{ "llm": { "conf": 0.99920225, "grade": "hostile", "model": "Qwen/Qwen3.8-27B", "before": { "lvl": 0, "prob": 0.99880934, "class": "hostile" }, "outcome": "hostile", "interpretation": "Minecraft credential stealer" }, "ml": { "v": "7", "eng": "2.12.0-beta.2", "lvl": 0, "conf": 100, "mods": [ { "cls": 0, "raw": 0.9911943, "rte": "az", "prob": 0.9911943 }, { "cls": 2, "raw": 0.99880934, "rte": "az/jar", "prob": 0.99880934 } ], "prob": 0.99880934, "files": [ { "id": 0, "lvl": 0, "conf": 100, "prob": 0.9988093376159668, "type": "jar" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.000034888584195869043, "type": "java_class" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.00003273288530181162, "type": "java_class" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.001096238731406629, "type": "java_class" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.00003566344457794912, "type": "java_class" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.00001333157251792727, "type": "java_class" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.000009715557098388672, "type": "java_class" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.000006407499313354492, "type": "java_class" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.000009715557098388672, "type": "json" } ], "version": "v18.18", "analyzed_at": "2026-09-28T21:20:41Z" }, "path": "DonutSMP-Dupe-Mod.jar", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "p!H([6Awak2MOE[j6?ypo9.T2002m+000Jf003CGB7GDmfkj{mzz2)CxvR{z3C]QVG[3ZQPP=v]a{LT+IOXM#LKeNf3\u003eW7.G[jlXIQsVgQZ#yno\u002683j)6rpIvkmMX2c\u003c3\u003eDHCwgZ=rGzij1vxn[7l)0eUxDl20O[5-8sI[F4H6S4@P-{cy1M:8}/{O5-obFQhd9NgqH0xxq[ZN+.)I.oDAKC}B2jo.2eV-CJxU7$)8\u003cxBf2@J\u003c)Ltf26@Hl.?Evs[4F\u0026DaFn44xnPHcWc}/p!H([6AwyA2MR*B4f", "ln": 0 } ], "mol": "K₂(McGa)O₆(CaEuAlAs₃ErI)H₆(Cm₅Db₅F₃Os₂Po₅Ti)Md₂(Pa)", "sha": "edaf15f40bcb45594d4f5efca1f1262ec39adaa662e3015c70f17f3bb813ce98", "path": "/data/samples/incoming/forager/bad/sha256/bazaar/DonutSMP-Dupe-Mod.jar", "risk": 300, "size": 74660, "type": "jar", "facts": { "metrics": { "jar": { "class_count": 7, "entry_count": 11, "index_count": 0, "service_count": 0, "signature_count": 0, "native_lib_count": 0, "embedded_jar_count": 0, "manifest.entry_count": 0, "manifest.digest_count": 0, "signature_block_count": 0, "versioned_class_count": 0, "manifest.section_count": 0, "manifest.attribute_count": 13, "manifest.class_path_count": 0, "manifest.boot_class_path_count": 0 }, "file": { "size": 74660, "entropy": 7.99 }, "binary": { "peak_region_bytes": 73728, "peak_region_entropy": 7.83 }, "archive": { "file_count": 11, "member_count": 11, "script_count": 0, "zip_bomb_ratio": 3.73, "compressed_size": 73044, "directory_count": 0, "executable_count": 0, "extra_field_size": 36, "noise_file_count": 0, "compression.ratio": 0.32, "hidden_file_count": 0, "uncompressed_size": 228145, "crc_collision_count": 0, "entry_comment_count": 0, "max_filename_length": 43, "rtlo_filename_count": 0, "format.regular_count": 11, "nested_archive_count": 0, "path_traversal_count": 0, "symlink_escape_count": 0, "security.setgid_count": 0, "security.setuid_count": 0, "security.sticky_count": 0, "double_extension_count": 0, "duplicate_member_count": 0, "security.symlink_count": 0, "unicode_filename_count": 0, "homoglyph_filename_count": 0, "security.encrypted_count": 0, "timing.mtime_unique_count": 2, "timing.mtime_unique_ratio": 0.18, "misplaced_executable_count": 0, "timing.mtime_outlier_count": 1, "timing.mtime_dominant_count": 10, "timing.mtime_spread_seconds": 3948542, "timing.sentinel_mtime_count": 0, "security.world_writable_count": 0, "timing.mtime_dominant_fraction": 0.91, "compression.method_counts.deflate": 11 } } }, "traits": [ { "id": "micro-behaviors/data/buffer/transfer::bytearrayoutputstream-ref", "conf": 0.88, "crit": 3, "desc": "Java ByteArrayOutputStream class", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-output", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard output", "from": [ { "file": 1 } ] }, { "id": "objectives/anti-static/obfuscation/string/control-prefix::java-character-digit-bytecode", "atk": "T1027", "mbc": "F0001", "conf": 0.9, "crit": 3, "desc": "Java bytecode calls Character.digit", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/info/current::getlocation-ref", "conf": 0.82, "crit": 3, "desc": "Java getLocation call reference" }, { "id": "micro-behaviors/process/info/selfpath::java-protection-domain", "conf": 0.82, "crit": 3, "desc": "Java getProtectionDomain self-path lookup" }, { "id": "micro-behaviors/os/env/gate::jvm-string-equals-import", "conf": 0.94, "crit": 1, "desc": "JVM class imports String equals", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/send::java-raw-socket-client-write", "atk": "T1071", "mbc": "C0001", "conf": 0.94, "crit": 3, "desc": "Java socket client writes request bytes through DataOutputStream", "from": [ { "off": 3160, "file": 4 } ], "uses": [ 49, 63, 73 ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-sslsocket-handshake-call", "conf": 0.94, "crit": 3, "desc": "JVM SSLSocket.startHandshake call", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/fs/write/file/full::jvm-files-writestring-bytecode", "conf": 0.9, "crit": 3, "desc": "JVM bytecode Files.writeString", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/process/info/current::codesource-class", "conf": 0.85, "crit": 3, "desc": "Java CodeSource class reference" }, { "id": "micro-behaviors/communications/socket/create::jvm-socket-class-ref", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "JVM socket class reference" }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-errors", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder merges standard error", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-x509trustmanager-server-callback", "conf": 0.94, "crit": 3, "desc": "JVM checkServerTrusted callback defined" }, { "id": "well-known/game/mod::minecraft-session-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft session object reference", "from": [ { "file": 3 } ] }, { "id": "objectives/anti-static/obfuscation/string/crypto::java-byte-range-copy", "atk": "T1027", "mbc": "F0001", "conf": 0.7, "crit": 3, "desc": "Java byte range copy", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/os/sysinfo/hostname::jvm-hostname-command-literal", "atk": "T1082", "mbc": "E1082", "conf": 0.9, "crit": 3, "desc": "JVM hostname command literal" }, { "id": "well-known/game/mod::minecraft-client-class-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft client singleton class reference", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-sslcontext-trustmanager-init-call", "conf": 0.94, "crit": 3, "desc": "JVM SSLContext.init trust-manager call", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-trustmanager-class-ref", "conf": 0.9, "crit": 3, "desc": "JVM TrustManager interface reference", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/fs/read/file/handle::jvm-nio-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM NIO file API reference" }, { "id": "objectives/evasion/self-delete/file/script::java-code-source-location", "atk": "T1070.004", "mbc": "F0007", "conf": 0.78, "crit": 3, "desc": "Java code source location", "from": [ { "file": 1 } ] }, { "id": "well-known/malware/stealer/prefire-shard::prefire-family-literal", "atk": "T1528", "mbc": "B0006", "conf": 0.9, "crit": 1, "desc": "Prefire family name literal", "from": [ { "file": 2 } ] }, { "id": "objectives/credential-access/gaming/minecraft::minecraft-session-token-access", "atk": "T1528", "mbc": "B0006", "conf": 0.96, "crit": 4, "desc": "Minecraft session token and UUID access", "from": [ { "off": 2161, "file": 3 } ], "uses": [ 29, 57, 64 ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-x509trustmanager-issuer-callback", "conf": 0.94, "crit": 3, "desc": "JVM getAcceptedIssuers callback defined" }, { "id": "micro-behaviors/data/archive/extract/zip::jvm-zip-entry-extraction-to-file", "conf": 0.96, "crit": 3, "desc": "JVM extracts ZIP entries to files", "from": [ { "off": 12820, "file": 2 } ], "uses": [ 51, 58, 74 ] }, { "id": "micro-behaviors/data/decode/base64::java-base64-decode-bytecode-call", "conf": 0.96, "crit": 3, "desc": "Java Base64 decode call", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/info/current::protection-domain-class", "conf": 0.85, "crit": 3, "desc": "Java ProtectionDomain class reference" }, { "id": "micro-behaviors/communications/socket/ssl::jvm-x509trustmanager-class-ref", "conf": 0.94, "crit": 3, "desc": "JVM X509 trust-manager interface reference" }, { "id": "objectives/credential-access/gaming/minecraft::minecraft-token-child-process-stage", "atk": "T1528, T1059", "mbc": "B0006", "conf": 0.99, "crit": 5, "desc": "Minecraft token access alongside redirected child launch", "from": [ { "off": 4066, "file": 1 }, { "off": 662, "file": 2 }, { "off": 2024, "file": 3 }, { "off": 10333, "file": 4 } ], "uses": [ 22, 31, 45, 71 ] }, { "id": "well-known/game/mod::minecraft-session-access", "conf": 0.91, "crit": 3, "desc": "Minecraft session profile access", "from": [ { "file": 3 } ], "uses": [ 13, 16, 70 ] }, { "id": "micro-behaviors/os/env/gate::jvm-opaque-secret-environment-gate", "conf": 0.97, "crit": 3, "desc": "JVM compares opaque environment gate", "from": [ { "off": 2076, "file": 1 }, { "off": 14490, "file": 2 }, { "file": 6 }, { "file": 7 } ], "uses": [ 5, 38, 65 ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirected-stdio", "conf": 0.96, "crit": 3, "desc": "Java ProcessBuilder redirects all standard streams", "from": [ { "off": 3064, "file": 1 }, { "off": 15266, "file": 2 }, { "off": 5840, "file": 3 } ], "uses": [ 1, 11, 37 ] }, { "id": "micro-behaviors/process/create/spawn::java-runtime-class", "atk": "T1059", "mbc": "E1203", "conf": 0.86, "crit": 3, "desc": "Java Runtime class reference", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/time/sleep/interval::java-thread-sleep-bytecode", "conf": 0.9, "crit": 3, "desc": "Java bytecode thread sleep", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/info/current::touri-ref", "conf": 0.82, "crit": 3, "desc": "Java toURI call reference" }, { "id": "micro-behaviors/data/decode/base64::java-base64-decoder-class", "conf": 0.92, "crit": 3, "desc": "JVM Base64 decoder class reference", "from": [ { "file": 2 } ] }, { "id": "objectives/impact/dos/disk::jvm-two-backward-goto-branches", "atk": "T1499.001", "conf": 0.9, "crit": 3, "desc": "JVM repeated counter backedges", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-input", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard input", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/env/gate::jvm-opaque-environment-key", "conf": 0.94, "crit": 1, "desc": "JVM class has generated gate value" }, { "id": "micro-behaviors/process/thread/lifecycle::jvm-thread-start-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM starts a thread", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.88, "crit": 3, "desc": "Java bytecode ProcessBuilder reference", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/framing::data-stream-transport", "atk": "T1573", "conf": 1.0, "crit": 3, "desc": "Java data-stream transport type", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method", "from": [ { "file": 1 } ] }, { "id": "objectives/anti-analysis/timing/evasion::kotlin-thread-sleep-check", "atk": "T1497.003", "conf": 0.94, "crit": 3, "desc": "Kotlin Thread.sleep call", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.95, "crit": 3, "desc": "Java bytecode ProcessBuilder start", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/encode/base64::jvm-base64-encode-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM Base64 encodeToString call", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/create::java-socket-bytecode-reference", "atk": "T1071", "mbc": "C0001", "conf": 0.86, "crit": 3, "desc": "Java bytecode socket reference", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/communications/proxy/tunnel::byte-output-stream", "atk": "T1090", "mbc": "C0003", "conf": 0.5, "crit": 3, "desc": "Java ByteArrayOutputStream usage", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/http/lib/urlconnection::java-url-class-bytecode", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Java URL class reference", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/buffer/transfer::jvm-outputstream-write", "conf": 0.96, "crit": 2, "desc": "JVM writes bytes to output stream", "from": [ { "file": 4 } ] }, { "id": "objectives/anti-static/obfuscation/string/control-prefix::java-control-prefixed-long-string", "atk": "T1027", "mbc": "F0001", "conf": 0.92, "crit": 3, "desc": "Java string starts with control-length prefix" }, { "id": "micro-behaviors/fs/write/file/handle::jvm-fileoutputstream-bytecode", "conf": 0.86, "crit": 3, "desc": "JVM imports FileOutputStream class", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/proxy/tunnel::inet-socket-address", "atk": "T1090", "mbc": "C0003", "conf": 0.6, "crit": 3, "desc": "Java InetSocketAddress reference", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/communications/socket/framing::bytebuffer-transport", "atk": "T1573", "conf": 1.0, "crit": 3, "desc": "Java byte-buffer transport type", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/communications/http/lib/urlconnection::jvm-url-class-ref", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "JVM URL class reference" }, { "id": "micro-behaviors/fs/read/file/handle::jvm-io-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM File API class reference" }, { "id": "micro-behaviors/communications/socket/ssl::jvm-sslparameters-set-server-names", "conf": 0.93, "crit": 3, "desc": "JVM sets TLS SNI server name", "from": [ { "file": 4 } ] }, { "id": "well-known/game/mod::minecraft-uuid-getter-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft profile UUID getter reference", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/data/archive/extract/zip::jvm-zip-entry-iteration-bytecode", "conf": 0.92, "crit": 3, "desc": "JVM iterates ZIP archive entries", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/create/spawn::child-process-creation-api", "atk": "T1106", "conf": 0.92, "crit": 3, "desc": "Starts a child process through a platform API", "from": [ { "off": 288, "file": 1 }, { "off": 662, "file": 2 }, { "file": 3 } ], "uses": [ 71 ] }, { "id": "micro-behaviors/data/buffer/transfer::bytearrayinputstream-ref", "conf": 0.88, "crit": 3, "desc": "Java ByteArrayInputStream class" }, { "id": "micro-behaviors/data/decode/base64::java-base64-decoding-bytecode", "conf": 0.94, "crit": 3, "desc": "Java bytecode Base64 decoding", "from": [ { "off": 19122, "file": 2 } ], "uses": [ 25, 62 ] }, { "id": "micro-behaviors/data/decode/base64::java-base64-decoder-bytecode-call", "conf": 0.94, "crit": 3, "desc": "Java Base64 decoder accessor call", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/socket/create::java-socket-class-import", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "Java