{ "statistics": { "processing": [ { "name": "CAPE", "time": 0.615 }, { "name": "AnalysisInfo", "time": 0.01 }, { "name": "BehaviorAnalysis", "time": 0.001 }, { "name": "Debug", "time": 0.001 }, { "name": "NetworkAnalysis", "time": 0.005 }, { "name": "UrlAnalysis", "time": 0.0 }, { "name": "script_log_processing", "time": 0.0 }, { "name": "ProcessMemory", "time": 0.0 } ], "signatures": [ { "name": "packer_themida", "time": 0.0 }, { "name": "stealth_network", "time": 0.0 }, { "name": "disable_driver_via_blocklist", "time": 0.0 }, { "name": "disable_driver_via_hvcidisallowedimages", "time": 0.0 }, { "name": "disable_hypervisor_protected_code_integrity", "time": 0.0 }, { "name": "pendingfilerenameoperations_Operations", "time": 0.0 }, { "name": "anomalous_deletefile", "time": 0.0 }, { "name": "antiav_servicestop", "time": 0.0 }, { "name": "antidebug_guardpages", "time": 0.0 }, { "name": "antidebug_outputdebugstring", "time": 0.0 }, { "name": "antidebug_windows", "time": 0.0 }, { "name": "antisandbox_cuckoocrash", "time": 0.0 }, { "name": "antisandbox_foregroundwindows", "time": 0.0 }, { "name": "mouse_movement_detect", "time": 0.0 }, { "name": "antisandbox_script_timer", "time": 0.0 }, { "name": "antisandbox_sleep", "time": 0.0 }, { "name": "antisandbox_unhook", "time": 0.0 }, { "name": "hardware_id_profiling", "time": 0.0 }, { "name": "antivm_directory_objects", "time": 0.0 }, { "name": "antivm_display", "time": 0.0 }, { "name": "antivm_generic_system", "time": 0.0 }, { "name": "antivm_checks_available_memory", "time": 0.0 }, { "name": "detect_virtualization_via_recent_files", "time": 0.0 }, { "name": "antivm_vmware_events", "time": 0.0 }, { "name": "antivm_wmi", "time": 0.0 }, { "name": "api_spamming", "time": 0.0 }, { "name": "api_uuidfromstringa", "time": 0.0 }, { "name": "bcdedit_command", "time": 0.0 }, { "name": "direct_hdd_access", "time": 0.0 }, { "name": "physical_drive_access", "time": 0.0 }, { "name": "potential_overwrite_mbr", "time": 0.0 }, { "name": "read_file_raw_disk_access", "time": 0.0 }, { "name": "suspicious_iocontrol_codes", "time": 0.0 }, { "name": "browser_needed", "time": 0.0 }, { "name": "amsi_enumeration", "time": 0.0 }, { "name": "suspicious_ntdll_disk_load", "time": 0.0 }, { "name": "direct_syscall_evasion", "time": 0.0 }, { "name": "unbacked_syscall_execution", "time": 0.0 }, { "name": "uac_bypass_cmstp", "time": 0.0 }, { "name": "uac_bypass_eventvwr", "time": 0.0 }, { "name": "privilege_elevation_check", "time": 0.0 }, { "name": "dotnet_code_compile", "time": 0.0 }, { "name": "queries_computer_name", "time": 0.0 }, { "name": "queries_user_name", "time": 0.0 }, { "name": "creates_largekey", "time": 0.0 }, { "name": "creates_nullvalue", "time": 0.0 }, { "name": "access_windows_passwords_vault", "time": 0.0 }, { "name": "lsass_credential_dumping", "time": 0.0 }, { "name": "critical_process", "time": 0.0 }, { "name": "query_fips_reconnaissance", "time": 0.0 }, { "name": "cryptopool_domains", "time": 0.0 }, { "name": "dead_connect", "time": 0.0 }, { "name": "dead_link", "time": 0.0 }, { "name": "decoy_document", "time": 0.0 }, { "name": "decoy_image", "time": 0.0 }, { "name": "deletes_consolehost_history", "time": 0.0 }, { "name": "dep_bypass", "time": 0.0 }, { "name": "dep_disable", "time": 0.0 }, { "name": "disables_wfp", "time": 0.0 }, { "name": "add_windows_defender_exclusions", "time": 0.0 }, { "name": "mountpoints_volume_discovery", "time": 0.0 }, { "name": "dllload_suspicious_directory", "time": 0.0 }, { "name": "document_script_exe_drop", "time": 0.0 }, { "name": "driver_load", "time": 0.0 }, { "name": "install_kernel_driver_service", "time": 0.0 }, { "name": "malformed_dll_loading", "time": 0.0 }, { "name": "dynamic_function_loading", "time": 0.0 }, { "name": "encrypted_ioc", "time": 0.0 }, { "name": "registers_vectored_exception_handler", "time": 0.0 }, { "name": "process_creation_suspicious_location", "time": 0.0 }, { "name": "exploit_getbasekerneladdress", "time": 0.0 }, { "name": "exploit_gethaldispatchtable", "time": 0.0 }, { "name": "exploit_heapspray", "time": 0.0 }, { "name": "downloads_from_filehosting", "time": 0.0 }, { "name": "generic_phish", "time": 0.0 }, { "name": "http_request", "time": 0.0 }, { "name": "infostealer_browser", "time": 0.0 }, { "name": "infostealer_browser_password", "time": 0.0 }, { "name": "infostealer_cookies", "time": 0.0 }, { "name": "captures_screenshot", "time": 0.0 }, { "name": "creates_suspended_process", "time": 0.0 }, { "name": "injection_module_stomping_probing", "time": 0.0 }, { "name": "injection_network_traffic", "time": 0.0 }, { "name": "section_mapping_injection", "time": 0.0 }, { "name": "injection_themeinitapihook", "time": 0.0 }, { "name": "apc_injection", "time": 0.0 }, { "name": "resumethread_remote_process", "time": 0.0 }, { "name": "injection_write_exe_process", "time": 0.0 }, { "name": "injection_write_process", "time": 0.0 }, { "name": "internet_dropper", "time": 0.0 }, { "name": "interprocess_comms_mutex", "time": 0.0 }, { "name": "interprocess_comms_named_pipe", "time": 0.0 }, { "name": "interprocess_comms_shared_memory", "time": 0.0 }, { "name": "escalate_privilege_via_named_pipe", "time": 0.0 }, { "name": "ipc_namedpipe", "time": 0.0 }, { "name": "js_phish", "time": 0.0 }, { "name": "js_suspicious_redirect", "time": 0.0 }, { "name": "execute_binary_via_internet_explorer_exporter", "time": 0.0 }, { "name": "execute_binary_via_run_exe_helper_utility", "time": 0.0 }, { "name": "execute_ps_via_syncappvpublishingserver", "time": 0.0 }, { "name": "malicious_dynamic_function_loading", "time": 0.0 }, { "name": "reads_memory_remote_process", "time": 0.0 }, { "name": "unbacked_exception_filter", "time": 0.0 }, { "name": "unbacked_process_mitigation_alteration", "time": 0.0 }, { "name": "thread_unbacked_memory", "time": 0.0 }, { "name": "unbacked_api_resolution", "time": 0.0 }, { "name": "unbacked_dotnet_execution", "time": 0.0 }, { "name": "unbacked_library_load", "time": 0.0 }, { "name": "unbacked_memory_apc_execution", "time": 0.0 }, { "name": "unbacked_memory_protection_alteration", "time": 0.0 }, { "name": "unbacked_mutex_creation", "time": 0.0 }, { "name": "unbacked_process_creation", "time": 0.0 }, { "name": "unbacked_veh_registration", "time": 0.0 }, { "name": "unbacked_com_instantiation", "time": 0.0 }, { "name": "unbacked_crypto_operations", "time": 0.0 }, { "name": "unbacked_delay_execution", "time": 0.0 }, { "name": "unbacked_file_dropping", "time": 0.0 }, { "name": "unbacked_process_enumeration", "time": 0.0 }, { "name": "unbacked_registry_modification", "time": 0.0 }, { "name": "unbacked_service_manipulation", "time": 0.0 }, { "name": "unbacked_token_manipulation", "time": 0.0 }, { "name": "unbacked_wmi_execution", "time": 0.0 }, { "name": "unbacked_bind_shell", "time": 0.0 }, { "name": "unbacked_dns_resolution", "time": 0.0 }, { "name": "unbacked_memory_network_connection", "time": 0.0 }, { "name": "unbacked_named_pipe_creation", "time": 0.0 }, { "name": "unbacked_useragent_retrieval", "time": 0.0 }, { "name": "mimics_filetime", "time": 0.0 }, { "name": "amsi_bypass_via_com_registry", "time": 0.0 }, { "name": "access_auto_logons_via_registry", "time": 0.0 }, { "name": "access_boot_key_via_registry", "time": 0.0 }, { "name": "create_suspicious_lnk_files", "time": 0.0 }, { "name": "credential_access_via_windows_credential_history", "time": 0.0 }, { "name": "dll_hijacking_via_microsoft_exchange", "time": 0.0 }, { "name": "dll_hijacking_via_waas_medic_svc_com_typelib", "time": 0.0 }, { "name": "execute_file_downloaded_via_openssh", "time": 0.0 }, { "name": "execute_safe_mode_from_suspicious_process", "time": 0.0 }, { "name": "execute_scripts_via_microsoft_management_console", "time": 0.0 }, { "name": "execute_suspicious_processes_via_windows_mssql_service", "time": 0.0 }, { "name": "execution_from_self_extracting_archive", "time": 0.0 }, { "name": "ip_address_discovery_via_trusted_program", "time": 0.0 }, { "name": "load_dll_via_control_panel", "time": 0.0 }, { "name": "network_connection_via_suspicious_process", "time": 0.0 }, { "name": "potential_location_discovery_via_unusual_process", "time": 0.0 }, { "name": "store_executable_registry", "time": 0.0 }, { "name": "Suspicious_Execution_Via_MicrosoftExchangeTransportAgent", "time": 0.0 }, { "name": "suspicious_java_execution_via_win_scripts", "time": 0.0 }, { "name": "Suspicious_Scheduled_Task_Creation_Via_Masqueraded_XML_File", "time": 0.0 }, { "name": "uses_restart_manager_for_suspicious_activities", "time": 0.0 }, { "name": "modify_desktop_wallpaper", "time": 0.0 }, { "name": "move_file_on_reboot", "time": 0.0 }, { "name": "multiple_useragents", "time": 0.0 }, { "name": "network_anomaly", "time": 0.0 }, { "name": "network_bind", "time": 0.0 }, { "name": "etherhiding_smart_contract_call", "time": 0.0 }, { "name": "network_cnc_https_archive", "time": 0.0 }, { "name": "network_cnc_https_free_webhosting", "time": 0.0 }, { "name": "network_cnc_https_generic", "time": 0.0 }, { "name": "network_cnc_https_interactsh", "time": 0.0 }, { "name": "network_cnc_https_opensource", "time": 0.0 }, { "name": "network_cnc_https_pastesite", "time": 0.0 }, { "name": "network_cnc_https_payload", "time": 0.0 }, { "name": "network_cnc_https_serviceinterface", "time": 0.0 }, { "name": "network_cnc_https_socialmedia", "time": 0.0 }, { "name": "network_cnc_https_telegram", "time": 0.0 }, { "name": "network_cnc_https_tempstorage", "time": 0.0 }, { "name": "network_cnc_https_temp_urldns", "time": 0.0 }, { "name": "network_cnc_https_urlshortener", "time": 0.0 }, { "name": "network_cnc_https_useragent", "time": 0.0 }, { "name": "network_cnc_smtps_exfil", "time": 0.0 }, { "name": "network_cnc_smtps_generic", "time": 0.0 }, { "name": "network_dns_idn", "time": 0.0 }, { "name": "network_dns_suspicious_querytype", "time": 0.0 }, { "name": "network_dns_tunneling_request", "time": 0.0 }, { "name": "network_document_http", "time": 0.0 }, { "name": "explorer_http", "time": 0.0 }, { "name": "network_fake_useragent", "time": 0.0 }, { "name": "legitimate_domain_abuse", "time": 0.0 }, { "name": "suspicious_communication_trusted_site", "time": 0.0 }, { "name": "network_tor", "time": 0.0 }, { "name": "office_cve2017_11882", "time": 0.0 }, { "name": "office_cve2017_11882_network", "time": 0.0 }, { "name": "office_cve_2021_40444", "time": 0.0 }, { "name": "office_cve_2021_40444_m2", "time": 0.0 }, { "name": "office_flash_load", "time": 0.0 }, { "name": "office_postscript", "time": 0.0 }, { "name": "office_suspicious_processes", "time": 0.0 }, { "name": "office_write_exe", "time": 0.0 }, { "name": "decompress_exe", "time": 0.0 }, { "name": "persistence_via_autodial_dll_registry", "time": 0.0 }, { "name": "persistence_autorun", "time": 0.0 }, { "name": "persistence_autorun_tasks", "time": 0.0 }, { "name": "persistence_bootexecute", "time": 0.0 }, { "name": "persistence_registry_script", "time": 0.0 }, { "name": "powershell_network_connection", "time": 0.0 }, { "name": "powershell_download", "time": 0.0 }, { "name": "powershell_request", "time": 0.0 }, { "name": "createtoolhelp32snapshot_module_enumeration", "time": 0.0 }, { "name": "enumerates_running_processes", "time": 0.0 }, { "name": "process_interest", "time": 0.0 }, { "name": "process_needed", "time": 0.0 }, { "name": "ransomware_iocp_asynchronous_encryption", "time": 0.0 }, { "name": "kernel_crypto_driver_abuse", "time": 0.0 }, { "name": "mass_data_encryption", "time": 0.0 }, { "name": "ransomware_extension_hijack", "time": 0.0 }, { "name": "mass_file_modification_access", "time": 0.0 }, { "name": "ransomware_attribute_stripping", "time": 0.0 }, { "name": "ransomware_file_modifications", "time": 0.0 }, { "name": "mass_ransom_note_drop", "time": 0.0 }, { "name": "ransomware_message", "time": 0.0 }, { "name": "reads_self", "time": 0.0 }, { "name": "recon_beacon", "time": 0.0 }, { "name": "recon_programs", "time": 0.0 }, { "name": "accesses_recyclebin", "time": 0.0 }, { "name": "script_created_process", "time": 0.0 }, { "name": "script_network_activity", "time": 0.0 }, { "name": "suspicious_js_script", "time": 0.0 }, { "name": "javascript_timer", "time": 0.0 }, { "name": "secure_login_phishing", "time": 0.0 }, { "name": "securityxploded_modules", "time": 0.0 }, { "name": "get_clipboard_data", "time": 0.0 }, { "name": "sets_autoconfig_url", "time": 0.0 }, { "name": "spoofs_procname", "time": 0.0 }, { "name": "stack_pivot", "time": 0.0 }, { "name": "stack_pivot_file_created", "time": 0.0 }, { "name": "stack_pivot_process_create", "time": 0.0 }, { "name": "set_clipboard_data", "time": 0.0 }, { "name": "stealth_childproc", "time": 0.0 }, { "name": "stealth_file", "time": 0.0 }, { "name": "stealth_window", "time": 0.0 }, { "name": "queries_keyboard_layout", "time": 0.0 }, { "name": "queries_locale_api", "time": 0.0 }, { "name": "terminates_remote_process", "time": 0.0 }, { "name": "user_enum", "time": 0.0 }, { "name": "virus", "time": 0.0 }, { "name": "webmail_phish", "time": 0.0 }, { "name": "persists_dev_util", "time": 0.0 }, { "name": "spawns_dev_util", "time": 0.0 }, { "name": "alters_windows_utility", "time": 0.0 }, { "name": "overwrites_accessibility_utility", "time": 0.0 }, { "name": "Potential_Lateral_Movement_Via_SMBEXEC", "time": 0.0 }, { "name": "potential_WebShell_Via_ScreenConnectServer", "time": 0.0 }, { "name": "uses_Microsoft_HTML_Help_Executable", "time": 0.0 }, { "name": "wiper_zeroedbytes", "time": 0.0 }, { "name": "wmi_create_process", "time": 0.0 }, { "name": "wmi_script_process", "time": 0.0 }, { "name": "antianalysis_tls_section", "time": 0.0 }, { "name": "antivirus_clamav", "time": 0.0 }, { "name": "antivirus_virustotal", "time": 0.0 }, { "name": "bad_certs", "time": 0.0 }, { "name": "bad_ssl_certs", "time": 0.0 }, { "name": "banker_zeus_p2p", "time": 0.0 }, { "name": "banker_zeus_url", "time": 0.0 }, { "name": "binary_yara", "time": 0.0 }, { "name": "bot_athenahttp", "time": 0.0 }, { "name": "bot_dirtjumper", "time": 0.0 }, { "name": "bot_drive", "time": 0.0 }, { "name": "bot_drive2", "time": 0.0 }, { "name": "bot_madness", "time": 0.0 }, { "name": "byod_loldrivers_match", "time": 0.0 }, { "name": "byod_novel_driver", "time": 0.0 }, { "name": "byod_post_load_exploitation", "time": 0.0 }, { "name": "byod_driver_service_install", "time": 0.0 }, { "name": "com_spawned_process", "time": 0.0 }, { "name": "phishing_kit_detected", "time": 0.0 }, { "name": "family_proxyback", "time": 0.0 }, { "name": "flare_capa_antianalysis", "time": 0.0 }, { "name": "flare_capa_collection", "time": 0.0 }, { "name": "flare_capa_communication", "time": 0.0 }, { "name": "flare_capa_compiler", "time": 0.0 }, { "name": "flare_capa_datamanipulation", "time": 0.0 }, { "name": "flare_capa_executable", "time": 0.0 }, { "name": "flare_capa_hostinteraction", "time": 0.0 }, { "name": "flare_capa_impact", "time": 0.0 }, { "name": "flare_capa_lib", "time": 0.0 }, { "name": "flare_capa_linking", "time": 0.0 }, { "name": "flare_capa_loadcode", "time": 0.0 }, { "name": "flare_capa_malwarefamily", "time": 0.0 }, { "name": "flare_capa_nursery", "time": 0.0 }, { "name": "flare_capa_persistence", "time": 0.0 }, { "name": "flare_capa_runtime", "time": 0.0 }, { "name": "flare_capa_targeting", "time": 0.0 }, { "name": "threatfox", "time": 0.0 }, { "name": "log4shell", "time": 0.0 }, { "name": "mimics_extension", "time": 0.0 }, { "name": "network_country_distribution", "time": 0.0 }, { "name": "network_cnc_http", "time": 0.0 }, { "name": "network_ip_exe", "time": 0.0 }, { "name": "network_dga", "time": 0.0 }, { "name": "network_dga_fraunhofer", "time": 0.0 }, { "name": "network_dyndns", "time": 0.0 }, { "name": "network_excessive_udp", "time": 0.0 }, { "name": "network_http", "time": 0.0 }, { "name": "network_icmp", "time": 0.0 }, { "name": "network_irc", "time": 0.0 }, { "name": "network_open_proxy", "time": 0.0 }, { "name": "network_questionable_http_path", "time": 0.0 }, { "name": "network_questionable_https_path", "time": 0.0 }, { "name": "network_smtp", "time": 0.0 }, { "name": "network_torgateway", "time": 0.0 }, { "name": "origin_langid", "time": 0.0 }, { "name": "origin_resource_langid", "time": 0.0 }, { "name": "overlay", "time": 0.0 }, { "name": "pe_deep_entrypoint", "time": 0.0 }, { "name": "packer_unknown_pe_section_name", "time": 0.0 }, { "name": "packer_aspack", "time": 0.0 }, { "name": "packer_aspirecrypt", "time": 0.0 }, { "name": "packer_bedsprotector", "time": 0.0 }, { "name": "packer_confuser", "time": 0.0 }, { "name": "packer_enigma", "time": 0.0 }, { "name": "packer_entropy", "time": 0.0 }, { "name": "packer_mpress", "time": 0.0 }, { "name": "packer_nate", "time": 0.0 }, { "name": "packer_nspack", "time": 0.0 }, { "name": "packer_smartassembly", "time": 0.0 }, { "name": "packer_spices", "time": 0.0 }, { "name": "packer_themida", "time": 0.0 }, { "name": "packer_titan", "time": 0.0 }, { "name": "packer_upx", "time": 0.0 }, { "name": "packer_vmprotect", "time": 0.0 }, { "name": "packer_yoda", "time": 0.0 }, { "name": "pdf_annot_urls_checker", "time": 0.0 }, { "name": "pe_cert_invalid_signature", "time": 0.0 }, { "name": "pe_cert_self_signed", "time": 0.0 }, { "name": "pe_cert_suspicious_issuer", "time": 0.0 }, { "name": "polymorphic", "time": 0.0 }, { "name": "punch_plus_plus_pcres", "time": 0.0 }, { "name": "procmem_yara", "time": 0.0 }, { "name": "recon_checkip", "time": 0.0 }, { "name": "sigma_events", "time": 0.0 }, { "name": "static_authenticode", "time": 0.0 }, { "name": "invalid_authenticode_signature", "time": 0.0 }, { "name": "static_dotnet_anomaly", "time": 0.0 }, { "name": "static_java", "time": 0.0 }, { "name": "static_pdf", "time": 0.0 }, { "name": "contains_pe_overlay", "time": 0.0 }, { "name": "static_pe_anomaly", "time": 0.0 }, { "name": "pe_compile_timestomping", "time": 0.0 }, { "name": "static_pe_pdbpath", "time": 0.0 }, { "name": "static_rat_config", "time": 0.0 }, { "name": "static_versioninfo_anomaly", "time": 0.0 }, { "name": "browser_credential_theft_headless", "time": 0.0 }, { "name": "suricata_alert", "time": 0.0 }, { "name": "suspicious_html_body", "time": 0.0 }, { "name": "suspicious_html_name", "time": 0.0 }, { "name": "suspicious_html_title", "time": 0.0 }, { "name": "volatility_devicetree_1", "time": 0.0 }, { "name": "volatility_handles_1", "time": 0.0 }, { "name": "volatility_ldrmodules_1", "time": 0.0 }, { "name": "volatility_ldrmodules_2", "time": 0.0 }, { "name": "volatility_malfind_1", "time": 0.0 }, { "name": "volatility_malfind_2", "time": 0.0 }, { "name": "volatility_modscan_1", "time": 0.0 }, { "name": "volatility_svcscan_1", "time": 0.0 }, { "name": "volatility_svcscan_2", "time": 0.0 }, { "name": "volatility_svcscan_3", "time": 0.0 }, { "name": "whois_create", "time": 0.0 }, { "name": "accesses_mailslot", "time": 0.0 }, { "name": "accesses_netlogon_regkey", "time": 0.0 }, { "name": "accesses_public_folder", "time": 0.0 }, { "name": "accesses_sysvol", "time": 0.0 }, { "name": "writes_sysvol", "time": 0.0 }, { "name": "adds_admin_user", "time": 0.0 }, { "name": "adds_user", "time": 0.0 }, { "name": "overwrites_admin_password", "time": 0.0 }, { "name": "antianalysis_detectfile", "time": 0.001 }, { "name": "antianalysis_detectreg", "time": 0.001 }, { "name": "modify_attachment_manager", "time": 0.0 }, { "name": "antiav_detectfile", "time": 0.002 }, { "name": "antiav_detectreg", "time": 0.002 }, { "name": "antiav_srp", "time": 0.0 }, { "name": "antiav_whitespace", "time": 0.0 }, { "name": "antidebug_devices", "time": 0.0 }, { "name": "antiemu_windefend", "time": 0.0 }, { "name": "antiemu_wine_reg", "time": 0.0 }, { "name": "antisandbox_cuckoo_files", "time": 0.0 }, { "name": "antisandbox_fortinet_files", "time": 0.0 }, { "name": "antisandbox_joe_anubis_files", "time": 0.0 }, { "name": "antisandbox_sboxie_mutex", "time": 0.0 }, { "name": "antisandbox_sunbelt_files", "time": 0.0 }, { "name": "antisandbox_threattrack_files", "time": 0.0 }, { "name": "antivm_bochs_keys", "time": 0.0 }, { "name": "antivm_generic_bios", "time": 0.0 }, { "name": "antivm_generic_diskreg", "time": 0.0 }, { "name": "antivm_hyperv_keys", "time": 0.0 }, { "name": "antivm_parallels_keys", "time": 0.0 }, { "name": "antivm_recentdocs", "time": 0.0 }, { "name": "antivm_vbox_devices", "time": 0.0 }, { "name": "antivm_vbox_files", "time": 0.001 }, { "name": "antivm_vbox_keys", "time": 0.0 }, { "name": "antivm_vmware_devices", "time": 0.0 }, { "name": "antivm_vmware_files", "time": 0.0 }, { "name": "antivm_vmware_keys", "time": 0.0 }, { "name": "antivm_vmware_mutexes", "time": 0.0 }, { "name": "antivm_vpc_files", "time": 0.0 }, { "name": "antivm_vpc_keys", "time": 0.0 }, { "name": "antivm_vpc_mutex", "time": 0.0 }, { "name": "antivm_xen_keys", "time": 0.0 }, { "name": "ketrican_regkeys", "time": 0.0 }, { "name": "bitcoin_opencl", "time": 0.0 }, { "name": "enumerates_physical_drives", "time": 0.0 }, { "name": "bot_russkill", "time": 0.0 }, { "name": "browser_addon", "time": 0.0 }, { "name": "chromium_browser_extension_directory", "time": 0.0 }, { "name": "browser_helper_object", "time": 0.0 }, { "name": "browser_security", "time": 0.001 }, { "name": "browser_startpage", "time": 0.0 }, { "name": "executes_headless_browser", "time": 0.0 }, { "name": "suspicious_browser_arguments", "time": 0.0 }, { "name": "ie_disables_process_tab", "time": 0.0 }, { "name": "odbcconf_bypass", "time": 0.0 }, { "name": "squiblydoo_bypass", "time": 0.0 }, { "name": "squiblytwo_bypass", "time": 0.0 }, { "name": "bypass_chromium_protection", "time": 0.0 }, { "name": "bypass_firewall", "time": 0.0 }, { "name": "checks_uac_status", "time": 0.0 }, { "name": "uac_bypass_cmstpcom", "time": 0.0 }, { "name": "uac_bypass_delegateexecute_sdclt", "time": 0.0 }, { "name": "uac_bypass_fodhelper", "time": 0.0 }, { "name": "cape_extracted_content", "time": 0.0 }, { "name": "clears_logs", "time": 0.0 }, { "name": "cmdline_obfuscation", "time": 0.0 }, { "name": "cmdline_switches", "time": 0.0 }, { "name": "cmdline_terminate", "time": 0.0 }, { "name": "cmdline_forfiles_wildcard", "time": 0.0 }, { "name": "cmdline_http_link", "time": 0.0 }, { "name": "cmdline_long_string", "time": 0.0 }, { "name": "cmdline_reversed_http_link", "time": 0.0 }, { "name": "long_commandline", "time": 0.0 }, { "name": "powershell_renamed_commandline", "time": 0.0 }, { "name": "copies_self", "time": 0.0 }, { "name": "credwiz_credentialaccess", "time": 0.0 }, { "name": "enables_wdigest", "time": 0.0 }, { "name": "vaultcmd_credentialaccess", "time": 0.0 }, { "name": "file_credential_store_access", "time": 0.0 }, { "name": "file_credential_store_write", "time": 0.0 }, { "name": "kerberos_credential_access_via_rubeus", "time": 0.0 }, { "name": "registry_credential_dumping", "time": 0.0 }, { "name": "registry_credential_store_access", "time": 0.0 }, { "name": "registry_lsa_secrets_access", "time": 0.0 }, { "name": "comsvcs_credentialdump", "time": 0.0 }, { "name": "cryptomining_stratum_command", "time": 0.0 }, { "name": "deepfreeze_mutex", "time": 0.0 }, { "name": "deletes_executed_files", "time": 0.0 }, { "name": "disables_app_launch", "time": 0.0 }, { "name": "disables_auto_app_termination", "time": 0.0 }, { "name": "disables_appv_virtualization", "time": 0.0 }, { "name": "disables_backups", "time": 0.001 }, { "name": "disables_browser_warn", "time": 0.001 }, { "name": "disables_context_menus", "time": 0.0 }, { "name": "disables_cpl_disable", "time": 0.0 }, { "name": "disables_crashdumps", "time": 0.0 }, { "name": "disables_event_logging", "time": 0.0 }, { "name": "disables_folder_options", "time": 0.0 }, { "name": "disables_notificationcenter", "time": 0.0 }, { "name": "disables_power_options", "time": 0.001 }, { "name": "disables_restore_default_state", "time": 0.0 }, { "name": "disables_run_command", "time": 0.0 }, { "name": "disables_smartscreen", "time": 0.0 }, { "name": "disables_startmenu_search", "time": 0.0 }, { "name": "disables_system_restore", "time": 0.0 }, { "name": "disables_uac", "time": 0.0 }, { "name": "disables_wer", "time": 0.0 }, { "name": "disables_windows_defender", "time": 0.0 }, { "name": "disables_windows_defender_logging", "time": 0.0 }, { "name": "removes_windows_defender_contextmenu", "time": 0.0 }, { "name": "removes_windows_defender_updates", "time": 0.0 }, { "name": "windows_defender_powershell", "time": 0.0 }, { "name": "disables_windows_file_protection", "time": 0.0 }, { "name": "disables_windowsupdate", "time": 0.0 }, { "name": "disables_winfirewall", "time": 0.0 }, { "name": "folder_enumeration", "time": 0.0 }, { "name": "discover_registry_mount_points", "time": 0.0 }, { "name": "adfind_domain_enumeration", "time": 0.0 }, { "name": "domain_enumeration_commands", "time": 0.0 }, { "name": "driver_filtermanager", "time": 0.0 }, { "name": "dropper", "time": 0.0 }, { "name": "dll_archive_execution", "time": 0.0 }, { "name": "lnk_archive_execution", "time": 0.0 }, { "name": "script_archive_execution", "time": 0.0 }, { "name": "excel4_macro_urls", "time": 0.0 }, { "name": "escalate_privilege_via_ntlm_relay", "time": 0.0 }, { "name": "spooler_access", "time": 0.0 }, { "name": "spooler_svc_start", "time": 0.0 }, { "name": "mapped_drives_uac", "time": 0.0 }, { "name": "hides_recycle_bin_icon", "time": 0.0 }, { "name": "infostealer_bitcoin", "time": 0.001 }, { "name": "infostealer_ftp", "time": 0.001 }, { "name": "infostealer_im", "time": 0.001 }, { "name": "infostealer_mail", "time": 0.001 }, { "name": "Evade_Execution_Via_ASPNet_Compiler", "time": 0.0 }, { "name": "Evade_Execute_Via_DeviceCredentialDeployment", "time": 0.0 }, { "name": "Evade_Execution_Via_Filter_Manager_Control", "time": 0.0 }, { "name": "Evade_Execution_Via_Intel_GFXDownloadWrapper", "time": 0.0 }, { "name": "execute_binary_via_appvlp", "time": 0.0 }, { "name": "execute_binary_via_pcalua", "time": 0.0 }, { "name": "Execute_Binary_Via_OpenSSH", "time": 0.0 }, { "name": "execute_binary_via_pcalua", "time": 0.0 }, { "name": "Execute_Binary_Via_PesterPSModule", "time": 0.0 }, { "name": "Execute_Binary_Via_ScriptRunner", "time": 0.0 }, { "name": "execute_binary_via_ttdinject", "time": 0.0 }, { "name": "Execute_Binary_Via_VisualStudioLiveShare", "time": 0.0 }, { "name": "Execute_Msiexec_Via_Explorer", "time": 0.0 }, { "name": "execute_remote_msi", "time": 0.0 }, { "name": "execute_suspicious_powershell_via_runscripthelper", "time": 0.0 }, { "name": "execute_suspicious_powershell_via_sqlps", "time": 0.0 }, { "name": "Indirect_Command_Execution_Via_ConsoleWindowHost", "time": 0.0 }, { "name": "Perform_Malicious_Activities_Via_Headless_Browser", "time": 0.0 }, { "name": "Register_DLL_Via_CertOC", "time": 0.0 }, { "name": "Register_DLL_Via_MSIEXEC", "time": 0.0 }, { "name": "Register_DLL_Via_Odbcconf", "time": 0.0 }, { "name": "Scriptlet_Proxy_Execution_Via_Pubprn", "time": 0.0 }, { "name": "ie_martian_children", "time": 0.0 }, { "name": "office_martian_children", "time": 0.0 }, { "name": "mimics_icon", "time": 0.0 }, { "name": "masquerade_process_name", "time": 0.002 }, { "name": "mimikatz_modules", "time": 0.0 }, { "name": "ms_office_cmd_rce", "time": 0.002 }, { "name": "mount_copy_to_webdav_share", "time": 0.0 }, { "name": "potential_protocol_tunneling_via_legit_utilities", "time": 0.0 }, { "name": "potential_protocol_tunneling_via_qemu", "time": 0.0 }, { "name": "suspicious_execution_via_dotnet_remoting", "time": 0.0 }, { "name": "modify_certs", "time": 0.0 }, { "name": "dotnet_clr_usagelog_regkeys", "time": 0.0 }, { "name": "modify_hostfile", "time": 0.0 }, { "name": "modify_oem_information", "time": 0.0 }, { "name": "modify_security_center_warnings", "time": 0.001 }, { "name": "modify_uac_prompt", "time": 0.0 }, { "name": "network_dns_blockchain", "time": 0.0 }, { "name": "network_dns_opennic", "time": 0.001 }, { "name": "network_dns_paste_site", "time": 0.0 }, { "name": "network_dns_reverse_proxy", "time": 0.0 }, { "name": "network_dns_temp_file_storage", "time": 0.0 }, { "name": "network_dns_temp_urldns", "time": 0.0 }, { "name": "network_dns_url_shortener", "time": 0.0 }, { "name": "network_dns_doh_tls", "time": 0.0 }, { "name": "suspicious_tld", "time": 0.0 }, { "name": "network_tor_service", "time": 0.0 }, { "name": "office_code_page", "time": 0.0 }, { "name": "office_addinloading", "time": 0.0 }, { "name": "office_perfkey", "time": 0.0 }, { "name": "office_macro", "time": 0.0 }, { "name": "changes_trust_center_settings", "time": 0.0 }, { "name": "disables_vba_trust_access", "time": 0.0 }, { "name": "office_macro_autoexecution", "time": 0.0 }, { "name": "office_macro_ioc", "time": 0.0 }, { "name": "office_macro_malicious_prediction", "time": 0.0 }, { "name": "office_macro_suspicious", "time": 0.0 }, { "name": "rtf_aslr_bypass", "time": 0.0 }, { "name": "rtf_anomaly_characterset", "time": 0.0 }, { "name": "rtf_anomaly_version", "time": 0.0 }, { "name": "rtf_embedded_content", "time": 0.0 }, { "name": "rtf_embedded_office_file", "time": 0.0 }, { "name": "rtf_exploit_static", "time": 0.0 }, { "name": "office_security", "time": 0.0 }, { "name": "accesses_office_username", "time": 0.0 }, { "name": "office_anomalous_feature", "time": 0.0 }, { "name": "office_dde_command", "time": 0.0 }, { "name": "packer_armadillo_mutex", "time": 0.0 }, { "name": "packer_armadillo_regkey", "time": 0.0 }, { "name": "persistence_safeboot", "time": 0.0 }, { "name": "persistence_ifeo", "time": 0.0 }, { "name": "persistence_silent_process_exit", "time": 0.0 }, { "name": "persistence_rdp_registry", "time": 0.0 }, { "name": "persistence_rdp_shadowing", "time": 0.0 }, { "name": "persistence_shim_database", "time": 0.0 }, { "name": "powershell_scriptblock_logging", "time": 0.0 }, { "name": "powershell_command_suspicious", "time": 0.0 }, { "name": "powershell_history_save_mod", "time": 0.0 }, { "name": "powershell_renamed", "time": 0.0 }, { "name": "powershell_reversed", "time": 0.0 }, { "name": "powershell_variable_obfuscation", "time": 0.0 }, { "name": "prevents_safeboot", "time": 0.0 }, { "name": "cmdline_process_discovery", "time": 0.0 }, { "name": "ransomware_extensions_generic", "time": 0.0 }, { "name": "ransomware_extensions_known", "time": 0.005 }, { "name": "ransomware_files", "time": 0.004 }, { "name": "ransomware_recyclebin", "time": 0.0 }, { "name": "ransomware_revil_regkey", "time": 0.0 }, { "name": "reads_password_database", "time": 0.0 }, { "name": "recon_fingerprint", "time": 0.0 }, { "name": "rdptcp_key", "time": 0.0 }, { "name": "uses_rdp_clip", "time": 0.0 }, { "name": "uses_remote_desktop_session", "time": 0.0 }, { "name": "removes_networking_icon", "time": 0.0 }, { "name": "removes_pinned_programs", "time": 0.0 }, { "name": "removes_security_maintenance_icon", "time": 0.0 }, { "name": "removes_startmenu_defaults", "time": 0.0 }, { "name": "removes_username_startmenu", "time": 0.0 }, { "name": "sniffer_winpcap", "time": 0.0 }, { "name": "spreading_autoruninf", "time": 0.0 }, { "name": "stealth_hidden_extension", "time": 0.0 }, { "name": "stealth_hiddenreg", "time": 0.0 }, { "name": "stealth_hide_notifications", "time": 0.0 }, { "name": "stealth_webhistory", "time": 0.0 }, { "name": "sysinternals_psexec", "time": 0.0 }, { "name": "sysinternals_tools", "time": 0.0 }, { "name": "language_check_registry", "time": 0.0 }, { "name": "tampers_etw", "time": 0.0 }, { "name": "lsa_tampering", "time": 0.0 }, { "name": "tampers_powershell_logging", "time": 0.0 }, { "name": "territorial_disputes_sigs", "time": 0.002 }, { "name": "uses_adfind", "time": 0.0 }, { "name": "uses_ms_protocol", "time": 0.0 }, { "name": "owa_web_shell_files", "time": 0.0 }, { "name": "web_shell_files", "time": 0.0 }, { "name": "web_shell_processes", "time": 0.0 }, { "name": "dotnet_csc_build", "time": 0.0 }, { "name": "mavinject_lolbin", "time": 0.0 }, { "name": "multiple_explorer_instances", "time": 0.0 }, { "name": "script_tool_executed", "time": 0.0 }, { "name": "suspicious_certutil_use", "time": 0.0 }, { "name": "suspicious_command_tools", "time": 0.0 }, { "name": "suspicious_mpcmdrun_use", "time": 0.0 }, { "name": "suspicious_ping_use", "time": 0.0 }, { "name": "uses_powershell_copyitem", "time": 0.0 }, { "name": "uses_windows_utilities", "time": 0.0 }, { "name": "uses_windows_utilities_appcmd", "time": 0.0 }, { "name": "uses_windows_utilities_csvde_ldifde", "time": 0.0 }, { "name": "uses_windows_utilities_cipher", "time": 0.0 }, { "name": "uses_windows_utilities_clickonce", "time": 0.0 }, { "name": "uses_windows_utilities_curl", "time": 0.0 }, { "name": "uses_windows_utilities_dsquery", "time": 0.0 }, { "name": "uses_windows_utilities_esentutl", "time": 0.0 }, { "name": "uses_windows_utilities_finger", "time": 0.0 }, { "name": "uses_windows_utilities_mode", "time": 0.0 }, { "name": "uses_windows_utilities_ntdsutil", "time": 0.0 }, { "name": "uses_windows_utilities_nltest", "time": 0.0 }, { "name": "uses_windows_utilities_setx", "time": 0.0 }, { "name": "uses_windows_utilities_xcopy", "time": 0.0 }, { "name": "wmic_command_suspicious", "time": 0.0 }, { "name": "scrcons_wmi_script_consumer", "time": 0.0 } ], "reporting": [ { "name": "BinGraph", "time": 0.0 } ] }, "target": { "category": "file", "file": { "name": "sodiumdynamiclights-.jar", "path": "/opt/CAPEv2/storage/binaries/9de7f31d4e44d8564c31cdbf51a03042a8092f4c7a502f84934017cee3597dde", "guest_paths": "", "size": 652650, "crc32": "EC87DEAD", "md5": "a1b36ba87ada993c51fe5d38789d7504", "sha1": "096c8946aee20df4fd78aa89882f6e3eb08b7982", "sha256": "9de7f31d4e44d8564c31cdbf51a03042a8092f4c7a502f84934017cee3597dde", "sha512": "3372e745f56d9958d276fd07afe4e15ebc795c99a81e40233622499f5db1248d13d6b20933b331b74cfc388a7ffe109dfc982fd55e886ca8acae3d486c3428f5", "rh_hash": null, "ssdeep": "12288:Ap648TXNE95vYhbpNjS2xBQTGkFYODJzMyYhMofkyW2MKZgHT:Ap6RrNEbvoPWFvCODJpgK2MKZoT", "type": "Java archive data (JAR)", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T16BD412667ADA4059F407B937024DE8A1E2190645FCC7E11FDBE66EBB18B0A9F03039DD", "sha3_384": "a605e54f82e574b0d7c35d39d58f1126036e0c2e4e3fd054039cc22fa6c757c761ccd3c4c40bf56a04d4d0b305b03113", "yara_hash": "68e243d1d9aeb1f1e94057af9823c58e140832514ed3e7b46b181bf94e4e12ce", "options_hash": "b7818797508282994ea72592ded64b364725c9400a38d418189579c94a89385e", "data": null, "strings": [ "xJ1GyQ", "n<9;Rxx", "@-HsKY", "0FX`0", "toni/sodiumdynamiclights/accessor/", "assets/sodiumdynamiclights/dynamiclights/item/fire_charge.jsonPK", "\"_?ea", "+00:1", "__e\"7", "kS`=zX6g%", "H(#Y}", "+3-ZPV", "?hKaC", "sodiumdynamiclights_1.21.4.accesswidenerKLNN-.", "K1Pt0", "Z;`9`", "bJ)9:", "bZ@_|y", "C[,g/+", "1 q%_", "DFQDF", "=kd/nm", "KM.JL+", "lMp/j", "{,kJi", "Y!5wS", "hYo|W", "F_5.=", "assets/sodiumdynamiclights/lang/id_id.jsonPK", "assets/sodiumdynamiclights/dynamiclights/item/adorn_gray_table_lamp.json-", "Djm#EQ", "5sW G", "~__n^r", "qfXmf", "*BkS*U", "%f,:A", "|!wpu", "wS,HL", ":zV}", "xh^kIV", ",lh2s", "Qb9mni", "&K4%-", "vB?a=", "~3X-H", "^H%hw0", "assets/sodiumdynamiclights/dynamiclights/item/prismarine_crystals.jsonPK", "S>L(~$X", "K-R1W)F", "IY+dN", "]HDH4", "Q<^If9", "#yct 9", "apW`<&", "u#[pI", "UVgqKZ", "*MIK!)M;>5K", "6yoK7", "META-INF/neoforge.mods.toml", "KitUb[", "R*AN+&", ";>:a}", "SBasE?", "E*Ya%", "assets/sodiumdynamiclights/dynamiclights/item/adorn_light_gray_table_lamp.json-", "toni/sodiumdynamiclights/mixin/sodium/LightDataAccessMixin.class", "|,RdI", "n!A?Z", "sg~s:y", "$c!^0O\"", "3B[/oj", "81()O", "(}.-_", ".E2I=", "<5sex", "s/Km&", "\\!yht", "0G}o~", "LA.I.+", "Izx,kr", "!gx&fRz", "^iYt:", "^q7Yo", "f!i|(", "9?]%p{", "p[%Pa#", "0[EI(|", ";304[}", "vDhqj", "TU8ZqL", "%$)4S", ">j1n(", "}\\XJlUR\"", "#TDa+", "30f&{", "cR?