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-input", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard input", "spans": [ [ 15217, 38 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-output", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard output", "spans": [ [ 15400, 39 ] ] }, { "id": "micro-behaviors/time/sleep/interval::java-thread-sleep-bytecode", "conf": 0.9, "crit": 3, "desc": "Java bytecode thread sleep", "spans": [ [ 12206, 22 ] ] }, { "id": "objectives/anti-analysis/timing/evasion::kotlin-thread-sleep-check", "atk": "T1497.003", "conf": 0.94, "crit": 3, "desc": "Kotlin Thread.sleep call", "spans": [ [ 12216, 12 ] ] }, { "id": "objectives/anti-static/obfuscation/string/control-prefix::java-character-digit-bytecode", "atk": "T1027", "mbc": "F0001", "conf": 0.9, "crit": 3, "desc": "Java bytecode calls Character.digit", "spans": [ [ 20965, 25 ] ] }, { "id": "objectives/anti-static/obfuscation/string/control-prefix::java-control-prefixed-long-string", "atk": "T1027", "mbc": "F0001", "conf": 0.92, "crit": 3, "desc": "Java string starts with control-length prefix" }, { "id": "objectives/anti-static/obfuscation/string/crypto::java-byte-range-copy", "atk": "T1027", "mbc": "F0001", "conf": 0.7, "crit": 3, "desc": "Java byte range copy", "spans": [ [ 13371, 11 ] ] }, { "id": "objectives/impact/dos/disk::jvm-two-backward-goto-branches", "atk": "T1499.001", "conf": 0.9, "crit": 3, "desc": "JVM repeated counter backedges", "spans": [ [ 22194, 8 ], [ 22280, 8 ], [ 22394, 8 ], [ 22477, 8 ], [ 22575, 8 ], [ 22664, 8 ], [ 22759, 8 ], [ 22874, 8 ] ] }, { "id": "well-known/malware/stealer/prefire-shard::prefire-family-literal", "atk": "T1528", "mbc": "B0006", "conf": 0.9, "crit": 1, "desc": "Prefire family name literal", "spans": [ [ 4184, 7 ] ] }, { "id": "micro-behaviors/data/archive/extract/zip::jvm-zip-entry-extraction-to-file", "conf": 0.96, "crit": 3, "desc": "JVM extracts ZIP entries to files", "uses": [ 1, 2, 11 ], "spans": [ [ 12561, 41 ], [ 12768, 24 ], [ 12905, 33 ] ] }, { "id": "micro-behaviors/data/decode/base64::java-base64-decoding-bytecode", "conf": 0.94, "crit": 3, "desc": "Java bytecode Base64 decoding", "uses": [ 5, 6 ], "spans": [ [ 19385, 27 ], [ 19439, 31 ] ] }, { "id": "micro-behaviors/os/env/gate::jvm-opaque-secret-environment-gate", "conf": 0.97, "crit": 3, "desc": "JVM compares opaque environment gate", "uses": [ 12, 13, 14 ], "spans": [ [ 5757, 6 ], [ 14589, 6 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.94, "crit": 3, "desc": "Java bytecode ProcessBuilder execution", "uses": [ 16, 17 ], "spans": [ [ 671, 31 ], [ 15491, 30 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirected-stdio", "conf": 0.96, "crit": 3, "desc": "Java ProcessBuilder redirects all standard streams", "uses": [ 18, 19, 20 ], "spans": [ [ 15217, 38 ], [ 15400, 39 ], [ 15427, 44 ] ] }, { "id": "micro-behaviors/process/create/spawn::child-process-creation-api", "atk": "T1106", "conf": 0.92, "crit": 3, "desc": "Starts a child process through a platform API", "uses": [ 31 ], "spans": [ [ 671, 31 ], [ 15491, 30 ] ] } ], "type": "java_class" }, { "ctx": [ { "b": "+kO#^0000+06ZF:ay/tbfk20vxMW=qy?vc*CxNK]A=lhFbT(oAB.sxWf:vWV0rrWCvrM6jy*?i]fhD4(wN//!00rl49+]bbvr:CywPPODB8iHih843\u0026A=(CBo\u003c}{FxjV8*00Jx", "ln": 0 } ], "depth": 1, "facts": { "imp": [ [ "", "java/lang/Object" ], [ "", "javax/net/ssl/X509TrustManager" ], [ "", "java/security/cert/X509Certificate" ], [ "", "com/github/lfbfwveProxy" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ] ], "metrics": { "file": { "size": 1245, "entropy": 5.77 }, "class": { "major_version": 65, "interface_count": 1, "method_ref_count": 1, "constant_pool_size": 63, "external_class_count": 4 }, "binary": { "peak_region_bytes": 1024, "peak_region_entropy": 5.83 }, "imports": { "count": 5 }, "functions": { "count": 4 } } }, "id": 11, "mol": "H(Cm)", "path": "mod-injected.jar!!com/github/lfbfwveProxy$EeUugLf1.class", "pid": 0, "risk": 1, "sha": "593b620b09f936850ed46d2331324eb2c31bdb23324044a1927e46347e947bf4", "size": 1245, "traits": [ { "id": "micro-behaviors/os/env/gate::jvm-opaque-environment-key", "conf": 0.94, "crit": 1, "desc": "JVM class has generated gate value" }, { "id": "micro-behaviors/communications/socket/ssl::jvm-x509trustmanager-class-ref", "conf": 0.94, "crit": 3, "desc": "JVM X509 trust-manager interface reference" }, { "id": "micro-behaviors/communications/socket/ssl::jvm-x509trustmanager-issuer-callback", "conf": 0.94, "crit": 3, "desc": "JVM getAcceptedIssuers callback defined" }, { "id": "micro-behaviors/communications/socket/ssl::jvm-x509trustmanager-server-callback", "conf": 0.94, "crit": 3, "desc": "JVM checkServerTrusted callback defined" }, { "id": "micro-behaviors/communications/socket/ssl::jvm-custom-x509trustmanager", "conf": 0.95, "crit": 3, "desc": "Class implements a custom X509 trust manager", "uses": [ 1, 2, 3 ] } ], "type": "java_class" }, { "ctx": [ { "b": "+kO#^0000+1a*KN7H}x2fk20vxMW=qy?vc*CxNK]A=lhF2lj=901-)NC404uvqYZhpHX6Iv@}}Q0%5xAv@Diqxk8E3BZ^1uw[2v@C4BG\u003cz*lKMmp/Fwxg#[(2lj]d02]A^z7/J", "ln": 0 }, { "b": "xl[YD0rrc)0rrvmz/x$?Dt@@=awuJUC42RGzE)]yB8#dJq=uv*z!0M]BvGXGBz(hBi@]r=jzwXEBuPZ911kQ03\u0026?\u003cVe^.NY051uM0+%K)02XEuz/4dux([3hvLqLfvRf?cwL^z=CZhvK00u\u003eBBo8w0c}[w:C404uvqYZhq/)4]zF83WoK\u00260Tfk20vxMW=qy?vc*CxNK]A=lhFbZjGPo\u003ewi:i@]r{ygho]fkktTnL.^1v}xR3x(v\u003e]05T=S26B%5q/)3Z1uoSm0@", "ln": 607 }, { "b": "rTX%W07WB%m/V9Y00V\u003eJAaJ]$0rs8/lN+YzvrM6jy*?i]fh($kx(mMIB.LV5wPx\u003cv080q=3iiM@o-Uk1Bz\u003e91A+PA70rr/ZdnjF+C404uvqYZhq/)4]zF83t08AO\u003e3iiM@q2{U8x\u003e8BcwP?\u003cbwPI[[0d34!ygho]fkL6mxd)h9A+PA7j4%x$C404uvqYZhq/)4]zF848ygho]fkL6mxd)h9A+PA7j4%x$C404uvqYZhq/)4]zF848ygho]flIwJy+FH\u003eA62Hxv@Diqxk8E3BP", "ln": 972 }, { "b": "v@=c?By+EMa$cc1vrM6jy*?i]fh($kx(mMBdnjF+C404wwPPO9qB@}U0h/*}3il}6Sq##5Bz\u003eeSoAtb8c[d\u00268vrM6jzE)]yrz(HL3\u0026)sdTo[%80iDn43#fi]vj#IfBt3S(oA$N30rrvqwPQEYB94/\u003cU(EPc0i=Ee0rrvqwPQ:!A=.Y\u0026V\u0026AD20i=Eh0rrHuwPQ:?z//]cz!]*ZW/xki0i=Ek0rtd\u003c(8IbIJ!MS4Gy1F]\u0026HvQzLdy4YOA==5\u003e--mtIlt\u003cBUI#sM(AlSASd:ApOz]Qu\u003ecRR:Jf@N{Vh", "ln": 2705 }, { "b": "z!@@Yx([VjyhA$KcmzM5vrM6jy*?i]fh($kx(mMBdnjF+C404uvqYZhq/)4]zF83t0m?e43igbc/z$%.ygho]fk+uyfh(!0yH}O)0nm+W*w\u0026(e00\u0026M80rr*PwPQ*Yv}xv$wKpJKw[u0Yx)Kt00nWYD3in/X?ViY}ygho]fk+uyfg*4)Bw)9/yH}PNwmPZ(B8}M^\u0026q\u0026]]c}[w:C404uvqYZhq/)4]zF845dol\u0026SeDB/r0oa1t3\u0026?KMaQFbI0oKpZ2v?W\u0026zE)s10rs8/oLO0Vvj#IfBt3Nhv@2T$l1BIDwPI]OnHWWG0o:BE3in/X(i)Us03ITG0S.M/01r{WBw)9Sx(dB1B-X2()F]=+0nvIx3\u0026?^Tec#pT0pZ6\u00269+]bbvr:CywPPODB8iHdq+Qbdv@2T$mQY!Gz/Qad0p{i\u003e3$Br?vru6Vz!0M]Bo8w3c}[w:C404wwPPO7z!0M]BurfhvrM6jy*?i]fh($kx(mMBnM)Mpygho]fk+uyfh(!0yH}PH3\u0026]@2{6H/(0quG]7IWx4vr:CywPPODB8iHdq+Qbdv@2T$2lsM201-^OBw(aip*[xMzdN*2A=RlYa1eNiygho]CRr@CBt4YRy+FZ=oI/ervqPN$wPz\u0026N3\u0026{e8@0AD20q#]#8erP6vr:CywPPODB8iHdpdW#{B97e=", "ln": 3221 }, { "b": "j1i\u003crvrM6jB-.tlfhc83Buo)i1{1@p0r\u0026Gf0rs6NvrM77fk+uyflqhJfh\u003e!yp*[xMzdN*2A=RD^3ipbpB7GC(wPz%9A.Z4WwPE\u003eL6duK?vrM6jB-.tlfhc83Bup{L3\u0026{+q4giaz0s/bghvYb^Nb$94(XZX\u003cFU8n7Qt?fx\u0026H)miLAUf^GxeC-(w}1QR%p\u003cL[4jXyQl$n8NEtV^)v{\u0026\u003e0t2nib6dsqmq=TPz!T9hnN#yIBzku3v{%E[z/d\u003cSxk.*8BzbI10tkzl3ipIn69e7AB7GC(q+Q1@A:-/@By/Gl0rsk\u003coLO0Vvr:CywPPODB8iHdq+Q1@A:-/@By/Glj1jhs0tLRJ3io]67xBHCB97\u0026hBvY?TwohA)yH)[P82#n@0qVZm0rrTywPQZ\u003cBz#wAq/)4\u003evqM2B7:{?bygho]fkktTpJZ+#B-ZM7A+eV@i$8cf0uzHE*w@t@01JTMBv*v?B-ZM7A+eV@0rr]:dnjF+C404rz.BX1Acln3BAg@3z95dbaorR)0nvI#0rsFQ\u003c^7\u003e=S\u003c?h\u003cU\u0026.jt\u003caAiIRIKYJN^dIS\u003ca$kfTc%", "ln": 3842 }, { "b": "T^n1LUi?dm)t=?UYq1u2X8\u003c%f\u0026HCIZINRMcSQc+4)Yz#+0FgsL3q1e(uPp25iBsGH0FyF[2)1@BG-IeSCxdztwDq=mc%G1!rTY1:0F?6-cJP5800M$JB-Rj80Gc}g3iqHPI#-[+xKL%OB9qhhCMv!7c}[w:C404rz.BX1Acln3BAg@3z96guv@Diqxk8E3BZ^1uw[2v@C4BG\u003cz*lKMCx!j7wO#PK3\u0026#v?J%U\u003c*0GWrZ1.hv!B7C:XK]N9w0nvKr0rr^FvrM6jy*?i]fh#R9z*bS0y?i?LL(Q\u003c@BztPgzF}*KB98hlrC=R\u00260rs0hygho]CRr@CBt4YRy+FZ=oJb\u003etyH}PH0rrvxvqPNIx(i}K9zyiRC42RGzE)]yB8#dJq=uv^vrb^[wPRH7B2%y51A[S@zuf.HoLO0Vvj#IfBt3Nhv@2T$i@]r=w[Vf\u003eyIT1K1z@i)fAzd*oLO0Vvj#+Bx(2B%vq)FXzGG]Ai@]r\u003cvqxv@Cu5B0ABBbXvf3uzoLO0Vvj#tkfhD.jAcln3BAg@3z94:#6gWpEvQA!rAa\u0026PFltfIeDuqFH0rr\u003cdygho]fkktTnP5G\u0026Bw)p4wNPBq0r", "ln": 6163 }, { "b": "lVc#D01JV%uS8hyrA-m6nKM{00rrEry*?p7wN[bIw=R(qwmYO0vngfP0rrQzr.L#av[*=Qn\u003ez\u0026/k(*@}oLO0Vvj#IfBt3S(oGJmP6hi7Lt3\u003e]orcR+@AZ-A7mmY*I0rrsDCWCPdy5[qEy\u0026Bk#v}oT#w)X$SuU0O:C69/=6h\u003c9Nx\u003cT?jBX=vMm}ldrA^qIk0rr^wsw9dhv}d?}uT#O%pHuB\u003epfdC@2XmH.Byw9\u0026ASDdIw{3:/ray2:BwlQ-y?rXF0+?", "ln": 6727 }, { "b": "z.BC1w[CQ{wN[wIAcln3BAg@3z3H9R0rr@+oLO0Vvj#tkfg*52B-ZM7A+eV@j1jhs04!k/3iv{y.t%SSygho]fkktTlv0V:l2}0OC#5N8Acln3BAg@3z3H9W3iw9Cf984QA+eV\u00263\u003c1xGlKA\u003ef0MUVIHx6\u003cL0Mt8Z0rrmzx)Kt00N7Kh3iw9D+(E!LBz\u003cG\u003eBy^:UA::j]00BY0ts5-0=Jhx10Mt8!0rs-2oLO0Vvj#Ijz.CQlvrcB2Bt30{vrcB2Bup{Bygho]fkL6mxd)h9A+PA7i$89+0N?wR-r1D?04OGwKIf.?JQ03*\u0026/O]YS/MqLG5I\u0026K)y64OJ*GabO9^Lv\u003eBwNoK=5klMK0Sy0rrpAAbolg0rsF}oLO0Vvj#C9zu", "ln": 7000 }, { "b": "m0AcSBB0@/87nf[vrM6jx(tT@zG6-uq/)4\u003evqO7Pts5-169n\u003cP00iip0rruMts7[Mdm\u003c{G-@W4:0L!:N0@@(j015+C07^m)0SSi300K=PlmCFm0MLlZ3iv{z9SVlCc%G2fnHWWG0FZ.03iw9EaPRM\u003cc}N9EvrM6jy*?i]fh($kx(mMBoLO0Vvj#+Bx(2B%vq[qjlmC}z04!l%3igzmbMN(Rx(F6impQT-yi\u0026u^Dtdhe0rrNEx/HiAuQm+9ze.vl0rr", "ln": 8098 }, { "b": "B:mtcD2WCfABir!0rr^2Du.