imports the network socket class", "from": [ { "file": 4 } ] }, { "id": "objectives/credential-access/gaming/minecraft::minecraft-token-getter-ref", "atk": "T1528", "mbc": "B0006", "conf": 0.92, "crit": 3, "desc": "Minecraft access token getter", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/os/env/gate::jvm-system-getenv-import", "conf": 0.94, "crit": 1, "desc": "JVM class imports System getenv", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/info/current::getpath-ref", "conf": 0.8, "crit": 3, "desc": "Java getPath call reference" }, { "id": "metadata/package/config::fabric-mod-metadata", "conf": 0.9, "crit": 3, "desc": "Fabric mod metadata resource", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/socket/create::java-socket-slash-reference", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "Java slash-form socket reference", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-init-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.92, "crit": 3, "desc": "Java bytecode ProcessBuilder constructor", "from": [ { "file": 1 } ] }, { "id": "well-known/game/mod::minecraft-name-getter-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft profile name getter reference", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.94, "crit": 3, "desc": "Java bytecode ProcessBuilder execution", "from": [ { "off": 3195, "file": 1 }, { "off": 15330, "file": 2 }, { "off": 867, "file": 3 } ], "uses": [ 44, 69 ] }, { "id": "objectives/anti-static/obfuscation/reflection/class::java-protectiondomain", "conf": 1.0, "crit": 3, "desc": "Java ProtectionDomain", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/send::java-dataoutputstream-class", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "Java DataOutputStream class reference", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/data/archive/extract/zip::jvm-zip-entry-read-bytecode", "conf": 0.9, "crit": 3, "desc": "JVM reads ZIP archive entry data", "from": [ { "file": 2 } ] }, { "id": "objectives/impact/dos/disk::jvm-megabyte-byte-array-constant", "atk": "T1499.001", "conf": 0.94, "crit": 3, "desc": "JVM one-megabyte allocation constant", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-custom-x509trustmanager", "conf": 0.95, "crit": 3, "desc": "Class implements a custom X509 trust manager", "from": [ { "file": 5 } ], "uses": [ 12, 23, 27 ] }, { "id": "metadata/file/archive::archive-at-least-10-members", "conf": 0.9, "crit": 3, "desc": "Archive contains at least ten members" }, { "id": "metadata/package/entrypoint::jar-main-class", "conf": 0.95, "crit": 2, "desc": "JAR manifest declares an executable Main-Class" }, { "id": "metadata/file/naming::archive-member-under-10kb", "conf": 0.9, "crit": 3, "desc": "Archive has a sub-10KB member" }, { "id": "metadata/package/config::fabric-runnable-mod-archive", "conf": 0.9, "crit": 3, "desc": "Fabric mod JAR is directly runnable", "from": [ { "file": 9 } ], "uses": [ 67, 78 ], "spans": [ [ 0, 15 ] ] }, { "id": "objectives/exfiltration/stealer/credential/token::minecraft-token-http-body-exfil", "atk": "T1041", "mbc": "E1041", "conf": 0.98, "crit": 4, "desc": "Minecraft token access paired with raw socket request write", "from": [ { "off": 2024, "file": 3 }, { "off": 6254, "file": 4 } ], "uses": [ 6, 22 ], "spans": [ [ 0, 41 ] ] }, { "id": "well-known/malware/stealer/prefire-shard::prefire-packed-runtime-stealer", "atk": "T1528", "mbc": "B0006", "conf": 0.99, "crit": 5, "desc": "Prefire packed runtime Minecraft stealer", "from": [ { "file": 1 }, { "off": 20714, "file": 2 }, { "off": 2024, "file": 3 }, { "file": 4 } ], "uses": [ 2, 21, 22, 50, 51, 58, 74 ] } ] }, { "ctx": [ { "b": "+kO#^0000+0ziv)5O2-@fk20vxMW=qyfbmCt0\u0026I{0rAfiygho]fkL6mxd)4\u0026ygQ)%2lj\u0026b03M8=C404uvqYZhp\u0026ZF:wPI]VB.LV5wPx4]wN]H}wN//!00Jx67\u00260G5vj#C9zF7R0A=kD0B8%V\u003cx(4r\u003eAT8NH0rry6wN]H}wN//.02PDVC404DBzkLAlsB}Dhz=WFzEWP}wPw1Q3ipbrygho]flIwJy+Fa-B7El^2lkek00+@gv@C)?ASDd^ygho]fkL6mxd)$pC5Iecfhl21xM4ALvqYQ(wPGa\u003cz/oAlA0DvN0rsfQvrM6jy*?i]fkkrEz!\u0026]qo\u003ewAWz!8yEzE^M{A%zWS0rrr$z/oAlz#/}yjzwXEBuPZ911kQ03\u0026*$w6::{z02tOn5mPD.ACG8}yHpK}wNw}Wzuf.JoK\u00260Tfk20vxMW=qyfbmCt0\u003evL00EdEx(i}K7arxXygho]fkL6mxd)h9A+PA7j1jhh00D.Jxla7N6ky%0vj#C9zF7Q\u003eCW\u003er7BzkVh2lk+Ffk\u0026]1DUUvm1POJ50bjiEeD(aO0000002kXq%nS9", "ln": 0 }, { "b": "zF7Q#vRPE:Bur5/ygho]fkL6mxd)4\u0026ygQ)%j4S0)rTX%!05$q=huk-r00K=PlN=4A02bz{3ihQSjokA^wPq\u003c3y\u0026YQS6^#:\u003cvrM6jy*?i]fhD4(wN/*zdoWbWj]^!O04Xan0rr\u003cAz/4dux([3hvLptyrBofBs29Gu2lm7002+?R3iiA[l\u0026^oG3fXOc(4=RfXS2:yLJGGH(9l=vM7v3JMHoyj\u003e=ZflHjOQ0SPY\u003eB\u003edmRTU!xg-UJrJ[)T+", "ln": 657 }, { "b": "rTX%x08:d7q2\u003cI}00V\u003eJAaJ]$0rs8/lN+YzvrM6jy*?i]fh($kx(mMIB.LV5wPx\u003cv096213ii{6r@\u0026pbBz\u003e91A+PA70rr/ZdnjF+C404uvqYZhq/)4]zF83t09Gq93ii{6tlaZaA=(md09]Nt3igbcui73-\u003e=.eOJG-I9V*SQu(6m+3FsC?=S)[ilL=:eLGZaJ4\u003ebKd7GUDYoWDAaE(xc!JGxwCP2)ZJs0#?:4]Av[xsChgywjcQ%Kn(N-", "ln": 948 }, { "b": "NDoD))w(ieGt3AgQU}#x\u003cI4C@0d+dJ3#fi]vj#tkfgGU(wD@i/0rrTBvrM6jy*?i]fgfL:B8}M^G-Ie!xjVfYA=l5hv@#B6zBwzWvqfPW03S*uoLO0Vvj#Xkv%8*aBA]JoA=l5hv@#B6zBwzWvqfQv3\u0026(4.HZBcp0eQZR9+]bbvj#Xkv%8*aBA]JoA=l5hv@#B6zBwzWvqfP:0e*\u003cT4qfl]lVlHDq/u/0v}tVv94imfygho]flpYmB-IhrC}RK6wmXXTB-H#6i$8aG0fdx^I#X[t02PDVC404BwN/\u003e6x([RNlVlHDq/u/0v}t(BKPtB\u0026xjVfUz!0i$x(v\u003e\u002601ZLcoLO0Vvj#IfBt3S(oGJT.Lk{*O0fNtE0rrKyvrM6jzE)]yrz(G}0g9Y^1:1V.qB{(?5gw#3ygho]fk+uyfi7[wi$8aS0gBk{M\u0026JPR01*RMygho]fk+uyfi7[wj1jhs02bB73ik.VO=F*4xjVfJvSME7B-.g\u003evrue\u003e0h6r}3ik.VP-CcL[3N#uL:pKlTMMvu)VCoyQO^H/L\u003c:\u0026[\u003e=p=EQMB]aR@szF[3E=pM6{\u003coUJITx)Vs^lQnFh30hxL{24}H?wO#V10hPWg3ih%:Ru3VE1(+#r[0x^jUAFp.P6iLZ\u0026*Vk4Mw:$fVf/96\u003e^u96O2=1zJP^KL)yxk50h][#kO0dSPY9LR(Z0s/Y}1FvISH$I\u003c/aHeKdLWHQVv!#\u003cI3AlJG9gTZ2(Dc)4?bHY[#6wSPy!5)sq4{TDhFwRW9n", "ln": 1603 }, { "b": "c}[w:C404rz.BN]y?kWSoLO0Vvj#C9zF7R0A=kD0B8%V\u003cx(4r\u003eAWjK]wnc6}v@%^v0k!/P3igng-q]@FA+e=}A+e:5nP5G\u0026Bo8wac}[w:C404uvqYZhp\u0026ZF:wPI]VB.LV5wPx4]wN]H}wN/*zdnjF+C404uvqYZhp\u0026ZF:wPI]VB.LV5wPx\u003cv0lk8X3igti:Phxe4dgxR)4{ijL.[W.QWi\u0026F\u0026*mpxI\u003ePM\u003cTllQ!\u003cc41kSjRt^JQs3s)4*PvMaugrG6XqN\u0026*b\u003e{I\u0026WpUHV+:\u003c\u003ccc2t0lUxy2xx", "ln": 2686 }, { "b": "0m7VC26s=Mx(4tY01ZLcoLO0Vvj#tkfgGU(wJHq2^e.P50ce7*0rrylAbYxawk)EQ0m.7/3igng!=t:XA+e=}A+e:5pJZ+#B-X2(/z@#100\u0026OT0rr^NwN]H}wN/*JA=M8sq/)4\u003evqM2B9vL8uoLO0Vvj#C9zF7R0A=kD0B8%V\u003cx(4r\u003eAYTWf*w{1o00\u0026OX0rrBpx(W={Bz(hB0rsO$oLO0Vvj#tkfgGU(wJItmygho]fkL6mxd)84z!0v1B3+1-y?d9$i$8bD0n[g:2MS/:00NB=vrcC\u003c02l[hoLO0Vvj#C9zF7R0A=kD0B8%zK0oj7u3igti\u003cPbt{zCsneuUr!vl%\u0026/5l3M:drbkwj01}$uvrM6jy*?i]fh($kx(mMB0rrsCCx(#0v/VMpx)J-$l3vr)yI%jN6IJmIC404wx(tUpx(4ulp*[DVi@]r/zEX03uWc9%v/VMnvpsv[zDZQ^0rr^Am07\u003e8", "ln": 2973 }, { "b": "0tt+u5DJND00)jGBv7m{wPE\u003eL9W\u003cY%vrM6jzFs2xv}Yp\u003eB7GCDlUG[GB7GCPdo/aE0tUXL3ihQT7Y:QDwO#0@wmX.Uq/)4]zF5$I7arxNdnjF+C404uvqYZhq/)4]zF83t0u7$T3igCm9033IvpKg@yK636wNOkNCx[ri02Fssz/4dux([3hvLptyrBofBs29Gui@]r-zF%X000EKvx(i}K26BP\u0026rD-fV00Wy.wP*T.0rrZLzG6Drs8.}-vPvR/ye5U=0rrdw13hbxwcj!iOhplD00\u0026PN0rr=", "ln": 4002 }, { "b": "WG50x2n):Gg=tQS2FHsK6:Otd2]9=V1V=$)hvHre6:ZPmbPc}73(GoM6:OgZ3$7[f2lU+I6:O+^g\u003eH(\u003cGBv)V%jXm{YAHt7843D-3J?aIXbXO404.m\u003c3+3a0WG5QZ00\u003e6:07BdxoE)?u13N.BQ5Yi:9wPUU83yNxiU02q1gwh5hv*VnWG68awebR=hw0F2qcsRBW/xw*5D:{76+Rk)Q5VRW5G85Y6+sW!5[5cFobOix6+Rk(Aa39Oom\u0026tn09ArQ5=[{g!!]7d09(@jl74YTXbY)vGAzmM%bN!3WG50x6=v+21y@w+uO\u003cUR85o\u003e27gWLUhwW8AYAHtk5[i+p6(BT[wsrGn6AzS4zwEa70a*TszwEa70b3\u003cwzuz^m6=v-5Q5VqN7.)]a6+}Py85i(56=v-4A9$IOL2WeM0Jk$PY8Tx+85P*.j?7GdoE*pW04.mP5]LbTfGHf\u003e90n2Q9t]\u003ch6=*//whUFz9\u003eRUq9%jzz6^akjQ5VCR9#b[o92fE%u\u003e\u003c!(g-mno6^akiA9$IOL2WeT0Jk$LY8Tx+86ur/jYtF^5]+nVfGHA@blG+XbPd\u0026v1y@k)whU.Gca\u003cyxciDdO6^%!yQ5VCRckv{DblO-bu\u003e\u003e7$g-mIv6^%!xA9$IOL2We-0Jk$L6^ZG@iWU^(0#SD*6^Zu\u0026i\u003eCwysS5P@06Kn\u003c0cR6/1haXVXbZ#D0jjlWY-oP^0${c)05cC-87C.Bhy/T{Z64%Yd}yK?6!E03iXpB(e!]#Netra\u002687=NQ87C+7d{%8Au]e-J1qJK7d@X(MwrG@Ce=?)I*Q^CpsS5*206Km-1qlr{05cC*88hjIhzMd8Z64%YggSp06/iGaiY3{%h5d$-gOK\u003c{88J6=88hmeggg?Ou]e-Q1qJ^egh{RTF%6b!h36SP*Q^CpsS66906Kn\u003c0cR8G0eaF/0\u003e58^WG8z$0g74[OvnG\u003cWG93%5#q@ofGIfhikbJa88$$WhAqTmZ7\u0026Us1y%zK6/@#hiY^B4jqx%[i?=P%89nM}88@u[g-nm/iU::(iDev.F%6b!joqwW?[5\u003etsS6rg06N*(RV%*melJ5", "ln": 4944 } ], "depth": 1, "facts": { "imp": [ [ "", "java/lang/ProcessBuilder$Redirect" ], [ "", "java/lang/String" ], [ "", "java/lang/invoke/MethodHandles$Lookup" ], [ "", "java/util/Base64$Encoder" ], [ "", "java/nio/file/Path" ], [ "", "java/nio/file/LinkOption" ], [ "", "java/lang/System" ], [ "", "java/util/Base64" ], [ "", "java/lang/Exception" ], [ "", "java/nio/file/Files" ], [ "", "java/io/File" ], [ "", "java/security/ProtectionDomain" ], [ "", "java/security/CodeSource" ], [ "", "java/net/URL" ], [ "", "java/lang/Integer" ], [ "", "com/github/JFU_adW2MG" ], [ "", "java/lang/StringBuilder" ], [ "", "java/lang/ProcessBuilder" ], [ "", "[Ljava/lang/String;" ], [ "", "java/nio/charset/StandardCharsets" ], [ "", "java/lang/Object" ], [ "", "java/nio/file/attribute/FileAttribute" ], [ "", "java/lang/Class" ], [ "", "[C" ], [ "", "java/lang/invoke/MethodHandles" ], [ "java/lang/String", "java/lang/String.length" ], [ "java/lang/String", "length" ], [ "java/nio/file/Files", "java/nio/file/Files.exists" ], [ "java/nio/file/Files", "exists" ], [ "java/nio/charset/StandardCharsets", "java/nio/charset/StandardCharsets.UTF_8" ], [ "java/nio/charset/StandardCharsets", "UTF_8" ], [ "java/io/File", "java/io/File.\u003cinit\u003e" ], [ "java/io/File", "\u003cinit\u003e" ], [ "java/lang/ProcessBuilder$Redirect", "java/lang/ProcessBuilder$Redirect.from" ], [ "java/lang/ProcessBuilder$Redirect", "from" ], [ "com/github/JFU_adW2MG", "com/github/JFU_adW2MG.fxg" ], [ "com/github/JFU_adW2MG", "fxg" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/lang/String", "java/lang/String.getBytes" ], [ "java/lang/String", "getBytes" ], [ "java/nio/file/Files", "java/nio/file/Files.createDirectories" ], [ "java/nio/file/Files", "createDirectories" ], [ "java/util/Base64$Encoder", "java/util/Base64$Encoder.encodeToString" ], [ "java/util/Base64$Encoder", "encodeToString" ], [ "java/lang/Integer", "java/lang/Integer.valueOf" ], [ "java/lang/Integer", "valueOf" ], [ "java/lang/System", "java/lang/System.arraycopy" ], [ "java/lang/System", "arraycopy" ], [ "java/lang/String", "java/lang/String.\u003cinit\u003e" ], [ "java/lang/String", "\u003cinit\u003e" ], [ "com/github/JFU_adW2MG", "com/github/JFU_adW2MG.\u003cinit\u003e" ], [ "com/github/JFU_adW2MG", "\u003cinit\u003e" ], [ "java/lang/Class", "java/lang/Class.getProtectionDomain" ], [ "java/lang/Class", "getProtectionDomain" ], [ "java/nio/file/Path", "java/nio/file/Path.of" ], [ "java/nio/file/Path", "of" ], [ "java/nio/file/Path", "java/nio/file/Path.resolve" ], [ "java/nio/file/Path", "resolve" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.directory" ], [ "java/lang/ProcessBuilder", "directory" ], [ "com/github/JFU_adW2MG", "com/github/JFU_adW2MG.krrycWeoRoivDolii" ], [ "com/github/JFU_adW2MG", "krrycWeoRoivDolii" ], [ "java/net/URL", "java/net/URL.toURI" ], [ "java/net/URL", "toURI" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectInput" ], [ "java/lang/ProcessBuilder", "redirectInput" ], [ "java/lang/String", "java/lang/String.equals" ], [ "java/lang/String", "equals" ], [ "com/github/JFU_adW2MG", "com/github/JFU_adW2MG.main" ], [ "com/github/JFU_adW2MG", "main" ], [ "java/io/File", "java/io/File.\u003cinit\u003e" ], [ "java/io/File", "\u003cinit\u003e" ], [ "com/github/jWmLZC", "com/github/jWmLZC.run" ], [ "com/github/jWmLZC", "run" ], [ "java/util/Base64", "java/util/Base64.getEncoder" ], [ "java/util/Base64", "getEncoder" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ], [ "java/lang/Class", "java/lang/Class.getName" ], [ "java/lang/Class", "getName" ], [ "com/github/JFU_adW2MG", "com/github/JFU_adW2MG.getDomain" ], [ "com/github/JFU_adW2MG", "getDomain" ], [ "java/lang/ProcessBuilder$Redirect", "java/lang/ProcessBuilder$Redirect.appendTo" ], [ "java/lang/ProcessBuilder$Redirect", "appendTo" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "java/nio/file/Path", "java/nio/file/Path.toString" ], [ "java/nio/file/Path", "toString" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.start" ], [ "java/lang/ProcessBuilder", "start" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.charAt" ], [ "java/lang/String", "charAt" ], [ "java/lang/String", "java/lang/String.toCharArray" ], [ "java/lang/String", "toCharArray" ], [ "java/nio/file/Path", "java/nio/file/Path.toFile" ], [ "java/nio/file/Path", "toFile" ], [ "com/github/jWmLZC", "com/github/jWmLZC.gnrAweLrfc" ], [ "com/github/jWmLZC", "gnrAweLrfc" ], [ "java/security/ProtectionDomain", "java/security/ProtectionDomain.getCodeSource" ], [ "java/security/ProtectionDomain", "getCodeSource" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectOutput" ], [ "java/lang/ProcessBuilder", "redirectOutput" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectErrorStream" ], [ "java/lang/ProcessBuilder", "redirectErrorStream" ], [ "java/lang/System", "java/lang/System.getenv" ], [ "java/lang/System", "getenv" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.