[:", "k#d9%b", "Mv5tg", "#[@>&e", "%MB(c", "a0!!f`&a", "{1A18", "dWyld)", "oh,&_", "k`T-K", "b'yC!f", "Carne", "MRsat", "Sz&\\%", "B=3SZ", "A*vHz", "Nth0Y", "w\\.B~", "<\\OZ<", "gA,`|.!X", "t<]^;", "5Zvb54", ",mIFJ", "Q7Jr/", "KKK'm", "*PBzkU#Q", "mixins.sodiumdynamiclights.jsonPK", ")QU%L", "IiHyG", "V'@ALz", "assets/sodiumdynamiclights/lang/ru_ru.json", "]_y[p", "=g KE", "x[gy~?", "R_6#|", "s;NVF", "XX D,2", "zl{wvD", "T`4/E", "fGomv", "9(-HH`", "Paq)Z", "{0mn_", "?J&#~", "}K'qt1Z3#", " WK@L", "WFqb<", ".yu+/\\", "PJ;&M9h", "\"4` ", "HlgZ$f", "%#xZ#", "X:\\Ul", "-{4%_", "I;\"~D", ")d,;,", "ENbo\"", "vRe_/*", "=Flc?", ":C%05L", "lD/q.", "MrNwP", "k5l^Ly", "5zOVi", "*?_#D", "2KvsQ-", "Iqk:~", "Z65 ", "?vi-2", "6O4-G", "\"z#`XFV", "9N)I9", "S=,1o8", "k^u\\z_J", "assets/sodiumdynamiclights/dynamiclights/item/adorn_green_table_lamp.json-", "*NTQS:", "Uc5rX", "V$8pI", "`{[PP", "p8nSj", "fbm2|", "q>61o", "0x$g(", "O|xg2v", "PKr*M", "0?r[R", "5.+/+s", "C)Bho", "Dv)i{", "]s7}Q", "&Ko{'j<", "hX4H}", "?3;I(k", "GScLZ", "n|7||", ">~K_{", "lzY^t", "4>H2b+sqQ#", "hVN%@/", "hO+cV", "[YBS*+w", "ACU=,", "v/]tJ", "kFg", "e\"g0x", "[,eK_", "assets/sodiumdynamiclights/dynamiclights/item/adorn_purple_table_lamp.json", "assets/sodiumdynamiclights/dynamiclights/item/glowstone_dust.jsonPK", "(/-7E", "!'dOa", "t3DVN", "=;k(p", "=2.G*)", "giaK0", "[J^LH", "0#^&(s", "j)W:%", "qCEsTL.", "HA\" us^&SJb", "assets/sodiumdynamiclights/dynamiclights/item/adorn_pink_table_lamp.json-", "sodiumdynamiclights.accesswidenerPK", "y]+5\\q", "=y.z7b", ";nC_Y", "v/Y*w\\],", "dev/lambdaurora/lambdynlights/api/DynamicLightHandler$1.classPK", "Ne&L-3%", "<~,GY", "t5MRi2;", "@~p86", ";hg0C", "(i\"7D", "VjM=B=@", "st/:U", "bGHI8", "!QkmA", "-U`LC", "??i:h?-W", "`711|", "EUP$\"", "0Q\\3L", "rTn}K", "assets/sodiumdynamiclights/lang/zh_tw.json", "P6##V", "dev/lambdaurora/lambdynlights/api/DynamicLightHandlers.class", "BAWuXZ", "t=Lyc", "RL4!$", "$%@7,Z", "C|;*k", "", "h5u@eF", "t2YCtUo)", "aOsI(", "lQMhAH", "@Bh !!", ":}u>zc", "rM%k^x>?", "M%,'4@\\", "-+-'n+", "0ug)4", "V7JTg", "2rJWHXS", ")kkwu", "+Vt(p", "<7]6^2", "J0paA6", "e'UUK", "toni/sodiumdynamiclights/mixin/lightsource/BlockEntityMixin.class", "885jg8", "RAqFE%", "JWY,%", "sL4pT", "M/&g4", "1Nm\\8.", "k:X?>", "rbqB|", "fFU]|R", "assets/sodiumdynamiclights/lang/pl_pl.json", "@At7>|n", "/vtPk", "1;Zmi", "qX7yS!", "hPnIZ.", "]bHo4A", "S.NP,", "assets/sodiumdynamiclights/dynamiclights/item/adorn_cyan_table_lamp.jsonPK", "6:z7v", "6{4gk", "IK \\z", "z6CXw", "\\:*Qb*", "assets/sodiumdynamiclights/lang/vi_vn.json", "[o(~Q", "kbJ3{", "{5iR\"", "ckcbv", "d.D|O", "-{=of-Q", "bR93I", "MW,'Z", "zTiU!", "J@eDS", "i2W3\\", "?'4mr", "o|mAr", ";)`cO", "toni/sodiumdynamiclights/DynamicLightsConfig.class", "n{fT+", "DYj~_/v", "SZv=ly", "{[Et7", ";)[-O", "g\\odeZ", "A#[Te", ")\"L-s", "D\"}@ ", "sW]smg", "6>Tn?", "\"UK[IN", "'&Idk7", "YLd@x", "i:H|)", "M)WE7", "6>kh)", "\"0j+t", ">&w+\\", "CF5^*", "!lO:t", "P|4c30", "K4: 6", "Y&&FM", "Llk`.\"", "assets/sodiumdynamiclights/lang/zh_tw.jsonPK", "?^8VSXO^", "x^>pvgiv", "kwlos", "`Ya`O", "L%&HY", "W>K>{", "ER&][&0m", "7\"_4I", "-h;4%", "dev/lambdaurora/lambdynlights/api/DynamicLightsInitializer.classPK", ">k!_l", "{[Vj'^W,+", "S;S'K", "k\\{6_B", ".p/K|", "dTud'", "N6V !", "sodiumdynamiclights_1.21.1.accesswidenerKLNN-.", "lXZ-[b", "Z|w1l4", "assets/sodiumdynamiclights/dynamiclights/item/adorn_yellow_table_lamp.json-", "assets/sodiumdynamiclights/lang/de_de.json", "X*?E~>", "PFP%R", "J[kq\\x", "zq\"A\"", "Wo/7h", "F!HakUT", "jYi/P", "#|1kn", "I-dI5", "p8r\\-", "h9egY.", "{xdye", "C}i-E", "/RO}'", "-oYWg@Cf", "TWa$;D", "1pOE24#D", "0 aWC", "z.jZF", "_Nw#B]", "{RN(h", "<)^GoN", "{ce1kVq", "U#O%y", "'u@X\\", "assets/sodiumdynamiclights/dynamiclights/item/adorn_yellow_table_lamp.jsonPK", "1J*O[", "/xMa)", "'4)1;", "assets/sodiumdynamiclights/dynamiclights/item/adorn_magenta_table_lamp.json-", "CVnuM", "KXMy^", "8.`D;", "w#}J#", "V", "!mGRz", "2/173", "[Zd$+", "tGYS ", "assets/sodiumdynamiclights/dynamiclights/item/adorn_blue_table_lamp.json-", "Ow|zC", "/,=#<", "bF#;%", "(,bM5:", "dHdV ", "O-NO.", "~9Sopr", "DdE3r", "p:Gx ", "\\JKUDT", "|zCw7|Z", "lzDzc", "!Jn{O", "VS%Ne", "U}$9<2", "r5X`D", "Dfy2sf", "+xOLS", "My&i*", "(X>%!", "b9AHb", "&Uj-\"", "Pe]%)&", ">fNyb", "S_xrb:", "tKsZh", "toni/sodiumdynamiclights/mixin/lightsource/PrimedTntEntityMixin.class", "Fe1q$", "\"BTWO", "(%T_vX,", "I7xYP.| ", "p'c>6", "toni/sodiumdynamiclights/mixin/lightsource/PlayerEntityMixin.classPK", "o9\"9a", "M]p1A", "toni/sodiumdynamiclights/ExplosiveLightingMode.classPK", "ZNg2X", "mhkSjK;1", "assets/sodiumdynamiclights/dynamiclights/item/blaze_powder.json", "b.jJH", "F1(_6", "^4uU(", "toni/sodiumdynamiclights/DynamicLightsMode.classPK", "h[X\\uF", ";t/9`\\", "RMQrCj", "9?F/N(A", "W$3.au", "'{70.c", "S#-YZe", "mA'JS", "H:U6F", "OwwY ", "G7^xcf", "II)rS", "5d&J=J", "2yz2)", "EBO&n", "chwV|", "Vb/5b", "u%Mes", "9U P]", "'`3&faO-;", "`\"AO\"", "|KgOo", "Vq<;z", "!rq$=", "+.Y+kee", "Zaem`", "\"LY.9?", "#'L0 ", "\"{yij", "t.Nx$", "1L0t]", "eQ@t~", ".1|$w", "y;!L1{", "#DTh(0", "au#.s", "]I>=#", "lG XU", "j7#=}", "*:7_d", "{[[S;", "BNOd+,", "dev/lambdaurora/lambdynlights/api/DynamicLightHandler$1.class", "Gb#z]", "xbN.!", ",+) e", "y]Uz_", "assets/sodiumdynamiclights/dynamiclights/item/adorn_orange_table_lamp.jsonPK", "q`=){g$", "4wmE-C", "u B&b", "toni/sodiumdynamiclights/SodiumDynamicLights$1.classPK", "l+8=I", "k'2vM", "q}c%)", "*.HM.)J", "v65<%p", "`k]*%t", "8NyhwT;", "N4\\a%", "psp\"T", "META-INF/mods.toml", "Rp\"%d", ";3pdw", "U%9>L", "assets/sodiumdynamiclights/lang/it_it.jsonPK", "Sf(tQ", ".>F?o", "\"JC/eG", "Ph9e&", "===6N", "skNA\"C", "UnGua^#", "toni/sodiumdynamiclights/mixin/LevelMixin.class", "Df8+D9", "#\"uD4qr", "#2R3B", ",7(44l", "bhPQJ(W", "|PT6R", "R, JA", "assets/sodiumdynamiclights/lang/fr_ca.jsonPK", "9Z<]=]", "sodiumdynamiclights.accesswidenerKLNN-.", ",P+5'", ")S|\"*", "%b uiBo-", "", "assets/sodiumdynamiclights/textures/", "V:]s?W", " _k9H", "H|&%Eh", "toni/sodiumdynamiclights/mixin/", "fl+{G", "fzljj", "m%@>uZ", "3DSj\"S", "y+#?[", "|}d'R|", "UDf:/", "assets/sodiumdynamiclights/lang/sv_se.jsonPK", "toni/sodiumdynamiclights/mixin/lightsource/AbstractMinecartEntityMixin.class", "^/kvn", "MOZ9^;q", "|8D.9", "|eAT5", "sq>:.a", "YAWm^aF", "2d dD", "0+Hc", "/\"Y D", "uw!|7", "9xO*9", "+-gZn", ">@1oo", "y5wzI", "E3p '", "n9wdB", "[J+ZE*", "nm,\\`C", "Xb3>1#5", "6X#6t", "nK@WY", "8tep4", "{$&R7", "oqH|5", "toni/sodiumdynamiclights/mixin/CommonLevelRendererMixin.classPK", "dev/lambdaurora/lambdynlights/api/item/PK", "#Ls#L", "}%+{&+", "assets/sodiumdynamiclights/lang/ja_jp.jsonPK", "QDm(q", "-U/!8", "\\%w/*", "X:oH\"", "OB3DS>", ">Y?55G7", "QnEp(", "u~R50.", "uT\\r.p", ",X(-P", "/fKh ", "a b[h", "&T]\\Q", "U1!\\(=N", "=;OA]l", "AdKWy", ">\\_FX", "toni/sodiumdynamiclights/mixin/DebugScreenOverlayMixin.class", "9v*=V", "k/..-", "}'gH|E/", "Q$P.O-", ";|J@9", "uJ`dD", "$~P#>", "?u4gQx", "zj&MB,", "|=|b%", "\\z#wY", "S;6hE", "d|L;7", "})AX|/T", "dev/lambdaurora/lambdynlights/api/DynamicLightHandlers.classPK", "toni/sodiumdynamiclights/mixin/lightsource/PK", ",oyXb&", "0G3hD", "\\idv|", "p)>A@", "3<`C1C", "z=LzF", "dCp:h", "toni/sodiumdynamiclights/DynamicLightSource.class", "@kZad", "i2`Sl", "2pr\\hMOF", "bnzT9", "~G5u&)", "L,TUjh", "% ?D%", "ENn[E", "QkINL6", ",N}pm", "6zBKt", "*<}}|", "UP*0s\"", "GX\"0/", "#!>#`>", "EWp]\\", ",-@Wi@wN", "+5I')'33+5)-G=F=FG9?9E36/5C'", "vtl0un", "E\\/SV", "toni/sodiumdynamiclights/mixin/lightsource/AbstractHurtingProjectileEntityMixin.class", "TJM$+,", "s>@ls", "vU'@$B|", "2*;QwWSW<", "{=Tmz", "zmY[l", " bb!f", "Lf+@6", ",k7#G", "_jr9n", "ukelM", "5eoKt;B~", "X\"jiSW=}", "B C19^n", "'}q'Y", "97<4<6", "--$3B(", "toni/sodiumdynamiclights/accessor/WorldRendererAccessor.classPK", "bO|5E", "`|V;@/", "~2E'.|", "w?2h)", "w_|w}", "8ahE)@", "K[.v0V", ";}%dCk", "u51V2", "'W%tR", "zH\\a!", "|MM':", "/ou@?", "1qt@D", "#y8Bo~Kh", "assets/sodiumdynamiclights/lang/zh_cn.json", ">`mr@t", "r39)E", "#0x.q}/>N", "\"}%(AS", "toni/sodiumdynamiclights/mixin/sodium/", "4;M](>H", "Um.LC", ":[z'_", "assets/sodiumdynamiclights/PK", "i j !nS", "rxsW{", "}aX$N", "I$'LZlo", "x{4WVF", "rtiUU", "I$cg0A*", "assets/sodiumdynamiclights/dynamiclights/item/blaze_rod.json", "i}&E XQ", "VXGyT@m", "J53D'D", "Cze~#", "t3Dxx", "toni/sodiumdynamiclights/mixin/lightsource/BlockAttachedEntityMixin.classPK", "PB=8d", "~5{ :", "JC#;4A", "({%$a", ".`pXr", "HG/ZH", "V.M0~4m", "sx y", "P.N", "vWS]%", ".Sb\\VMU", "toni/sodiumdynamiclights/PK", "}#nzB", "S(TGPVK", "K0b^_", "`)mhj", "+e)|4g", "q77Myq", "r_flA", "jjt}3H", "g&)Dk+", "P5<\")", "wZuN=", "e(2gQJ", "Yw3{X", "}Sd'e", "U>3R8f", "LXVMv6R", "c%pEo", "Xh'}4X", "uk^:F{!", "Z*>B;+", "assets/sodiumdynamiclights/lang/pt_br.json", "^SX05", "i'Sr~", "xE@Tj\"", "X#m(.", "vZf?V", "hkq\"h", "4ZZF9", "!GaU\\u", ">dWAr", "51={cX}jC", "+VsvF", "sib\"9", "EL2d}", "OG(Gm)fwI", "?