}!qdrG(uVnqKoKz{sxhX*h1vk4nmGAF{ze%w#v@DWe0rsinygho]fkktTlv0V:l2}0OC#5N8Acln3BAg@3z94:#6k?FHw)X2NADLROr8uL3oHS5I0rrsyBAgn/Cl4WGBA?[mBZ[[Z01J*hyewzxp!j@jt1.EA0rsclygho]fkktTluM)LwPzu)nP5G\u0026Bw)p4wNPBq0rr:IB7635z=7B\u0026x\u003eH7Tz*2UYC(W)HxlFl9q*5fw2ypD1nb", "ln": 8431 }, { "b": "Y:aXc0rrsrwoZy-x8}#klJEe}w]hu\u003evSkW-A=k-80rrHtyIEj0yh^J$zE\u0026[.E-WcyHK.Qg15cdJ.2TJMygho]fkktTl$7gCpJZ+#B-ZM7A+eV@2lHR202WgUygho]fkktTpJZ+#B-ZM7A+eV@j1jhs04!nF3iD$7R2ZM4zEEB3rb3hX3\u003c9sdGBdZf0\u0026Mn5000000rr61019{\u003cx()]+xM4{k3\u003c9Hgnd2A[0\u003c8M$\u003cL0idlCYw:1dAtPo922a1Ml8g\u003cGjr$VY:y2GY5X}\u003cGki-0\u003cR?b33QA7By^^:By+\u003cZV\u0026AS70\u00262?80rrEJA+PSblv0V:A%@bV0rAJeQxm}a02/PXC404uvqYZhqGV(0x(dAICW\u003er7BzkVh2lIEq02NaTygho]fkL6mxd)j$A=legvR/Qqdol\u0026SeDSM(0\u003eOJE0rr^Ct2mK)Bwb!uuU8=GoKzu$x\u003edkA1:sxDw]^$M0Af103uQ0as7$=TyINR+02ngxvrM6jx(tT@pEPIrwPh:9z/dSq00WpMx\u003eG:", "ln": 9522 }, { "b": "vrM6jB-.tlfg68*wI#v\u003cmq=QNwmY^y3\u003cbb:*x)]}0]9!R4ThSexM53np*))Bx(mL(0]s1k3ig.v?ViY!wO#0@wmX.Uq/)4]zF6vV\u0026r1Jp022B[0ruae\u003eCtVNO$CeGFAAL=(yA^%IJ^1\u0026WbM\u003c%\u003cGkMEO@8N8FABqw)V\u0026N\u003cRi{OvYxlo0\u003eaGAMOUULeQt.R[\u0026!BO@TE[WFU\u0026RW}\u003ec{fmL=r\u0026wGZkk72M\u003c5/03.^3Px\u002621\u003e.(OhP0NQVHuUZ@\u003cH\u0026m/NZgIi(Z-^]IN\u0026eDLl.lL0rtE@^x@bIJQr\u003e", "ln": 10114 }, { "b": "%nSbYYh{-\u003e000000000F1POJ507*LBSrF9fz/c54Jvj@:q@u)2cYN^5w\u003eE=jTO%jp0rr^FvrM6jzFs2xlv0V:luM)LwPw1T6-!pqCxdbh0rr#=ts6=jygho]fk+Gxfg6@awKpJKw[u0A3\u003cdpF7ZZuX0#Rat2XNZ\u003cq!Q8\u0026Bo8vzc[e760#?sZ3iI4C9rMowFb/VK0rr61018XdsWU5PAD=E%0rr@+oLO0Vvj#Ijz.BC5By^^Yw[CQ{j1jhs10E", "ln": 11040 }, { "b": "v}tVve*%zdvrM6jy*?i]fh($kx(mMBdnjF+C42RGzE)]yB8#dJq=uvSz/fVdCYV1Q17hjt3iKSqvGuDEygho]CRr@CBt4YRy+F+dB-RU0vqYH^wPw1Twc@qv051uM8FSY7vj#Xkv%8*aBA]JrwN/\u003e6wL#@Own=q\u002617}@yxAfW^00E1Nx(\u003cvQs14oDygho]CRr@CBt4YRy+FB)C$?Z+vp%d(j6Lx[vrM77fk+uyflqhJfh#$mB97b+zEEf?AYV%fvrM6jB7F\u003c7A+PSvfh(B(B-I4\u003evqYQ]z96gE3\u003cgkDyygeJ18E#r5nbM@q/ueYwPQyIv@#TfC(W)?c[d\u00268vrM77fk+uyflqhJfh\u003e!yq/ueYwPQyIv@#R", "ln": 12017 }, { "b": "jXNvdWG5PRe4bBD1y@G.kdZ!+sSK%Kn\u0026^7Shu:*09IJJW83zC)9afG+v7353d*cN\u003c9b]q]06#j1WG667GARyO%jXy]WG6hP0rAkh09lr700065Ee\u003clEcJBnG04X9P2ll*=000000rrc103haB2ll*\u003c06phZ2lml{0rr9E1ag7G01n\u0026d04XaH09odw000aI000040096T1aHpJ00Jx6hVJ*T2((:Yso5EaDJj3C:P8LC2MK\u00268zw3ei2nEER", "ln": 12782 }, { "b": "6:Co.F\u0026i\u0026DuBx\u0026yo!lx6j$KzJwf2hs1qI6L1V=!?hu\u003c)26:glhaq\u003es$1$P($u\u003e\u0026(Ng+n+A1%4U\u003cg\u003eH(\u003cGA.EP%kgA*j6rB8W/y4\u003c0rBZX09lr700065Ee\u003clEeDt[M03haC2ll*\u003c01P5f00001009308up3F06pz=4*J8B0rAA9wb#Yh03.O[0000m00icw08JVe03hau03hbp0bhAX009gJ000040096T19%}E00id61aHpJ00@YbhVJ*T", "ln": 12998 }, { "b": "hWHla6AAo9hWHla6AAudhWHe#C@D9D3LSO/E(v-J3LSO?FJ0@O1@dy}1qI5E6:Oh7eD=^]6:eF-g\u003eH(\u003cGA}QR%ecOnYAHt383QfX2lLXAXb.h]06ss32E:XCdL04JXbYNl000021apdH05T-V@@sbv3i{L)2ll*\u003c06peX000000rrc102$$B2ll*\u003c06pz=i%L:@0rAA9wb(Sg06zq8D\u0026KcDaohGz9@}=gG-Ad]0018vN/Ffy9SMiv9@}=g", "ln": 13305 }, { "b": "WG6+$1q}sAg=tHP1IL1H6:nba1@duP1V=\u003e\u003chv7366:yxjbPc?42Pi:F6:m$W2W/Fb1oYCB6:nL:g\u003eH(\u003cGA}QR%j+c=j6rBaW/y4\u003cd\u003eAoZ09lr700065Ee\u003clEaohG@@@sbv2)QC(2ll*\u003c06pz=4*J8B0rAA9wb#VgcJ!.@001FG1op4OsPBV^9SMfue=Y2OL(I\u003c90rs.LsPB-/9SMlwe=Y2OMJexk0%r#L000c40rt1WDh){B0SX8WE/GDG5D\u00267)0001n0001o00015000090gi+y00AyJ0002=00-Gh0001s5$7S:6:UIvPA2GmhubMv6:UBPEL}GBO3\u0026raiS{r6Z64%:1yA#z1SmDS6:naJwhTSb2d$a22lM\u003c\u00266:LJUQ5VqN2nEHZ1qIh083yVU6:LJTA9$IOL2Wev0Jk$PY8T]}83^RJxdtz.eW$^YUMaU60T0\u0026J0021V1oeuq015@hi%L:E2ll*\u003c01P5f0000100930bMFeR06pz=i%L:E2lknt0aV9h2lnon0rr9A1ag7G04E%K02CSs0gT3g0000n09Pw[03hav02CSs0g\u003cfi00icp09Pw{04d", "ln": 13609 }, { "b": "WG6+$78W\u003e\u0026g=uc/7qo]Z6=gys7.)[21V^I6hx0qG6=rUBbPdEm8w%p[6=gl)8ELxt76Cu\u003c6=g*%g?q+HGC\u003c(?%j+c=j6rBsW/y6H0kyz$6:B/k0237MNe^M00kUMk2c[lDhu$96WGard2]K5?01fUJWGaEr09o/SWG6+$9t])i1y@w\u003cuO\u003cUZ86cBa9+ky:hxJUQYAHts12.qqaR=8[03Ad46^jCn6^kyK9tGUhaR=5qu]iE#rFhH@R#LU^06ss3aH.t-iTDVcWGaT[0c/v/83NCG=Pivkb!B4Ds*[yT86(S\u003c^?pit0aE#o872Cxhyxv?Z64%YcUba-6!3Y#iW\u003ed?dITAFd53X!87upI872F3cTWVsu]e-F1qJy3cVADIF%6b!dGMEE*Q^CEsS5V$0b5.u^?%Eu0mOvRqAta42dKV^iTSF0*Gy#=*=t/X3LIp70n[.5Y8Z?[8448-W/CJ}0oZ=\u003c(LQ8o0pvh{[d=j%0gf$\u003e[!?/M1@dvCWGc9r0qX.=84B1O@YgJb4.z-wsS4BM0rY?j3ao\u003cB84EqX5W?WGiXqi", "ln": 14199 }, { "b": "1R?ig01x!G0#h0F0Q\u00265L83EwF+9-klRVp6w1HXv75d(tMpC@y(2atI@RVov82d$j52lM\u003c\u00266:LJUQ5VF?83Z(Z6:txUwvqLohvg980?YI$RVmev2O^UNhvckX*aa3C0@", "ln": 37280 } ], "depth": 1, "facts": { "imp": [ [ "", "java/lang/StringBuilder" ], [ "", "java/util/List" ], [ "", "[C" ], [ "", "com/github/lfbfwveProxy$wxtMent" ], [ "", "java/lang/invoke/MethodHandles$Lookup" ], [ "", "java/net/Socket" ], [ "", "java/lang/Throwable" ], [ "", "javax/net/ssl/SNIHostName" ], [ "", "java/io/ByteArrayOutputStream" ], [ "", "[Ljava/lang/String;" ], [ "", "java/lang/RuntimeException" ], [ "", "java/nio/charset/StandardCharsets" ], [ "", "[B" ], [ "", "com/github/lfbfwveProxy$EeUugLf1" ], [ "", "java/io/OutputStream" ], [ "", "java/io/DataOutputStream" ], [ "", "javax/net/ssl/TrustManager" ], [ "", "java/util/Base64" ], [ "", "java/lang/String" ], [ "", "java/io/InputStream" ], [ "", "java/util/Set" ], [ "", "java/util/concurrent/ConcurrentHashMap" ], [ "", "java/util/Map" ], [ "", "java/io/BufferedInputStream" ], [ "", "java/util/LinkedHashMap" ], [ "", "java/lang/invoke/MethodHandles" ], [ "", "java/util/Iterator" ], [ "", "java/lang/Exception" ], [ "", "java/io/IOException" ], [ "", "java/lang/System" ], [ "", "java/util/Base64$Encoder" ], [ "", "javax/net/ssl/SSLParameters" ], [ "", "javax/net/ssl/SSLSocket" ], [ "", "java/lang/Integer" ], [ "", "java/nio/ByteBuffer" ], [ "", "java/util/Map$Entry" ], [ "", "java/net/InetSocketAddress" ], [ "", "java/net/URI" ], [ "", "java/lang/Object" ], [ "", "javax/net/ssl/SSLSocketFactory" ], [ "", "javax/net/ssl/SSLContext" ], [ "", "com/github/lfbfwveProxy$nqv" ], [ "", "java/lang/NumberFormatException" ], [ "", "java/security/SecureRandom" ], [ "", "java/net/URL" ], [ "java/net/Socket", "java/net/Socket.connect" ], [ "java/net/Socket", "connect" ], [ "java/lang/String", "java/lang/String.indexOf" ], [ "java/lang/String", "indexOf" ], [ "java/lang/String", "java/lang/String.equals" ], [ "java/lang/String", "equals" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.\u003cinit\u003e" ], [ "java/io/ByteArrayOutputStream", "\u003cinit\u003e" ], [ "com/github/lfbfwveProxy", "com/github/lfbfwveProxy.hasJsvgjx" ], [ "com/github/lfbfwveProxy", "hasJsvgjx" ], [ "java/lang/String", "java/lang/String.substring" ], [ "java/lang/String", "substring" ], [ "com/github/lfbfwveProxy", "com/github/lfbfwveProxy.handleSgzuz" ], [ "com/github/lfbfwveProxy", "handleSgzuz" ], [ "java/io/BufferedInputStream", "java/io/BufferedInputStream.read" ], [ "java/io/BufferedInputStream", "read" ], [ "javax/net/ssl/SSLSocket", "javax/net/ssl/SSLSocket.getOutputStream" ], [ "javax/net/ssl/SSLSocket", "getOutputStream" ], [ "java/lang/String", "java/lang/String.charAt" ], [ "java/lang/String", "charAt" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.write" ], [ "java/io/ByteArrayOutputStream", "write" ], [ "java/net/URL", "java/net/URL.getPort" ], [ "java/net/URL", "getPort" ], [ "java/net/URL", "java/net/URL.getPath" ], [ "java/net/URL", "getPath" ], [ "java/util/Iterator", "java/util/Iterator.next" ], [ "java/util/Iterator", "next" ], [ "java/lang/RuntimeException", "java/lang/RuntimeException.\u003cinit\u003e" ], [ "java/lang/RuntimeException", "\u003cinit\u003e" ], [ "com/github/lfbfwveProxy$EeUugLf1", "com/github/lfbfwveProxy$EeUugLf1.\u003cinit\u003e" ], [ "com/github/lfbfwveProxy$EeUugLf1", "\u003cinit\u003e" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.\u003cinit\u003e" ], [ "java/io/ByteArrayOutputStream", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.\u003cinit\u003e" ], [ "java/lang/String", "\u003cinit\u003e" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.write" ], [ "java/io/ByteArrayOutputStream", "write" ], [ "java/lang/String", "java/lang/String.trim" ], [ "java/lang/String", "trim" ], [ "java/io/DataOutputStream", "java/io/DataOutputStream.writeBytes" ], [ "java/io/DataOutputStream", "writeBytes" ], [ "java/util/concurrent/ConcurrentHashMap", "java/util/concurrent/ConcurrentHashMap.