\u003cinit\u003e" ], [ "java/lang/ProcessBuilder", "\u003cinit\u003e" ], [ "java/io/File", "java/io/File.getAbsolutePath" ], [ "java/io/File", "getAbsolutePath" ], [ "java/security/CodeSource", "java/security/CodeSource.getLocation" ], [ "java/security/CodeSource", "getLocation" ], [ "java/lang/System", "java/lang/System.getProperty" ], [ "java/lang/System", "getProperty" ], [ "java/lang/String", "java/lang/String.format" ], [ "java/lang/String", "format" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.toString" ], [ "java/lang/StringBuilder", "toString" ] ], "metrics": { "file": { "size": 12416, "entropy": 5.81 }, "class": { "major_version": 65, "interface_count": 0, "method_ref_count": 49, "constant_pool_size": 330, "external_class_count": 25 }, "binary": { "peak_region_bytes": 4096, "peak_region_entropy": 6.72 }, "imports": { "count": 74 }, "functions": { "count": 4 } } }, "id": 1, "mol": "O₃(As₂ErI)H₅(CmDb₂FOsPo₄)", "path": "/data/samples/incoming/forager/bad/sha256/bazaar/DonutSMP-Dupe-Mod.jar!!com/github/jWmLZC.class", "pid": 0, "risk": 11, "sha": "7d9198c0c741fe11a30f8686914f803e6dec13997215454ed6751f477a55261c", "size": 12416, "traits": [ { "id": "micro-behaviors/communications/http/lib/urlconnection::java-url-class-bytecode", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Java URL class reference", "spans": [ [ 1873, 16 ], [ 1902, 12 ] ] }, { "id": "micro-behaviors/communications/http/lib/urlconnection::jvm-url-class-ref", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "JVM URL class reference" }, { "id": "micro-behaviors/data/encode/base64::jvm-base64-encode-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM Base64 encodeToString call", "spans": [ [ 4066, 39 ] ] }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method", "spans": [ [ 1012, 8 ] ] }, { "id": "micro-behaviors/fs/read/file/handle::jvm-io-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM File API class reference" }, { "id": "micro-behaviors/fs/read/file/handle::jvm-nio-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM NIO file API reference" }, { "id": "micro-behaviors/os/env/gate::jvm-opaque-environment-key", "conf": 0.94, "crit": 1, "desc": "JVM class has generated gate value" }, { "id": "micro-behaviors/os/env/gate::jvm-string-equals-import", "conf": 0.94, "crit": 1, "desc": "JVM class imports String equals", "spans": [ [ 721, 0 ] ] }, { "id": "micro-behaviors/os/env/gate::jvm-system-getenv-import", "conf": 0.94, "crit": 1, "desc": "JVM class imports System getenv", "spans": [ [ 2076, 0 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.88, "crit": 3, "desc": "Java bytecode ProcessBuilder reference", "spans": [ [ 58, 71 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-init-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.92, "crit": 3, "desc": "Java bytecode ProcessBuilder constructor", "spans": [ [ 288, 31 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.95, "crit": 3, "desc": "Java bytecode ProcessBuilder start", "spans": [ [ 3195, 30 ] ] }, { "id": "micro-behaviors/process/info/current::codesource-class", "conf": 0.85, "crit": 3, "desc": "Java CodeSource class reference" }, { "id": "micro-behaviors/process/info/current::getlocation-ref", "conf": 0.82, "crit": 3, "desc": "Java getLocation call reference" }, { "id": "micro-behaviors/process/info/current::protection-domain-class", "conf": 0.85, "crit": 3, "desc": "Java ProtectionDomain class reference" }, { "id": "micro-behaviors/process/info/current::touri-ref", "conf": 0.82, "crit": 3, "desc": "Java toURI call reference" }, { "id": "micro-behaviors/process/info/selfpath::java-protection-domain", "conf": 0.82, "crit": 3, "desc": "Java getProtectionDomain self-path lookup" }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-errors", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder merges standard error", "spans": [ [ 3064, 44 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-input", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard input", "spans": [ [ 2750, 38 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-output", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard output", "spans": [ [ 3037, 39 ] ] }, { "id": "objectives/anti-static/obfuscation/reflection/class::java-protectiondomain", "conf": 1.0, "crit": 3, "desc": "Java ProtectionDomain", "spans": [ [ 1667, 19 ], [ 1689, 34 ], [ 1736, 30 ] ] }, { "id": "objectives/anti-static/obfuscation/string/control-prefix::java-control-prefixed-long-string", "atk": "T1027", "mbc": "F0001", "conf": 0.92, "crit": 3, "desc": "Java string starts with control-length prefix" }, { "id": "objectives/evasion/self-delete/file/script::java-code-source-location", "atk": "T1070.004", "mbc": "F0007", "conf": 0.78, "crit": 3, "desc": "Java code source location", "spans": [ [ 1772, 13 ] ] }, { "id": "objectives/impact/dos/disk::jvm-two-backward-goto-branches", "atk": "T1499.001", "conf": 0.9, "crit": 3, "desc": "JVM repeated counter backedges", "spans": [ [ 5008, 8 ], [ 5147, 8 ], [ 5168, 8 ], [ 5274, 8 ], [ 5366, 8 ], [ 5450, 8 ], [ 5571, 8 ], [ 5655, 8 ] ] }, { "id": "micro-behaviors/os/env/gate::jvm-opaque-secret-environment-gate", "conf": 0.97, "crit": 3, "desc": "JVM compares opaque environment gate", "uses": [ 6, 7, 8 ], "spans": [ [ 721, 6 ], [ 2076, 6 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.94, "crit": 3, "desc": "Java bytecode ProcessBuilder execution", "uses": [ 10, 11 ], "spans": [ [ 288, 31 ], [ 3195, 30 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirected-stdio", "conf": 0.96, "crit": 3, "desc": "Java ProcessBuilder redirects all standard streams", "uses": [ 17, 18, 19 ], "spans": [ [ 2750, 38 ], [ 3037, 39 ], [ 3064, 44 ] ] }, { "id": "micro-behaviors/process/create/spawn::child-process-creation-api", "atk": "T1106", "conf": 0.92, "crit": 3, "desc": "Starts a child process through a platform API", "uses": [ 25 ], "spans": [ [ 288, 31 ], [ 3195, 30 ] ] } ], "type": "java_class" }, { "ctx": [ { "b": "+kO#^0000+1Gqz46\u003eqf0fk20vxMW=qn\u003e8//vpSB{o?bA*0rAfiygho]fkL6mxd)4\u0026ygQ)%2lj\u0026b02]A^z7/KoBzb/afkbGxuU%$gB%H)xvpSIYwD@hs0rr^yz/4dux([3hvLqzqx\u003cU.2CxKh\u003e2ls/fy\u0026r-)s-O6O03M8=C404uvqYZhp\u0026ZF:wPI]VB.LV5wPx4]wN]H}wN//!015-b7\u00260G5vj#C9zF7R0A=kD0B8%V\u003cx(4r\u003eAT8NM0rry6wN]H}wN//.02PDVC404DBzkLAlsB}Dhz=WEwN/T?wPw1Q4/(Uwygho]flIwJy+Fa-B7El^2lktp00+]6v@C)?ASDd^ygho]fkL6mxd)$pC5Iecfhl21xM4ALvqYQ(wPGa\u003cz/oAlA0DvS0rsfQvrM6jy*?i]fkkrEz!\u0026]qo\u003ewAWz!8yEzE^M{A%zWX0rrr$z/oAlz#/}KACb", "ln": 0 }, { "b": "xlBpQ6IJmIC404wx(tUpx(4ulp*[DVi@]r+zC%$Mp5$tjoLO0Vvj#C9zF7R3BAh8kxf{-Py?d9$i@]r=jzwXEBuPZ911kQ03\u0026?)Wfa4WZ05aAN5nCS%vj#C9zF7R3BAh8kx9Oz(0rr{JvrM6jy*?i]fh($kx(mMIB.LV5wPw1QgZTju05aANspKn\u0026K)vWM\u003eBmC0YpehtU\u0026g[U)1RF3SKp]ALin{d\u003c^.[fRh:-wKk^jJ(Xh?hNZ?*$S{+E\u003c\u0026G/b.Hkj]\u003cN=/B1\u003eDhIXOW4QUWcsT", "ln": 598 }, { "b": "gxphK00BYwdol\u0026Se=X-Q05T:O0rs8/lN+YzvrM6jy*?i]fh($kx(mMIB.LV5wPx\u003cv07c-=3ih{-rri79Bz\u003e91A+PA70rr/ZdnjF+C404uvqYZhq/)4]zF83t09oe53ih{-sPFH:)s\u0026mqZK\u003c{*)WQ0kJj!nONc}X-(4b+)NZhsmY6c[$)sZ+*Zp8E{)WYH5JGrh6Qvb:O(4aVJN$p}L09YE7py=MSPx.Yc\u003e+%{hT*^D9FA:Oo[1)2BV6sv5", "ln": 1073 }, { "b": "wJG[)3@h7nuQ!M-q^SG{o-Uj%x\u0026nIO0rrggg64vWAb]J4x(W+=07[Ukygho]fkL6mxd)h9A+PA7j4%x$C404uvqYZhq/)4]zF848ygho]fkL6mxd)h9A+PA7j1i\u003crvrM5", "ln": 4024 }, { "b": "0rt4.\u0026KVI+I?ZwSK)F({\u003c/2ivW4Dr?Yx\u003eAi\u003e97${RgvWbRSCjS\u0026K=2OIK9y*Mf+t$\u003c/b#QWvNT8dGGINxjVf@zGVA?ecaDj0b./?0rts)(Xyw.W7C^+X-ZA4\u003c?4+WV-A8WWc\u003ciV(zYuTH3DpG\u003eyXSSHkk64Ljao%\u003eEl(vX$we\u003eNbT)g)V-W}Si()if9856\u0026*M\u003egH{uAtQVOkK\u003e.\u003eF/ZpSK1T(t?:\u003e.UX}Oq(W8IrG?\u003c)7XIwO$le)0wK", "ln": 5497 }, { "b": "ILFg-\u003cbF]OJI$%kQV/mF)tNjHK(IB@\u0026F:Jq0YHn.0000000*\u003cK01-)NC404uvqYZhra{q-vpPPAi@]r+B8kA0z#/}wc}U{?3\u003c5M[j{?uN0ZuX=2Yai(x()r\u003ez#/}Gz/5f)Dt(z\u003emRD%NCWZWN2uBI#t3\u003eSl0rr*UC4+Gax\u003cV10CWC5#woJf7xLz5V00^yKuU1j}vGuDmB97\u0026jwMAkQ0rr^EAahKGrAai=uR\u003cG\u003ex\u003cTqjvqb-x6ky%0vj#tkfg!@dCW\u003er7BzkVh2lB", "ln": 12075 }, { "b": "wNPAX0-Pg21T)Owdol\u0026Se=]5X0-Yq60rr@+oLO0Vvj#tkfg*52B-ZM7A+eV@j1jhs04[sQ3iBccs]!QixjVfWwQ5q=zGG]A0rs2^dnjF+C404DBzkLADtdsKt4}}AzGG]Ai$8f}0:McmqVZna02xrTC404DBzkLADtdsKt4}}AzGG]A2lFol00^dFBwumYwEFSH09xNfvff{t01iHZl${WMv@#TfC)\u003c:=0n[g=vfg3w010pHBwMy^wO#O\u003c02u$ioLO0Vvj#Ijz.CZpy?km@vrufA3\u003c78zx:T@10+}-o9bn]9vj#tkfg6![w[u0]wkvt\u0026Acln3BAg@3z3HbU0rr%KvrM6jx(tT]x(4uRB-.OBBw)p4wNPAX0=w2s26s=Mx(4tY01ZLcoLO0Vvj#tkfgGU(wJHq4z#$1!0x7110rrYWoLO0Vvj#tkfgGU(wJItw3\u0026?)YBp57/0^aIz8yOo]vrM6jx(tU2B-.OBBw)p4wNPBqnHWWG04[s%3iC5CCMv^EA+eV\u00263\u003c7.RdHDkQ0^:}F1:t03By+EM2pJ!ynL7vi3\u003c7?UEHlc[0!gjJ1.hv!B7C:YFDdtg0=n0\u003c0rrNqwmORYAbY\u0026eB8$]60rr@+oLO0Vvj#C9zF7R4xMw3nvpB4:j1jhs0!ZSe3iA)5H5?nYv@c78wKQGUA^n5{HYx7n0-GeS3iBccF=!b0kw*MJ!\u003clhoYl]rb0rrvyvRPR0wO?CF6\u003e.MaDs3", "ln": 12412 }, { "b": "vSMTavGuDkByxi5wPN}M2xjM[l$7gC159M6+(X}lOtMEvsC!{o01-)NC404DBzkLAl2}0OD2\u003ch(P8!{1v@DsipI9HkzF9IY00\u003c#Slp\u003c-$ts5-1P-Q}}0?YQ\u00260rrHxy**%$wk3MVC5N\u0026\u003eR2?np00ik01aKR0=\u0026V^[YJ24S23M/-01B0\u003cADlm\u003eD3r23y!5jv01idlxj2%!zaF1]k(*@(nL8Yoy**v?Bo8vDv@l6SC4$E!00WEPBwcm-0rrstwQcS", "ln": 13207 }, { "b": "0001FuDzZs02xrTC404DBzkLADtdsKnP5cRvru732lIKB0\u003e!N/0rryDwPQHYAclmh0(1!q3iE)xZYsAQygho]fkktTlv0V:l2}0OC#5N8Acln3BAg@3z3HcV3iF9Bqul+6w[=c%B7/b}3\u003caxF\u00260GL00(+lv2wF6/y*?A%3\u003caGKdHDl\u003c0)7Dy3t%A^wogsWAclmh0)pP43iE)x+NaA?0!gjJ17=vX3\u003ca-Pfa4=]0)*@F3V{qND30Q-A=LPl0rrlJdo/aE0[4e03iF9D!bYK-z!:Jxvqf7{B.\u003e(ouU:.0yf#a20rrEEwPJ0gBv*N=z2\u003cRNoLO0Vvj#+Bx(2CGx(CZ%zF0Y[By/FO0rr^wB6\u0026u(wnkE?w[#K2uUBX7AD}M+a53ATC404rz.BC5By^:UA::k?B-.OBBw)p4wNPBq0rrvdhCE\u003c{g!dMD3UBA^yhWW0z^N0@0rrvCx)Kt?BAdxZ3#g6bnOy$lDp8T]w=\u0026}?1D-/5ht6Dw\u003c9vl31h95T!Dl^^l=Pici0[(6Yu=x4N3D/{Zuylf(Yma/PtfT4N^luL(v\u003eewV*BfO\u003e8L+\u003eG}^)[Q2.\u0026d(asX", "ln": 13495 }, { "b": "QQ7jc}v0uH02#pB0S@o204nflNY2qpO-^U.)s*!-RJfYyOA(Yz(79B]LbdccIrpqa\u003eE(=uGT.o?@S906wPq\u003c3y\u0026Z0!00q*205BYT0rsRR\u0026\u0026!QlP}p.fHvf\u003eI).uD[V4Ia]U\u0026@iO)6\u0026quUZ#hoI%(Lm)UN+dFUSLN0$keM02#pB0S@Pb051=tI\u003ePM\u003eX-ej1\u003cHq?^My6h*SdKh-QumJv(A#SiGphbqI@xLO)T*zSGp}qlKQ83]0rsIK\u003eB8", "ln": 14426 }, { "b": "c}[w:C404rz.BN]y?kWSoLO0Vvj#C9zF7R0A=kD0B8%V\u003cx(4r\u003eAWjK]wnc6}v@%^v10vW?3igCoa]}VMA+e=}A+e:5nP5G\u0026Bo8wac}[w:C404uvqYZhp\u0026ZF:wPI]VB.LV5wPx4]wN]H}wN/*zdnjF+C404uvqYZhp\u0026ZF:wPI]VB.LV5wPx\u003cv10^%{3igIqciDqqQws(\u003cgZrffGw?V\u0026)U(?FO8YG(\u0026jaK9MZ)2\u003cO:IGw^.s+2VF-o[\u003e:eg9H[9)(S)XxpJj!8VP:g-H0rrylAbYxawk)EQ11KD%3igCoecb.XA+e=}A+e:5pJZ+#B-X2]e^0yb01x2-0rr^NwN]H}wN/*JA=M8sq/)4\u003evqM2B9vL8uoLO0Vvj#C9zF7R0A=kD0B8%V\u003cx(4r\u003eAYTWif-%fr01x2^0rrpAByxii0rr\u0026.dnjF+C404uvqYZhp\u0026ZF:wPI]O3\u003ceu?hvoA[12*kX5O+-$vj#C9zF7R0A=kD0B8}M*iro9ZAa@?-00sR#n^\u003e!-13u[)iS?IC09xJ\u003eOse\u0026AUh(:L\u003cHH=xJ!MO\u003cV*a#X\u0026!@SSOVIpWQu5I\u003c\u003cHS1^KfN/zNcIhk\u0026!%=1O@AcrP5^8+\u003cHZPqKf^@BNcIe/\u0026S", "ln": 14999 }, { "b": "uV/\u003c}CW{*P1B9THCMv^NvQTs?hz^^tzGGDmBotFq\u003cP2F:%nSaPm}4wX000000001l1][S5%gH)(dffzQxjVfMwN/T?wPv!K94imfygho]flIwJy+Fa-B7El^bT=iNz!9B1i$8kQ1l{i[5^dC200V$Bv@C)?0rr(-oLO0Vvj#C9zF7R3BAh8kxfdLDljr$-1muG@5cIw403M8=C404wx(tUmxKL}5wPPO7Byx5$vrb)CxKL}5wPR$#1mVx(1YXI\u003euPn5^8CB)OC404wx(tUmxKL}5wPPN)xKL}5wPQ0x1m(S!2)o-2]-k4mc%G2iygho]fk+GxfjOW7A=U/lfgfzYA=U/li@", "ln": 19004 }, { "b": "1]f\u003c*cD{fX+(%JEJHu@{8B1yt}9=@95TDP7L(PoyAYmx70rr^FvrM6jy*?i]fgfzYA:-E1wPw1Us]!QbwnbW\u003cBo8vBc{{MPnEL-b1yhuqtlFmk00WmJzB5z\u00260rr^Hw(JFKs6eBluS7YtA9(QTraM7g33g3cA:@VLwoXaP3vbAXzeI%MuRB/c00^WQA.gv:z2\u003cRsyH}+[08@UO0%3i+/Alcv@gs7zD\u003e#+-04N63Jo3Ok\u003e+%^nM9x.wNcRe?\u003cew49Ns$3[TjJ\u003c6NT\u003cvUUk", "ln": 20650 }, { "b": "3ao?g1y@kOwhT?c05W)]3+3amiT=9G4hxr!3.^RI84mw?1qInK6+aMV08amp1qIvX3ufyY08e0cWG6ufGBE%W%je4@WG6Ht07H3uWG6GfsP(tphcEx*hAzx!5e5lR06ApO84\u003cN=weL$^g=t%:5XX$)wcuB36bqg[1V^t1hwD@w6+^qwaq\u003e\u003ed6=vO#6/l^u6+.q%6+UE[g\u003eH(\u003cGCsJ=%kgA*gG+OfW/w+607H3c5e5rT06ApV85JDjhw)wHZ64%Y8dUSz6=KZ*iVw!L1y%zg6=-XybPdKo92PN@6=yx]9agPv7Z7M[6=y%#g\u003eH(\u003cGDg2\u0026%j$o!gG+OmW/w+607H3c5e5xV06Ap:86n@qhxS\u003eVZ64%Yay)wN6^pi[iWaU:bnzBra!!@Z86P!u86n$@ayC{eu]e-y1qJc@aAgZBwrG@Cbls.x*Q^CwsS5A)07a9]mPQDsWG6GfsP]BEiWLZ\u003e1gwh6hyxv?WG6bbwecF5hyMfqhcyUxW/xt/dfzET6!f}DQ5VRWdh:Dn6^)x7dQYW+oC]eW6!f}CAa39OoK%r{09ifOdGMEE!!]{B09Sr72d\u003c\u003c)s*[w?iXqj35[B3Q87(3108bp787@t$pY$qzfjV%{Y8TY\u003e6!)8%q-VSnhzM156!(uZdh:\u0026Te^8[xu\u003e\u003eC8WG5#se^8[A6!:JlWG60MLc$u\u003esa\u0026sfR#Lr=f$46=WG5=#87=FkWG5AJh5Oo=1y@xcuO\u003cV088YbyhE(@3hA8vfYAHtQ12-dOitBGE03Ads6/^c?6/!8*h5e4+itBC\u003eu]iE#rFivkR#LU^05E:}ijw(OWG5=#87=FmWG5AJjq*l-g=vGmjIzK[wcuB3j@3n]1V!\u003cIhB50x6*wt(bPe/YkP8W0jP]dckWVz^joMx:6*lIzg\u003eH(\u003cGG]No%j+c=gG+OWW/w+607H3ceW+T.q=%vq05W]*05=(98ab3KWG5AJl(ww{g=v=um7@!m6?8T\u003emIOz91V/cQhB[MN6?j[$bPf8!neT!#6?8HBnmjm(l\u003cak}6?97Hg?q+HGH=cw%j+c=gG+O=W/w+607H3clLsjz06Aqn8a$5*hCs#YZ64%YoK{4Q6?#sAi./=np.=!wo}?Rk8bp]y8a$8EoKFPiu]e-]1qK-FoMjw@F%6b!pYWG]*z9C}1V/A%p6hwf0#jLu0ckWKgG+O\u003eW/w+607H3clLsG4qw\u0026vmWG5#V", "ln": 21960 }, { "b": "Ne^WDWG6bo0d{{B1P+?T1?1IHo!l\u0026v5DEu\u002618gHZ5d(tOkSe-W1EPk$6:b9@5tPpf0Ka9!0dUTYFe5g\u003cxKFmJx/VzE83NCKlPLB-05E:}2c[v8W/=Dgo-.D#0SXL!Y-", "ln": 129516 }, { "b": "2p)j.p^2^4y}H3G12Zn%1rscod\u003eIFs1-bX71HXq75d(tOuK7*a6:aUEWG5#j5v.\u003cIv3aAw1oLI3!H!0900066QYpw{3\u0026*w?@S0xd2lCXxeD?)I001?Q1PR0(e^bLZ!C", "ln": 129976 } ], "depth": 1, "facts": { "imp": [ [ "", "java/util/Arrays" ], [ "", "java/io/File" ], [ "", "java/io/FileOutputStream" ], [ "", "java/nio/charset/StandardCharsets" ], [ "", "java/nio/file/Path" ], [ "", "java/lang/invoke/MethodHandles" ], [ "", "java/lang/Integer" ], [ "", "java/lang/Character" ], [ "", "java/util/Base64" ], [ "", "java/util/zip/Inflater" ], [ "", "com/github/hui_mvwv$loadYre" ], [ "", "[C" ], [ "", "java/nio/file/attribute/FileAttribute" ], [ "", "java/io/IOException" ], [ "", "java/io/PrintStream" ], [ "", "java/util/Base64$Decoder" ], [ "", "[B" ], [ "", "java/io/ByteArrayOutputStream" ], [ "", "java/lang/System" ], [ "", "java/util/List" ], [ "", "java/nio/file/Files" ], [ "", "java/util/zip/ZipEntry" ], [ "", "java/lang/ProcessBuilder$Redirect" ], [ "", "java/lang/ProcessBuilder" ], [ "", "java/lang/invoke/MethodHandles$Lookup" ], [ "", "java/lang/Exception" ], [ "", "java/lang/Class" ], [ "", "java/util/ArrayList" ], [ "", "java/lang/String" ], [ "", "java/lang/Process" ], [ "", "com/github/hui_mvwv" ], [ "", "[Ljava/lang/String;" ], [ "", "java/lang/Object" ], [ "", "java/lang/InterruptedException" ], [ "", "java/lang/Thread" ], [ "", "java/lang/Throwable" ], [ "", "java/lang/StringBuilder" ], [ "", "java/util/zip/ZipInputStream" ], [ "", "java/io/ByteArrayInputStream" ], [ "", "java/util/Map" ], [ "", "java/nio/file/LinkOption" ], [ "", "java/io/BufferedOutputStream" ], [ "java/io/File", "java/io/File.\u003cinit\u003e" ], [ "java/io/File", "\u003cinit\u003e" ], [ "java/util/zip/ZipEntry", "java/util/zip/ZipEntry.getName" ], [ "java/util/zip/ZipEntry", "getName" ], [ "java/util/zip/Inflater", "java/util/zip/Inflater.finished" ], [ "java/util/zip/Inflater", "finished" ], [ "com/github/JFU_adW2MG", "com/github/JFU_adW2MG.xyllwk_vrg_inb" ], [ "com/github/JFU_adW2MG", "xyllwk_vrg_inb" ], [ "java/lang/String", "java/lang/String.\u003cinit\u003e" ], [ "java/lang/String", "\u003cinit\u003e" ], [ "java/util/Base64", "java/util/Base64.getDecoder" ], [ "java/util/Base64", "getDecoder" ], [ "com/github/JFU_adW2MG", "com/github/JFU_adW2MG.RYqBgFLJOcf" ], [ "com/github/JFU_adW2MG", "RYqBgFLJOcf" ], [ "com/github/JFU_adW2MG", "com/github/JFU_adW2MG.uizdbZ1SA" ], [ "com/github/JFU_adW2MG", "uizdbZ1SA" ], [ "com/github/JFU_adW2MG", "com/github/JFU_adW2MG.vbre_uwkyxf" ], [ "com/github/JFU_adW2MG", "vbre_uwkyxf" ], [ "java/lang/System", "java/lang/System.currentTimeMillis" ], [ "java/lang/System", "currentTimeMillis" ], [ "com/github/JFU_adW2MG", "com/github/JFU_adW2MG.mu_ueqc_wcdcc_pn" ], [ "com/github/JFU_adW2MG", "mu_ueqc_wcdcc_pn" ], [ "java/util/zip/Inflater", "java/util/zip/Inflater.setInput" ], [ "java/util/zip/Inflater", "setInput" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.directory" ], [ "java/lang/ProcessBuilder", "directory" ], [ "com/github/hui_mvwv", "com/github/hui_mvwv.bbtyn" ], [ "com/github/hui_mvwv", "bbtyn" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.start" ], [ "java/lang/ProcessBuilder", "start" ], [ "java/lang/String", "java/lang/String.isEmpty" ], [ "java/lang/String", "isEmpty" ], [ "java/lang/ProcessBuilder$Redirect", "java/lang/ProcessBuilder$Redirect.appendTo" ], [ "java/lang/ProcessBuilder$Redirect", "appendTo" ], [ "java/nio/file/Path", "java/nio/file/Path.getParent" ], [ "java/nio/file/Path", "getParent" ], [ "com/github/JFU_adW2MG", "com/github/JFU_adW2MG.vuxgp6" ], [ "com/github/JFU_adW2MG", "vuxgp6" ], [ "java/util/ArrayList", "java/util/ArrayList.