|oh~X_~s", "++7-/", "af6Mi", "avty/", "qd$\"!", "assets/sodiumdynamiclights/dynamiclights/item/adorn_red_table_lamp.json-", "jDjU\\)", "b[yOL", ",w-q9", "Dda{S", "#*!O^:", "N!,*|", ";P%K4", ".73)B", "cu5h?", "%~9,Z", "Gi];d", "/E#_jo>-U", "0C~9ZA", "z[ooy", "Xixy=", "ua< c", "_X2oMG", "Y\\w8X", "hC=>T", "M.EH ", "META-INF/MANIFEST.MFPK", "7XEJ^", "V^H%[Xe", "A}0F`", "toni/sodiumdynamiclights/mixin/lightsource/LivingEntityMixin.classPK", "assets/sodiumdynamiclights/lang/it_it.json", "[}9@H", "o^EC#", "3tSh6", "Tn<+uc", "d*NAy", "|xniKW_", "(AhS=A\"", "toni/sodiumdynamiclights/mixin/EntityRendererMixin.classPK", "#aF2%", "W/(@(", "QNP)N", "R7?->z", "|[gT9", "UrPE5", "^ >Ayr", "EWZHA`", "l1+2dU", ")<*p-", "_+#DR", "VDng7", "2Ni{%}", "assets/sodiumdynamiclights/dynamiclights/item/fire_charge.json", "(u?9/", "h&Gxu", "6o9B[yQ", "TTR)>U", "oa1T?", "b:@5C", "\\0p\\A", "Do,LW", "9#\\%\"\\ B", "dev/lambdaurora/lambdynlights/api/item/ItemLightSource.class", "qOqP_$", ".nfGF", "META-INF/jars/forgeconfigapiport-fabric-8.0.0.jar", "?*7OzT", "toni/sodiumdynamiclights/DynamicLightsConfig.classPK", "assets/sodiumdynamiclights/dynamiclights/item/adorn_lime_table_lamp.json-", "&D@(3", "/DQ#gy", "H=HQQ", "+yeQ=", "qsP+s", "7t>SL]2", "U}q`=", "&wO$l", "lM\\9m", "-aU_5", "assets/sodiumdynamiclights/lang/ja_jp.json", "Y],c;", "Ej_0ISU)", "F{@u}", "9tm]{@;", " A+tL", "\"E", "assets/sodiumdynamiclights/dynamiclights/item/glow_berries.jsonPK", "iwv.[", "Q3@+F3", " vQ@:iYQ", "0S-ZW", ";L3lZ", "assets/sodiumdynamiclights/dynamiclights/item/redstone_torch.json-", "^mg5+]A&", "@`S;r", "[+%bs", "fEWcT", "M-l.n", "'>ZC'", "S<|]m", "0#8RnP~", "Zs?PK", "'l80p", "U?`cg", "bs~r`", "xxM93Vs", "4p(DAe", "4X~::7", "f5_{?", "n~Z?l2", "YK`}y(", "6mXhm", "no6JpG", "!,L2- \"N", "\"bbMZ", "#S`,;,", ">c_YJ", ".J kj", "L68[B", "U-Ru2", "assets/sodiumdynamiclights/lang/pl_pl.jsonPK", "rz};i", "1k2yG50", "?wo`0", "gRj;e", "toni/PK", "V;siiuuuC/", "%`52u", "s%zoR", "nY`4rue", "8|l8X", "assets/sodiumdynamiclights/dynamiclights/item/redstone_torch.jsonPK", "assets/sodiumdynamiclights/dynamiclights/item/adorn_lime_table_lamp.jsonPK", "assets/sodiumdynamiclights/dynamiclights/item/adorn_stone_torch.json-", "KX] 4", "dev/lambdaurora/lambdynlights/api/DynamicLightHandler$3.classPK", "g$eQ&c2", "QTOw5", "SkOS1", "RWUZ2", ":vo3kj", "35&Zh", "9: Ie", "Lru0L#", "kq9kQ", "XIs(b", ".UmVp", "fabric.mod.jsonPK", "6]DZk", ":4-N+yC", "oc/bw", "assets/sodiumdynamiclights/dynamiclights/item/blaze_powder.jsonPK", "tFBo", "bE$YM", "l`h2k@", "lSEj3", "]k]W0", "D'J7['i", "da{i.8<", "KH(4A@v%", "iTN2'`WMM", "toni/sodiumdynamiclights/mixin/WorldRendererMixin.class", "sodiumdynamiclights-fabric-1.20.1-fabric-refmap.json", "[Y+eCo.U", "pzePf", "dev/lambdaurora/lambdynlights/", "aN.rH", "T%1XC", "Yi~rLzcD", "_hGkg", "4k~H0?", "-0A'^", "=}I:8~", "70uM1", "1$baw", "t/3q{", "b}*`A", "BZ l:+^", "f1u*S_", "E\\cy/", "V_7tC", "I@X0!", "84,I4", "95@yY", "assets/sodiumdynamiclights/dynamiclights/item/spectral_arrow.json", "Cm^-#", "sjVY\"", "1jKq\\Er", "He+@-", "XN95/", "df34u", "%`bg.bQ9", "w/B2!b", "EEa.H", "O-5pT", "5o62cc", "LT$&RW", "BBPGY;", "I23#3", "F 4BkR", "NQ|~u;", "y]r$<", "$]2%i", "=$s8S", "pWI8n", "assets/sodiumdynamiclights/dynamiclights/item/adorn_light_gray_table_lamp.jsonPK", "q\\~SWw", "Adgnd", "oe!Rr", "h~6kF*D", "assets/sodiumdynamiclights/dynamiclights/item/adorn_white_table_lamp.json", "JmZv0", "[ZZjk", "#\\}}D", "b`j62", "f^O#\\", "OgRH$", "Ef4PH\"L", "rD]8&", "`lokko", "YbQkv", "1'6a1", "`abZ+", "at\\a>)M}5H", "%VMk]e", "8KR+ &", "toni/sodiumdynamiclights/util/SodiumDynamicLightHandler.classPK", "${V][I", "\\Q,c\"", "dev/lambdaurora/", "4LWhp", "R)D$]Y<0", "l}u=f ", "s5>7L(", "h(C,~", "[?2\"#", "MqzmE", "8 Pd&U+K", "META-INF/jars/forgeconfigapiport-fabric-8.0.0.jarPK", "+swgX", "QC9>f", "VbC=3", "|}[b2^p", "'_#m^Ktx", "sp.CMJ", "dev/lambdaurora/lambdynlights/api/item/ItemLightSources.class", "IYQ^I", "Crrn5C", "SoxaS", "$-|+L1]", "iGUrj", "#PX[F", ";wZ7A", "META-INF/neoforge.mods.tomlPK", "=(d)R^", "<^ wE}S+=n", "assets/sodiumdynamiclights/dynamiclights/item/soul_torch.json-", "-JfVY", "`*fS8", "/X-g>", "Hpwwo", "/ASm{", "B>(En", "QP9?Q", "W0}Jm", "4KDxM", "xj@bVx", "DI ZhsL", "[N`H}", "'i<#(", "|s*pq", "hKSD", "r|*3to", "*iHfWl", "e8a1iP", "!PC4`", "'d@7&", "P", "]/9Z/K$", "QXTl,", "oHm.`", "^V$tQ", "3g!nL", "v<)2y", "Q\\1wi", "d3D<=", "S[[=", "Dyg/R", "aS_IEC", "kWJC.]A", "qtU. x", "020 A", "5_b[9C_~", "!K0}Rd", "@Fh~a", "_kswHz'", "~ZOm=", "8@A4G", "4eS7;", "lKXZC", "6S78=-", "kk,N*", "e/Sy7", "-+twX", "w.\"Nl)", "Y:)DW", ",=)PI", "toni/sodiumdynamiclights/util/", "4x~`g", "Sb\"`a", " c'VO", "<_\\4p", "|Gw8 ", "0!x!g", "|K&K'Q4", "assets/sodiumdynamiclights/dynamiclights/item/glowstone_dust.json", "pNF>-", "W1KKsf", "g+y/o", "#yFOS", "Q@ltA", "zx]=B", "Y'Wk+", "jYN;2", "s9#o>", "[[M54:48", "5%,Jo", "toni/sodiumdynamiclights/mixin/fabric/AoCalculatorMixin.class", "pfWY+;", "7d\"4`>", "N-`2<5", "O(Zs;", "o4+iH", "N2i#'", "7[A&**", "3U6W\"l", "0%0yr", "[?vrOQ", "}cGKC", "-@\"*J", "`rH\"X", "'5@TQ", "u\\xu<", "jcA :", "c8%MC", "%'ji[z;", "mn5Ck+i", "1^j'I", "OHNUNkz", "tXlnC", "4|SIy", "Qc2Gd}:", "NRcP{9$", "a(6Rb", "![HMLhDMhiv", "Q-Q=57", "hh2lq", "xZB{4", "META-INF/jars/PK", "2Bqr\\", "U.S2r", "['|", "_eR|-", "Y&eaa", "dVA.s;", " P#jzJ", "Cu8sVZ'", "+:Z)}}", "EgJ,h4", "b4/CN", "v9gBc", "yRl>8", "qU$zh", "Gi&gP", "y,-wm", "5Ru~Q_", "Z%,> ", "/C_D[", "y?(R7", "UcmFJ", "M&OV`", "B^:(OO", "Hr}VI", "[beG7", "$V.&D", "D5%I ", "$[ _l", "mB\\YLd", "PLt.UOj9", "i{g-sH B+", "P9'c3", "assets/sodiumdynamiclights/lang/uk_ua.jsonPK", "toni/sodiumdynamiclights/mixin/CommonLevelRendererMixin.class", "97l]<", "0]&?{", "aYyP@", "u\"@zQ", "a.,?~", "}D)xs", "b]/ae>", ";(@[b", "QOm7^", "G*^\"\"", "BWNU!", "Ec5.jI", "4XBX V", "~T#58v", "(?L~KF", ";{7rf", "6Vy*]", "2sR%a", " ]q]A", "HQey\"<", "~ENOI", "*`f61", "HO525:j", "hM^LT", "G^ing", "Z:U7)P", "z5qvH", "0DQHDm", "Aw%/-\\", "|jp?7", "1\\EbmL", "ZUDyhH", "$k3<9", "[:_v4", "[bbmb", "`uZU45", "A", "]$L TA+s", "6zl~/)", "q)!}9v", "}.kB@", "*PPCU", "GfUu7", "e(3q7", "Q&(UR ", "2fcPJ", "assets/sodiumdynamiclights/textures/PK", "_;l58", "njw,5T", "2~wq(#d^", "]~yt]", "\"@r6d", "LE6ie", "toni/sodiumdynamiclights/mixin/sodium/ArrayLightDataCacheMixin.classPK", "Fa8S !", "A@>j?'o", "sK6P4", "Z.'47k", "DCwdw", "1P=\\mi", ":,.bO", "GmkZ/", "?\\=3Y", "TDzL]", "}{{sz", "toni/sodiumdynamiclights/mixin/lightsource/AbstractHurtingProjectileEntityMixin.classPK", "`a7Ku-2", "o!}u_.", "GyDp)", "XS", "lr[Vs!", "e^j[NH*", "elE>q-", "QX\"_jW$", "E#x`d", "=uv=S#X", "=4iCF", "%4*MQ", "N_9B:m", "m~jw|h", "XbDj:", "_P-qn", "2F*Px`n>", ":<}_W 4q", "[,&:U", "~J^`U", "5i4[G{", "{Uu&t~wp", "!\"eZLSz ", "h%#RE", "toni/sodiumdynamiclights/ExplosiveLightingMode.class", "^I!\"P", "YSRML5", "/\\7$M6_8", "G=e5T", "R!HC-", "_QkL+", "G%|!]", "4te!%", "rR!wX", "LqSC (", ";zYc@$", "=vvRZJX", "~5\"[cH", "svt&&t", "C!`F0", "ptv<`", "Y>4yB\\", "PT?*dq", ".Zei,", "\\fxAX", "bVJ.j", "AZi\\}", ";}#YV", "+Ps{K", "<$]Yn", "", "p|_'x", "9<=m8", "L(&5n", "67PWe`u", "'iU@c", "\"N'Dq~!L", "assets/sodiumdynamiclights/dynamiclights/item/campfire.jsonPK", "#{@ZX:", "k#;9N", "W_alX9", "N6&Sk", "}*MPG", "F5u~3G", "${8OHGt", "TRCc3e", "AJ*m(", "Yq:Vt", "7=!kp", "A5\\CW", "ts-r-", "s4CIKN", "IDATx", "kb h84", "ZN-9.", "sD'w*o", "i$r7V", "'&qrfD$a", "sodiumdynamiclights-fabric-1.20.1-fabric-refmap.jsonPK", "v<*.vI", ":aC:f8", "kC73k", ".!16^", ":DUJ,", "Oy66]", "D_lM`!", "ii;+\\", ",v(9.", "[`6Sme&", "X#B5^", "qTTNQL", "G7<3R|", "_e!lC!0", "toni/sodiumdynamiclights/mixin/MinecraftClientMixin.class", "nVeum", "$Y(\\seP", "(B)gMhs", "TKTaI", "|L&Pm", "O+P1Cj", "Sh^=_A/", "eXUq$", "&:KSA", "%y$;H", "S[otn", "x$BtC", "(kvM,>", "odUVZT", "6cC_a", "*JmzY", "k4?ot+", "X&|ma", "lKeQPH@U@", "-$ /O+", "2&$=\"", "MjO|V", "0INl0", "DIM!M", ",#lvP@", "N#Nz73j", "}D7VE", "_sy2(", "L2F|n", "kxKWz", "=jB'Q", "'0\\SX", "toni/sodiumdynamiclights/mixin/PK", "eL/e2", "+Wl5=0", "PvDqC", "]R<[|", "++jhw", "cbJDa_1", "e}2W_", "dev/lambdaurora/lambdynlights/api/DynamicLightHandler$2.classPK", "0#O;3", "B5BY\"Z", "&+FtY", "zH2]VL+", "Q>s0G", "BkQWY", ";bo4}", "wQ`=.", ",GcWy", "mL4\"P", "!3Gvo", "x,\\Oq", "lc!:T", "dhbWj", "7D=$6O", "cOUy,", "aFUnNH", "=FJot", "tEns8", "+R0oT-", "b&.8X", "x\\D(k", "*%KxR", "toni/sodiumdynamiclights/DynamicLightSource.classPK", "Ue*#KUr", "{c\\Cl^b", "DiSOX", "7S5kU-L", "lL@05W", "B-w,\"", "cl&bY", "aE>U4", "pH_I=", "_?n_6", "SZT#N", "FE3VYM", "}k`d_", "V,sNH", "toni/sodiumdynamiclights/util/SodiumDynamicLightHandler.class", "w'uUM", "lIX[9", "1ihbY", "i^7\".", "D!:-8", "y(=E8", "J #mm", "_\\?RF)Q#", "I}{!m", "jhA`N)", "!J+j0", "^Dd\\F$*", "TK$%-2P", "f{R4w=", "@'d8hYB", "assets/sodiumdynamiclights/textures/mod_logo.pngPK", "{L7tkB`", "ho; DC", "$\"dM)", "'1N3B", "sodiumdynamiclights.toml", "hN`4g", "QT-:>", "s('xo&", "|js@w", "kU.O$P", "dev/lambdaurora/lambdynlights/api/item/ItemLightSource.classPK", "2y.4g", "%Htn{", "!hkmmmk", "V(J{Z", "yR,>8", ".@?