\u003cinit\u003e" ], [ "java/util/concurrent/ConcurrentHashMap", "\u003cinit\u003e" ], [ "java/util/Map", "java/util/Map.entrySet" ], [ "java/util/Map", "entrySet" ], [ "com/github/lfbfwveProxy", "com/github/lfbfwveProxy.oldQitzejm" ], [ "com/github/lfbfwveProxy", "oldQitzejm" ], [ "java/lang/String", "java/lang/String.startsWith" ], [ "java/lang/String", "startsWith" ], [ "java/net/Socket", "java/net/Socket.close" ], [ "java/net/Socket", "close" ], [ "java/io/OutputStream", "java/io/OutputStream.flush" ], [ "java/io/OutputStream", "flush" ], [ "java/io/DataOutputStream", "java/io/DataOutputStream.\u003cinit\u003e" ], [ "java/io/DataOutputStream", "\u003cinit\u003e" ], [ "javax/net/ssl/SSLParameters", "javax/net/ssl/SSLParameters.setServerNames" ], [ "javax/net/ssl/SSLParameters", "setServerNames" ], [ "java/util/Base64", "java/util/Base64.getUrlEncoder" ], [ "java/util/Base64", "getUrlEncoder" ], [ "com/github/lfbfwveProxy", "com/github/lfbfwveProxy.cqpgcRef" ], [ "com/github/lfbfwveProxy", "cqpgcRef" ], [ "java/io/BufferedInputStream", "java/io/BufferedInputStream.read" ], [ "java/io/BufferedInputStream", "read" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.getShort" ], [ "java/nio/ByteBuffer", "getShort" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.getInt" ], [ "java/nio/ByteBuffer", "getInt" ], [ "com/github/lfbfwveProxy", "com/github/lfbfwveProxy.icypevkness" ], [ "com/github/lfbfwveProxy", "icypevkness" ], [ "java/util/List", "java/util/List.of" ], [ "java/util/List", "of" ], [ "com/github/lfbfwveProxy", "com/github/lfbfwveProxy.srammsyXdDwcltz" ], [ "com/github/lfbfwveProxy", "srammsyXdDwcltz" ], [ "com/github/lfbfwveProxy$wxtMent", "com/github/lfbfwveProxy$wxtMent.\u003cinit\u003e" ], [ "com/github/lfbfwveProxy$wxtMent", "\u003cinit\u003e" ], [ "java/net/Socket", "java/net/Socket.setReceiveBufferSize" ], [ "java/net/Socket", "setReceiveBufferSize" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/net/URL", "java/net/URL.getHost" ], [ "java/net/URL", "getHost" ], [ "java/util/Map$Entry", "java/util/Map$Entry.getKey" ], [ "java/util/Map$Entry", "getKey" ], [ "java/lang/String", "java/lang/String.substring" ], [ "java/lang/String", "substring" ], [ "java/net/Socket", "java/net/Socket.\u003cinit\u003e" ], [ "java/net/Socket", "\u003cinit\u003e" ], [ "javax/net/ssl/SSLSocketFactory", "javax/net/ssl/SSLSocketFactory.getDefault" ], [ "javax/net/ssl/SSLSocketFactory", "getDefault" ], [ "java/net/InetSocketAddress", "java/net/InetSocketAddress.\u003cinit\u003e" ], [ "java/net/InetSocketAddress", "\u003cinit\u003e" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.size" ], [ "java/io/ByteArrayOutputStream", "size" ], [ "java/net/Socket", "java/net/Socket.getOutputStream" ], [ "java/net/Socket", "getOutputStream" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.toString" ], [ "java/io/ByteArrayOutputStream", "toString" ], [ "java/util/Base64$Encoder", "java/util/Base64$Encoder.encodeToString" ], [ "java/util/Base64$Encoder", "encodeToString" ], [ "java/util/LinkedHashMap", "java/util/LinkedHashMap.\u003cinit\u003e" ], [ "java/util/LinkedHashMap", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.equalsIgnoreCase" ], [ "java/lang/String", "equalsIgnoreCase" ], [ "javax/net/ssl/SSLParameters", "javax/net/ssl/SSLParameters.setEndpointIdentificationAlgorithm" ], [ "javax/net/ssl/SSLParameters", "setEndpointIdentificationAlgorithm" ], [ "java/lang/System", "java/lang/System.nanoTime" ], [ "java/lang/System", "nanoTime" ], [ "com/github/lfbfwveProxy", "com/github/lfbfwveProxy.mz_jyynvi_nphq_ukr" ], [ "com/github/lfbfwveProxy", "mz_jyynvi_nphq_ukr" ], [ "java/net/Socket", "java/net/Socket.getInputStream" ], [ "java/net/Socket", "getInputStream" ], [ "java/nio/charset/StandardCharsets", "java/nio/charset/StandardCharsets.UTF_8" ], [ "java/nio/charset/StandardCharsets", "UTF_8" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "javax/net/ssl/SSLSocket", "javax/net/ssl/SSLSocket.setSSLParameters" ], [ "javax/net/ssl/SSLSocket", "setSSLParameters" ], [ "java/nio/charset/StandardCharsets", "java/nio/charset/StandardCharsets.ISO_8859_1" ], [ "java/nio/charset/StandardCharsets", "ISO_8859_1" ], [ "java/util/Map", "java/util/Map.put" ], [ "java/util/Map", "put" ], [ "java/lang/String", "java/lang/String.indexOf" ], [ "java/lang/String", "indexOf" ], [ "java/lang/String", "java/lang/String.getBytes" ], [ "java/lang/String", "getBytes" ], [ "java/net/URI", "java/net/URI.toURL" ], [ "java/net/URI", "toURL" ], [ "com/github/lfbfwveProxy$nqv", "com/github/lfbfwveProxy$nqv.\u003cinit\u003e" ], [ "com/github/lfbfwveProxy$nqv", "\u003cinit\u003e" ], [ "java/io/BufferedInputStream", "java/io/BufferedInputStream.read" ], [ "java/io/BufferedInputStream", "read" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ], [ "javax/net/ssl/SSLSocket", "javax/net/ssl/SSLSocket.close" ], [ "javax/net/ssl/SSLSocket", "close" ], [ "javax/net/ssl/SSLContext", "javax/net/ssl/SSLContext.init" ], [ "javax/net/ssl/SSLContext", "init" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/lang/String", "java/lang/String.split" ], [ "java/lang/String", "split" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "java/util/Iterator", "java/util/Iterator.hasNext" ], [ "java/util/Iterator", "hasNext" ], [ "java/io/BufferedInputStream", "java/io/BufferedInputStream.\u003cinit\u003e" ], [ "java/io/BufferedInputStream", "\u003cinit\u003e" ], [ "com/github/lfbfwveProxy", "com/github/lfbfwveProxy.TYYD3bqwsK" ], [ "com/github/lfbfwveProxy", "TYYD3bqwsK" ], [ "javax/net/ssl/SSLSocketFactory", "javax/net/ssl/SSLSocketFactory.createSocket" ], [ "javax/net/ssl/SSLSocketFactory", "createSocket" ], [ "javax/net/ssl/SSLSocket", "javax/net/ssl/SSLSocket.startHandshake" ], [ "javax/net/ssl/SSLSocket", "startHandshake" ], [ "javax/net/ssl/SSLContext", "javax/net/ssl/SSLContext.getInstance" ], [ "javax/net/ssl/SSLContext", "getInstance" ], [ "java/util/Base64$Encoder", "java/util/Base64$Encoder.withoutPadding" ], [ "java/util/Base64$Encoder", "withoutPadding" ], [ "com/github/lfbfwveProxy", "com/github/lfbfwveProxy.D9LjURRO" ], [ "com/github/lfbfwveProxy", "D9LjURRO" ], [ "java/net/Socket", "java/net/Socket.setSoTimeout" ], [ "java/net/Socket", "setSoTimeout" ], [ "java/util/Set", "java/util/Set.iterator" ], [ "java/util/Set", "iterator" ], [ "java/lang/String", "java/lang/String.contains" ], [ "java/lang/String", "contains" ], [ "java/lang/System", "java/lang/System.currentTimeMillis" ], [ "java/lang/System", "currentTimeMillis" ], [ "java/security/SecureRandom", "java/security/SecureRandom.\u003cinit\u003e" ], [ "java/security/SecureRandom", "\u003cinit\u003e" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.setLength" ], [ "java/lang/StringBuilder", "setLength" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.position" ], [ "java/nio/ByteBuffer", "position" ], [ "java/io/InputStream", "java/io/InputStream.read" ], [ "java/io/InputStream", "read" ], [ "java/net/URL", "java/net/URL.getProtocol" ], [ "java/net/URL", "getProtocol" ], [ "com/github/lfbfwveProxy", "com/github/lfbfwveProxy.cfc6" ], [ "com/github/lfbfwveProxy", "cfc6" ], [ "com/github/lfbfwveProxy$nqv", "com/github/lfbfwveProxy$nqv.isExpired" ], [ "com/github/lfbfwveProxy$nqv", "isExpired" ], [ "java/lang/String", "java/lang/String.toCharArray" ], [ "java/lang/String", "toCharArray" ], [ "java/io/DataOutputStream", "java/io/DataOutputStream.writeByte" ], [ "java/io/DataOutputStream", "writeByte" ], [ "javax/net/ssl/SSLSocket", "javax/net/ssl/SSLSocket.getInputStream" ], [ "javax/net/ssl/SSLSocket", "getInputStream" ], [ "java/lang/Integer", "java/lang/Integer.parseInt" ], [ "java/lang/Integer", "parseInt" ], [ "javax/net/ssl/SNIHostName", "javax/net/ssl/SNIHostName.\u003cinit\u003e" ], [ "javax/net/ssl/SNIHostName", "\u003cinit\u003e" ], [ "com/github/lfbfwveProxy", "com/github/lfbfwveProxy.jggmQfL" ], [ "com/github/lfbfwveProxy", "jggmQfL" ], [ "com/github/lfbfwveProxy", "com/github/lfbfwveProxy.rvC" ], [ "com/github/lfbfwveProxy", "rvC" ], [ "com/github/lfbfwveProxy", "com/github/lfbfwveProxy.orze3pxi" ], [ "com/github/lfbfwveProxy", "orze3pxi" ], [ "java/io/InputStream", "java/io/InputStream.read" ], [ "java/io/InputStream", "read" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.position" ], [ "java/nio/ByteBuffer", "position" ], [ "javax/net/ssl/SSLSocket", "javax/net/ssl/SSLSocket.getSSLParameters" ], [ "javax/net/ssl/SSLSocket", "getSSLParameters" ], [ "com/github/lfbfwveProxy", "com/github/lfbfwveProxy.uzwq" ], [ "com/github/lfbfwveProxy", "uzwq" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.toByteArray" ], [ "java/io/ByteArrayOutputStream", "toByteArray" ], [ "java/net/URL", "java/net/URL.getQuery" ], [ "java/net/URL", "getQuery" ], [ "com/github/lfbfwveProxy", "com/github/lfbfwveProxy.r7GuH_BNZKJ" ], [ "com/github/lfbfwveProxy", "r7GuH_BNZKJ" ], [ "javax/net/ssl/SSLContext", "javax/net/ssl/SSLContext.getSocketFactory" ], [ "javax/net/ssl/SSLContext", "getSocketFactory" ], [ "com/github/lfbfwveProxy", "com/github/lfbfwveProxy.bRwwqeu" ], [ "com/github/lfbfwveProxy", "bRwwqeu" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.hasRemaining" ], [ "java/nio/ByteBuffer", "hasRemaining" ], [ "java/lang/Integer", "java/lang/Integer.parseInt" ], [ "java/lang/Integer", "parseInt" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.toString" ], [ "java/lang/StringBuilder", "toString" ], [ "java/lang/String", "java/lang/String.isEmpty" ], [ "java/lang/String", "isEmpty" ], [ "java/net/URI", "java/net/URI.create" ], [ "java/net/URI", "create" ], [ "com/github/lfbfwveProxy", "com/github/lfbfwveProxy.copyCzq" ], [ "com/github/lfbfwveProxy", "copyCzq" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.wrap" ], [ "java/nio/ByteBuffer", "wrap" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.get" ], [ "java/nio/ByteBuffer", "get" ], [ "com/github/lfbfwveProxy$nqv", "com/github/lfbfwveProxy$nqv.ip" ], [ "com/github/lfbfwveProxy$nqv", "ip" ], [ "java/io/DataOutputStream", "java/io/DataOutputStream.writeShort" ], [ "java/io/DataOutputStream", "writeShort" ], [ "com/github/lfbfwveProxy$wxtMent", "com/github/lfbfwveProxy$wxtMent.body" ], [ "com/github/lfbfwveProxy$wxtMent", "body" ], [ "java/util/Map$Entry", "java/util/Map$Entry.getValue" ], [ "java/util/Map$Entry", "getValue" ], [ "java/lang/String", "java/lang/String.length" ], [ "java/lang/String", "length" ], [ "com/github/lfbfwveProxy", "com/github/lfbfwveProxy.TKZHxhzbuOQNS9" ], [ "com/github/lfbfwveProxy", "TKZHxhzbuOQNS9" ], [ "com/github/lfbfwveProxy", "com/github/lfbfwveProxy.ithkwOhzzBnsgiq" ], [ "com/github/lfbfwveProxy", "ithkwOhzzBnsgiq" ], [ "java/lang/String", "java/lang/String.toLowerCase" ], [ "java/lang/String", "toLowerCase" ], [ "java/util/Map", "java/util/Map.get" ], [ "java/util/Map", "get" ], [ "java/io/OutputStream", "java/io/OutputStream.write" ], [ "java/io/OutputStream", "write" ], [ "java/lang/System", "java/lang/System.arraycopy" ], [ "java/lang/System", "arraycopy" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.get" ], [ "java/nio/ByteBuffer", "get" ] ], "metrics": { "file": { "size": 43766, "entropy": 5.18 }, "class": { "major_version": 65, "interface_count": 0, "method_ref_count": 129, "constant_pool_size": 898, "external_class_count": 45 }, "binary": { "peak_region_bytes": 3072, "peak_region_entropy": 7.02 }, "imports": { "count": 174 }, "functions": { "count": 16 } } }, "id": 12, "mol": "O₂(AsI)H₄(Cm₅Db₃OsPo₂)", "path": "mod-injected.jar!!com/github/lfbfwveProxy.class", "pid": 0, "risk": 10, "sha": "dc7c3f897ba7bd7c579b156f5d3c73c174f607e5ab0c3f5e87d8752879672369", "size": 43766, "traits": [ { "id": "micro-behaviors/communications/http/lib/urlconnection::java-url-class-bytecode", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Java URL class reference", "spans": [ [ 2769, 16 ], [ 2798, 12 ], [ 6791, 14 ] ] }, { "id": "micro-behaviors/communications/http/lib/urlconnection::jvm-url-class-ref", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "JVM URL class reference" }, { "id": "micro-behaviors/communications/proxy/tunnel::byte-output-stream", "atk": "T1090", "mbc": "C0003", "conf": 0.5, "crit": 3, "desc": "Java ByteArrayOutputStream usage", "spans": [ [ 671, 21 ], [ 1044, 21 ], [ 6235, 21 ], [ 7072, 21 ], [ 7139, 21 ], [ 7156, 21 ], [ 8495, 21 ] ] }, { "id": "micro-behaviors/communications/proxy/tunnel::inet-socket-address", "atk": "T1090", "mbc": "C0003", "conf": 0.6, "crit": 3, "desc": "Java InetSocketAddress reference", "spans": [ [ 672, 17 ], [ 3358, 17 ] ] }, { "id": "micro-behaviors/communications/socket/create::java-socket-bytecode-reference", "atk": "T1071", "mbc": "C0001", "conf": 0.86, "crit": 3, "desc": "Java bytecode socket reference", "spans": [ [ 3573, 56 ], [ 6491, 17 ] ] }, { "id": "micro-behaviors/communications/socket/create::java-socket-class-import", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "Java imports the network socket class", "spans": [ [ 3285, 15 ] ] }, { "id": "micro-behaviors/communications/socket/create::java-socket-slash-reference", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "Java slash-form socket reference", "spans": [ [ 3285, 15 ], [ 3436, 28 ], [ 3573, 56 ], [ 6491, 17 ] ] }, { "id": "micro-behaviors/communications/socket/create::jvm-socket-class-ref", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "JVM socket class reference" }, { "id": "micro-behaviors/communications/socket/framing::bytebuffer-transport", "atk": "T1573", "conf": 1.0, "crit": 3, "desc": "Java byte-buffer transport type", "spans": [ [ 11104, 10 ] ] }, { "id": "micro-behaviors/communications/socket/framing::data-stream-transport", "atk": "T1573", "conf": 1.0, "crit": 3, "desc": "Java data-stream transport type", "spans": [ [ 9594, 16 ] ] }, { "id": "micro-behaviors/communications/socket/send::java-dataoutputstream-class", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "Java DataOutputStream class reference", "spans": [ [ 9586, 24 ] ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-sslcontext-trustmanager-init-call", "conf": 0.94, "crit": 3, "desc": "JVM SSLContext.init trust-manager call", "spans": [ [ 12155, 29 ] ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-sslparameters-set-server-names", "conf": 0.93, "crit": 3, "desc": "JVM sets TLS SNI server name", "spans": [ [ 3906, 42 ] ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-sslsocket-handshake-call", "conf": 0.94, "crit": 3, "desc": "JVM SSLSocket.startHandshake call", "spans": [ [ 4126, 38 ] ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-trustmanager-class-ref", "conf": 0.9, "crit": 3, "desc": "JVM TrustManager interface reference", "spans": [ [ 12081, 26 ] ] }, { "id": "micro-behaviors/data/buffer/transfer::bytearrayoutputstream-ref", "conf": 0.88, "crit": 3, "desc": "Java ByteArrayOutputStream class", "spans": [ [ 7064, 29 ] ] }, { "id": "micro-behaviors/data/buffer/transfer::jvm-outputstream-write", "conf": 0.96, "crit": 2, "desc": "JVM writes bytes to output stream", "spans": [ [ 6227, 0 ] ] }, { "id": "micro-behaviors/data/encode/base64::jvm-base64-encode-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM Base64 encodeToString call", "spans": [ [ 10178, 39 ] ] }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method", "spans": [ [ 1036, 8 ] ] }, { "id": "micro-behaviors/os/sysinfo/hostname::jvm-hostname-command-literal", "atk": "T1082", "mbc": "E1082", "conf": 0.9, "crit": 3, "desc": "JVM hostname command literal" }, { "id": "micro-behaviors/process/create/spawn::java-runtime-class", "atk": "T1059", "mbc": "E1203", "conf": 0.86, "crit": 3, "desc": "Java Runtime class reference", "spans": [ [ 9792, 17 ] ] }, { "id": "micro-behaviors/process/info/current::getpath-ref", "conf": 0.8, "crit": 3, "desc": "Java getPath call reference" }, { "id": "objectives/anti-static/obfuscation/string/control-prefix::java-control-prefixed-long-string", "atk": "T1027", "mbc": "F0001", "conf": 0.92, "crit": 3, "desc": "Java string starts with control-length prefix" }, { "id": "objectives/impact/dos/disk::jvm-megabyte-byte-array-constant", "atk": "T1499.001", "conf": 0.94, "crit": 3, "desc": "JVM one-megabyte allocation constant", "spans": [ [ 8162, 14 ] ] }, { "id": "objectives/impact/dos/disk::jvm-two-backward-goto-branches", "atk": "T1499.001", "conf": 0.9, "crit": 3, "desc": "JVM repeated counter backedges", "spans": [ [ 12846, 8 ], [ 13062, 8 ], [ 13369, 8 ], [ 13673, 8 ], [ 13939, 8 ], [ 14263, 8 ], [ 14392, 8 ], [ 14506, 8 ] ] }, { "id": "micro-behaviors/communications/socket/send::java-raw-socket-client-write", "atk": "T1071", "mbc": "C0001", "conf": 0.94, "crit": 3, "desc": "Java socket client writes request bytes through DataOutputStream", "uses": [ 5, 10, 16 ], "spans": [ [ 3285, 15 ], [ 6227, 26 ], [ 9586, 24 ] ] } ], "type": "java_class" }, { "ctx": [ { "b": "+kO#^0000+0LXTn6K#5#fk20vxMW=qpg)P=A^y+Nz3H4w0rrWCvrM6jy*?i]fhD4(wN//!00rl4a8UUifj[T4A+P32v\u003eRnfx!Jh0wjZVMBzkf1x)Kuh2lj]d02PDVC404DBzkLAlsB}Dhz=WFzEWP}wPw1Q2ls/oygho]flIwJy+Fa-B7El^2lk5h00+@gv@C)?ASDd-ygho]fkL6mxd)84z!0v1B3+1-y?d9$bVnh:x(W={Bo.^O0rr%KvrM6jy*?i]fhMXcv}x.5luN0UwmY=^01G2f2VtkAx(W={Bo8v/ygho]fkL6mxd)$pC5Iecfhl21xM4ALvqYQ(wPGa\u003cz/oAlA0DvP0rsfQvrM6jy*?i]fkkrEz!\u0026]qo\u003ewAWz!8yEzE^M{A%zWU0rrr$z/oAlz#/}yjzwXEBuPZ911kQ03\u0026?4y7yycB02L.p3WM\u003e:wmPyCCtid20rr)ev@Diqxk8E3BZ^10xi3{hDr9yIi@]r\u0026z/ec:x([5$y?Xib15pVAt)5\u003c:n09@![V9XwL%TshU%[Usn*^zm1*!cvV8)Zhmf9x1ygho]fkL6mxd)j$A+eV\u00262ll4Y02CUo3V{5[AcCVfzEmd63\u0026?WQ7yycz04wAZ04F0Hb5gLfvj#C9zF7RpzGY@lwIl.=zdm3:o\u003ewAPw)]g\u003ez/Qad04XcJ3VfD%vp\u0026}TBz(hB0rys(oLO0Vvj#C9zF7RpzGY@lwIl+?BzbP6nmuyDy?mVkoMa\u0026+B-oAoygho]fkL6mxd)h9A+PA7j4%x$C403", "ln": 0 }, { "b": "fkL6mxd)e9zF\u0026((y?kWp05BQi5=.[ih30W[c}[w:C404uvqYZhqGV\u003e{vpB4:j1jhs02tL[3ihyMh#%0.B97\u0026hBpndg02C$xcicad00E4nm]xu/2Y\u003c^3raoYTwb#VSc}[w:C404uvqYZhq/)4]zF83WoLO0Vvj#C9zF7R3BAh8kxfca]0DOtOMo##3(.gug1e25O*xg.f6Hh=ENZ4nw01-)NC404uvqYZhq/)4]zF6gOmGAF?2MNx@02GxUC404uvqYZhq/)4]zF8pUx(4r\u003eAT8", "ln": 807 }, { "b": "rTX%z09]{io8@o000V\u003eJAaJ]$0rs8/lN+YzvrM6jy*?i]fh($kx(mMIB.LV5wPx\u003cv0ak!n3iiZ0vGuDmBz\u003e91A+PA70rr/ZdnjF+C404uvqYZhq/)4]zF83t0aV7v3iiZ0w=R(-c}[w:C404uvqYZhq/)4]zF83WoLO0Vvj#C9zF7R3BAh8kxf{-Py?d9$i$89%0b8Yto8@Vb02t+4VXdU5Y62Y:\u003e9.B$YnL)UPy4Ml2MOSv00K=PlN=4A", "ln": 1187 }, { "b": "zF7Q\u003eCW\u003er7BzkVh2loO.0blB90%4p]dG+-Q0V?CYF\u003e\u003c!