\u003cinit\u003e" ], [ "java/util/ArrayList", "\u003cinit\u003e" ], [ "java/lang/Process", "java/lang/Process.pid" ], [ "java/lang/Process", "pid" ], [ "java/lang/Integer", "java/lang/Integer.valueOf" ], [ "java/lang/Integer", "valueOf" ], [ "com/github/JFU_adW2MG", "com/github/JFU_adW2MG.parseEpigv" ], [ "com/github/JFU_adW2MG", "parseEpigv" ], [ "com/github/JFU_adW2MG", "com/github/JFU_adW2MG.wyzo5" ], [ "com/github/JFU_adW2MG", "wyzo5" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.toByteArray" ], [ "java/io/ByteArrayOutputStream", "toByteArray" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectInput" ], [ "java/lang/ProcessBuilder", "redirectInput" ], [ "java/util/zip/Inflater", "java/util/zip/Inflater.inflate" ], [ "java/util/zip/Inflater", "inflate" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.write" ], [ "java/io/ByteArrayOutputStream", "write" ], [ "com/github/JFU_adW2MG", "com/github/JFU_adW2MG.tqmsIdx" ], [ "com/github/JFU_adW2MG", "tqmsIdx" ], [ "java/lang/Throwable", "java/lang/Throwable.addSuppressed" ], [ "java/lang/Throwable", "addSuppressed" ], [ "java/lang/System", "java/lang/System.arraycopy" ], [ "java/lang/System", "arraycopy" ], [ "java/util/zip/ZipInputStream", "java/util/zip/ZipInputStream.getNextEntry" ], [ "java/util/zip/ZipInputStream", "getNextEntry" ], [ "java/nio/file/Path", "java/nio/file/Path.toFile" ], [ "java/nio/file/Path", "toFile" ], [ "com/github/JFU_adW2MG", "com/github/JFU_adW2MG.pUNyqfs1" ], [ "com/github/JFU_adW2MG", "pUNyqfs1" ], [ "java/lang/Object", "java/lang/Object.getClass" ], [ "java/lang/Object", "getClass" ], [ "com/github/hui_mvwv$loadYre", "com/github/hui_mvwv$loadYre.body" ], [ "com/github/hui_mvwv$loadYre", "body" ], [ "com/github/JFU_adW2MG", "com/github/JFU_adW2MG.wTjEQ5Y" ], [ "com/github/JFU_adW2MG", "wTjEQ5Y" ], [ "java/io/PrintStream", "java/io/PrintStream.println" ], [ "java/io/PrintStream", "println" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/io/FileOutputStream", "java/io/FileOutputStream.\u003cinit\u003e" ], [ "java/io/FileOutputStream", "\u003cinit\u003e" ], [ "java/util/Arrays", "java/util/Arrays.copyOfRange" ], [ "java/util/Arrays", "copyOfRange" ], [ "java/util/Map", "java/util/Map.of" ], [ "java/util/Map", "of" ], [ "com/github/JFU_adW2MG", "com/github/JFU_adW2MG.runDetached" ], [ "com/github/JFU_adW2MG", "runDetached" ], [ "java/io/ByteArrayInputStream", "java/io/ByteArrayInputStream.\u003cinit\u003e" ], [ "java/io/ByteArrayInputStream", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.substring" ], [ "java/lang/String", "substring" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectErrorStream" ], [ "java/lang/ProcessBuilder", "redirectErrorStream" ], [ "java/util/Map", "java/util/Map.of" ], [ "java/util/Map", "of" ], [ "java/util/zip/Inflater", "java/util/zip/Inflater.needsInput" ], [ "java/util/zip/Inflater", "needsInput" ], [ "java/lang/Thread", "java/lang/Thread.sleep" ], [ "java/lang/Thread", "sleep" ], [ "java/lang/System", "java/lang/System.getenv" ], [ "java/lang/System", "getenv" ], [ "java/lang/String", "java/lang/String.format" ], [ "java/lang/String", "format" ], [ "com/github/JFU_adW2MG", "com/github/JFU_adW2MG.qhthjAaymarmGjCxkc" ], [ "com/github/JFU_adW2MG", "qhthjAaymarmGjCxkc" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.toString" ], [ "java/lang/StringBuilder", "toString" ], [ "com/github/JFU_adW2MG", "com/github/JFU_adW2MG.AXWD_J2v" ], [ "com/github/JFU_adW2MG", "AXWD_J2v" ], [ "com/github/JFU_adW2MG", "com/github/JFU_adW2MG.MdalwfoiOz" ], [ "com/github/JFU_adW2MG", "MdalwfoiOz" ], [ "com/github/hui_mvwv$loadYre", "com/github/hui_mvwv$loadYre.bodyString" ], [ "com/github/hui_mvwv$loadYre", "bodyString" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectOutput" ], [ "java/lang/ProcessBuilder", "redirectOutput" ], [ "com/github/JFU_adW2MG", "com/github/JFU_adW2MG.roxp_ldmf_hqxj_rb" ], [ "com/github/JFU_adW2MG", "roxp_ldmf_hqxj_rb" ], [ "java/util/zip/Inflater", "java/util/zip/Inflater.end" ], [ "java/util/zip/Inflater", "end" ], [ "java/lang/Integer", "java/lang/Integer.parseInt" ], [ "java/lang/Integer", "parseInt" ], [ "com/github/JFU_adW2MG", "com/github/JFU_adW2MG.vrbpQltr" ], [ "com/github/JFU_adW2MG", "vrbpQltr" ], [ "java/util/zip/ZipInputStream", "java/util/zip/ZipInputStream.read" ], [ "java/util/zip/ZipInputStream", "read" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.\u003cinit\u003e" ], [ "java/lang/ProcessBuilder", "\u003cinit\u003e" ], [ "java/lang/System", "java/lang/System.out" ], [ "java/lang/System", "out" ], [ "com/github/JFU_adW2MG", "com/github/JFU_adW2MG.oeIvGigbbm" ], [ "com/github/JFU_adW2MG", "oeIvGigbbm" ], [ "java/util/zip/Inflater", "java/util/zip/Inflater.\u003cinit\u003e" ], [ "java/util/zip/Inflater", "\u003cinit\u003e" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "com/github/JFU_adW2MG", "com/github/JFU_adW2MG.objIeir" ], [ "com/github/JFU_adW2MG", "objIeir" ], [ "java/util/Base64$Decoder", "java/util/Base64$Decoder.decode" ], [ "java/util/Base64$Decoder", "decode" ], [ "java/util/List", "java/util/List.add" ], [ "java/util/List", "add" ], [ "java/lang/String", "java/lang/String.startsWith" ], [ "java/lang/String", "startsWith" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/util/zip/ZipEntry", "java/util/zip/ZipEntry.isDirectory" ], [ "java/util/zip/ZipEntry", "isDirectory" ], [ "java/io/BufferedOutputStream", "java/io/BufferedOutputStream.\u003cinit\u003e" ], [ "java/io/BufferedOutputStream", "\u003cinit\u003e" ], [ "java/nio/file/Path", "java/nio/file/Path.of" ], [ "java/nio/file/Path", "of" ], [ "java/nio/file/Files", "java/nio/file/Files.readString" ], [ "java/nio/file/Files", "readString" ], [ "java/lang/Exception", "java/lang/Exception.getMessage" ], [ "java/lang/Exception", "getMessage" ], [ "com/github/JFU_adW2MG", "com/github/JFU_adW2MG.nSabN" ], [ "com/github/JFU_adW2MG", "nSabN" ], [ "com/github/JFU_adW2MG", "com/github/JFU_adW2MG.valDpdw" ], [ "com/github/JFU_adW2MG", "valDpdw" ], [ "com/github/hui_mvwv$loadYre", "com/github/hui_mvwv$loadYre.statusCode" ], [ "com/github/hui_mvwv$loadYre", "statusCode" ], [ "com/github/hui_mvwv", "com/github/hui_mvwv.NRKkX_uqvkCK" ], [ "com/github/hui_mvwv", "NRKkX_uqvkCK" ], [ "com/github/JFU_adW2MG", "com/github/JFU_adW2MG.jlagsdLexvp" ], [ "com/github/JFU_adW2MG", "jlagsdLexvp" ], [ "com/github/JFU_adW2MG", "com/github/JFU_adW2MG.uThugxvHHgq" ], [ "com/github/JFU_adW2MG", "uThugxvHHgq" ], [ "java/util/zip/ZipInputStream", "java/util/zip/ZipInputStream.close" ], [ "java/util/zip/ZipInputStream", "close" ], [ "java/lang/String", "java/lang/String.length" ], [ "java/lang/String", "length" ], [ "java/util/zip/ZipInputStream", "java/util/zip/ZipInputStream.closeEntry" ], [ "java/util/zip/ZipInputStream", "closeEntry" ], [ "java/lang/Character", "java/lang/Character.digit" ], [ "java/lang/Character", "digit" ], [ "com/github/JFU_adW2MG", "com/github/JFU_adW2MG.bvxgpRef" ], [ "com/github/JFU_adW2MG", "bvxgpRef" ], [ "java/lang/String", "java/lang/String.toCharArray" ], [ "java/lang/String", "toCharArray" ], [ "java/nio/file/Files", "java/nio/file/Files.exists" ], [ "java/nio/file/Files", "exists" ], [ "com/github/hui_mvwv", "com/github/hui_mvwv.get" ], [ "com/github/hui_mvwv", "get" ], [ "com/github/JFU_adW2MG", "com/github/JFU_adW2MG.bufCmsmk" ], [ "com/github/JFU_adW2MG", "bufCmsmk" ], [ "java/lang/Class", "java/lang/Class.getSimpleName" ], [ "java/lang/Class", "getSimpleName" ], [ "java/io/BufferedOutputStream", "java/io/BufferedOutputStream.close" ], [ "java/io/BufferedOutputStream", "close" ], [ "java/util/zip/ZipInputStream", "java/util/zip/ZipInputStream.\u003cinit\u003e" ], [ "java/util/zip/ZipInputStream", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.substring" ], [ "java/lang/String", "substring" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ], [ "com/github/JFU_adW2MG", "com/github/JFU_adW2MG.pushShq" ], [ "com/github/JFU_adW2MG", "pushShq" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/nio/file/Path", "java/nio/file/Path.resolve" ], [ "java/nio/file/Path", "resolve" ], [ "com/github/JFU_adW2MG", "com/github/JFU_adW2MG.nmrgwk_dvf" ], [ "com/github/JFU_adW2MG", "nmrgwk_dvf" ], [ "java/lang/String", "java/lang/String.equals" ], [ "java/lang/String", "equals" ], [ "java/nio/file/Files", "java/nio/file/Files.createDirectories" ], [ "java/nio/file/Files", "createDirectories" ], [ "java/lang/ProcessBuilder$Redirect", "java/lang/ProcessBuilder$Redirect.from" ], [ "java/lang/ProcessBuilder$Redirect", "from" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.\u003cinit\u003e" ], [ "java/io/ByteArrayOutputStream", "\u003cinit\u003e" ], [ "com/github/JFU_adW2MG", "com/github/JFU_adW2MG.sba_unsgw_cojgbq" ], [ "com/github/JFU_adW2MG", "sba_unsgw_cojgbq" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "com/github/JFU_adW2MG", "com/github/JFU_adW2MG.\u003cinit\u003e" ], [ "com/github/JFU_adW2MG", "\u003cinit\u003e" ], [ "com/github/JFU_adW2MG", "com/github/JFU_adW2MG.afpkhm6" ], [ "com/github/JFU_adW2MG", "afpkhm6" ], [ "java/nio/file/Path", "java/nio/file/Path.toString" ], [ "java/nio/file/Path", "toString" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.indexOf" ], [ "java/lang/String", "indexOf" ], [ "java/lang/String", "java/lang/String.indexOf" ], [ "java/lang/String", "indexOf" ], [ "com/github/JFU_adW2MG", "com/github/JFU_adW2MG.brNnpfrpbUkuWaef" ], [ "com/github/JFU_adW2MG", "brNnpfrpbUkuWaef" ], [ "java/nio/charset/StandardCharsets", "java/nio/charset/StandardCharsets.UTF_8" ], [ "java/nio/charset/StandardCharsets", "UTF_8" ], [ "java/io/BufferedOutputStream", "java/io/BufferedOutputStream.write" ], [ "java/io/BufferedOutputStream", "write" ], [ "java/lang/String", "java/lang/String.charAt" ], [ "java/lang/String", "charAt" ], [ "com/github/JFU_adW2MG", "com/github/JFU_adW2MG.zZgmcbf" ], [ "com/github/JFU_adW2MG", "zZgmcbf" ], [ "java/lang/System", "java/lang/System.getProperty" ], [ "java/lang/System", "getProperty" ], [ "java/lang/String", "java/lang/String.\u003cinit\u003e" ], [ "java/lang/String", "\u003cinit\u003e" ] ], "metrics": { "file": { "size": 133415, "entropy": 4.64 }, "class": { "major_version": 65, "interface_count": 0, "method_ref_count": 120, "constant_pool_size": 1193, "external_class_count": 42 }, "binary": { "peak_region_bytes": 17408, "peak_region_entropy": 7.01 }, "imports": { "count": 162 }, "functions": { "count": 20 } } }, "id": 2, "mol": "O₃(AlAs₂I)H₅(Db₄F₂OsPo₂Ti)", "path": "/data/samples/incoming/forager/bad/sha256/bazaar/DonutSMP-Dupe-Mod.jar!!com/github/JFU_adW2MG.class", "pid": 0, "risk": 13, "sha": "e3c7d41d5d18b947153b2ddf1a9b0ebbfc25e57edcaa2a72a6e97990038a32fc", "size": 133415, "traits": [ { "id": "micro-behaviors/communications/proxy/tunnel::byte-output-stream", "atk": "T1090", "mbc": "C0003", "conf": 0.5, "crit": 3, "desc": "Java ByteArrayOutputStream usage", "spans": [ [ 670, 21 ], [ 12845, 21 ], [ 13567, 21 ], [ 13692, 21 ], [ 13809, 21 ] ] }, { "id": "micro-behaviors/data/archive/extract/zip::jvm-zip-entry-iteration-bytecode", "conf": 0.92, "crit": 3, "desc": "JVM iterates ZIP archive entries", "spans": [ [ 12476, 41 ] ] }, { "id": "micro-behaviors/data/archive/extract/zip::jvm-zip-entry-read-bytecode", "conf": 0.9, "crit": 3, "desc": "JVM reads ZIP archive entry data", "spans": [ [ 12820, 33 ] ] }, { "id": "micro-behaviors/data/buffer/transfer::bytearrayinputstream-ref", "conf": 0.88, "crit": 3, "desc": "Java ByteArrayInputStream class" }, { "id": "micro-behaviors/data/buffer/transfer::bytearrayoutputstream-ref", "conf": 0.88, "crit": 3, "desc": "Java ByteArrayOutputStream class", "spans": [ [ 13559, 29 ] ] }, { "id": "micro-behaviors/data/decode/base64::java-base64-decode-bytecode-call", "conf": 0.96, "crit": 3, "desc": "Java Base64 decode call", "spans": [ [ 19122, 31 ] ] }, { "id": "micro-behaviors/data/decode/base64::java-base64-decoder-bytecode-call", "conf": 0.94, "crit": 3, "desc": "Java Base64 decoder accessor call", "spans": [ [ 19068, 27 ] ] }, { "id": "micro-behaviors/data/decode/base64::java-base64-decoder-class", "conf": 0.92, "crit": 3, "desc": "JVM Base64 decoder class reference", "spans": [ [ 210, 24 ], [ 19081, 28 ] ] }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method", "spans": [ [ 1137, 8 ] ] }, { "id": "micro-behaviors/fs/read/file/handle::jvm-io-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM File API class reference" }, { "id": "micro-behaviors/fs/read/file/handle::jvm-nio-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM NIO file API reference" }, { "id": "micro-behaviors/fs/write/file/handle::jvm-fileoutputstream-bytecode", "conf": 0.86, "crit": 3, "desc": "JVM imports FileOutputStream class", "spans": [ [ 12683, 24 ] ] }, { "id": "micro-behaviors/os/env/gate::jvm-opaque-environment-key", "conf": 0.94, "crit": 1, "desc": "JVM class has generated gate value" }, { "id": "micro-behaviors/os/env/gate::jvm-string-equals-import", "conf": 0.94, "crit": 1, "desc": "JVM class imports String equals", "spans": [ [ 14490, 0 ] ] }, { "id": "micro-behaviors/os/env/gate::jvm-system-getenv-import", "conf": 0.94, "crit": 1, "desc": "JVM class imports System getenv", "spans": [ [ 5561, 0 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.88, "crit": 3, "desc": "Java bytecode ProcessBuilder reference", "spans": [ [ 130, 71 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-init-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.92, "crit": 3, "desc": "Java bytecode ProcessBuilder constructor", "spans": [ [ 662, 31 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.95, "crit": 3, "desc": "Java bytecode ProcessBuilder start", "spans": [ [ 15330, 30 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-errors", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder merges standard error", "spans": [ [ 15266, 44 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-input", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard input", "spans": [ [ 15063, 38 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-output", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard output", "spans": [ [ 15239, 39 ] ] }, { "id": "micro-behaviors/time/sleep/interval::java-thread-sleep-bytecode", "conf": 0.9, "crit": 3, "desc": "Java bytecode thread sleep", "spans": [ [ 12139, 22 ] ] }, { "id": "objectives/anti-analysis/timing/evasion::kotlin-thread-sleep-check", "atk": "T1497.003", "conf": 0.94, "crit": 3, "desc": "Kotlin Thread.sleep call", "spans": [ [ 12149, 12 ] ] }, { "id": "objectives/anti-static/obfuscation/string/control-prefix::java-character-digit-bytecode", "atk": "T1027", "mbc": "F0001", "conf": 0.9, "crit": 3, "desc": "Java bytecode calls Character.digit", "spans": [ [ 20714, 25 ] ] }, { "id": "objectives/anti-static/obfuscation/string/control-prefix::java-control-prefixed-long-string", "atk": "T1027", "mbc": "F0001", "conf": 0.92, "crit": 3, "desc": "Java string starts with control-length prefix" }, { "id": "objectives/anti-static/obfuscation/string/crypto::java-byte-range-copy", "atk": "T1027", "mbc": "F0001", "conf": 0.7, "crit": 3, "desc": "Java byte range copy", "spans": [ [ 13271, 11 ] ] }, { "id": "objectives/impact/dos/disk::jvm-two-backward-goto-branches", "atk": "T1499.001", "conf": 0.9, "crit": 3, "desc": "JVM repeated counter backedges", "spans": [ [ 22024, 8 ], [ 22124, 8 ], [ 22299, 8 ], [ 22403, 8 ], [ 22505, 8 ], [ 22589, 8 ], [ 22676, 8 ], [ 22780, 8 ] ] }, { "id": "well-known/malware/stealer/prefire-shard::prefire-family-literal", "atk": "T1528", "mbc": "B0006", "conf": 0.9, "crit": 1, "desc": "Prefire family name literal", "spans": [ [ 4056, 7 ] ] }, { "id": "micro-behaviors/data/archive/extract/zip::jvm-zip-entry-extraction-to-file", "conf": 0.96, "crit": 3, "desc": "JVM extracts ZIP entries to files", "uses": [ 1, 2, 11 ], "spans": [ [ 12476, 41 ], [ 12683, 24 ], [ 12820, 33 ] ] }, { "id": "micro-behaviors/data/decode/base64::java-base64-decoding-bytecode", "conf": 0.94, "crit": 3, "desc": "Java bytecode Base64 decoding", "uses": [ 5, 6 ], "spans": [ [ 19068, 27 ], [ 19122, 31 ] ] }, { "id": "micro-behaviors/os/env/gate::jvm-opaque-secret-environment-gate", "conf": 0.97, "crit": 3, "desc": "JVM compares opaque environment gate", "uses": [ 12, 13, 14 ], "spans": [ [ 5561, 6 ], [ 14490, 6 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.94, "crit": 3, "desc": "Java bytecode ProcessBuilder execution", "uses": [ 16, 17 ], "spans": [ [ 662, 31 ], [ 15330, 30 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirected-stdio", "conf": 0.96, "crit": 3, "desc": "Java ProcessBuilder redirects all standard streams", "uses": [ 18, 19, 20 ], "spans": [ [ 15063, 38 ], [ 15239, 39 ], [ 15266, 44 ] ] }, { "id": "micro-behaviors/process/create/spawn::child-process-creation-api", "atk": "T1106", "conf": 0.92, "crit": 3, "desc": "Starts a child process through a platform API", "uses": [ 31 ], "spans": [ [ 662, 31 ], [ 15330, 30 ] ] } ], "type": "java_class" }, { "ctx": [ { "b": "+kO#^0000+0L!Zo8!i/6fk20vxMW=qA^g@5yI^A}Aar{8uVG[22lj=901-)NC404uvqYZhpHX6Iv@}}Q0%5xzzE)]yw)]d?x\u003e80\u0026fjw*lfhlv}nP5l:x\u003c\u003e*(Ds.a400Jx67\u00260G5vj#+Bx(2B?vrl0rg:CIcv@C)?AT8NH0rrWCvrM6jB-.tlfg68*wI#vI00@Va2sSJuz!9B10rsoTvrM6jy*?i]fhMXcv}x.5luN0UwmY^bqE%xMA+e:52lkek02PDVC404uvqYZhp\u0026ZF:wPI]VB.LV5wPw1Q4GMLnqE%xMA+e:50rsAXvrM6jy*?i]fkkrEz!\u0026]qo\u003ewAWz!8yEzE^M{B0KB$z!\u003cGm2lktp03k(-C404uvqYZhx(n9jyH]d[wPRQ7wjQcDwnC*#2lkzr00Vbnz!\u003cGm0rrr^x(mTbj]\u003eS=c[eg902tLJ3ighe7Y:QBv}5CduPp!/vqf7?0rsclv@Diqxk8E3BZ^1ACWC2$zc}d0v@=x)A+YLP0rrKDzB[.WBzkf1x)Ks)xq2H%1a{b3jokA[ygho]fkL6mxd)j$A+eV\u00262lk?S02CUo40C/JwP6F6xh0OLy777^02C$x0STCQ1PP!G03Ve^C404uvqYZhx(n9jyH]d)vqPE:vngrPvp\u0026}TBz(hB2ll7K01iTPByw=\u0026v@#TfC(W]?c}[w:C404uvqYZhx(n9jyH]d[wPRQ7wjQcDwnC*#bUSb{yJTOToLO0Vvj#C9zF7R3BAh8kxfe!4vrM6jy*?i]fkkrEz!\u0026]qo\u003ewAWz!5", "ln": 0 }, { "b": "fkL6mxd)e9zF\u0026((y?kWp04!g65=.[if984?c}[w:C404uvqYZhqGV\u003e{vpB4:j1jhs02tL?3ihgGg64vUB97\u0026hBpnda02C$xaojn100)jGwQ5Aay?S[I4%8h]CuOA}CYds{vqo+50rsC{oLO0Vvj#C9zF7R3BAh8kxfdLoygho]fkL6mxd)h9A+PA7i@]rZA@#zRo\u0026}F$W.]PShn\u00260*1dl@7B].NOygho]fkL6mxd)h9A+PA72ll%?000o8k)6:pY*h-eu0X3z-4)nF0rr{JvrI", "ln": 803 }, { "b": "rTX%z09GTem/VY[00V\u003eJAaJ]$0rs8/lN+YzvrM6jy*?i]fh($kx(mMIB.LV5wPx\u003cv09/If3iiM@ui73iBz\u003e91A+PA70rr/ZdnjF+C404uvqYZhq/)4]zF83t0ak!n3iiM@vGuDXc}[w:C404uvqYZhq/)4]zF83WoLO0Vvj#C9zF7R3BAh8kxf{-Py?d9$i$89]0aVApm/W9303yNuZtVR^)7GdLXr2)IR0\u003egr\u003e={3cNtZsrX9/072NyAy", "ln": 1180 }, { "b": "C404uvqYZhmr\u0026rNAcb/jzu*f10@@{{pxHOIUD[xk:tVEZghI{N6Fs6gKS+yu1^4$m[F\u0026vVa]}VQv%8*jwO#P?x(dAQx(4Q1A@=myc[d:%0f)LI3ij#AMJm75zE)]yze0)0v@=0\u0026Bt4cuvrlG%gCHM*0gr\u0026/3VfD%xM4A*f/p*y0rs5!dnjR\u003cBt4GBzE)r#vp\u003cQmv@bN{B6*ZTfGPWyN/F@=0gA[U0rrHAwPRQ7wm45Gg=LHo8Z)dezE)]yze0)0v@=0\u0026Bt4cuvrlG%gCQTC3\u0026([1PB7W/0hfz[7J9/afkUAvwN/:?w]]Xoy*?yauO:C\u003e2lpI101iTPBzbP6uOKC$gZ\u003cwX0auimQYvm)01iTPBzbP6uOKC$hvGO:0auimQYvv{01rZQBzbP6uO\u003cO#f/Gak5?2h5ygho]flIwJy+F^*nKLSG0ila33il\u003e4TPnziygho]flIwJy+F^*nKJ^-Ul\u003eol0aC%e0:wn40i#R9ec$TMPx.38-er-TV*SZH)1I7[XuUs^RTp{](vU2lQ35FE)$(!=GSa1yP9LC70rr\u003cAz/4dux([3hvLptyrBofBs29Gu2lqgk00u?Txaa^I0auimW/A@t01\u003c0!A^qd@wP7E+x)8).y?WO(0j@kt3imKnYA50TzE)]yw)]d?x\u003e80\u0026fkLMnwmY^mvq]{lmQV", "ln": 1928 }, { "b": "0lUYHW/vlC010pHBvp4:vqfP/0l$NM3imKn=Ja1JAb]J4x(W+=07[Ukygho]fkL6mxd)h9A+PA7j4%x$C404uvqYZhq/)4]zF848ygho]fkL6mxd)h9A+PA7j1i\u003crvrM6jy*?i]fh($kx(mMB3\u0026[VP^H2#-00", "ln": 2640 }, { "b": "A=U/lfh($3zE^f@wj73sA=U/lA%zZ90rrp6r7pjO0rs3iygho]fk+GxfjOW7A=U/lfgfzYA=U/li$8bJ0oKN/\u003cn!uz00)jGBv7m{wPE\u003eL9W\u003cY%vrM6jzFs2xv}Yp\u003eB7GCDlUG[GB7GCPdo/aE0o\u003cHG3iir\u003e(J3$}wO#0@wmX.Uq/)4]zF5$I7arxNdnjF+C404uvqYZhq/)4]zF83t0po^O3igti)/rzB)6?J7X0urYRTxw2)6:7QWXh#?ITDw1\u003cHHfgUBaZtPx0OG\u0026!Tz\u003cTdws-T(#vs)s?RJ2MTx50lCjI0rt:SH[0FeQVE]0\u003eaPrALEf+:UJ?ZE+^l=oI@pwb\u003ecQ-BIj\u0026}kF-So0\u003eaFj6Ld*p?F:e(x=7am2SO\u003cLz\u003ecR!-O%XSEL\u0026ooI4Hr7b0rtd-\u0026JoGDW5AwDX-6Dz\u0026JnB9W1N?3O8HlQ\u0026Jd^[Wt\u003cNePw=Vx\u0026Jd^[Wt\u003cNeU\u0026hEZ\u0026JnB9W36*hN*o2/0rs}X\u003eA@QpI?]Yl\u003caiJRIK\u0026}vSPPUh\u003cCP?WQ#N02\u003cbp86XqYO", "ln": 3089 }, { "b": "1NR}p)UFEwX321^QWs?V)UNC2WWuuJG6/qj)UNO6WWciHH6N/80rrTBvrM6jy*?i]fgfL:B8}M!b()#VxjVfYA=l5hv@#B6zBwzWvqfPW03S*uoLO0Vvj#Xkv%8*aBA]JoA=l5hv@#B6zBwzWvqfQv3\u0026}ZRc\u003c/#40vX3H9+]bbvj#Xkv%8*aBA]JoA=l5hv@#B6zBwzWvqfP:0v[fJ4qfl]lVlHDq/u/0v}tVv94imfygho]flpYmB-IhrC}RK6wmXXTB-H#6i$8cw0wjYWecdy802PDVC404BwN/\u003e6x([RNlVlHDq/u/0v}t(Cf-.mZxjVfUz!0i$x(v\u003e\u002601ZLcoLO0Vvj#IfBt3S(oGJT-gxxrt0wTWk0rrKyvrM6jzE)]yrz(G}0xg2V1:1V.qB{(?5gw#3ygho]fk+uyfi7[wi$8cI0xHL*h##8w03\u0026%^ygho]fk+uyfi7[wj1i\u003crvrM6jzFs2xw[=6)fhM80xGDR66-*D90lCm90rtH})1pCWL7J4VO9l3d)wLYPSo{:F\u003c*Q9jY%)75IrzTp)1g=", "ln": 4429 }, { "b": "c}[w:C404rz.BN]y?kWSoLO0Vvj#C9zF7R0A=kD0B8%V\u003cx(4r\u003eAWjK]wnc6}v@%^v0B=7t3igIowb#VtA+e=}A+e:5nP5G\u0026Bo8wac}[w:C404uvqYZhp\u0026ZF:wPI]VB.LV5wPx4]wN]H}wN/*zdnjF+C404uvqYZhp\u0026ZF:wPI]VB.LV5wPx\u003cv0ChvB3igOqxAn8*2Jz[L)Wy-NTCs#()Zn\u003eUH]6gdMeY07)WG71T*=D7)ZehCIhQC\u003cYw*39)WGHdT!k}2y5[qtA+frgy\u003c6v\u003c04ol?ygho]fkH", "ln": 5479 }, { "b": "0D4]r26s=Mx(4tY01ZLcoLO0Vvj#tkfgGU(wJHq3z#\u003c}^0lCmZ0rrylAbYxawk)EQ0DXuL3igIoBPzELA+e=}A+e:5pJZ+#B-X2)Cl8s-01P9P0rr^NwN]H}wN/*JA=M8sq/)4\u003evqM2B9vL8uoLO0Vvj#C9zF7R0A=kD0B8%V\u003cx(4r\u003eAYTWgDi5v101P9T0rrBpx(W={Bz(hB0rsO$oLO0Vvj#tkfgGU(wJItmygho]fkL6mxd)84z!0v1B3+1-y?d9$i$8ds0E\u003eBR4/}gY02l[hoLO0Vvj#C9zF7R0A=kD0B8%zK05K.d3igOqG8\u003e%l3H1)R)1\u0026y", "ln": 5749 }, { "b": "2MY}^02t!0JecO%I0fXZ\u0026jB:dUB1y:GYw2(2MZ1/02PDVC404wx(tUpx(4ulpJf(.pJgz\u0026z/b^XK]UK\u003cCxdztwM9X\u003ex(mL:09}0Dygho]fk+Gxfj[{mwIl\u003e*Bz9:fygho]fkL6mxd(R=vrbpTADL\u0026gv}v-aoLO0Vvj#Ijz.CZpy?km}AaJ].Acb/jzAxpvygho]fk+Gxfj[{mwIl\u003e*Bz9-A0H9RI3iqaEMh{%@Ab]VgBw)o\u0026v@24:vpJ\u003cS0HJ\u003c63il1=Ne)o\u003eB7]@ig64v)oM1z", "ln": 6209 }, { "b": "2ETRm1y@kMwhT+a07Qfb3ax[siTL%E3L:3:38dzG844k^1qIhI6:[AT08%*v1qIpV2YKgW091MkWG6VoGBm*U%je4{WG6*C0a]rg0R4YNxTN[miU02qZ64%:4QR4J4\u0026C\u003e\u003e6+s*TwhT#l5wefc5D:{76+Rk)Q5VqN5FU]@4IYQk84Ew)6+Rk(A9$IOL2WeF0Jk$PY8U9084\u003csTyQKjPseM7=ed#*d08bA*85ilghwNeBZ64%Y7gYrt6=jH^iV4@S8wKe97OQ)P85K8b85in?7gm\u003c}u]e-o1qI*\u00267i0UrF%6b!8uD=o*z7Kq1V^Is7Y$S[0#hSZ0ct:LkV[%xW/yiL0a]rg0wb\u0026nB*.oziVG1S12I[R863u[weca}hxAOOYAHtr12.npaqC@(03\u0026B76^awl1qI}+6^c)v85@+]aqC]ou]iE#rFhE}R#LI-06\u003cW8agzk=WG6]vRVti$5{H+:oGByobFBp\u003e86-GBhy6d+Z7?]71y%zp6^ZG@iWK}!cLX0zc87wZ8737C86Y\u003ezg-mIMb]4^xbYEcFF%6b!cJQdB?[5\u003eNsS5M}0bG1yw(\u003e(gDkcR}aFF\u003cLee0lp08bB687Ju6weM\u003e7g=u\u003c4d.VSFwcuB3eeo.G1V!jqhzbZ%6!D6Vaq(:Ce/ubNe\u0026jB}6!y7L6!slhg\u003eH(\u003cGF0q6%kgA*kV[%RW/ygDY-ngr0#h3I0dN}S0e4YWw(\u003e(g3m([@WG6VoGARyO@CBf{0aSkk00063Yz}{mgxnr)04O462lj/g06*I:0000000000000000000000000000000000000000000000000000001000iS@@rYjfB4NV2lm0]07Nm]p5$v}0000000000000000000000000000000000000000", "ln": 7395 }, { "b": "08bA%86MY%weMK$g=uJ}a?!WnwcuB3bnzDo1V^[hhyf7:6^GBMaq(Btb]E\u003cvb@uF.6^BCt6^vQ8g\u003eH(\u003cGE3U%%kgA*kV[%IW/yiL0a)8\u0026WG6[L?NizTiW+\u003c]12I[+87ri4wecL7hyYB\u003eYAHtD12..CeFP+f03\u0026Bj6!HpK1qJv[6!J/I87kR5eFPZNu]iE#rFh}8R#LG^d.C{CeeY@u87U\u003e8d.2F1Y8U9087-k%yQKjP86uo!w!K4g08bBb", "ln": 9438 } ], "depth": 1, "facts": { "imp": [ [ "", "net/fabricmc/api/ModInitializer" ], [ "", "java/nio/file/Files" ], [ "", "java/lang/Object" ], [ "", "java/security/ProtectionDomain" ], [ "", "net/fabricmc/loader/api/FabricLoader" ], [ "", "java/net/URI" ], [ "", "[J" ], [ "", "java/nio/file/LinkOption" ], [ "", "net/minecraft/class_310" ], [ "", "java/lang/invoke/LambdaMetafactory" ], [ "", "java/security/CodeSource" ], [ "", "java/lang/Exception" ], [ "", "java/lang/Integer" ], [ "", "java/util/UUID" ], [ "", "java/lang/String" ], [ "", "java/net/URL" ], [ "", "java/nio/file/Path" ], [ "", "java/util/Base64$Encoder" ], [ "", "java/lang/invoke/MethodHandles" ], [ "", "java/lang/StringBuilder" ], [ "", "[Ljava/lang/String;" ], [ "", "java/nio/charset/StandardCharsets" ], [ "", "java/io/File" ], [ "", "java/nio/file/OpenOption" ], [ "", "java/lang/System" ], [ "", "java/lang/invoke/MethodHandles$Lookup" ], [ "", "java/lang/Class" ], [ "", "java/nio/file/attribute/FileAttribute" ], [ "", "java/lang/ProcessBuilder$Redirect" ], [ "", "java/util/Base64" ], [ "", "net/minecraft/class_320" ], [ "", "com/github/JFU_adW2MG" ], [ "", "java/lang/ProcessBuilder" ], [ "", "[C" ], [ "", "java/lang/Thread" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectErrorStream" ], [ "java/lang/ProcessBuilder", "redirectErrorStream" ], [ "java/lang/System", "java/lang/System.getProperty" ], [ "java/lang/System", "getProperty" ], [ "java/lang/ProcessBuilder$Redirect", "java/lang/ProcessBuilder$Redirect.from" ], [ "java/lang/ProcessBuilder$Redirect", "from" ], [ "com/github/JFU_adW2MG", "com/github/JFU_adW2MG.krrycWeoRoivDolii" ], [ "com/github/JFU_adW2MG", "krrycWeoRoivDolii" ], [ "java/nio/file/Path", "java/nio/file/Path.toFile" ], [ "java/nio/file/Path", "toFile" ], [ "com/github/rx_ekm_mpcrl_rjp", "com/github/rx_ekm_mpcrl_rjp.sbiwZarxojRajps" ], [ "com/github/rx_ekm_mpcrl_rjp", "sbiwZarxojRajps" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectOutput" ], [ "java/lang/ProcessBuilder", "redirectOutput" ], [ "com/github/JFU_adW2MG", "com/github/JFU_adW2MG.\u003cinit\u003e" ], [ "com/github/JFU_adW2MG", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.charAt" ], [ "java/lang/String", "charAt" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.toString" ], [ "java/lang/StringBuilder", "toString" ], [ "com/github/rx_ekm_mpcrl_rjp", "com/github/rx_ekm_mpcrl_rjp.vZPeo6PgLyWj" ], [ "com/github/rx_ekm_mpcrl_rjp", "vZPeo6PgLyWj" ], [ "java/lang/Thread", "java/lang/Thread.\u003cinit\u003e" ], [ "java/lang/Thread", "\u003cinit\u003e" ], [ "java/util/Base64", "java/util/Base64.getEncoder" ], [ "java/util/Base64", "getEncoder" ], [ "java/lang/Class", "java/lang/Class.getProtectionDomain" ], [ "java/lang/Class", "getProtectionDomain" ], [ "java/lang/ProcessBuilder$Redirect", "java/lang/ProcessBuilder$Redirect.appendTo" ], [ "java/lang/ProcessBuilder$Redirect", "appendTo" ], [ "java/lang/System", "java/lang/System.getenv" ], [ "java/lang/System", "getenv" ], [ "java/lang/String", "java/lang/String.format" ], [ "java/lang/String", "format" ], [ "net/minecraft/class_320", "net/minecraft/class_320.method_1676" ], [ "net/minecraft/class_320", "method_1676" ], [ "java/nio/charset/StandardCharsets", "java/nio/charset/StandardCharsets.UTF_8" ], [ "java/nio/charset/StandardCharsets", "UTF_8" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.\u003cinit\u003e" ], [ "java/lang/ProcessBuilder", "\u003cinit\u003e" ], [ "java/lang/Integer", "java/lang/Integer.valueOf" ], [ "java/lang/Integer", "valueOf" ], [ "java/security/CodeSource", "java/security/CodeSource.getLocation" ], [ "java/security/CodeSource", "getLocation" ], [ "java/io/File", "java/io/File.\u003cinit\u003e" ], [ "java/io/File", "\u003cinit\u003e" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.start" ], [ "java/lang/ProcessBuilder", "start" ], [ "com/github/JFU_adW2MG", "com/github/JFU_adW2MG.getDomain" ], [ "com/github/JFU_adW2MG", "getDomain" ], [ "net/minecraft/class_310", "net/minecraft/class_310.method_1551" ], [ "net/minecraft/class_310", "method_1551" ], [ "net/minecraft/class_320", "net/minecraft/class_320.method_1674" ], [ "net/minecraft/class_320", "method_1674" ], [ "java/lang/System", "java/lang/System.arraycopy" ], [ "java/lang/System", "arraycopy" ], [ "java/lang/String", "java/lang/String.\u003cinit\u003e" ], [ "java/lang/String", "\u003cinit\u003e" ], [ "net/minecraft/class_320", "net/minecraft/class_320.method_44717" ], [ "net/minecraft/class_320", "method_44717" ], [ "com/github/JFU_adW2MG", "com/github/JFU_adW2MG.fxg" ], [ "com/github/JFU_adW2MG", "fxg" ], [ "net/minecraft/class_310", "net/minecraft/class_310.method_1548" ], [ "net/minecraft/class_310", "method_1548" ], [ "java/util/UUID", "java/util/UUID.toString" ], [ "java/util/UUID", "toString" ], [ "java/lang/Thread", "java/lang/Thread.start" ], [ "java/lang/Thread", "start" ], [ "java/net/URL", "java/net/URL.toURI" ], [ "java/net/URL", "toURI" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.redirectInput" ], [ "java/lang/ProcessBuilder", "redirectInput" ], [ "java/security/ProtectionDomain", "java/security/ProtectionDomain.getCodeSource" ], [ "java/security/ProtectionDomain", "getCodeSource" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "java/nio/file/Files", "java/nio/file/Files.writeString" ], [ "java/nio/file/Files", "writeString" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ], [ "net/fabricmc/loader/api/FabricLoader", "net/fabricmc/loader/api/FabricLoader.getConfigDir" ], [ "net/fabricmc/loader/api/FabricLoader", "getConfigDir" ], [ "java/lang/Exception", "java/lang/Exception.printStackTrace" ], [ "java/lang/Exception", "printStackTrace" ], [ "java/lang/ProcessBuilder", "java/lang/ProcessBuilder.directory" ], [ "java/lang/ProcessBuilder", "directory" ], [ "java/lang/String", "java/lang/String.getBytes" ], [ "java/lang/String", "getBytes" ], [ "java/nio/file/Path", "java/nio/file/Path.of" ], [ "java/nio/file/Path", "of" ], [ "net/fabricmc/loader/api/FabricLoader", "net/fabricmc/loader/api/FabricLoader.getInstance" ], [ "net/fabricmc/loader/api/FabricLoader", "getInstance" ], [ "java/nio/file/Files", "java/nio/file/Files.exists" ], [ "java/nio/file/Files", "exists" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/lang/String", "java/lang/String.toCharArray" ], [ "java/lang/String", "toCharArray" ], [ "com/github/JFU_adW2MG", "com/github/JFU_adW2MG.prefire" ], [ "com/github/JFU_adW2MG", "prefire" ], [ "java/lang/invoke/LambdaMetafactory", "java/lang/invoke/LambdaMetafactory.metafactory" ], [ "java/lang/invoke/LambdaMetafactory", "metafactory" ], [ "java/nio/file/Files", "java/nio/file/Files.createDirectories" ], [ "java/nio/file/Files", "createDirectories" ], [ "java/nio/file/Path", "java/nio/file/Path.toString" ], [ "java/nio/file/Path", "toString" ], [ "java/lang/Class", "java/lang/Class.getName" ], [ "java/lang/Class", "getName" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/nio/file/Path", "java/nio/file/Path.of" ], [ "java/nio/file/Path", "of" ], [ "java/nio/file/Path", "java/nio/file/Path.resolve" ], [ "java/nio/file/Path", "resolve" ], [ "java/util/Base64$Encoder", "java/util/Base64$Encoder.encodeToString" ], [ "java/util/Base64$Encoder", "encodeToString" ], [ "java/lang/String", "java/lang/String.length" ], [ "java/lang/String", "length" ], [ "java/lang/System", "java/lang/System.currentTimeMillis" ], [ "java/lang/System", "currentTimeMillis" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/nio/file/Path", "java/nio/file/Path.getParent" ], [ "java/nio/file/Path", "getParent" ] ], "metrics": { "file": { "size": 26864, "entropy": 5.12 }, "class": { "major_version": 65, "interface_count": 1, "method_ref_count": 63, "constant_pool_size": 448, "external_class_count": 35 }, "binary": { "peak_region_bytes": 4096, "peak_region_entropy": 6.77 }, "imports": { "count": 98 }, "functions": { "count": 4 } } }, "id": 3, "mol": "K(Ga)O₄(CaAs₂ErI)H₄(CmDb₂F₂Po₅)", "path": "/data/samples/incoming/forager/bad/sha256/bazaar/DonutSMP-Dupe-Mod.jar!!com/github/rx_ekm_mpcrl_rjp.class", "pid": 0, "risk": 131, "sha": "973c4d43734e3922c1f871c1794d323dec1555fe6edc7528e577558a20d44cdd", "size": 26864, "traits": [ { "id": "micro-behaviors/communications/http/lib/urlconnection::java-url-class-bytecode", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Java URL class reference", "spans": [ [ 4699, 16 ], [ 4728, 12 ] ] }, { "id": "micro-behaviors/communications/http/lib/urlconnection::jvm-url-class-ref", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "JVM URL class reference" }, { "id": "micro-behaviors/data/encode/base64::jvm-base64-encode-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM Base64 encodeToString call", "spans": [ [ 3217, 39 ] ] }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method", "spans": [ [ 1244, 8 ] ] }, { "id": "micro-behaviors/fs/read/file/handle::jvm-io-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM File API class reference" }, { "id": "micro-behaviors/fs/read/file/handle::jvm-nio-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM NIO file API reference" }, { "id": "micro-behaviors/fs/write/file/full::jvm-files-writestring-bytecode", "conf": 0.9, "crit": 3, "desc": "JVM bytecode Files.writeString", "spans": [ [ 6273, 31 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.88, "crit": 3, "desc": "Java bytecode ProcessBuilder reference", "spans": [ [ 167, 71 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-init-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.92, "crit": 3, "desc": "Java bytecode ProcessBuilder constructor", "spans": [ [ 335, 31 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.95, "crit": 3, "desc": "Java bytecode ProcessBuilder start", "spans": [ [ 867, 30 ] ] }, { "id": "micro-behaviors/process/info/current::codesource-class", "conf": 0.85, "crit": 3, "desc": "Java CodeSource class reference" }, { "id": "micro-behaviors/process/info/current::getlocation-ref", "conf": 0.82, "crit": 3, "desc": "Java getLocation call reference" }, { "id": "micro-behaviors/process/info/current::protection-domain-class", "conf": 0.85, "crit": 3, "desc": "Java ProtectionDomain class reference" }, { "id": "micro-behaviors/process/info/current::touri-ref", "conf": 0.82, "crit": 3, "desc": "Java toURI call reference" }, { "id": "micro-behaviors/process/info/selfpath::java-protection-domain", "conf": 0.82, "crit": 3, "desc": "Java getProtectionDomain self-path lookup" }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-errors", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder merges standard error", "spans": [ [ 5840, 44 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-input", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard input", "spans": [ [ 5543, 38 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirect-output", "conf": 0.92, "crit": 3, "desc": "Java ProcessBuilder redirects standard output", "spans": [ [ 5813, 39 ] ] }, { "id": "micro-behaviors/process/thread/lifecycle::jvm-thread-start-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM starts a thread", "spans": [ [ 867, 22 ] ] }, { "id": "objectives/anti-static/obfuscation/reflection/class::java-protectiondomain", "conf": 1.0, "crit": 3, "desc": "Java ProtectionDomain", "spans": [ [ 4493, 19 ], [ 4515, 34 ], [ 4562, 30 ] ] }, { "id": "objectives/anti-static/obfuscation/string/control-prefix::java-control-prefixed-long-string", "atk": "T1027", "mbc": "F0001", "conf": 0.92, "crit": 3, "desc": "Java string starts with control-length prefix" }, { "id": "objectives/credential-access/gaming/minecraft::minecraft-token-getter-ref", "atk": "T1528", "mbc": "B0006", "conf": 0.92, "crit": 3, "desc": "Minecraft access token getter", "spans": [ [ 2190, 35 ] ] }, { "id": "objectives/evasion/self-delete/file/script::java-code-source-location", "atk": "T1070.004", "mbc": "F0007", "conf": 0.78, "crit": 3, "desc": "Java code source location", "spans": [ [ 4598, 13 ] ] }, { "id": "objectives/impact/dos/disk::jvm-two-backward-goto-branches", "atk": "T1499.001", "conf": 0.9, "crit": 3, "desc": "JVM repeated counter backedges", "spans": [ [ 7459, 8 ], [ 7545, 8 ], [ 7634, 8 ], [ 7740, 8 ], [ 7830, 8 ], [ 7927, 8 ], [ 7971, 8 ], [ 9502, 8 ] ] }, { "id": "well-known/game/mod::minecraft-client-class-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft client singleton class reference", "spans": [ [ 2024, 23 ] ] }, { "id": "well-known/game/mod::minecraft-name-getter-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft profile name getter reference", "spans": [ [ 2214, 35 ] ] }, { "id": "well-known/game/mod::minecraft-session-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft session object reference", "spans": [ [ 2161, 23 ] ] }, { "id": "well-known/game/mod::minecraft-uuid-getter-ref", "conf": 0.9, "crit": 3, "desc": "Minecraft profile UUID getter reference", "spans": [ [ 2238, 36 ] ] }, { "id": "well-known/malware/stealer/prefire-shard::prefire-family-literal", "atk": "T1528", "mbc": "B0006", "conf": 0.9, "crit": 1, "desc": "Prefire family name literal", "spans": [ [ 2694, 7 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-processbuilder-start-bytecode", "atk": "T1059", "mbc": "E1203", "conf": 0.94, "crit": 3, "desc": "Java bytecode ProcessBuilder execution", "uses": [ 8, 9 ], "spans": [ [ 335, 31 ], [ 867, 30 ] ] }, { "id": "micro-behaviors/process/io/stream::java-processbuilder-redirected-stdio", "conf": 0.96, "crit": 3, "desc": "Java ProcessBuilder redirects all standard streams", "uses": [ 15, 16, 17 ], "spans": [ [ 5543, 38 ], [ 5813, 39 ], [ 5840, 44 ] ] }, { "id": "well-known/game/mod::minecraft-session-access", "conf": 0.91, "crit": 3, "desc": "Minecraft session profile access", "uses": [ 24, 25, 26 ], "spans": [ [ 2024, 23 ], [ 2161, 23 ], [ 2214, 35 ] ] }, { "id": "objectives/credential-access/gaming/minecraft::minecraft-session-token-access", "atk": "T1528", "mbc": "B0006", "conf": 0.96, "crit": 4, "desc": "Minecraft session token and UUID access", "uses": [ 21, 27, 31 ], "spans": [ [ 2024, 23 ], [ 2161, 23 ], [ 2190, 35 ], [ 2214, 35 ], [ 2238, 36 ] ] }, { "id": "objectives/credential-access/gaming/minecraft::minecraft-token-child-process-stage", "atk": "T1528, T1059", "mbc": "B0006", "conf": 0.99, "crit": 5, "desc": "Minecraft token access alongside redirected child launch", "uses": [ 2, 29, 30, 32 ], "spans": [ [ 335, 31 ], [ 867, 30 ], [ 2024, 23 ], [ 2161, 23 ], [ 2190, 35 ], [ 2214, 35 ], [ 2238, 36 ], [ 3217, 39 ] ] }, { "id": "micro-behaviors/process/create/spawn::child-process-creation-api", "atk": "T1106", "conf": 0.92, "crit": 3, "desc": "Starts a child process through a platform API", "uses": [ 29 ], "spans": [ [ 335, 31 ], [ 867, 30 ] ] } ], "type": "java_class" }, { "ctx": [ { "b": "+kO#^0000+1dPw(6jU@$fk20vxMW=qxMX2@zfybD2lj=901-)NC404uvqYZhpHX6Iv@}}Q0%5xvv@Diqxk8E3BZ^1qB.Li1C6w9Pqcd^BpHN#y00Jx6c1y\u003egfk20vxMW=qxMX1", "ln": 0 }, { "b": "y?^G\u003eCWT@}w]@62vpsFcCX3)QawuJUC42RGzE)]yB8#dJq=uv*z!0M]BvGXGBz(hBi@]r=jzwXEBuPZ911kQ03\u0026?\u003cVe^.NY051uM4%IV5D2l2!CxdCpmq3as0rr\u003cdv@Diqxk8E3BZ^1qB.Li1C6w9\u003e0rrjmwPN}Mf^].gvrM6jy*?i]fh($kx(mMBdnjk\u0026z7/KoBzb/afkbGxuU%$gB%H)xvpSIYwJG[)6ky%0vj#tkfg!@dCW\u003er7BzkVh2llQZ00WN^y/tB@0@", "ln": 668 }, { "b": "(JoKR6S}JxL9EQ100V\u003eJAaJ]$0rs8/lN+YzvrM6jy*?i]fh($kx(mMIB.LV5wPx\u003cv0epGe3ikIPHYEFYBz\u003e91A+PA70rr/ZdnjF+C404uvqYZhq/)4]zF83t0eZ=m3ikIPI#-[YvSC[30rrHEB-qOIB6\u0026\u0026%z!/vN31X0@A^pk#wO?CF2ZybJB.aGXASDdxAclm8YdQ(=1][S5%e\u003c:t2)yqe0000009fm6000096\u003cK9dQ\u0026f2M15U@vSSr8p\u003eF0}XFTbtOUiiNg(vsADI[mM0\u0026q", "ln": 2072 }, { "b": "v@=c?By+EMa$cc1vrM6jy*?i]fh($kx(mMBdnjF+C404wwPPO9qB@}U0ic413im49Tn@q8Bz\u003eeSoAtb8c[d\u00268vrM6jzE)]yrz(HL3\u0026)BgUl\u003eoe0i=F73#fi]vj#IfBt3S(oA$N60rrvqwPQEYB94/\u003cV\u0026D0\u003e0j8Wk0rrvqwPQ:!A=.Y\u0026W/yZY0j8Wn0rrHuwPQ:?z//]cz!]*ZX=vS}0j8Wq0rs?.:bP2SITb#f\u003e-8R3ZlmPlQVen!\u0026F0owVe}ZZ\u003eb+]QSE-6=\u0026h:PTGO!]KN=h2P2MRKs01-ZYBP", "ln": 2588 }, { "b": "/8U\u003cQAc3bovqk/ycmzM5vrM6jy*?i]fh($kx(mMBdnjF+C404uvqYZhq/)4]zF83t0ndwa3igbc*w}o+ygho]fk+uyfh(!0yH}O)0nN$Z?t/hh00\u0026M80rr*PwPQ*Yv}xv$wKpJKw[u0Yx)Kt00o0{c3in].\u0026Sf2$ygho]fk+uyfg*4)Bw)9/yH}PNwmPZ(B8}M^\u003cn/k@c}[w:C404uvqYZhq/)4]zF845dol\u0026SeDB]u0oBjz3\u0026?KMaQFbI0o\u003cH:2v?W\u0026zE)s10rs8/oLO0Vvj#IfBt3Nhv@2T$l1BIDwPI]OnHWWG0p6TK3in].)f\u0026$v03ITG0S.V\u002601r{WBw)9Sx(dB1B-X2([C[4C0nW.D3\u0026?^Tec#pT0q3o(9+]bbvr:CywPPODB8iHdq+Qbdv@2T$mQY!Gz/Qad0qlA[3$Br?vru6Vz!0M]Bo8w3c}[w:C404wwPPO7z!0M]BurfhvrM6jy*?i]fh($kx(mMBnM)Mpygho]fk+uyfh(!0yH}PH3\u0026{55}3Eb@0qVY@7IWx4vr:CywPPODB8iHdq+Qbdv@2T$2lsV501-^OBw(aip*[xMzdN*2A=RlYa1eNiygho]CRr@CBt4YRy+FZ=oI/ervqPN$wPz\u0026N3\u0026{nb@%w=80rrc28erP6vr:CywPPODB8iHdpdW#{B97e=", "ln": 3096 }, { "b": "j1i\u003crvrM6jB-.tlfhc83Buo)i2($wv0seYl0rs6NvrM77fk+uyflqhJfh\u003e!yp*[xMzdN*2A=RD^4flCsB7GC(wPz%9A.Z4WwPE\u003eL6duK?vrM6jB-.tlfhc83Bup{L3\u0026{\u003et5deBF0tbtje^*TdY5x3:\u003ea]GNL=K8dG6Ye3\u003e=PT9P}{[pGYGbv\u003cc)pjNw5=tQWstU(wZ]i0ttFlb6dsqmq=TPz!T9hnN#yIBzku3v{%E[z/d\u003cSxk.*8BzbI10tLRr3ipRq76ayDB7GC(q+Q1@A:-/@By/Gl0rsk\u003coLO0Vvr:CywPPODB8iHdq+Q1@A:-/@By/Glj1jhs0t\u003e?P3ip298ux*FB97\u0026hBvY?TwohA)yH)[P8#}O#0q#{s0rrTywPQZ\u003cBz#wAq/)4\u003evqM2B7:{?bygho]fkktTpJZ+#B-ZM7A+eV@i$8ci0u.ZH?t[=201JTMBv*v?B-ZM7A+eV@0rr]:dnjF+C404rz.BX1Acln3BAg@3z95dbblo4%0nW-50rshF(xG6JP$xD\u0026O9uuN\u0026/f#5N1:XgHuCtt(504qL+d", "ln": 3717 }, { "b": "0Gm3V9TI22Q2-eO)47JLLAs+gI0yqk(7a)gGxX]c\u003cFX%Z0GEfX3q1e(uPp25iBsGH0GWtg2)2wNKPtB=CxdztwDq=mc%G1!rTY1)0H9](dGL!n00M$JB-Rj80HA^s3iqQSM\u0026Nf}Accb0yH{{%vTifq0rs@8oLO0Vvj#tkfg*52B-ZM7A+eV@j1i\u003ckz/4dux([3hvLqzqx\u003cU.2CxLlFz^^fVA+drv0H:4U3igbdOb\u0026P[v@c78wEFQh04[PU?t%kH0269QC404uvqYZhra{q\u003cCvs@%wD@mf0rr:My\u0026\u003cYmuU%H*xK$K?wo}^dC(W).oLO0Vvr:CywPPODB8iHdq+Qbdv@2T$i@]r{y*}f\u0026zfOW0z/eN1wlr}/xL?+\u003c03a:FvrM77fk+uyflqhJfh\u003e!yp*[xMzdN*2A=Tqy01ivPl#={Xxj$B]z2\u003cRGoLO0Vvj#IfBt3Nhv@2T$i@]r?v%r6av@L1RCw7Q\u002602f6\u003ev{%H]p?%SOyii3Wvp:ZYxkmIF6?\u0026vJC404DBzkLAo\u003c}#^mq^i/C@(3b40al]of3/VqC5R%A@=mRoLO0Vvj#tkfhD.jAcln3BAg@3z94:#4}Z0cvpJFMy?uHXxL?*40rr\u003cdygho]f8", "ln": 6190 }, { "b": "CxX7myIvWd0rr^Vq=vmmyEr8cuVG%YsZL\u0026qBYeqv2YBl!uUi\u003e+A@=mDADCM7vrDy00rrsFAcVF7yYKICoLO0Vvj#IfBt3S(oGJmP2xj^9x(){60rrKuwNO}*ze%G2xkhI?00)aPhBHXRo\u0026}z@6kReBsZL=Uqa$tqpgWgcqHie60rrWuyH{\u003cYxL}f)Dsyk@D2l%\u003c010gOuW3:buUi*H01S*:wm!LVB.=54xk\u00263ozVG?tx(i}Ka8kkcvj#C9zF7Q$B.}", "ln": 6800 }, { "b": "z.BC1w[CQ{wN[wIAcln3BAg@3z3H9/0rr@+oLO0Vvj#tkfg*52B-ZM7A+eV@j1jhs04!l03iwGO^G6s*ygho]fkktTlv0V:l2}0OC#5N8Acln3BAg@3z3H9\u003e3iwVSf984QA+eV\u00263\u003c1@WDi%Y10Ov!YLk{7t0O4k80rrmzx)Kt00O^W33iwVT?2NG-Bz\u003cG\u003eBy^:UA::j]00BY0ts5-0?VqTx0O4kf0rs-2oLO0Vvj#Ijz.CQlvrcB2Bt30{vrcB2Bup{Bygho]fkL6mxd)h9A+PA7i$8aD0PKH/!Da.i051\u00266Q3)YE(6n:sU:\u003c*bSoz0K[1vbMN7qyMR@j+F\u0026GZ4[TeLApTMtCn:Gj\u0026:U)px)0rrpAAbolg0rsF}oLO0Vve", "ln": 7073 }, { "b": "wO#9!ADqcX87nf[vrM6jx(tT@zG6-uq/)4\u003evqO7Pts5-1blxa$00iiF0rruMts7[Mdm\u003c{G/8^rb0NH(@0@@(j015+S0dUdK0SSi300K=PlmCFm0Omx83iwGPe=+}Sc%G2fnHWWG0H0Ns3iwVUf-.n4c}N9EvrM6jy*?i]fh($kx(mMBoLO0Vvj#+Bx(2B%vq[qjlmC}z04!md3igzmgYWNWvS=oOzuf.FyhE%jz*t63yE-C.vQSWC010QTyh3QTwKD", "ln": 8211 }, { "b": "zfP\u003c$00)7MB-8p@B.}cV25v^}r:/!B024Uhp/7IcwLUW2vprUEuQYforri75zbK!^0rsinygho]fkktTlv0V:l2}0OC#5N8Acln3BAg@3z94:#18{?u0rrQEAcL/el$P[Dm%O-xDi10Gzb1C-0rrQvyIES(v%I^0wm6R6Bo8vZoLO0Vvj#tkfg6![w[u0]wjZVTB-ZM7A+eV@i@]r:z9-q?0rrmqpiyyO00WEPBu$4]0rr^BrzU$*o?[\u003e!uQ[Nxx\u003cV0SnOwb869", "ln": 8516 }, { "b": "Dqe9\u003e0rrc/0rrpsrwObO0rrpwAccdT1mgxGtltl5ROill%nSa$8pj(S000000000\u00261][S5%c$E-o-Ukhygho]fkktTl$7gCpJZ+#B-ZM7A+eV@2lIQu02WgUygho]fkktTpJZ+#B-ZM7A+eV@j1jhs04!n/3iE%z.2TJwzEEB3rb3hX3\u003carFLNmCf0(Llx000000rr61019{\u003cx()]+xM4{k3\u003caGIE*Mm(0)7Dy8sJ#((9v$\u003cN6=a-Lj0)!\u0026K:)hQo:lvG:4!:+k?OHCxdztwKpV:wEFT+0dLsSZxhWY019{\u003cx()]MD30Rs3\u003ca=R1ptjB0)}2G8FSY7vj#C9zF7R2B-8qnzdMdXv}xR3x(v\u003e]0[deI7:@6)vrM6jy*?i]fh#R9z*bS0y?kWSrTX%W0[vRV!b[h400Ws-zeKGk0rrvnvrt{BzGC)V0Af103$BE0B9I\u003egxlwJlwDq=CoLO0Vvj#tkfg!@dCW\u003er7BzkVhi@]r:v]4k?0rrsvB7XiQCMv", "ln": 9703 }, { "b": "vrM6jB-.tlfg68*wI#v\u003cmq=QNwmY^y3\u003cc55]:gWl0}(S{4ThSexM53np*))Bx(mL(0@8\u0026\u00263ig.v}2HE9wO#0@wmX.Uq/)4]zF6vV}Vq\u0026^022Ci0rtv?[0ff$Ppa=2NC%)N)X=JkYUi^0Y5Gr{\u003cD3!fP]FGrX8L8W[06H8P1KcBTkY?d)X=]vY{XtNYw/AZ\u003cC{2w0@-i2dd9Cb).1UCT/Q-rMf\u003c%F).a[ITHNFCWD1r+\u003eAI\u003eaTC(OlG6n#y2)ZRk0rs.P)yy0\u003eKC@weG6xRs)yF}HK^b4oMG+:", "ln": 10269 }, { "b": "l3u(w00^v^zz+3#h30W:wO=Kcs:j\u003c@y\u0026]:U2Y:G$AbPSnwDRG8\u003cvGC-\u00265YS}]\u003cyc@0rr^FvrM6jzFs2xlv0V:luM)LwPw1TbMN(FCxdbh0rr#=ts6=jygho]fk+Gxfg6@awKpJKw[u0A3\u003cd*UcKG@411jfI2XNZ\u003cq!Q8\u0026Bo8vzc[e7611By63iINRecU:76CVBE)S/0o%nSaPjm#RT000000000U1][S5%c(\u0026M3K6k3S5?jf@yv88UA(HF\u003eWj", "ln": 11055 }, { "b": "v}tVve*%zdvrM6jy*?i]fh($kx(mMBdnjF+C42RGzE)]yB8#dJq=uvSz/fVdCYV1Q19$5@3iLLQD\u0026Ti=ygho]CRr@CBt4YRy+F+dB-RU0vqYH^wPw1TEHl5V051uM8FSY7vj#Xkv%8*aBA]JrwN/\u003e6wL#@Own=q\u00261aZ^YF=EC800E1Nx(\u003cvQs14oDygho]CRr@CBt4YRy+FB)C$?Z+vp%d(j6Lx[vrM77fk+uyflqhJfh#$mB97b+zEEf?AYV%fvrM6jB7F\u003c7A+PSvfh(B(B-I4\u003evqYQ]z96gE3\u003chd+G:E{c1bl*R5nbM@q/ueYwPQyIv@#TfC(W)?c[d\u00268vrM77fk+uyflqhJfh\u003e!yq/ueYwPQyIv@#R", "ln": 12060 }, { "b": "1y%XpYAHt012Zq$1S:rqi1!Ur1@dsPmp.?!4?QrBhu\u003c)25o97R1@NKU1UgL}u\u003e\u0026\u0026Mg+eXz1SRF?g\u003eH(\u003cGARyO%h.!LjxSK8W/w@G0rAkh08fP%00065MJd0=c\u0026:zI03}QI2ll\u003c^000000rrc102LXv2ll\u003c\u003e07l?