(_jM", " F36_", "TvzlEs", "assets/sodiumdynamiclights/lang/tr_tr.json", "[:bnk:", "Z}wU|", "`Z_^h_", "QJ,Iy", "ZVZNm=", "assets/sodiumdynamiclights/dynamiclights/item/adorn_gray_table_lamp.jsonPK", "Iyw>NY", "Lc#d1DH>", "bxF>J", "):'U}=z", "V|OVH", "assets/sodiumdynamiclights/lang/et_ee.json", "}7jEo", "9w7I*7)P2", "$<@$%", "`}e[9", "y.Xp=0", "d_SlI", "qWqCr\")", "=JKv3", "assets/sodiumdynamiclights/dynamiclights/item/glow_ink_sac.json", "3d/Ya", "\"pD5d", "*>WgS", "pJgB7", "m$kK:", "VNET6", "~mldo", "k[WZN", "lAiRb", "t\\&KFP", "`ga\"EJ", "", "PUU%HD", "[M:Fc", " nR9\\p", "Eo4;s", "8C}j7", "Vv%am", "Dy\\1;", "assets/sodiumdynamiclights/lang/vi_vn.jsonPK", "toni/sodiumdynamiclights/mixin/sodium/ArrayLightDataCacheMixin.class", "9A3\"`", "9s/d-", "~}X_~{", "Jkg,Y", "9QZ ^*", "l'[IEd", "C_pu`X-", "N(;n ", ";_\\;6", "assets/sodiumdynamiclights/dynamiclights/item/adorn_brown_table_lamp.json-", "3c-n$6", "T&PKb", "toni/sodiumdynamiclights/SodiumDynamicLights$1.class", "Sv}L8", "DTDFJA*", "UHF}DRk", "AYy43", "`~xIQ1p", "'1a`4", "!Bs@DC`$St[", "xxDIhr", "0$,CW", "lfwbuJ", "toni/sodiumdynamiclights/util/DynamicLightingPage.classPK", ":/J6s", "E8NjlQ_", "qRje1", "D5\"4!", "CRXH\\O", "E1^}H", "yT,TP", "jhSG1+>", "`gGM{", "=b-NK", ">+~Dd", "H@2vx+", "zgny4r", "mS=s|^", "22keEF", "[x7ZX", "toni/sodiumdynamiclights/mixin/lightsource/PlayerEntityMixin.class", "9eNo<", "toni/sodiumdynamiclights/accessor/WorldRendererAccessor.classm", "I!$Hu-", "SY/;/;SY", ":QV6r", "mgKT", "C=^R}", "+Y:QA!'", "dev/lambdaurora/lambdynlights/api/DynamicLightHandler.class", ">!nAY", "5|pIH7V6", ",K|f ", "QQ-c*>", "nL&OhX", "=-^fb", "dev/lambdaurora/lambdynlights/api/PK", "gib'N", "5w7qV", "XBgEO", "ESdL8N", "5BC?=", "k\"!WU", "@=ID)", "i+o53", "_GCVh", "ra*>u&C9J", "6g38j", "xiDi$v", "assets/sodiumdynamiclights/lang/es_mx.json", "1:2W ", "D]o!K", ".>0I&", "(O,I-", "{#XcWjp", "*$ki5", "tde\"I", "RJWsv", ")<$e^b", "P9Ac&k>0]_F0)", "assets/sodiumdynamiclights/dynamiclights/item/adorn_black_table_lamp.json-", "s3X^Y", ";EHBS", "assets/sodiumdynamiclights/dynamiclights/item/", "[QB)0", "56/GHB", ",6h\"&", " MVRNK5?!", ",H~+q5", "kc}OleRS", "\"r4+p", "G.vGO5E>q", "~I'-$", "Qku`ZM", "2oiwK", "VX`dy", "4UK6U", "H8IrpN", "#T_X/fJ", "Uhk!s", "Z#Bnt", "j@1", "B%leV", "assets/sodiumdynamiclights/dynamiclights/PK", "tT_om47_w", ")u&UJ5", "TR Gc", "RY[1d", "Tiw$!S", "u-:aRg", "spSrp", "WJ3", "V2`)++", "Z`*z3", "Mfx&y", "dev/lambdaurora/lambdynlights/api/DynamicLightsInitializer.class;", "&$E47", "W>]}xj", "C512S9hny", "\"B\\GX", "dH3}R", "arzGb", "wGt-d", "\"tUjB", "ilXRU4P", "AEXV8", "6ggeg3yf*", "|O)Z]", "VZ_5h", "V)w}h", "/GRo~", "qz.tj", "toni/sodiumdynamiclights/accessor/DynamicLightHandlerHolder.classPK", "/*jbg", "g93e.", "uB#,md`;", "/946+", "4n%T$", "|S<;@", "y|GkO", "I$Kl.", "9NQo(", ":Liu{", "MJa4!", "A'=|~r", "?|u|b4", "tmY07rG", "C3yi5", "k_>mJ", "|k\\P~", "zG%TS", "w>7;%", "*tb23jU", "(m\\vZ'", "be%K<", "kAk+p", "jfuLE", "F}`=`z", "<'PMn", "LLM1wL/N", "T776D", ")B$$]f", "{WV2m", "&mX&<", "0azO/_", "assets/sodiumdynamiclights/dynamiclights/item/adorn_white_table_lamp.jsonPK", "T?jqT", "E&XS+", "wNuG//", "sclfK", "l:2UD", "sodiumdynamiclights_1.21.1.accesswidenerPK", "Oo^|9", ")Uy&A", "f+-7f", " r@P}", "78Ke", "M>+ZG", ":7e{3", "3uRKx", "n?ajt", "KD=gA", "[Df|TG2#,", "\\Xx,zQ", "&u)*7", "tIQi*/W-", "521V0p6", "*nn4#", "L;spp", "N1W0^o", "^{jV]] W", "Gjm~0", ".ZNy&", "m[j$a", "t0}Dk^-", " PQd$u.", "p_ZRzd", "=C0%u*", ",2?b$", "(n}7c", "u(KW{", "@l6m8;", "2D7SJ]", "p)r@2b'", "I.V[ N", ";D:sm", "N7@P|", "kR.~#", "d6wv*'", "sagzj", "Nuzw{", "i]Aan", "NvEHZ", "\"KRRO", "uu,F]#p", "$QU[uS", "7Oo?6%", "vnfy9", "f^rK`", "k6cq;^G", "?a:,2b(", "ad3$x\\", "d|X6o_a", "assets/sodiumdynamiclights/dynamiclights/item/adorn_light_blue_table_lamp.jsonPK", "Qvp'4tQ&^", "g?s9_", "t&W&\"", "*W'Y`EO", "B?j/>", "|p\"yE83$", "~S]WE", "\"rWHto", "AVF$hF", "#?b %@", "assets/sodiumdynamiclights/lang/de_de.jsonPK", "w]a^+", "!eVw$Hv", "2rfZ]", "eeD=C%|", "yxXyzp", "W^J;^l", "{e'_Y{", "4e]>U%", "bO1t|", "4iOMN}~5|gA", "vA)ASu", "HLd1K", "$b", "CIeoFj", "ah\\.<", "KOLtBu", "assets/sodiumdynamiclights/dynamiclights/item/prismarine_crystals.json", ">y45jX", "?QOrj", "assets/sodiumdynamiclights/dynamiclights/item/soul_campfire.json-", "Z#l~a", "x2 )5S", "7*iYL=", "k`!d+", "UmS[E", "&}l\\Q", "&$4K6-", "ga&r:1", "\\;jIh", "G]IAQ", "toni/sodiumdynamiclights/mixin/lightsource/EntityMixin.classPK", "#G\"@\\i", "'Gh(F", "cD?}v", "eW", "(_Y T", "aXBHB", "b2E+$", "I9JH9", "HyH~9gmF", "S,~3<", "tB4vwg?!", "~\"#tqN", "}8|bnK%", "wePtB", "#vqH7", "uc.,_j", "`3oU0HP!", "(t;Bd", "-rIp3", "%Ng7l", "wcn=t", "3wm*o", "-tw{t+", "XiY}s", "gJYtX", "v{uX`", "I\"Eu7", "105Q?", "2F1>LW", "OEEe ", "DtAa#", "toni/sodiumdynamiclights/mixin/lightsource/BlockEntityMixin.classPK", ".@{z", "}`[?\\Z", "~?gax", "`HT-6", "#yGR}0M", "lEN1d", "$mrqq", "}AmxN", "`1 FQ", "Xg[iY1;", "d HQ8", "Bp=AZ", "fnBm]", "fp{G)", "w'4_", "N\\6p/", "+Mf:X", "APdqa", "[/[G$+", ";~\"zZ", "+?Az6", "C|p,X", "qm`0Y", "WCA@PZ", "9F=$N", "k747Z", "Jcd@7", "s-qi&", "ojFfY", "~T0\\v", "B>3|'", "Z3Sn\\", "~57d7", "@C^?L#", "feLp.", "W4a}BZ", "S.wH_", "V&lG{O", "HXJ4IH+", "Qrv/\\", "/.(|S&)", "3*SU*", "sm?UO", "#RZ9f", "I;YS[{'O1{'[", "dev/lambdaurora/lambdynlights/api/item/ItemLightSourceManager.class;", "R6tn`N1^", ")Mug<", "^\"AFB", "lf{fM", "DX`iC", "t[?\"6", "zPRI~", "RE(hg", "iNA!K", "E{C}0", "H/$Dw", "^cv&^", "FC?$F", "'^Wj+", "9\"#C7%", "))kq}(", "!C<'}", "assets/sodiumdynamiclights/lang/nl_nl.json", "b4GH,", "\"JGo;", "PW(G<", "f3^9:", "ShOnr3", "iq&b3", "/6\\wQ", "B]mCZ", "ElzCl", "uKzo0 ", "`ZLr4", "Bib]9S", "0)&cX", "60.}y", "Q6Z>6$", "YF$Z7", "5,aj0a", "k}lE&+*", "wW:{:", "?\"+t2", "$eS2g", "T!H|$W", "QFq/B", "|#9Cq", "53zw ", "assets/sodiumdynamiclights/lang/fr_fr.json", "m_(]0", "assets/sodiumdynamiclights/dynamiclights/item/campfire.json-", "ngY6Z", "JN:yn", "D;I@D", "x{2ar", "tV>&k", "wC]#$Z", "$cX3k", "(D^!~", "toni/sodiumdynamiclights/mixin/LevelMixin.classPK", "va5G_", "U,t*V", "SY2e5a", "O0zr<", "-E;k2", "tk0id", "S!-St~{", "b1AC3", "Hucao", "VBQGz", "jQa\"{", "I6^AF", "RKT.*G", "h'miU", "ej_>\"", "H{Al>", "i[/}}", "l(\\,:", "YO)gS", "%F7a1", "Ny4\\~", "k[W:=k", "3U+cl", "TM6{*", "W\"Les", "Uz3wAb", "+c6Nc8m", "+hKxZ", "/Un^:!", "a}vsf", "H!6*9", "O_Qfs", "K3C;sh", "EN1l4", "l2Sx!", "[4)*g", "dX6QA", "UhV+xg", "V\"pP@", ",cC%b", "JTi-c", "i!'wj", "OH,~1", "g9?2=", "3Q.Y&1", "y,>bG#", ";aM,3", "jBzS}", "/=e'5", "jSnZ(", "IJMa/", "dMB6}", ")\\CA$$", "Wh.6F-", "=}_^\\", "+ 0[B", "H,JOU", "sjhA ", "_8Y$%4", "$ aff", "ll!A/", "&1v9g", "bNq>e", "p7lf$", "7\"\"B`z", "Hf,*,", "B3v14;3", "nTIl=1", "toni/sodiumdynamiclights/mixin/MinecraftClientMixin.classPK", "toni/sodiumdynamiclights/mixin/lightsource/", "5tPpu", "wo-$9", "{,zP61", "!btltfN", "DZCD-q", "0x$U%", "]Owe/%", "Qpu;~", "k,ULc,", "eD|{C", "Rz,!4", "BA3i^`G", "jR+Un", "m1Pt0", "U+r]bE", "%=cR0]", "d =l4s", "x\"L&8", "31^6X", "dp.pT", "0B& 5", "c!1HA", "^#y`%", "Oyk7]", "WW_NP", "mug$F", "(\\UxC", "EsxToo;K2k#", "BnGK~QF", "dev/lambdaurora/lambdynlights/api/item/ItemLightSourceManager.classPK", "JYH&x%", "CjXWe5uS", "W(rePx.5", "v>f~oD", "iS\"fNt", "IrZlz=", "79l1m", "%]zDC", "aZron", "rhEVq", "EhhY*T", "ejamB'", "x18I0@", "|r\"@GX", ";YL\",", "Bp&ke+a", "pla3A", "2o>O}", "da&]y(", "assets/sodiumdynamiclights/dynamiclights/item/adorn_green_table_lamp.jsonPK", "{S'6|", "{d&5`", "GFUos", "Lui{>", "Mwmwr", ";4qBR", "\"ZxMl", "@+a^N", "Wp~iQr", "bF!IY!", "jZXIU", "a?WRJ", "3}X@A", "ZHwbJxM", "3h6iz", "hZQep", "/.I,R", "e8b+%", "D+3I{Y", "6RK)oU!", "=pFdo", "C(k|W", "42&+A,", "lqey", "@Mxw%>Ec", "@#CY\\", "C!kSy", ".c'f0", "+E' i", "TimQh", "2Gp3s", "7,! +", "Bz@N|", "BS(b2", "*:knTY", "/?^m%", "?1l4#", "-clL:", "%CqVVB", ".Y0st&", "Vvn<%`", "_%53\"", "KH]c7", "DOiC#", "4S+'r", "assets/sodiumdynamiclights/lang/ru_ru.jsonPK", "Cs1{p", "+DR\\2", "p", "5Pl)$U", "$ORARc", "RzlF\\s\"", "892C,,&", "I[?&i", "Ya3E7", "q*m`l", "3Q]|O", "e{A-m<.o", "`=g7ag", "s g>9c", "toni/", "*IX8o", "1sC'{", "6%d&3@", "&ug6,<", "9M[7'#", "\\f_ho", "\"4<+Yd{d", "%=3s%Y", "%CBxi", "CQ3PF", "7/]dA_", "z>:?{", "9Nrkj", "assets/sodiumdynamiclights/lang/uk_ua.json", "6)O[!", "yl<\"Y", "]C.4u", "'`XxK", "~3Zyg", "y:+.@", ";+LGw", "BZgHRU", "eWd#W", ":AxH~", ":U.>x}", "r\\GM_", ":T^7?1", "assets/sodiumdynamiclights/lang/zh_cn.jsonPK", "$AZW;G", "rP$}sl", "K=0", "af%c@", "M$HiX", "assets/sodiumdynamiclights/dynamiclights/item/adorn_magenta_table_lamp.jsonPK", "O)-.Q", ">\"%A6", "lE4~L", "f(6MH", "qn=*f%I&", "-FIv:", "Fcvm*Y", "V&\"h7", "s@PON<", "_71KsK", "2\\1'S", "U{\"J}", "m9I~G", "a Go6", "BrV[[", "@10TA", "L7G^..", "Q|aGP", "Z0W'w", "Mu.$`d", "K9'", "dhsb2", "\\[_S'", ":Tr*N", "META-INF/MANIFEST.MF]", "t-hux", "{Re*.9YZ", ", Fd7", "r;&a,", "X47bD", "dev/lambdaurora/lambdynlights/PK", "HQ%OSV", "Sj#Up", "`c+3^", "kXCD@puIK", "B~<|XSs", "y(S$V", "dev/lambdaurora/lambdynlights/api/item/ItemLightSource$BlockItemLightSource.class", "Ncgg;", "oo_sD", "JRj-\\", "assets/PK", "N)Jg$", "mPc9Ak", "3P2qy", "2#1|'", "W'vh6", "3A7gJ9{", "K,;>he", "1~@xL", "Y?c^.", "toni/sodiumdynamiclights/mixin/lightsource/PrimedTntEntityMixin.classPK", "m4)Lz", "Uqgw%6", "z'~%C4", "Zy=7`", "assets/sodiumdynamiclights/dynamiclights/item/adorn_brown_table_lamp.jsonPK", "*;Ej%*", "s&}mL", "-!,@Hf", "K-R(3R", "toni/sodiumdynamiclights/mixin/sodium/LightDataAccessMixin.classPK", "qA[m3b", "8}HdXT<", "d5ks``z", "s]OSo", "{7r]K", "agRFnn", "1$y$<", "#fY\"R", "sP=;J", "assets/sodiumdynamiclights/lang/tr_tr.jsonPK", "3LAW,*", "1s-&X", "assets/sodiumdynamiclights/dynamiclights/item/adorn_black_table_lamp.jsonPK", "rCzS,(", "-7UK3", "o.