@01-)NC404uvqYZhq*ACawO?ULJ@Yj)v%8*jwO#P?x(dAQx(4Q1A@=myc[d:%0fEnA3ild/Lk$U1zE)]yze0)0v@=0\u0026Bt4cuvrlG%gCHM*0f)M+3VfD%xM4A*f/p*y0rs5!dnjR\u003cBt4GBzE)r#vp\u003cQmv@bN{B6*ZTfGPWyMJixW0g0RM0rrHAwPRQ7wm45Gg=LHo8Z)dezE)]yze0)0v@=0\u0026Bt4cuvrlG%gCQTC3\u0026(:%Oc/mZ0g:b\u003c7J9/afkUAvwN/:?w]]Xoy*?yauO:C\u003e2lpv%01iTPBzbP6uOKC$gZ\u003cwT0a=GqPA7X!01iTPBzbP6uOKC$hvGOY0a=GqPA7!?01rZQBzbP6uO\u003cO#f/Gak5?2h5ygho]flIwJy+F^*nKLSG0h/*}3il.0Sq##eygho]flIwJy+F^*nKJ^-S%O\u003cd0a(li0:wn40iMt5iT$5YNanR9LCvoAV*S*a(9EeLF%kh^F.^r!RN2uSVF}gG[3nUCYSGXM\u003cDttYV7puvS{c*N)sS7T0i=F75[t\u0026%fk20vxMW=qxLpywzaNb20i#R94q!NkCx!9%s5??7ye29pV\u0026BUA0j8Wk0rrr[vNTsrpyElj0a=GqVJdGo03(C[Bt4lmvSDf)zdtknz^-", "ln": 1842 }, { "b": "0lkADVJ7*y010pHBvp4:vqfP/0lLpM3imyj+k?OFAb]J4x(W+=07[Ukygho]fkL6mxd)h9A+PA7j4%x$C404uvqYZhq/)4]zF848ygho]fkL6mxd)h9A+PA7j1i\u003crvrM6jy*?i]fh($kx(mMB3\u0026[JL=i:", "ln": 2564 }, { "b": "A=U/lfh($3zE^f@wj73sA=U/lA%zZ50rrp6r7pjO0rs3iygho]fk+GxfjOW7A=U/lfgfzYA=U/li$8bF0oap+?#I^r00)jGBv7m{wPE\u003eL9W\u003cY%vrM6jzFs2xv}Yp\u003eB7GCDlUG[GB7GCPdo/aE0oBjy3iiM@\u003ek+L)wO#0@wmX.Uq/)4]zF5$I7arxNdnjF+C404uvqYZhq/)4]zF83t0o\u003cHG3igti(J3#u4dgB9(ZbfGLBgr{OB025(9l@wIk]/@TMkFg)WHGFUzIkpTNiAD(Z0H@Lc\u003chmUM$l@3JOcCw=R)0(7krAL9b79UI$q0\u0026*3?ePrNviI0Q+b\u003c=Dt8OrS64N^3D8\u003c=V$oQjRxWVF}aX\u0026*#+4IluipKl8EU(ZUcrNyARg0pQ0?kNcOqPx-$w\u003c*fQ4XSDfrG6x4X)2(}+XW7t6Rrkyu)2OKrQ]0BwH3DmM\u003c*qCTY0Z)=I%m4k)2(}+X}5[GR3E7(0rtX1\u003c/L=JUD)O+O9Mk(\u003ccCzVO#}4pLioPr\u003cgQGvNy@0!O-N8l\u003c/KW", "ln": 3071 }, { "b": "TMWB8)tM}?R?i)mRTy)\u0026\u0026HD+kM:tXDIs4sz[1=leTC#RnS%w.F0rrTBvrM6jy*?i]fgfL:B8}M!aPRMRxjVfYA=l5hv@#B6zBwzWvqfPW03S*uoLO0Vvj#Xkv%8*aBA]JoA=l5hv@#B6zBwzWvqfQv3\u0026}NNbNKL@0vm:D9+]bbvj#Xkv%8*aBA]JoA=l5hv@#B6zBwzWvqfP:0vE)F4qfl]lVlHDq/u/0v}tVv94imfygho]flpYmB-IhrC}RK6wmXXTB-H#6i$8cs0v!ASc\u0026\u003e?002PDVC404BwN/\u003e6x([RNlVlHDq/u/0v}t(CeDC?VxjVfUz!0i$x(v\u003e\u002601ZLcoLO0Vvj#IfBt3S(oGJT-f99:l0wjyc0rrKyvrM6jzE)]yrz(G}0w:-R1:1V.qB{(?5gw#3ygho]fk+uyfi7[wi$8cE0x7n=gYYJo03\u0026%^ygho]fk+uyfi7[wj1i\u003crvrM6jzFs2xw[=6)fhM80xGDR65DK)10l1$10rt?7\u0026?r4kYrHtbX5#hrYR\u003e4LQ2ShH\u003edXQ$OqldpQ#Eo6[43d", "ln": 4520 }, { "b": "c}[w:C404rz.BN]y?kWSoLO0Vvj#C9zF7R0A=kD0B8%V\u003cx(4r\u003eAWjK]wnc6}v@%^v0BV1r3igIov/VMsA+e=}A+e:5nP5G\u0026Bo8wac}[w:C404uvqYZhp\u0026ZF:wPI]VB.LV5wPx4]wN]H}wN/*zdnjF+C404uvqYZhp\u0026ZF:wPI]VB.LV5wPx\u003cv0C8pz3igOqx8}#\u003e2\u003cwR2\u0026\u003c20rHjFDRGxOR])u:EeN$f*)N=}ew\u0026\u003cjWgHP]%iR0ahj)u@%$O387DHuM4s\u0026\u003cjjx0CIMm2xBx%z!%Pd0rsI@oLK", "ln": 5616 }, { "b": "0C}\u0026q26s=Mx(4tY01ZLcoLO0Vvj#tkfgGU(wJHq3zVK!+0l1$U0rrylAbYxawk)EQ0DOoJ3igIoBo8vKA+e=}A+e:5pJZ+#B-X2)B]=gZ01P9O0rr^NwN]H}wN/*JA=M8sq/)4\u003evqM2B9vL8uoLO0Vvj#C9zF7R0A=kD0B8%V\u003cx(4r\u003eAYTWgC(-i#01P9S0rrBpx(W={Bz(hB0rsO$oLO0Vvj#tkfgGU(wJItmygho]fkL6mxd)84z!0v1B3+1-y?d9$i$8dr0E+vQ4/}dX02l[hoLO0Vvj#C9zF7R0A=kD0B8%zK06gdi3igOqF=L\u003cd\u003e8(7$V8D\u003c", "ln": 5891 }, { "b": "SpbXM[1cDBK?x.HKlB0D)yO+KG0smvLJ[9)2MY$!02PDVC404wx(tUpx(4ulpJf(.pJgz\u0026z/b^XKPtB\u0026CxdztwM9X\u003ex(mL:09}0Dygho]fk+Gxfj[{mwIl\u003e*Bz9:fygho]fkL6mxd(R=vrbpTADL\u0026gv}v-aoLO0Vvj#Ijz.CZpy?km}AaJ].Acb/jzAxpvygho]fk+Gxfj[{mwIl\u003e*Bz9-A0H0LG3ip$AL(Q\u003c}Ab]VgBw)o\u0026v@24:vpJ\u003cS0HA^53ik}:M\u0026Nf\u003eBz(Cnrat}e8ba]", "ln": 6369 }, { "b": "2ETRq1y@kMwhT+a083Df3ax[wiTL%E3L:3:38dzG844k^1qIhI6:[AT09y9z1qIpV2YKgW09A={WG6/sGBm*U%je4{WG6%G0btPk0P2vuy{\u003csuiU02q12I[D84Kv}4}C/Nhv{PmYAHtd12Z=b5!$$L03\u0026A]6+Rw]6+pBP6+T[h84D=:5!${@u]iE#rFg$=R#LI-07Qff5W}:UWG75zRVzG55]\u003etWp=Yse6:3oJ78W\u003e31y@k.whUks7Rx]j7Y#Vl6=v-5Q5VCR7.)]a6:bl!u\u003e\u003cL!g-m2h6=v-4A9$IOL2WeM0Jk$LY8Uu785P*.z)/TXseM6Iee03j08LY@85@-nhxrUPZ7?V01y%zi6=$0\u003eiV!CZaqD1l9?\u0026SW86oOo85%wi1yI@!u]e-v1qJ3]9DkyyF%6b!aowzu*Q^CQsS5r\u003c0b]pCyfdqk^\u003c#bOWG6b+bn?Zdg=uP%bFBp\u003e6^NrFb]4-s1V^$jhyxj!6^YNObPd{zcMaci6^Nf4cTX+GblO-e6^N:ag\u003eH(\u003cGEl!#%j+c=m{cYRW/yuP0btPk0d2v:5fNXEy+ciyWG6b+dJ6Yrg=u\u003c4d.V3@6!r/Meeo.G1V!jIecGGwe!{1d03\u0026Bl6!QvN1qJB{6!S(J87C+7e!])Qu]iE#rFi18R#LO+07QffeW\u003eZ#1IB^rsPYxyXbZ}QXb.8*0btPk017m(2dsIwsa*.TR#q8@WG6%A000020Lnsi1tP@]@@tj.fB4NV2lml]00000000000000000000000000000000000000000000000000000000rr97@@rYjfB4NV2lmm0080K%qul^#000000000000000000000000000000000000000000", "ln": 7556 }, { "b": "WG6b+7A11\u003eg=uf*7RQR3wcuB385j441V^L7hx9wI6=A.CbPdHn8YoCb7ZajY8^\u003eGu7x+D(6=p)$g\u003eH(\u003cGC%@\u0026%j+c=m{cYFW/ytc2dKVwiTrd{XJg2a0kD5A.Vo+F0ltfviTEqtXb.:\u0026Y8YfuW/BJh3k\u003chV0l^Fid*rA.LU-k884e2l2ETSViT^IyXb.:\u0026Xb+2d83EwF!*.KwWGa(deW+VgiV{E9iV+)koiF.7oCl0^08LZ186MY%weMK$g=uJ}a?!WnwcuB3bnzDo1V^[hhyf7:6^GBMaq(Btb]E\u003cvb@uF.6^BCt6^vQ8g\u003eH(\u003cGE3U%%kgA*m{cYPW/yuP0brw)WG74P*o{#TiW+\u003c]Z64%:c%[!?dh:LF6!9U@whU[Ld.C{Cd*4WX6!y7HQ5VqNd?%PMc(1o\u002687ljH6!y7GA9$IOL2We^0Jk$PY8Uu787Se@z)/TX86uo!y7/sg08LZf87#7Ghzu14Z64%YfL06@", "ln": 9402 } ], "depth": 1, "facts": { "imp": [ [ "", "java/lang/invoke/MethodHandles$Lookup" ], [ "", "java/io/File" ], [ "", "java/security/CodeSource" ], [ "", "java/nio/file/LinkOption" ], [ "", "java/lang/ProcessBuilder" ], [ "", "java/lang/Thread" ], [ "", "java/lang/Exception" ], [ "", "java/lang/Object" ], [ "", "java/lang/Class" ], [ "", "java/net/URL" ], [ "", "java/util/Base64$Encoder" ], [ "", "net/minecraft/class_310" ], [ "", "net/fabricmc/loader/api/FabricLoader" ], [ "", "java/util/UUID" ], [ "", "java/lang/StringBuilder" ], [ "", "net/minecraft/class_320" ], [ "", "java/lang/invoke/LambdaMetafactory" ], [ "", "java/lang/invoke/MethodHandles" ], [ "", "java/nio/charset/StandardCharsets" ], [ "", "[J" ], [ "", "java/lang/System" ], [ "", "com/github/hhUOmID" ], [ "", "java/net/URI" ], [ "", "java/util/Base64" ], [ "", "java/lang/ProcessBuilder$Redirect" ], [ "", "net/fabricmc/api/ModInitializer" ], [ "", "java/nio/file/Files" ], [ "", "java/security/ProtectionDomain" ], [ "", "java/nio/file/OpenOption" ], [ "", "java/nio/file/attribute/FileAttribute" ], [ "", "[Ljava/lang/String;" ], [ "", "java/lang/Integer" ], [ "", "java/nio/file/Path" ], [ "", "java/lang/String" ], [ "", "[C" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectErrorStream" ], [ "java/lang/ProcessBuilder", "redirectErrorStream" ], [ "java/security/CodeSource", "java/security/CodeSource.getLocation" ], [ "java/security/CodeSource", "getLocation" ], [ "net/minecraft/class_310", "net/minecraft/class_310.method_1548" ], [ "net/minecraft/class_310", "method_1548" ], [ "com/github/hhUOmID", "com/github/hhUOmID.prefire" ], [ "com/github/hhUOmID", "prefire" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.toString" ], [ "java/lang/StringBuilder", "toString" ], [ "java/nio/file/Path", "java/nio/file/Path.of" ], [ "java/nio/file/Path", "of" ], [ "net/minecraft/class_310", "net/minecraft/class_310.method_1551" ], [ "net/minecraft/class_310", "method_1551" ], [ "java/lang/String", "java/lang/String.length" ], [ "java/lang/String", "length" ], [ "java/nio/file/Files", "java/nio/file/Files.createDirectories" ], [ "java/nio/file/Files", "createDirectories" ], [ "net/fabricmc/loader/api/FabricLoader", "net/fabricmc/loader/api/FabricLoader.getInstance" ], [ "net/fabricmc/loader/api/FabricLoader", "getInstance" ], [ "com/github/hhUOmID", "com/github/hhUOmID.mFSwxqFWUIfjM" ], [ "com/github/hhUOmID", "mFSwxqFWUIfjM" ], [ "java/lang/Class", "java/lang/Class.getProtectionDomain" ], [ "java/lang/Class", "getProtectionDomain" ], [ "com/github/hhUOmID", "com/github/hhUOmID.FbEVrO" ], [ "com/github/hhUOmID", "FbEVrO" ], [ "java/nio/charset/StandardCharsets", "java/nio/charset/StandardCharsets.UTF_8" ], [ "java/nio/charset/StandardCharsets", "UTF_8" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.\u003cinit\u003e" ], [ "java/lang/ProcessBuilder", "\u003cinit\u003e" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/nio/file/Path", "java/nio/file/Path.resolve" ], [ "java/nio/file/Path", "resolve" ], [ "java/lang/ProcessBuilder$Redirect", "java/lang/ProcessBuilder$Redirect.appendTo" ], [ "java/lang/ProcessBuilder$Redirect", "appendTo" ], [ "java/lang/Thread", "java/lang/Thread.\u003cinit\u003e" ], [ "java/lang/Thread", "\u003cinit\u003e" ], [ "java/net/URL", "java/net/URL.toURI" ], [ "java/net/URL", "toURI" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ], [ "com/github/NgV6rzVCm", "com/github/NgV6rzVCm.thepw_rn_jx" ], [ "com/github/NgV6rzVCm", "thepw_rn_jx" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "java/nio/file/Files", "java/nio/file/Files.exists" ], [ "java/nio/file/Files", "exists" ], [ "java/lang/String", "java/lang/String.toCharArray" ], [ "java/lang/String", "toCharArray" ], [ "java/lang/String", "java/lang/String.format" ], [ "java/lang/String", "format" ], [ "java/util/UUID", "java/util/UUID.toString" ], [ "java/util/UUID", "toString" ], [ "net/fabricmc/loader/api/FabricLoader", "net/fabricmc/loader/api/FabricLoader.getConfigDir" ], [ "net/fabricmc/loader/api/FabricLoader", "getConfigDir" ], [ "java/lang/Integer", "java/lang/Integer.valueOf" ], [ "java/lang/Integer", "valueOf" ], [ "net/minecraft/class_320", "net/minecraft/class_320.method_44717" ], [ "net/minecraft/class_320", "method_44717" ], [ "java/lang/String", "java/lang/String.