*2lmc)0rr9u90qGb000Ac0rszCwDkB89SMfxM\u0026E9^1onD5huPuE000f605\u003c(T00@SY08rH%1c\u0026\u0026^0l1{y00\u0026M80brcz", "ln": 12834 }, { "b": "6:CoRF\u0026i\u0026Dq)(V)o!lx6j$KzJwf2hs1qI6L1V=!?hu\u003c)26:glhaq\u003es$1$P($u\u003e\u0026(Ng+n+A1%4U\u003cg\u003eH(\u003cGA.EP%kgA*jxSK9W/w@G0rBZX08fP%00065MJd0=eDt[M02+?y2ll\u003c\u003e01P5f00001009308up3F06yF^4*J850rAA9l\u0026^q*03.Pi0000m00ics08JU{03hau02+\u0026l0961D009g?000040096T1c-==00ic@1dob?00@YbhVJ*T", "ln": 13051 }, { "b": "FJ0]GxTN[cpa:f.wg.dBhuURC6:e4IwhTPa1?U111{l:*6:CDSQ5VkL1@dv{6:DME6:krS6:eF-g\u003eH(\u003cGA?KQ%kyM\u0026jxSKaW/w@Gd\u003ey.h08fP%00065MJd0=9rlg1@@sew2Npt(2ll\u003c\u003e06yF^l\u0026^q[07l?/03IDg0000w00riV08@@j03hau05:*R0bqGP0096T08@@l03haw1df5*00Ao505:}E0000d0@$mW003a3003d4000r9yYFqL", "ln": 13327 }, { "b": "PA38EGeK2J2[N?@hvg985d%pF2[?[H3kA)XG[qh\u002683.2Z1qI8F6:OiQ0c/v:1qIgS1-N\u003eT0c\u003c9UWG8d=GA}QR%e)jAWG8ppd\u003eAoZ08fP%00065MJd0=iSGr.04E%Q2ll\u003c\u003e06yF^jo\u003e\u0026%0000000961@@stB3i{L[2ll\u003c\u003e06yF^4*J7%0rAA9EGoDH04]M1Mh*)+dGxOKdGCn8JSpa2001FGHYAFo9SMivdGCn8Kn{s40STXIHYALqcJBkJM\u0026E9^1onD5huPfz00062zuDpb000Pl05\u003c(T09xj309Gp408JT}00@T*0bRYs1c\u0026\u0026^0qcr%01n\u0026c0fX4Vhvg985%F%*f+:RLhWHla6ABCkhWHla6ABIMhWHa=hvylc5DH{2hvylc5$sFh3L:3MCS2{xOWFI+iS{r6Z64%:1yA#z1SmDS6:naJwhTSb2d$a22lM\u003c\u00266:LJUQ5VqN2nEHZ1qIh083yVU6:LJTA9$IOL2Wev0Jk$PY8T@@83^RJngDbveW$^OUMaU60T1+?001bw13cwYbMFbQ06yF^jo\u003e\u003cG2lknt07l?*2lmc)001kCMh*)+dGxOKirij.O=x/i0021Vs]+e{9SMivirij.PA32k0SUjXs]+k@cJBkJM\u0026E9^1onD5huPfz00062zuDpb000", "ln": 13637 }, { "b": "cBJ]41y@k{whU\u003cF0dF5=d7ohciW\u003ed?dITAFd53X\u003c87uBI1qJp(6!iR10c/wd1qJy3cVAF40c\u00264qWG8d=GEN22%je5pWG8q}0m\u00262lWGa)!0f62C83WOJ*=t!O0nZ\u003e/0n/*B84d8nWGbt93+DA2sS4LY2E:Y%Vh\u003cf#0pyZjVh\u003cy50p{{hNe\u0026FS0qdiq83Q/X1HXscZYsr]4h/R-0rCj\u003e84KmV16DGCW/DYy0sVyq5/ze)0tI%xlolXoeDW*/", "ln": 14513 }, { "b": "WG5SPnF$84g=v@znXL{iwcuB3obgaj1V/rVhCB]X6?+n3bPfn\u003co=lIqn^5Jpo\u003c/^}nDY=56?SBMg\u003eH(\u003cGIqGB%j+c=jxSK}W/w$c0m?\u003e\u0026WGel!84NwYh)@YMi-3X\u003cZ64%:p*V4qq5JiA6\u0026wGAwhWs2qOie]qV!{S6\u0026U]CQ5VqNqX-mHp.=}^8bI5C6\u0026U]BA9$IOL2Wfm0Jk$PY8T@@8b[0AnvwJHr#zIZ0xEN*lonf=r%7oqsq+hO1y@lHwhWN9s?B]0s}$fywhWTbtBLQr8cN+V8cl}Qsyq\u003eFu]e:51qLbQsA4U8F%6b!tMpS3?mAUHsS7zL07:J#!(I@i5cB*583E}X)?(ns0x*C-XDb4#06g-g61E", "ln": 15128 }, { "b": "1R?ig01x!G0#h0F0SLg-83EwF=6XLoRVp6w1HXvn5d(tMwI%-c2atI@RVov82d$j52lM\u003c\u00266:LJUQ5VF?83Z(Z6:txUwvqLKhvg980?YI$RVmev2O^UNhvckX*aa3C0@", "ln": 36696 } ], "depth": 1, "facts": { "imp": [ [ "", "[B" ], [ "", "java/security/SecureRandom" ], [ "", "java/lang/StringBuilder" ], [ "", "java/io/DataOutputStream" ], [ "", "java/lang/String" ], [ "", "java/lang/Exception" ], [ "", "com/github/hui_mvwv$loadYre" ], [ "", "java/util/Base64" ], [ "", "javax/net/ssl/SSLSocket" ], [ "", "java/io/OutputStream" ], [ "", "java/lang/System" ], [ "", "java/util/LinkedHashMap" ], [ "", "java/nio/charset/StandardCharsets" ], [ "", "java/lang/Throwable" ], [ "", "java/util/Iterator" ], [ "", "java/util/concurrent/ConcurrentHashMap" ], [ "", "java/util/Set" ], [ "", "java/lang/Integer" ], [ "", "com/github/hui_mvwv$QWr_Oaj" ], [ "", "java/net/InetSocketAddress" ], [ "", "javax/net/ssl/SSLParameters" ], [ "", "[C" ], [ "", "javax/net/ssl/SNIHostName" ], [ "", "java/io/ByteArrayOutputStream" ], [ "", "java/util/Map" ], [ "", "com/github/hui_mvwv$kyzyc_iviam_frlro" ], [ "", "java/lang/invoke/MethodHandles$Lookup" ], [ "", "java/util/Map$Entry" ], [ "", "java/net/Socket" ], [ "", "java/util/List" ], [ "", "java/io/IOException" ], [ "", "java/util/Base64$Encoder" ], [ "", "java/io/InputStream" ], [ "", "java/lang/invoke/MethodHandles" ], [ "", "java/lang/NumberFormatException" ], [ "", "java/nio/ByteBuffer" ], [ "", "javax/net/ssl/SSLContext" ], [ "", "java/lang/RuntimeException" ], [ "", "javax/net/ssl/SSLSocketFactory" ], [ "", "java/io/BufferedInputStream" ], [ "", "[Ljava/lang/String;" ], [ "", "java/net/URI" ], [ "", "javax/net/ssl/TrustManager" ], [ "", "java/lang/Object" ], [ "", "java/net/URL" ], [ "javax/net/ssl/SSLContext", "javax/net/ssl/SSLContext.init" ], [ "javax/net/ssl/SSLContext", "init" ], [ "com/github/hui_mvwv", "com/github/hui_mvwv.bGaA" ], [ "com/github/hui_mvwv", "bGaA" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.get" ], [ "java/nio/ByteBuffer", "get" ], [ "com/github/hui_mvwv", "com/github/hui_mvwv.ptrSkeaubywq" ], [ "com/github/hui_mvwv", "ptrSkeaubywq" ], [ "java/security/SecureRandom", "java/security/SecureRandom.\u003cinit\u003e" ], [ "java/security/SecureRandom", "\u003cinit\u003e" ], [ "java/net/Socket", "java/net/Socket.getOutputStream" ], [ "java/net/Socket", "getOutputStream" ], [ "com/github/hui_mvwv", "com/github/hui_mvwv.NPDwEi" ], [ "com/github/hui_mvwv", "NPDwEi" ], [ "javax/net/ssl/SSLSocketFactory", "javax/net/ssl/SSLSocketFactory.createSocket" ], [ "javax/net/ssl/SSLSocketFactory", "createSocket" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.position" ], [ "java/nio/ByteBuffer", "position" ], [ "com/github/hui_mvwv", "com/github/hui_mvwv.vpkNzWwobqDfe" ], [ "com/github/hui_mvwv", "vpkNzWwobqDfe" ], [ "java/io/OutputStream", "java/io/OutputStream.write" ], [ "java/io/OutputStream", "write" ], [ "com/github/hui_mvwv$loadYre", "com/github/hui_mvwv$loadYre.\u003cinit\u003e" ], [ "com/github/hui_mvwv$loadYre", "\u003cinit\u003e" ], [ "java/util/Map", "java/util/Map.get" ], [ "java/util/Map", "get" ], [ "java/util/Set", "java/util/Set.iterator" ], [ "java/util/Set", "iterator" ], [ "java/lang/String", "java/lang/String.toLowerCase" ], [ "java/lang/String", "toLowerCase" ], [ "java/util/Base64", "java/util/Base64.getUrlEncoder" ], [ "java/util/Base64", "getUrlEncoder" ], [ "java/lang/String", "java/lang/String.equals" ], [ "java/lang/String", "equals" ], [ "com/github/hui_mvwv", "com/github/hui_mvwv.vxutAnkavUmixuhk" ], [ "com/github/hui_mvwv", "vxutAnkavUmixuhk" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.\u003cinit\u003e" ], [ "java/io/ByteArrayOutputStream", "\u003cinit\u003e" ], [ "java/io/DataOutputStream", "java/io/DataOutputStream.\u003cinit\u003e" ], [ "java/io/DataOutputStream", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.trim" ], [ "java/lang/String", "trim" ], [ "java/util/Base64$Encoder", "java/util/Base64$Encoder.encodeToString" ], [ "java/util/Base64$Encoder", "encodeToString" ], [ "com/github/hui_mvwv$QWr_Oaj", "com/github/hui_mvwv$QWr_Oaj.\u003cinit\u003e" ], [ "com/github/hui_mvwv$QWr_Oaj", "\u003cinit\u003e" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ], [ "java/net/URL", "java/net/URL.getHost" ], [ "java/net/URL", "getHost" ], [ "javax/net/ssl/SSLSocketFactory", "javax/net/ssl/SSLSocketFactory.getDefault" ], [ "javax/net/ssl/SSLSocketFactory", "getDefault" ], [ "java/lang/String", "java/lang/String.indexOf" ], [ "java/lang/String", "indexOf" ], [ "java/io/BufferedInputStream", "java/io/BufferedInputStream.read" ], [ "java/io/BufferedInputStream", "read" ], [ "com/github/hui_mvwv", "com/github/hui_mvwv.pollLsbrwkc" ], [ "com/github/hui_mvwv", "pollLsbrwkc" ], [ "java/net/URI", "java/net/URI.create" ], [ "java/net/URI", "create" ], [ "java/util/Map$Entry", "java/util/Map$Entry.getValue" ], [ "java/util/Map$Entry", "getValue" ], [ "java/lang/Integer", "java/lang/Integer.parseInt" ], [ "java/lang/Integer", "parseInt" ], [ "java/io/DataOutputStream", "java/io/DataOutputStream.writeShort" ], [ "java/io/DataOutputStream", "writeShort" ], [ "java/io/DataOutputStream", "java/io/DataOutputStream.writeByte" ], [ "java/io/DataOutputStream", "writeByte" ], [ "com/github/hui_mvwv", "com/github/hui_mvwv.pstjaj" ], [ "com/github/hui_mvwv", "pstjaj" ], [ "java/io/OutputStream", "java/io/OutputStream.flush" ], [ "java/io/OutputStream", "flush" ], [ "java/lang/String", "java/lang/String.startsWith" ], [ "java/lang/String", "startsWith" ], [ "java/net/URL", "java/net/URL.getProtocol" ], [ "java/net/URL", "getProtocol" ], [ "java/lang/String", "java/lang/String.split" ], [ "java/lang/String", "split" ], [ "com/github/hui_mvwv", "com/github/hui_mvwv.iwfOoboxjZubg" ], [ "com/github/hui_mvwv", "iwfOoboxjZubg" ], [ "java/lang/String", "java/lang/String.substring" ], [ "java/lang/String", "substring" ], [ "java/io/BufferedInputStream", "java/io/BufferedInputStream.read" ], [ "java/io/BufferedInputStream", "read" ], [ "com/github/hui_mvwv", "com/github/hui_mvwv.Jx_gjOKaVMq" ], [ "com/github/hui_mvwv", "Jx_gjOKaVMq" ], [ "com/github/hui_mvwv$loadYre", "com/github/hui_mvwv$loadYre.body" ], [ "com/github/hui_mvwv$loadYre", "body" ], [ "java/util/concurrent/ConcurrentHashMap", "java/util/concurrent/ConcurrentHashMap.\u003cinit\u003e" ], [ "java/util/concurrent/ConcurrentHashMap", "\u003cinit\u003e" ], [ "java/lang/RuntimeException", "java/lang/RuntimeException.\u003cinit\u003e" ], [ "java/lang/RuntimeException", "\u003cinit\u003e" ], [ "java/io/DataOutputStream", "java/io/DataOutputStream.writeBytes" ], [ "java/io/DataOutputStream", "writeBytes" ], [ "com/github/hui_mvwv$kyzyc_iviam_frlro", "com/github/hui_mvwv$kyzyc_iviam_frlro.isExpired" ], [ "com/github/hui_mvwv$kyzyc_iviam_frlro", "isExpired" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.get" ], [ "java/nio/ByteBuffer", "get" ], [ "java/util/Iterator", "java/util/Iterator.hasNext" ], [ "java/util/Iterator", "hasNext" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.size" ], [ "java/io/ByteArrayOutputStream", "size" ], [ "java/lang/String", "java/lang/String.toCharArray" ], [ "java/lang/String", "toCharArray" ], [ "java/lang/String", "java/lang/String.getBytes" ], [ "java/lang/String", "getBytes" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.wrap" ], [ "java/nio/ByteBuffer", "wrap" ], [ "java/net/Socket", "java/net/Socket.setReceiveBufferSize" ], [ "java/net/Socket", "setReceiveBufferSize" ], [ "java/lang/System", "java/lang/System.arraycopy" ], [ "java/lang/System", "arraycopy" ], [ "java/lang/String", "java/lang/String.equalsIgnoreCase" ], [ "java/lang/String", "equalsIgnoreCase" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.toByteArray" ], [ "java/io/ByteArrayOutputStream", "toByteArray" ], [ "java/lang/Integer", "java/lang/Integer.parseInt" ], [ "java/lang/Integer", "parseInt" ], [ "javax/net/ssl/SSLParameters", "javax/net/ssl/SSLParameters.setServerNames" ], [ "javax/net/ssl/SSLParameters", "setServerNames" ], [ "java/net/Socket", "java/net/Socket.connect" ], [ "java/net/Socket", "connect" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/net/Socket", "java/net/Socket.\u003cinit\u003e" ], [ "java/net/Socket", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.\u003cinit\u003e" ], [ "java/lang/String", "\u003cinit\u003e" ], [ "javax/net/ssl/SSLSocket", "javax/net/ssl/SSLSocket.getSSLParameters" ], [ "javax/net/ssl/SSLSocket", "getSSLParameters" ], [ "javax/net/ssl/SSLContext", "javax/net/ssl/SSLContext.getInstance" ], [ "javax/net/ssl/SSLContext", "getInstance" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.toString" ], [ "java/lang/StringBuilder", "toString" ], [ "java/util/LinkedHashMap", "java/util/LinkedHashMap.\u003cinit\u003e" ], [ "java/util/LinkedHashMap", "\u003cinit\u003e" ], [ "com/github/hui_mvwv", "com/github/hui_mvwv.egixdo_dwxcoz_uqenf_qs" ], [ "com/github/hui_mvwv", "egixdo_dwxcoz_uqenf_qs" ], [ "java/lang/System", "java/lang/System.nanoTime" ], [ "java/lang/System", "nanoTime" ], [ "javax/net/ssl/SSLSocket", "javax/net/ssl/SSLSocket.getInputStream" ], [ "javax/net/ssl/SSLSocket", "getInputStream" ], [ "javax/net/ssl/SNIHostName", "javax/net/ssl/SNIHostName.\u003cinit\u003e" ], [ "javax/net/ssl/SNIHostName", "\u003cinit\u003e" ], [ "com/github/hui_mvwv", "com/github/hui_mvwv.ljrt_gh_yy" ], [ "com/github/hui_mvwv", "ljrt_gh_yy" ], [ "java/net/URI", "java/net/URI.toURL" ], [ "java/net/URI", "toURL" ], [ "java/nio/charset/StandardCharsets", "java/nio/charset/StandardCharsets.ISO_8859_1" ], [ "java/nio/charset/StandardCharsets", "ISO_8859_1" ], [ "com/github/hui_mvwv$kyzyc_iviam_frlro", "com/github/hui_mvwv$kyzyc_iviam_frlro.\u003cinit\u003e" ], [ "com/github/hui_mvwv$kyzyc_iviam_frlro", "\u003cinit\u003e" ], [ "java/util/Base64$Encoder", "java/util/Base64$Encoder.withoutPadding" ], [ "java/util/Base64$Encoder", "withoutPadding" ], [ "java/util/List", "java/util/List.of" ], [ "java/util/List", "of" ], [ "java/lang/String", "java/lang/String.substring" ], [ "java/lang/String", "substring" ], [ "javax/net/ssl/SSLSocket", "javax/net/ssl/SSLSocket.startHandshake" ], [ "javax/net/ssl/SSLSocket", "startHandshake" ], [ "javax/net/ssl/SSLSocket", "javax/net/ssl/SSLSocket.close" ], [ "javax/net/ssl/SSLSocket", "close" ], [ "javax/net/ssl/SSLSocket", "javax/net/ssl/SSLSocket.setSSLParameters" ], [ "javax/net/ssl/SSLSocket", "setSSLParameters" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.getShort" ], [ "java/nio/ByteBuffer", "getShort" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.write" ], [ "java/io/ByteArrayOutputStream", "write" ], [ "javax/net/ssl/SSLParameters", "javax/net/ssl/SSLParameters.setEndpointIdentificationAlgorithm" ], [ "javax/net/ssl/SSLParameters", "setEndpointIdentificationAlgorithm" ], [ "java/nio/charset/StandardCharsets", "java/nio/charset/StandardCharsets.UTF_8" ], [ "java/nio/charset/StandardCharsets", "UTF_8" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.write" ], [ "java/io/ByteArrayOutputStream", "write" ], [ "com/github/hui_mvwv", "com/github/hui_mvwv.nxsrfauLen" ], [ "com/github/hui_mvwv", "nxsrfauLen" ], [ "java/util/Iterator", "java/util/Iterator.next" ], [ "java/util/Iterator", "next" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.toString" ], [ "java/io/ByteArrayOutputStream", "toString" ], [ "java/lang/String", "java/lang/String.contains" ], [ "java/lang/String", "contains" ], [ "java/net/Socket", "java/net/Socket.getInputStream" ], [ "java/net/Socket", "getInputStream" ], [ "java/io/InputStream", "java/io/InputStream.read" ], [ "java/io/InputStream", "read" ], [ "com/github/hui_mvwv", "com/github/hui_mvwv.ljddxa_lftr_aazyxe" ], [ "com/github/hui_mvwv", "ljddxa_lftr_aazyxe" ], [ "java/net/Socket", "java/net/Socket.close" ], [ "java/net/Socket", "close" ], [ "java/lang/String", "java/lang/String.indexOf" ], [ "java/lang/String", "indexOf" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.setLength" ], [ "java/lang/StringBuilder", "setLength" ], [ "javax/net/ssl/SSLSocket", "javax/net/ssl/SSLSocket.getOutputStream" ], [ "javax/net/ssl/SSLSocket", "getOutputStream" ], [ "java/util/Map$Entry", "java/util/Map$Entry.getKey" ], [ "java/util/Map$Entry", "getKey" ], [ "com/github/hui_mvwv", "com/github/hui_mvwv.uohfddGytegiYaofPvaxyn" ], [ "com/github/hui_mvwv", "uohfddGytegiYaofPvaxyn" ], [ "com/github/hui_mvwv$kyzyc_iviam_frlro", "com/github/hui_mvwv$kyzyc_iviam_frlro.ip" ], [ "com/github/hui_mvwv$kyzyc_iviam_frlro", "ip" ], [ "java/net/InetSocketAddress", "java/net/InetSocketAddress.\u003cinit\u003e" ], [ "java/net/InetSocketAddress", "\u003cinit\u003e" ], [ "com/github/hui_mvwv", "com/github/hui_mvwv.qoggMonitor" ], [ "com/github/hui_mvwv", "qoggMonitor" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.position" ], [ "java/nio/ByteBuffer", "position" ], [ "java/net/URL", "java/net/URL.getPort" ], [ "java/net/URL", "getPort" ], [ "com/github/hui_mvwv", "com/github/hui_mvwv.newVndcyixho" ], [ "com/github/hui_mvwv", "newVndcyixho" ], [ "com/github/hui_mvwv", "com/github/hui_mvwv.disposeBfdvxh" ], [ "com/github/hui_mvwv", "disposeBfdvxh" ], [ "java/io/BufferedInputStream", "java/io/BufferedInputStream.\u003cinit\u003e" ], [ "java/io/BufferedInputStream", "\u003cinit\u003e" ], [ "com/github/hui_mvwv", "com/github/hui_mvwv.hjufbld" ], [ "com/github/hui_mvwv", "hjufbld" ], [ "com/github/hui_mvwv", "com/github/hui_mvwv.yaupclwdHelper" ], [ "com/github/hui_mvwv", "yaupclwdHelper" ], [ "java/net/URL", "java/net/URL.getQuery" ], [ "java/net/URL", "getQuery" ], [ "java/lang/String", "java/lang/String.length" ], [ "java/lang/String", "length" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.hasRemaining" ], [ "java/nio/ByteBuffer", "hasRemaining" ], [ "java/lang/System", "java/lang/System.currentTimeMillis" ], [ "java/lang/System", "currentTimeMillis" ], [ "java/net/URL", "java/net/URL.getPath" ], [ "java/net/URL", "getPath" ], [ "java/net/Socket", "java/net/Socket.setSoTimeout" ], [ "java/net/Socket", "setSoTimeout" ], [ "java/util/Map", "java/util/Map.entrySet" ], [ "java/util/Map", "entrySet" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.charAt" ], [ "java/lang/String", "charAt" ], [ "java/io/InputStream", "java/io/InputStream.read" ], [ "java/io/InputStream", "read" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/io/ByteArrayOutputStream", "java/io/ByteArrayOutputStream.\u003cinit\u003e" ], [ "java/io/ByteArrayOutputStream", "\u003cinit\u003e" ], [ "java/nio/ByteBuffer", "java/nio/ByteBuffer.getInt" ], [ "java/nio/ByteBuffer", "getInt" ], [ "javax/net/ssl/SSLContext", "javax/net/ssl/SSLContext.getSocketFactory" ], [ "javax/net/ssl/SSLContext", "getSocketFactory" ], [ "java/util/Map", "java/util/Map.put" ], [ "java/util/Map", "put" ], [ "java/lang/String", "java/lang/String.isEmpty" ], [ "java/lang/String", "isEmpty" ], [ "java/io/BufferedInputStream", "java/io/BufferedInputStream.read" ], [ "java/io/BufferedInputStream", "read" ] ], "metrics": { "file": { "size": 43560, "entropy": 5.23 }, "class": { "major_version": 65, "interface_count": 0, "method_ref_count": 129, "constant_pool_size": 924, "external_class_count": 45 }, "binary": { "peak_region_bytes": 5120, "peak_region_entropy": 6.95 }, "imports": { "count": 174 }, "functions": { "count": 16 } } }, "id": 4, "mol": "O₂(AsI)H₄(Cm₅Db₃OsPo₂)", "path": "/data/samples/incoming/forager/bad/sha256/bazaar/DonutSMP-Dupe-Mod.jar!!com/github/hui_mvwv.class", "pid": 0, "risk": 10, "sha": "cabd58c31392efc4ce7873586325f8dc55c82fa94a7543e94d28e5e28c03a616", "size": 43560, "traits": [ { "id": "micro-behaviors/communications/http/lib/urlconnection::java-url-class-bytecode", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Java URL class reference", "spans": [ [ 2652, 16 ], [ 2681, 12 ], [ 6864, 14 ] ] }, { "id": "micro-behaviors/communications/http/lib/urlconnection::jvm-url-class-ref", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "JVM URL class reference" }, { "id": "micro-behaviors/communications/proxy/tunnel::byte-output-stream", "atk": "T1090", "mbc": "C0003", "conf": 0.5, "crit": 3, "desc": "Java ByteArrayOutputStream usage", "spans": [ [ 732, 21 ], [ 2144, 21 ], [ 6262, 21 ], [ 7145, 21 ], [ 7212, 21 ], [ 7229, 21 ], [ 8580, 21 ] ] }, { "id": "micro-behaviors/communications/proxy/tunnel::inet-socket-address", "atk": "T1090", "mbc": "C0003", "conf": 0.6, "crit": 3, "desc": "Java InetSocketAddress reference", "spans": [ [ 733, 17 ], [ 3233, 17 ] ] }, { "id": "micro-behaviors/communications/socket/create::java-socket-bytecode-reference", "atk": "T1071", "mbc": "C0001", "conf": 0.86, "crit": 3, "desc": "Java bytecode socket reference", "spans": [ [ 3448, 56 ], [ 6538, 17 ] ] }, { "id": "micro-behaviors/communications/socket/create::java-socket-class-import", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "Java imports the network socket class", "spans": [ [ 3160, 15 ] ] }, { "id": "micro-behaviors/communications/socket/create::java-socket-slash-reference", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "Java slash-form socket reference", "spans": [ [ 3160, 15 ], [ 3311, 28 ], [ 3448, 56 ], [ 6538, 17 ] ] }, { "id": "micro-behaviors/communications/socket/create::jvm-socket-class-ref", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "JVM socket class reference" }, { "id": "micro-behaviors/communications/socket/framing::bytebuffer-transport", "atk": "T1573", "conf": 1.0, "crit": 3, "desc": "Java byte-buffer transport type", "spans": [ [ 11119, 10 ] ] }, { "id": "micro-behaviors/communications/socket/framing::data-stream-transport", "atk": "T1573", "conf": 1.0, "crit": 3, "desc": "Java data-stream transport type", "spans": [ [ 9775, 16 ] ] }, { "id": "micro-behaviors/communications/socket/send::java-dataoutputstream-class", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "Java DataOutputStream class reference", "spans": [ [ 9767, 24 ] ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-sslcontext-trustmanager-init-call", "conf": 0.94, "crit": 3, "desc": "JVM SSLContext.init trust-manager call", "spans": [ [ 12198, 29 ] ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-sslparameters-set-server-names", "conf": 0.93, "crit": 3, "desc": "JVM sets TLS SNI server name", "spans": [ [ 3781, 42 ] ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-sslsocket-handshake-call", "conf": 0.94, "crit": 3, "desc": "JVM SSLSocket.startHandshake call", "spans": [ [ 3993, 38 ] ] }, { "id": "micro-behaviors/communications/socket/ssl::jvm-trustmanager-class-ref", "conf": 0.9, "crit": 3, "desc": "JVM TrustManager interface reference", "spans": [ [ 12124, 26 ] ] }, { "id": "micro-behaviors/data/buffer/transfer::bytearrayoutputstream-ref", "conf": 0.88, "crit": 3, "desc": "Java ByteArrayOutputStream class", "spans": [ [ 7137, 29 ] ] }, { "id": "micro-behaviors/data/buffer/transfer::jvm-outputstream-write", "conf": 0.96, "crit": 2, "desc": "JVM writes bytes to output stream", "spans": [ [ 6254, 0 ] ] }, { "id": "micro-behaviors/data/encode/base64::jvm-base64-encode-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM Base64 encodeToString call", "spans": [ [ 10333, 39 ] ] }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method", "spans": [ [ 2136, 8 ] ] }, { "id": "micro-behaviors/os/sysinfo/hostname::jvm-hostname-command-literal", "atk": "T1082", "mbc": "E1082", "conf": 0.9, "crit": 3, "desc": "JVM hostname command literal" }, { "id": "micro-behaviors/process/create/spawn::java-runtime-class", "atk": "T1059", "mbc": "E1203", "conf": 0.86, "crit": 3, "desc": "Java Runtime class reference", "spans": [ [ 9964, 17 ] ] }, { "id": "micro-behaviors/process/info/current::getpath-ref", "conf": 0.8, "crit": 3, "desc": "Java getPath call reference" }, { "id": "objectives/anti-static/obfuscation/string/control-prefix::java-control-prefixed-long-string", "atk": "T1027", "mbc": "F0001", "conf": 0.92, "crit": 3, "desc": "Java string starts with control-length prefix" }, { "id": "objectives/impact/dos/disk::jvm-megabyte-byte-array-constant", "atk": "T1499.001", "conf": 0.94, "crit": 3, "desc": "JVM one-megabyte allocation constant", "spans": [ [ 8275, 14 ] ] }, { "id": "objectives/impact/dos/disk::jvm-two-backward-goto-branches", "atk": "T1499.001", "conf": 0.9, "crit": 3, "desc": "JVM repeated counter backedges", "spans": [ [ 12898, 8 ], [ 13115, 8 ], [ 13391, 8 ], [ 13701, 8 ], [ 14023, 8 ], [ 14577, 8 ], [ 15192, 8 ], [ 15286, 8 ] ] }, { "id": "micro-behaviors/communications/socket/send::java-raw-socket-client-write", "atk": "T1071", "mbc": "C0001", "conf": 0.94, "crit": 3, "desc": "Java socket client writes request bytes through DataOutputStream", "uses": [ 5, 10, 16 ], "spans": [ [ 3160, 15 ], [ 6254, 26 ], [ 9767, 24 ] ] } ], "type": "java_class" }, { "ctx": [ { "b": "+kO#^0000+07c+!8!i/6fk20vxMW=qxMX2@zfybDbVdS-uR+9B2lj=901-)NC404uvqYZhpHX6Iv@}}Q0%5xyygho]CRr@CBt4YRy+F)FfGA9MB-RU0vqYH^wPw1Q1PXPpv@Dh", "ln": 0 } ], "depth": 1, "facts": { "imp": [ [ "", "javax/net/ssl/X509TrustManager" ], [ "", "java/lang/Object" ], [ "", "com/github/hui_mvwv" ], [ "", "java/security/cert/X509Certificate" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ] ], "metrics": { "file": { "size": 1315, "entropy": 5.88 }, "class": { "major_version": 65, "interface_count": 1, "method_ref_count": 1, "constant_pool_size": 67, "external_class_count": 4 }, "binary": { "peak_region_bytes": 1024, "peak_region_entropy": 5.92 }, "imports": { "count": 5 }, "functions": { "count": 4 } } }, "id": 5, "mol": "H(Cm)", "path": "/data/samples/incoming/forager/bad/sha256/bazaar/DonutSMP-Dupe-Mod.jar!!com/github/hui_mvwv$QWr_Oaj.class", "pid": 0, "risk": 1, "sha": "432cad4826aef9c60460df1f39917a099f5f64cf24d8db1728655c6070e4c5cc", "size": 1315, "traits": [ { "id": "micro-behaviors/communications/socket/ssl::jvm-x509trustmanager-class-ref", "conf": 0.94, "crit": 3, "desc": "JVM X509 trust-manager interface reference" }, { "id": "micro-behaviors/communications/socket/ssl::jvm-x509trustmanager-issuer-callback", "conf": 0.94, "crit": 3, "desc": "JVM getAcceptedIssuers callback defined" }, { "id": "micro-behaviors/communications/socket/ssl::jvm-x509trustmanager-server-callback", "conf": 0.94, "crit": 3, "desc": "JVM checkServerTrusted callback defined" }, { "id": "micro-behaviors/communications/socket/ssl::jvm-custom-x509trustmanager", "conf": 0.95, "crit": 3, "desc": "Class implements a custom X509 trust manager", "uses": [ 0, 1, 2 ] } ], "type": "java_class" }, { "ctx": [ { "b": "+kO#^0000+096418!i/6fk20vxMW=qxMX2@zfybDbY4ycwlA}:2lj=901-)NC404uvqYZhpHX6Iv@}}Q0%5xnv@Diqxk8E3BZ^1qB.Li1C6w9m00Jx62w!r!wlA}:0rrEFByxm", "ln": 0 }, { "b": "aPI/G0rr918up@Y3JHkd000]qbleeM0@@r38uq2.5c8?kp5\u003em]0SS(lq2*N@5D\u00267t0000a0000c0000f0000103}Q(0096}0001c00Ao60000S5*]^X5*@p101fz/jr1[ZFijC]jr1[.EIac601oD-TumBkCw6aJ04.n5V\u0026zeM05z1-hlW5X00ic#00007", "ln": 1208 } ], "depth": 1, "facts": { "imp": [ [ "", "java/lang/Object" ], [ "", "java/util/Map" ], [ "", "java/nio/charset/StandardCharsets" ], [ "", "com/github/hui_mvwv" ], [ "", "java/lang/String" ], [ "com/github/hui_mvwv$loadYre", "com/github/hui_mvwv$loadYre.statusCode" ], [ "com/github/hui_mvwv$loadYre", "statusCode" ], [ "java/lang/String", "java/lang/String.toLowerCase" ], [ "java/lang/String", "toLowerCase" ], [ "java/util/Map", "java/util/Map.get" ], [ "java/util/Map", "get" ], [ "com/github/hui_mvwv$loadYre", "com/github/hui_mvwv$loadYre.statusLine" ], [ "com/github/hui_mvwv$loadYre", "statusLine" ], [ "java/nio/charset/StandardCharsets", "java/nio/charset/StandardCharsets.UTF_8" ], [ "java/nio/charset/StandardCharsets", "UTF_8" ], [ "com/github/hui_mvwv$loadYre", "com/github/hui_mvwv$loadYre.headers" ], [ "com/github/hui_mvwv$loadYre", "headers" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ], [ "com/github/hui_mvwv$loadYre", "com/github/hui_mvwv$loadYre.body" ], [ "com/github/hui_mvwv$loadYre", "body" ], [ "java/lang/String", "java/lang/String.\u003cinit\u003e" ], [ "java/lang/String", "\u003cinit\u003e" ] ], "metrics": { "file": { "size": 1540, "entropy": 5.72 }, "class": { "major_version": 65, "interface_count": 0, "method_ref_count": 9, "constant_pool_size": 85, "external_class_count": 5 }, "binary": { "peak_region_bytes": 1024, "peak_region_entropy": 5.75 }, "imports": { "count": 14 }, "functions": { "count": 3 } } }, "id": 6, "path": "/data/samples/incoming/forager/bad/sha256/bazaar/DonutSMP-Dupe-Mod.jar!!com/github/hui_mvwv$loadYre.class", "pid": 0, "risk": 1, "sha": "7d04d7769eb7a6812aaf4eb7324df8a2c4719b0728e20ecee4563648d0d95278", "size": 1540, "traits": [ { "id": "metadata/binary/code/complexity::few-functions-3", "conf": 1.0, "crit": 2, "desc": "Binary has 3+ functions" }, { "id": "metadata/binary/code/complexity::functions-at-most-24", "conf": 1.0, "crit": 2, "desc": "Binary has 24 or fewer functions" }, { "id": "metadata/binary/code/complexity::functions-at-most-32", "conf": 1.0, "crit": 2, "desc": "Binary has 32 or fewer functions" }, { "id": "micro-behaviors/os/env/gate::jvm-opaque-environment-key", "conf": 0.94, "crit": 1, "desc": "JVM class has generated gate value" } ], "type": "java_class" }, { "ctx": [ { "b": "+kO#^0000+051uMc1y\u003egfk20vxMW=qxMX2@zfybDbX}WKD1gh}C4\u003ex4uUjs{A=hf.0rAfiygho]fkL6mxd)4\u0026ygQ)%2lj\u0026b025\u003cXz7/KoBzb/afkbGxuU%$gB{w0J0rrZED3T-", "ln": 0 } ], "depth": 1, "facts": { "imp": [ [ "", "com/github/hui_mvwv" ], [ "", "java/lang/Object" ], [ "", "java/lang/System" ], [ "com/github/hui_mvwv$kyzyc_iviam_frlro", "com/github/hui_mvwv$kyzyc_iviam_frlro.expiresAt" ], [ "com/github/hui_mvwv$kyzyc_iviam_frlro", "expiresAt" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ], [ "com/github/hui_mvwv$kyzyc_iviam_frlro", "com/github/hui_mvwv$kyzyc_iviam_frlro.ip" ], [ "com/github/hui_mvwv$kyzyc_iviam_frlro", "ip" ], [ "java/lang/System", "java/lang/System.currentTimeMillis" ], [ "java/lang/System", "currentTimeMillis" ] ], "metrics": { "file": { "size": 783, "entropy": 5.41 }, "class": { "major_version": 65, "interface_count": 0, "method_ref_count": 4, "constant_pool_size": 47, "external_class_count": 3 }, "binary": { "peak_region_bytes": 783, "peak_region_entropy": 5.41 }, "imports": { "count": 7 }, "functions": { "count": 2 } } }, "id": 7, "path": "/data/samples/incoming/forager/bad/sha256/bazaar/DonutSMP-Dupe-Mod.jar!!com/github/hui_mvwv$kyzyc_iviam_frlro.class", "pid": 0, "risk": 1, "sha": "1b87522d2105367efd7de589c466d008a520cc056b9ce78fc2ed3b04cfdb207d", "size": 783, "traits": [ { "id": "metadata/binary/code/complexity::functions-at-most-24", "conf": 1.0, "crit": 2, "desc": "Binary has 24 or fewer functions" }, { "id": "metadata/binary/code/complexity::functions-at-most-32", "conf": 1.0, "crit": 2, "desc": "Binary has 32 or fewer functions" }, { "id": "metadata/file/magic/identity::cafebabe-magic", "conf": 1.0, "crit": 2, "desc": "CAFEBABE magic at file start", "spans": [ [ 0, 0 ] ] }, { "id": "micro-behaviors/os/env/gate::jvm-opaque-environment-key", "conf": 0.94, "crit": 1, "desc": "JVM class has generated gate value" } ], "type": "java_class" }, { "ctx": [ { "b": "DKp(rb6dmcwO\u003e\u003cRwPz\u003caz/c:wiV{dd3lQDnx\u003eezgiV]R=vpK7YxjSnr3lQDnC4CYnx(v(kauyR?f!LdjfD@4ParR\u003eCvqPN1auyR?p*)\u003cHvp%c}ed9Hxb4Lnav/", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 435, "entropy": 4.58 }, "json": { "parsed_bytes": 435, "parse_limit_bytes": 76800 }, "binary": { "peak_region_bytes": 435, "peak_region_entropy": 4.58 } } }, "id": 9, "mol": "Md(Pa)", "path": "/data/samples/incoming/forager/bad/sha256/bazaar/DonutSMP-Dupe-Mod.jar!!fabric.mod.json", "pid": 0, "risk": 1, "sha": "a1984e74774e6ae1705451116de28d726b4fd8f148ae23cb666b6c9d08144fe3", "size": 435, "traits": [ { "id": "metadata/package/config::fabric-mod-metadata", "conf": 0.9, "crit": 3, "desc": "Fabric mod metadata resource" } ], "type": "json" } ], "rev": "c1ea9", "v": "8" } }