\u003cinit\u003e" ], [ "java/lang/String", "\u003cinit\u003e" ], [ "java/lang/System", "java/lang/System.getenv" ], [ "java/lang/System", "getenv" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/io/File", "java/io/File.\u003cinit\u003e" ], [ "java/io/File", "\u003cinit\u003e" ], [ "com/github/NgV6rzVCm", "com/github/NgV6rzVCm.skqTbmhd" ], [ "com/github/NgV6rzVCm", "skqTbmhd" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectInput" ], [ "java/lang/ProcessBuilder", "redirectInput" ], [ "java/lang/System", "java/lang/System.currentTimeMillis" ], [ "java/lang/System", "currentTimeMillis" ], [ "java/lang/Thread", "java/lang/Thread.start" ], [ "java/lang/Thread", "start" ], [ "java/security/ProtectionDomain", "java/security/ProtectionDomain.getCodeSource" ], [ "java/security/ProtectionDomain", "getCodeSource" ], [ "java/lang/Exception", "java/lang/Exception.printStackTrace" ], [ "java/lang/Exception", "printStackTrace" ], [ "java/nio/file/Path", "java/nio/file/Path.getParent" ], [ "java/nio/file/Path", "getParent" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "com/github/hhUOmID", "com/github/hhUOmID.\u003cinit\u003e" ], [ "com/github/hhUOmID", "\u003cinit\u003e" ], [ "java/lang/Class", "java/lang/Class.getName" ], [ "java/lang/Class", "getName" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.start" ], [ "java/lang/ProcessBuilder", "start" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "java/lang/System", "java/lang/System.getProperty" ], [ "java/lang/System", "getProperty" ], [ "java/nio/file/Files", "java/nio/file/Files.writeString" ], [ "java/nio/file/Files", "writeString" ], [ "java/nio/file/Path", "java/nio/file/Path.of" ], [ "java/nio/file/Path", "of" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectOutput" ], [ "java/lang/ProcessBuilder", "redirectOutput" ], [ "net/minecraft/class_320", "net/minecraft/class_320.method_1676" ], [ "net/minecraft/class_320", "method_1676" ], [ "java/lang/String", "java/lang/String.getBytes" ], [ "java/lang/String", "getBytes" ], [ "java/nio/file/Path", "java/nio/file/Path.toFile" ], [ "java/nio/file/Path", "toFile" ], [ "java/lang/String", "java/lang/String.charAt" ], [ "java/lang/String", "charAt" ], [ "java/lang/System", "java/lang/System.arraycopy" ], [ "java/lang/System", "arraycopy" ], [ "net/minecraft/class_320", "net/minecraft/class_320.method_1674" ], [ "net/minecraft/class_320", "method_1674" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.directory" ], [ "java/lang/ProcessBuilder", "directory" ], [ "java/lang/ProcessBuilder$Redirect", "java/lang/ProcessBuilder$Redirect.from" ], [ "java/lang/ProcessBuilder$Redirect", "from" ], [ "java/lang/invoke/LambdaMetafactory", "java/lang/invoke/LambdaMetafactory.metafactory" ], [ "java/lang/invoke/LambdaMetafactory", "metafactory" ], [ "java/util/Base64", "java/util/Base64.getEncoder" ], [ "java/util/Base64", "getEncoder" ], [ "java/util/Base64$Encoder", "java/util/Base64$Encoder.encodeToString" ], [ "java/util/Base64$Encoder", "encodeToString" ], [ "java/nio/file/Path", "java/nio/file/Path.toString" ], [ "java/nio/file/Path", "toString" ], [ "com/github/hhUOmID", "com/github/hhUOmID.getDomain" ], [ "com/github/hhUOmID", "getDomain" ] ], "metrics": { "file": { "size": 35422, "entropy": 4.37 }, "class": { "major_version": 65, "interface_count": 1, "method_ref_count": 63, "constant_pool_size": 447, "external_class_count": 35 }, "binary": { "peak_region_bytes": 5120, "peak_region_entropy": 6.74 }, "imports": { "count": 98 }, "functions": { "count": 4 } } }, "id": 13, "mol": "K(Ga)O₄(CaAs₂ErI)H₄(CmDb₂F₂Po₅)", "path": "mod-injected.jar!!com/github/NgV6rzVCm.class", "pid": 0, "risk": 131, "sha": "e8af98d63041e0fe3aa06382f415300609c0a894d1a4e6c72741c31de8b188e0", "size": 35422, "traits": [ { "id": "micro-behaviors/communications/http/lib/urlconnection::java-url-class-bytecode", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Java URL class reference", "spans": [ [ 4790, 16 ], [ 4819, 12 ] ] }, { "id": "micro-behaviors/communications/http/lib/urlconnection::jvm-url-class-ref", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "JVM URL class reference" }, { "id": "micro-behaviors/data/encode/base64::jvm-base64-encode-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM Base64 encodeToString call", "spans": [ [ 3199, 39 ] ] }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method", "spans": [ [ 1251, 8 ] ] }, { "id": "micro-behaviors/fs/read/file/handle::jvm-io-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM File API class reference" }, { "id": "micro-behaviors/fs/read/file/handle::jvm-nio-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM NIO file API reference" }, { "id": "micro-behaviors/fs/write/file/full::jvm-files-writestring-bytecode", "conf": 0.9, "crit": 3, "desc": "JVM bytecode Files.writeString", "spans": [ [ 6433, 31 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.88, "crit": 3, "desc": "Java bytecode ProcessBuilder reference", "spans": [ [ 160, 71 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-init-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.92, "crit": 3, "desc": "Java bytecode ProcessBuilder constructor", "spans": [ [ 328, 31 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.95, "crit": 3, "desc": "Java bytecode ProcessBuilder start", "spans": [ [ 871, 30 ] ] }, { "id": "micro-behaviors/process/info/current::codesource-class", "conf": 0.85, "crit": 3, "desc": "Java CodeSource class reference" }, { "id": "micro-behaviors/process/info/current::getlocation-ref", "conf": 0.82, "crit": 3, "desc": "Java getLocation call reference" }, { "id": "micro-behaviors/process/info/current::protection-domain-class", "conf": 0.85, "crit": 3, "desc": "Java ProtectionDomain class reference" }, { "id": "micro-behaviors/process/info/current::touri-ref", "conf": 0.82, "crit": 3, "desc": "Java toURI call reference" }, { "id": "micro-behaviors/process/info/selfpath::java-protection-domain", "conf": 0.82, "crit": 3, "desc": "Java getProtectionDomain self-path lookup" }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-errors", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder merges standard error", "spans": [ [ 5982, 44 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-input", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard input", "spans": [ [ 5680, 38 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-output", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard output", "spans": [ [ 5955, 39 ] ] }, { "id": "micro-behaviors/process/thread/lifecycle::jvm-thread-start-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM starts a thread", "spans": [ [ 871, 22 ] ] }, { "id": "objectives/anti-static/obfuscation/reflection/class::java-protectiondomain", "conf": 1.0, "crit": 3, "desc": "Java ProtectionDomain", "spans": [ [ 4584, 19 ], [ 4606, 34 ], [ 4653, 30 ] ] }, { "id": "objectives/anti-static/obfuscation/string/control-prefix::java-control-prefixed-long-string", "atk": "T1027", "mbc": "F0001", "conf": 0.92, "crit": 3, "desc": "Java string starts with control-length prefix" }, { "id": "objectives/credential-access/gaming/minecraft::minecraft-token-getter-ref", "atk": "T1528", "mbc": "B0006", "conf": 0.92, "crit": 3, "desc": "Minecraft access token getter", "spans": [ [ 2104, 35 ] ] }, { "id": "objectives/evasion/self-delete/file/script::java-code-source-location", "atk": "T1070.004", "mbc": "F0007", "conf": 0.78, "crit": 3, "desc": "Java code source location", "spans": [ [ 4689, 13 ] ] }, { "id": "objectives/impact/dos/disk::jvm-two-backward-goto-branches", "atk": "T1499.001", "conf": 0.9, "crit": 3, "desc": "JVM repeated counter backedges", "spans": [ [ 7620, 8 ], [ 7705, 8 ], [ 7794, 8 ], [ 7883, 8 ], [ 7972, 8 ], [ 8113, 8 ], [ 9466, 8 ], [ 9654, 8 ] ] }, { "id": "well-known/game/mod::minecraft-client-class-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft client singleton class reference", "spans": [ [ 1938, 23 ] ] }, { "id": "well-known/game/mod::minecraft-name-getter-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft profile name getter reference", "spans": [ [ 2128, 35 ] ] }, { "id": "well-known/game/mod::minecraft-session-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft session object reference", "spans": [ [ 2075, 23 ] ] }, { "id": "well-known/game/mod::minecraft-uuid-getter-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft profile UUID getter reference", "spans": [ [ 2152, 36 ] ] }, { "id": "well-known/malware/stealer/prefire-shard::prefire-family-literal", "atk": "T1528", "mbc": "B0006", "conf": 0.9, "crit": 1, "desc": "Prefire family name literal", "spans": [ [ 2615, 7 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.94, "crit": 3, "desc": "Java bytecode ProcessBuilder execution", "uses": [ 8, 9 ], "spans": [ [ 328, 31 ], [ 871, 30 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirected-stdio", "conf": 0.96, "crit": 3, "desc": "Java ProcessBuilder redirects all standard streams", "uses": [ 15, 16, 17 ], "spans": [ [ 5680, 38 ], [ 5955, 39 ], [ 5982, 44 ] ] }, { "id": "well-known/game/mod::minecraft-session-access", "conf": 0.91, "crit": 3, "desc": "Minecraft session profile access", "uses": [ 24, 25, 26 ], "spans": [ [ 1938, 23 ], [ 2075, 23 ], [ 2128, 35 ] ] }, { "id": "objectives/credential-access/gaming/minecraft::minecraft-session-token-access", "atk": "T1528", "mbc": "B0006", "conf": 0.96, "crit": 4, "desc": "Minecraft session token and UUID access", "uses": [ 21, 27, 31 ], "spans": [ [ 1938, 23 ], [ 2075, 23 ], [ 2104, 35 ], [ 2128, 35 ], [ 2152, 36 ] ] }, { "id": "objectives/credential-access/gaming/minecraft::minecraft-token-child-process-stage", "atk": "T1528, T1059", "mbc": "B0006", "conf": 0.99, "crit": 5, "desc": "Minecraft token access alongside redirected child launch", "uses": [ 2, 29, 30, 32 ], "spans": [ [ 328, 31 ], [ 871, 30 ], [ 1938, 23 ], [ 2075, 23 ], [ 2104, 35 ], [ 2128, 35 ], [ 2152, 36 ], [ 3199, 39 ] ] }, { "id": "micro-behaviors/process/create/spawn::child-process-creation-api", "atk": "T1106", "conf": 0.92, "crit": 3, "desc": "Starts a child process through a platform API", "uses": [ 29 ], "spans": [ [ 328, 31 ], [ 871, 30 ] ] } ], "type": "java_class" }, { "ctx": [ { "b": "+kO#^0000+0Ao717gRo1fk20vxMW=qyI4Baw{vr$x(4?}009925nCS%vj#C9zF7Q#vRPE:Bo.^F0rsoTvrM6jy*?i]fhMXcv}x.5luN0UwmY^bqE%xMA+e:52lj]d02PDVC404uvqYZhp\u0026ZF:wPI]VB.LV5wPw1Q2ls/gqE%xMA+e:50rr%KvrM6jB-.tlfg68*wI#v\u003cmq=QNwmY=^015-b5nCS%vj#+Bx(2B?vrl0rgZs0?0rru[zEWP}wPv!Kc2c\u003eivj#C9zF7RpzGY@lwIl+?BzbP6nmuyDy?mVkoMa\u0026+B-mM=4/(UKygho]fkL6mxd)$pC5Iecfhl21xM4ALvqYQ(wPF7R5DI\u003eooMa\u0026+B-muY20uQqx((Jt00sR#rTX%x02k?v1oohr00^QOx(3Q:A@=mToK\u00260Tfk20vxMW=qyI4Baw{vr$x(4\u0026L0rrmtvqfPW02u$!oLO0Vvj#C9zF7R3BAh8kxfdLy0rrmhA+xB]0269QC404uvqYZhmr\u0026rNAcb/jzu*dZ1g8sm=JSpk{-8CvDVYIhCMwPYNt[xNH\u0026ty.{UP=Y0rt4:", "ln": 0 }, { "b": "3\u0026?:Sd*=n904XcJ6i!dBvrM6jy*?i]fh($kx(mMB2llvS00lv(2llBU00K=PlN=4A02bz*3ihHPgxvEWwPq\u003c3y\u0026YQS6^#:\u003cvrM6jy*?i]fhD4(wN/*zdoWbWh2]Jw04v[b0rr:xz/4dux([3hvLqzdrzNE6l\u003cAYL3\u0026?gC8WVNa06phYlK.}aLiw9#\u003c/#wPL-+o+Y5]V=[0oWbH[KauUKdZf)3ByhJFcnyZVZ\u0026V\u003c/\u003eolM7)O#J])3[[0s", "ln": 552 }, { "b": "rTX%x096vaq#/@100V\u003eJAaJ]$0rs8/lN+YzvrM6jy*?i]fh($kx(mMIB.LV5wPx\u003cv09xk73ij39s]!QeBz\u003e91A+PA70rr/ZdnjF+C404uvqYZhq/)4]zF83t09/If3ij39ui73qygho]fkL6mxd)heB97#g2lncj01iBJBwN0@AaK6iC(W)(c}[w:C404uvqYZhq/)4]zF83WoLO0Vvj#C9zF7R3BAh8kxfcI4vGo)B0at\u003er0rsqH)yG^!", "ln": 968 }, { "b": "WDJWh\u003ca-(/Xu$wcUJ@rw\u003eCBax0dB}G3#fi]vj#tkfgGU(wD@i=0rrTBvrM6jy*?i]fgfL:B8}M^F=L\u0026+xjVfYA=l5hv@#B6zBwzWvqfPW03S*uoLO0Vvj#Xkv%8*aBA]JoA=l5hv@#B6zBwzWvqfQv3\u0026\u003e}XG:E*j0epHO9+]bbvj#Xkv%8*aBA]JoA=l5hv@#B6zBwzWvqfP:0eHTQ4qfl]lVlHDq/u/0v}tVv94imfygho]flpYmB-IhrC}RK6wmXXTB-H#6i$8aD0e?f:I2-Fn02PDVC404BwN/\u003e6x([RNlVlHDq/u/0v}t(BJSxa/xjVfUz!0i$x(v\u003e\u002601ZLcoLO0Vvj#IfBt3S(oGJT.Kn$yI0fmby0rrKyvrM6jzE)]yrz(G}0f^G:1:1V.qB{(?5gw#3ygho]fk+uyfi7[wi$8aP0ga2)L(NfL01*RMygho]fk+uyfi7[wj1jhs02bB43ikRSN/JH1xjVfJvSME7B-.g\u003evrue\u003e0g:9}3ikRSO=F*X3*@!+\u0026E^MRTgdnHOz*(R\u003c/b@QHnT4fVG^g2[3YB!GRv*\u003cI@xt/\u0026h\u003cJMI\u003ee?nX8\u003cT7\u003e7*C9S!fI\u003eJpjlW)s?$oIgt\u003ciPAb2%xjVf@zGVA*Q5XWg0at(50rtd/\u003eD8zYIk]ZEX-Z.V\u0026//$)H(y!}PYq9t(5Iq1W3P%TV/)i$\u003ec*-wZoDQWVeHLO[1C*5J*n\u003c\u0026S0Ay10rtv{\u003e:]6wPr4B]R@jO-\u003cgH#IH}-2lK)e0!\u003cEH$/Q}2(KUhLhf(6FBmTb(FpRSKF4[4n", "ln": 1629 }, { "b": "c}[w:C404rz.BN]y?kWSoLO0Vvj#C9zF7R0A=kD0B8%V\u003cx(4r\u003eAWjK]wnc6}v@%^v0kFPJ3igng.t%SCA+e=}A+e:5nP5G\u0026Bo8wac}[w:C404uvqYZhp\u0026ZF:wPI]VB.LV5wPx4]wN]H}wN/*zdnjF+C404uvqYZhp\u0026ZF:wPI]VB.LV5wPx\u003cv0k[(R3igti-Sl6b\u003e+Bs0P@vsHZ2VIK\u003c!w17Wy$).Kk^Q7\u0026KUfuJ*/gaJO{F0)4oo#VzlJRQV]dH(XRs{X1}#{Zvdb@(:K7TPQc5)0ltfv2xx", "ln": 2733 }, { "b": "0l+Dz26s=Mx(4tY01ZLcoLO0Vvj#tkfgGU(wJHq2=h=e#0b?\u003e:0rrylAbYxawk)EQ0my\u003e-3igng^/xBUA+e=}A+e:5pJZ+#B-X2(!D0L}00\u0026OQ0rr^NwN]H}wN/*JA=M8sq/)4\u003evqM2B9vL8uoLO0Vvj#C9zF7R0A=kD0B8%V\u003cx(4r\u003eAYTWf/z%Oi00\u0026OU0rrBpx(W={Bz(hB0rsO$oLO0Vvj#tkfgGU(wJItmygho]fkL6mxd)84z!0v1B3+1-y?d9$i$8bA0nN$Z2MSYZ00NB=vrcC\u003c02l[hoLO0Vvj#C9zF7R0A=kD0B8%zK0n)\u003eo3igti\u0026Sf2!Cx)Uar=-E}BXuoD01}$uvrM6jy*?i]fh($kx(mMB0rrQtC6d?qzbLW)zG5A#Bo8vDwO+{{p\u0026yyQ02eawvrM6jzFs2xw[=6)fhM80xGDj{6gt}\u0026m{!$RxK+yyrDI}Zl1U1g0rr^wA79l6zF93%", "ln": 3020 }, { "b": "0tU$x6AG0J00)jGBv7m{wPE\u003eL9W\u003cY%vrM6jzFs2xv}Yp\u003eB7GCDlUG[GB7GCPdo/aE0t$[R3ihHQ8VY{GwO#0@wmX.Uq/)4]zF5$I7arxNdnjF+C404uvqYZhq/)4]zF83t0uzgZ3igCm9@#uFByxi5wPQ%YyYKIIoK\u00260Tfk20vxMW=qxLpywzaNbS0rr\u003cWwmx1[uVZQsy?^r@zHczixNa-j0rrHICw6xPrbc8YD1NcT1y\u003e\u003eVgxvEXy\u0026%-8BAR9]026usBvxLExHtZ9r8)*auWbpXm/-O\u003cA%03", "ln": 4104 }, { "b": "5wefc5D:{784^O@84D=:4}3a+u]e-h1qIK:4@+]kF%6b!5=\u0026ZW6+E8s?N-+psS4*X05Ra:igf:KXbX?1GAzmM%cTG!iU-IE1gwh1hwNeBWG5@6web\u003e\u003chwW01hF%mE5\u003e)[C03\u0026lUo/D@9zwi7Dx/x]Bzwi7FGeWVWa^s)76(TZoEL#eS0908o7Q\u003cxCiV4@S85j277OQ)U85Kka1qIXW6=yz/07N[w1qI^?7i0V\u002607RT7WG6JkGC:/*%je58WG6WA0a!?O1?:)+sPYpHWG4)u92PZ#g=uu(9khL^6=**y9U/:e1V^.chx-!U6=%7HbPdWsaShm56=*V%aZ^bA90v016=?m3g\u003eH(\u003cGDQw]%jXnfYAHts86n}#aoJu1XbZrR04z4*aH.tcq=%kozmfA@iWkH!12I[Y86=\u003cgbXd3*hyf7:YAHty12.IwcLW@403\u0026Be6^\u003c\u003ez6^J]\u00266^)xC86Yn0cLW[Cu]iE#rFh.2R#LI-04z4*cBS$iq[8*Go!lyW0cL^KDZT@xd*rP^doM-=EyobciW#0%12I[^87Ju6wecR9hy]N]YAHtF6!xF#hzbZ%N/BYKeFP(QdG*Fpu\u003e\u003eq4g-m+C6!QjKA9$IOL2We/%ek[MY8To.87\u0026q$g/EJW5}vs\u0026eJLQ7f-%l\u003cg8R*X1y@l5whVjUgRr(LgY]S[6/uZZQ5VCRg.?\u003e=f:5jDu\u003e\u003eLbg-n1J6/uZYA9$IkL2We)0Jk$LY8To.88O/5g/H):B4%mDFMSP!WG88\u003e0faz!LEpEVW/z@b0h010P/LdJi0lO?m(AvBijn/W1y@lcwhVGX0908oi\u003e28\u003ciY^B4jqx%[i?=Q689nY}1qJ}86*b)j07N[^1qK3liDexm07QN.WG6JkGGGpk%je5HWG6WA0hG?j04z4M5#J8qeJM9lklA-2kP8/21y@ljwhVZ*la^vZlixbk6*\u0026Z4Q5VCRlkq\u003c9klIY^u\u003e(4pg-nHX6*\u0026Z3A9$IOL2Wf50Jk$LY8To.8a7!jg/EJW5#-kseJMusmGUF9m\u0026s!g1y@lqwhV%[nw29!nFK=0whW3{n$b/a8a+Mn8aB-zm{)67u]e-\u003c1qKJzm@R\u0026)F%6b!o8\u003e*??mAUosS6/u05NRS1RN\u0026z04*la8bgh\u0026hCLb:Z64%YpgMmU6\u0026hECi-2]pqwA7ApOE?m8bI5C8bgkGpga/mu]e-}1qK/Hph\u003cO$F%6b!qurY}*z9I%1V/G#pY?Oj0#jRw0bGgDdoNJ=W/wl-XbZOh1q}sAY-tdz0i/Jq0\u003e59niT9a}2W4CD04z4Mev++/0ru531qneK04*lh8c1rMweOuNg=wtKrk68EwcuB3rUXVF1V/Y!hDQX@6\u0026}4eaq[k}sq+6MstQ){6\u0026(5K6\u0026/h", "ln": 5166 } ], "depth": 1, "facts": { "imp": [ [ "", "java/lang/Object" ], [ "", "[C" ], [ "", "java/lang/Exception" ], [ "", "java/nio/file/LinkOption" ], [ "", "java/io/File" ], [ "", "java/util/Base64" ], [ "", "java/lang/ProcessBuilder$Redirect" ], [ "", "java/security/ProtectionDomain" ], [ "", "java/lang/invoke/MethodHandles$Lookup" ], [ "", "java/lang/String" ], [ "", "java/net/URL" ], [ "", "java/lang/invoke/MethodHandles" ], [ "", "java/util/Base64$Encoder" ], [ "", "java/lang/ProcessBuilder" ], [ "", "java/lang/StringBuilder" ], [ "", "com/github/hhUOmID" ], [ "", "java/nio/file/Files" ], [ "", "[Ljava/lang/String;" ], [ "", "java/lang/Class" ], [ "", "java/nio/charset/StandardCharsets" ], [ "", "java/lang/Integer" ], [ "", "java/lang/System" ], [ "", "java/nio/file/Path" ], [ "", "java/nio/file/attribute/FileAttribute" ], [ "", "java/security/CodeSource" ], [ "java/util/Base64", "java/util/Base64.getEncoder" ], [ "java/util/Base64", "getEncoder" ], [ "java/util/Base64$Encoder", "java/util/Base64$Encoder.encodeToString" ], [ "java/util/Base64$Encoder", "encodeToString" ], [ "java/lang/System", "java/lang/System.getProperty" ], [ "java/lang/System", "getProperty" ], [ "com/github/hhUOmID", "com/github/hhUOmID.main" ], [ "com/github/hhUOmID", "main" ], [ "java/nio/file/Files", "java/nio/file/Files.createDirectories" ], [ "java/nio/file/Files", "createDirectories" ], [ "java/lang/Class", "java/lang/Class.getProtectionDomain" ], [ "java/lang/Class", "getProtectionDomain" ], [ "java/lang/System", "java/lang/System.getenv" ], [ "java/lang/System", "getenv" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectOutput" ], [ "java/lang/ProcessBuilder", "redirectOutput" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.directory" ], [ "java/lang/ProcessBuilder", "directory" ], [ "java/security/ProtectionDomain", "java/security/ProtectionDomain.getCodeSource" ], [ "java/security/ProtectionDomain", "getCodeSource" ], [ "com/github/hhUOmID", "com/github/hhUOmID.mFSwxqFWUIfjM" ], [ "com/github/hhUOmID", "mFSwxqFWUIfjM" ], [ "java/nio/file/Path", "java/nio/file/Path.resolve" ], [ "java/nio/file/Path", "resolve" ], [ "java/nio/file/Path", "java/nio/file/Path.of" ], [ "java/nio/file/Path", "of" ], [ "java/lang/String", "java/lang/String.equals" ], [ "java/lang/String", "equals" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.start" ], [ "java/lang/ProcessBuilder", "start" ], [ "java/lang/String", "java/lang/String.getBytes" ], [ "java/lang/String", "getBytes" ], [ "java/lang/String", "java/lang/String.length" ], [ "java/lang/String", "length" ], [ "java/security/CodeSource", "java/security/CodeSource.getLocation" ], [ "java/security/CodeSource", "getLocation" ], [ "java/net/URL", "java/net/URL.toURI" ], [ "java/net/URL", "toURI" ], [ "com/github/hhUOmID", "com/github/hhUOmID.FbEVrO" ], [ "com/github/hhUOmID", "FbEVrO" ], [ "com/github/kfmufxUtils", "com/github/kfmufxUtils.cvpqzPkNwzye" ], [ "com/github/kfmufxUtils", "cvpqzPkNwzye" ], [ "java/io/File", "java/io/File.getAbsolutePath" ], [ "java/io/File", "getAbsolutePath" ], [ "java/lang/Class", "java/lang/Class.getName" ], [ "java/lang/Class", "getName" ], [ "java/lang/String", "java/lang/String.format" ], [ "java/lang/String", "format" ], [ "com/github/kfmufxUtils", "com/github/kfmufxUtils.run" ], [ "com/github/kfmufxUtils", "run" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.toCharArray" ], [ "java/lang/String", "toCharArray" ], [ "java/nio/file/Path", "java/nio/file/Path.toString" ], [ "java/nio/file/Path", "toString" ], [ "java/lang/String", "java/lang/String.\u003cinit\u003e" ], [ "java/lang/String", "\u003cinit\u003e" ], [ "java/lang/System", "java/lang/System.arraycopy" ], [ "java/lang/System", "arraycopy" ], [ "java/nio/file/Files", "java/nio/file/Files.exists" ], [ "java/nio/file/Files", "exists" ], [ "java/io/File", "java/io/File.\u003cinit\u003e" ], [ "java/io/File", "\u003cinit\u003e" ], [ "java/io/File", "java/io/File.\u003cinit\u003e" ], [ "java/io/File", "\u003cinit\u003e" ], [ "java/nio/file/Path", "java/nio/file/Path.toFile" ], [ "java/nio/file/Path", "toFile" ], [ "com/github/hhUOmID", "com/github/hhUOmID.\u003cinit\u003e" ], [ "com/github/hhUOmID", "\u003cinit\u003e" ], [ "java/lang/ProcessBuilder$Redirect", "java/lang/ProcessBuilder$Redirect.appendTo" ], [ "java/lang/ProcessBuilder$Redirect", "appendTo" ], [ "java/lang/String", "java/lang/String.charAt" ], [ "java/lang/String", "charAt" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "com/github/hhUOmID", "com/github/hhUOmID.getDomain" ], [ "com/github/hhUOmID", "getDomain" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.toString" ], [ "java/lang/StringBuilder", "toString" ], [ "java/nio/charset/StandardCharsets", "java/nio/charset/StandardCharsets.UTF_8" ], [ "java/nio/charset/StandardCharsets", "UTF_8" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectInput" ], [ "java/lang/ProcessBuilder", "redirectInput" ], [ "java/lang/ProcessBuilder$Redirect", "java/lang/ProcessBuilder$Redirect.from" ], [ "java/lang/ProcessBuilder$Redirect", "from" ], [ "java/lang/Integer", "java/lang/Integer.valueOf" ], [ "java/lang/Integer", "valueOf" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectErrorStream" ], [ "java/lang/ProcessBuilder", "redirectErrorStream" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.\u003cinit\u003e" ], [ "java/lang/ProcessBuilder", "\u003cinit\u003e" ] ], "metrics": { "file": { "size": 12641, "entropy": 5.81 }, "class": { "major_version": 65, "interface_count": 0, "method_ref_count": 49, "constant_pool_size": 340, "external_class_count": 25 }, "binary": { "peak_region_bytes": 4096, "peak_region_entropy": 6.67 }, "imports": { "count": 74 }, "functions": { "count": 4 } } }, "id": 14, "mol": "O₃(As₂ErI)H₅(CmDb₂FOsPo₄)", "path": "mod-injected.jar!!com/github/kfmufxUtils.class", "pid": 0, "risk": 11, "sha": "885e6ef017464d5c9b78526dea56e169edadcdcff41bca7010d0bebbd0c5b407", "size": 12641, "traits": [ { "id": "micro-behaviors/communications/http/lib/urlconnection::java-url-class-bytecode", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Java URL class reference", "spans": [ [ 1899, 16 ], [ 1928, 12 ] ] }, { "id": "micro-behaviors/communications/http/lib/urlconnection::jvm-url-class-ref", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "JVM URL class reference" }, { "id": "micro-behaviors/data/encode/base64::jvm-base64-encode-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM Base64 encodeToString call", "spans": [ [ 4168, 39 ] ] }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method", "spans": [ [ 1032, 8 ] ] }, { "id": "micro-behaviors/fs/read/file/handle::jvm-io-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM File API class reference" }, { "id": "micro-behaviors/fs/read/file/handle::jvm-nio-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM NIO file API reference" }, { "id": "micro-behaviors/os/env/gate::jvm-opaque-environment-key", "conf": 0.94, "crit": 1, "desc": "JVM class has generated gate value" }, { "id": "micro-behaviors/os/env/gate::jvm-string-equals-import", "conf": 0.94, "crit": 1, "desc": "JVM class imports String equals", "spans": [ [ 616, 0 ] ] }, { "id": "micro-behaviors/os/env/gate::jvm-system-getenv-import", "conf": 0.94, "crit": 1, "desc": "JVM class imports System getenv", "spans": [ [ 2117, 0 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.88, "crit": 3, "desc": "Java bytecode ProcessBuilder reference", "spans": [ [ 63, 71 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-init-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.92, "crit": 3, "desc": "Java bytecode ProcessBuilder constructor", "spans": [ [ 293, 31 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.95, "crit": 3, "desc": "Java bytecode ProcessBuilder start", "spans": [ [ 3242, 30 ] ] }, { "id": "micro-behaviors/process/info/current::codesource-class", "conf": 0.85, "crit": 3, "desc": "Java CodeSource class reference" }, { "id": "micro-behaviors/process/info/current::getlocation-ref", "conf": 0.82, "crit": 3, "desc": "Java getLocation call reference" }, { "id": "micro-behaviors/process/info/current::protection-domain-class", "conf": 0.85, "crit": 3, "desc": "Java ProtectionDomain class reference" }, { "id": "micro-behaviors/process/info/current::touri-ref", "conf": 0.82, "crit": 3, "desc": "Java toURI call reference" }, { "id": "micro-behaviors/process/info/selfpath::java-protection-domain", "conf": 0.82, "crit": 3, "desc": "Java getProtectionDomain self-path lookup" }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-errors", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder merges standard error", "spans": [ [ 3111, 44 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-input", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard input", "spans": [ [ 2797, 38 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-output", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard output", "spans": [ [ 3084, 39 ] ] }, { "id": "objectives/anti-static/obfuscation/reflection/class::java-protectiondomain", "conf": 1.0, "crit": 3, "desc": "Java ProtectionDomain", "spans": [ [ 1693, 19 ], [ 1715, 34 ], [ 1762, 30 ] ] }, { "id": "objectives/anti-static/obfuscation/string/control-prefix::java-control-prefixed-long-string", "atk": "T1027", "mbc": "F0001", "conf": 0.92, "crit": 3, "desc": "Java string starts with control-length prefix" }, { "id": "objectives/evasion/self-delete/file/script::java-code-source-location", "atk": "T1070.004", "mbc": "F0007", "conf": 0.78, "crit": 3, "desc": "Java code source location", "spans": [ [ 1798, 13 ] ] }, { "id": "objectives/impact/dos/disk::jvm-two-backward-goto-branches", "atk": "T1499.001", "conf": 0.9, "crit": 3, "desc": "JVM repeated counter backedges", "spans": [ [ 5230, 8 ], [ 5358, 8 ], [ 5446, 8 ], [ 5547, 8 ], [ 5736, 8 ], [ 5858, 8 ], [ 5944, 8 ], [ 6113, 8 ] ] }, { "id": "micro-behaviors/os/env/gate::jvm-opaque-secret-environment-gate", "conf": 0.97, "crit": 3, "desc": "JVM compares opaque environment gate", "uses": [ 6, 7, 8 ], "spans": [ [ 616, 6 ], [ 2117, 6 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.94, "crit": 3, "desc": "Java bytecode ProcessBuilder execution", "uses": [ 10, 11 ], "spans": [ [ 293, 31 ], [ 3242, 30 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirected-stdio", "conf": 0.96, "crit": 3, "desc": "Java ProcessBuilder redirects all standard streams", "uses": [ 17, 18, 19 ], "spans": [ [ 2797, 38 ], [ 3084, 39 ], [ 3111, 44 ] ] }, { "id": "micro-behaviors/process/create/spawn::child-process-creation-api", "atk": "T1106", "conf": 0.92, "crit": 3, "desc": "Starts a child process through a platform API", "uses": [ 25 ], "spans": [ [ 293, 31 ], [ 3242, 30 ] ] } ], "type": "java_class" }, { "ctx": [ { "b": "DKp(rb6dmcwO\u003e\u003cRwPz\u003caz/c:WatCzOarR\u003exwfK5Sb5*$2yHH\u003c!a$K6zar\u003e#uA=U@kzx.a:a#7Y7e?!F23lQDnzEEx[b03?\u003cp*)\u003cHvp%c}ed9Hxb4Lnav@=p5Bn", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 458, "entropy": 4.62 }, "json": { "parsed_bytes": 458, "parse_limit_bytes": 76800 }, "binary": { "peak_region_bytes": 458, "peak_region_entropy": 4.62 } } }, "id": 16, "mol": "Md(Pa)", "path": "mod-injected.jar!!fabric.mod.json", "pid": 0, "risk": 1, "sha": "b782a58102ea0101d091c9451b28ac5ebcb83db23020d3e2aefbdb4b530613cd", "size": 458, "traits": [ { "id": "metadata/package/config::fabric-mod-metadata", "conf": 0.9, "crit": 3, "desc": "Fabric mod metadata resource" } ], "type": "json" } ], "rev": "c1ea9", "v": "8" } }