+<3\"", "VV\\re\\r", "PoW[\"", "l9Beo", "+Ebcb", "/Hjwm", "m9jXbo<", "Ez\"26", ",.jk}", "i}EH0", "Eb*xV", "lJ(-1", "3^&BZ<", "w4+2[", "W3bbl", "cJb.'c", "[)c7j", "(p[{q", "}~}3&", "8UQa|u5", "0q@8t", "_>Pz}", "4ZY{@", "x_R_l[z_2", "2:XGx", "D\\UbiyT", "l6Vp.", "OqpiA", "LipH&", "7t>_\"-", "!N*XW", "]J>&c5!", "9twro", ";\\AiM}]", "6P9`c", "+-g^t", ",S.EkbHn", "o.iHM", "nbC:s", "liYh]", "Le-h#t", "@'\\@u}", ";i+ym", "5wEQ\\", "pKJzbe", "lG||||", "Ojri*a", "|)<;8", "xuR", "G\"/x{", "EoaSP", "[4(o|", "toni/sodiumdynamiclights/mixin/fabric/AoCalculatorMixin.classPK", "):U'5", "#G.o*", "assets/sodiumdynamiclights/dynamiclights/item/soul_torch.jsonPK", "M?yzg(", "uq4^L", "U=Y_%", "*S`2P`u", "@>#F5", "WE\\80", "~fAVL", "assets/sodiumdynamiclights/dynamiclights/item/nether_star.jsonPK", "r^hF^x", "XettR", "8!)R9", ".)Nhq", "$QhX_", "q^.s[", "<'xbL", "5GQ+R", "ds&/s", "i'tXX_", "LH;U]N4", "S?;|=>", "[e[vw", "f<-)+", "*R26u", "dejUl", "%,\"`+", "Z6@1o", ">r=a;", "-~ris", "y=1Tr", "M1\\,p", "0)a=n", "1Q*-:", "vr$(1", "D\\OAl`w", "tJi,,", "uW+fx9", "#Us{0E", "Z0{PG", "N$P&No", "=`8*#", "r]:YR", ":Lt5U" ], "virustotal": { "error": true, "msg": "Unable to complete connection to VirusTotal. Status code: 429" }, "executed_tools": [ "msi_extract", "overlay", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 0, "cape_type": "" } }, "CAPE": { "payloads": [], "configs": [] }, "info": { "version": "2.5", "started": "2026-06-29 19:38:35", "ended": "2026-06-29 19:38:55", "duration": 20, "id": 104, "category": "file", "custom": "", "machine": { "id": 104, "status": "stopping", "name": "win10", "label": "win10", "platform": "windows", "manager": "KVM", "started_on": "2026-06-29 19:38:35", "shutdown_on": "2026-06-29 19:38:54" }, "package": "jar", "timeout": false, "tlp": null, "parent_sample": null, "options": { "vnc_port": "5900" }, "source_url": null, "route": "internet", "user_id": 0, "CAPE_current_commit": "394455c2cd85889fb0782bfcf1f8c5c2f7f77b46" }, "behavior": { "processes": [] }, "debug": { "log": "2026-06-29 14:58:59,777 [root] INFO: Date set to: 20260629T19:38:40, timeout set to: 15\n2026-06-29 19:38:40,715 [root] DEBUG: Starting analyzer from: C:\\7d7wfxi0\n2026-06-29 19:38:40,717 [root] DEBUG: Storing results at: C:\\QonFocsg\n2026-06-29 19:38:40,718 [root] DEBUG: Pipe server name: \\\\.\\PIPE\\ZkVqIBDyaH\n2026-06-29 19:38:40,718 [root] DEBUG: Python path: C:\\Users\\Rajesh\\AppData\\Local\\Programs\\Python\\Python314\n2026-06-29 19:38:40,719 [root] INFO: analysis running as an admin\n2026-06-29 19:38:40,719 [root] INFO: analysis package specified: \"jar\"\n2026-06-29 19:38:40,720 [root] DEBUG: importing analysis package module: \"modules.packages.jar\"...\n2026-06-29 19:38:40,727 [root] DEBUG: imported analysis package \"jar\"\n2026-06-29 19:38:40,727 [root] DEBUG: initializing analysis package \"jar\"...\n2026-06-29 19:38:40,728 [lib.common.common] INFO: no wrapping\n2026-06-29 19:38:40,728 [lib.core.compound] INFO: C:\\Users\\Rajesh\\AppData\\Local\\Temp already exists, skipping creation\n2026-06-29 19:38:40,729 [root] DEBUG: New location of moved file: C:\\Users\\Rajesh\\AppData\\Local\\Temp\\sodiumdynamiclights-.jar\n2026-06-29 19:38:40,730 [root] INFO: Analyzer: Package modules.packages.jar does not specify a dll option\n2026-06-29 19:38:40,730 [root] INFO: Analyzer: Package modules.packages.jar does not specify a dll_64 option\n2026-06-29 19:38:40,730 [root] INFO: Analyzer: Package modules.packages.jar does not specify a loader option\n2026-06-29 19:38:40,731 [root] INFO: Analyzer: Package modules.packages.jar does not specify a loader_64 option\n2026-06-29 19:38:40,763 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.browser\"\n2026-06-29 19:38:40,773 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.digisig\"\n2026-06-29 19:38:40,806 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.disguise\"\n2026-06-29 19:38:40,839 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.human\"\n2026-06-29 19:38:40,844 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.tlsdump\"\n2026-06-29 19:38:40,844 [root] DEBUG: Initialized auxiliary module \"Browser\"\n2026-06-29 19:38:40,845 [root] DEBUG: attempting to configure 'Browser' from data\n2026-06-29 19:38:40,846 [root] DEBUG: module Browser does not support data configuration, ignoring\n2026-06-29 19:38:40,847 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.browser\"...\n2026-06-29 19:38:41,136 [root] DEBUG: Started auxiliary module modules.auxiliary.browser\n2026-06-29 19:38:41,137 [root] DEBUG: Initialized auxiliary module \"DigiSig\"\n2026-06-29 19:38:41,138 [root] DEBUG: attempting to configure 'DigiSig' from data\n2026-06-29 19:38:41,139 [root] DEBUG: module DigiSig does not support data configuration, ignoring\n2026-06-29 19:38:41,140 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.digisig\"...\n2026-06-29 19:38:41,140 [modules.auxiliary.digisig] DEBUG: Checking for a digital signature\n2026-06-29 19:38:42,174 [modules.auxiliary.digisig] DEBUG: File has an invalid signature\n2026-06-29 19:38:42,174 [modules.auxiliary.digisig] INFO: Uploading signature results to aux/DigiSig.json\n2026-06-29 19:38:42,175 [root] DEBUG: Started auxiliary module modules.auxiliary.digisig\n2026-06-29 19:38:42,176 [root] DEBUG: Initialized auxiliary module \"Disguise\"\n2026-06-29 19:38:42,176 [root] DEBUG: attempting to configure 'Disguise' from data\n2026-06-29 19:38:42,176 [root] DEBUG: module Disguise does not support data configuration, ignoring\n2026-06-29 19:38:42,177 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.disguise\"...\n2026-06-29 19:38:42,185 [modules.auxiliary.disguise] INFO: Launched background process notepad.exe hidden (PID: 3116)\n2026-06-29 19:38:42,197 [modules.auxiliary.disguise] INFO: Disguising GUID to fa0ac19c-b40c-4caf-91d3-7eb1460f4ffc\n2026-06-29 19:38:42,199 [root] DEBUG: Started auxiliary module modules.auxiliary.disguise\n2026-06-29 19:38:42,200 [root] DEBUG: Initialized auxiliary module \"Human\"\n2026-06-29 19:38:42,201 [root] DEBUG: attempting to configure 'Human' from data\n2026-06-29 19:38:42,202 [root] DEBUG: module Human does not support data configuration, ignoring\n2026-06-29 19:38:42,210 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.human\"...\n2026-06-29 19:38:42,223 [root] DEBUG: Started auxiliary module modules.auxiliary.human\n2026-06-29 19:38:42,224 [root] DEBUG: Initialized auxiliary module \"TLSDumpMasterSecrets\"\n2026-06-29 19:38:42,224 [root] DEBUG: attempting to configure 'TLSDumpMasterSecrets' from data\n2026-06-29 19:38:42,225 [root] DEBUG: module TLSDumpMasterSecrets does not support data configuration, ignoring\n2026-06-29 19:38:42,225 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.tlsdump\"...\n2026-06-29 19:38:42,227 [modules.auxiliary.tlsdump] WARNING: Unable to find lsass.exe process\n2026-06-29 19:38:42,227 [root] DEBUG: Started auxiliary module modules.auxiliary.tlsdump\n2026-06-29 19:38:48,187 [root] INFO: Restarting WMI Service\n2026-06-29 19:38:50,339 [root] DEBUG: package modules.packages.jar does not support configure, ignoring\n2026-06-29 19:38:50,341 [root] WARNING: configuration error for package modules.packages.jar: error importing data.packages.jar: No module named 'data.packages'\n2026-06-29 19:38:50,347 [root] ERROR: You probably submitted the job with wrong package\nTraceback (most recent call last):\n File \"C:\\7d7wfxi0/analyzer.py\", line 688, in run\n pids = self.package.start(self.target)\n File \"C:\\7d7wfxi0\\modules\\packages\\jar.py\", line 43, in start\n java = self.get_path_glob(\"Java\")\n File \"C:\\7d7wfxi0\\lib\\common\\abstracts.py\", line 154, in get_path_glob\n raise CuckooPackageError(f\"Unable to find any {application} executable\")\nlib.common.exceptions.CuckooPackageError: Unable to find any Java executable\n\nThe above exception was the direct cause of the following exception:\n\nTraceback (most recent call last):\n File \"C:\\7d7wfxi0/analyzer.py\", line 1598, in \n success = analyzer.run()\n File \"C:\\7d7wfxi0/analyzer.py\", line 692, in run\n raise CuckooError(f'The package \"{self.package_name}\" start function raised an error: {e}') from e\nlib.common.exceptions.CuckooError: The package \"modules.packages.jar\" start function raised an error: Unable to find any Java executable\n2026-06-29 19:38:50,437 [root] WARNING: Folder at path \"C:\\QonFocsg\\debugger\" does not exist, skipping\n2026-06-29 19:38:50,438 [root] WARNING: Folder at path \"C:\\QonFocsg\\tlsdump\" does not exist, skipping\n2026-06-29 19:38:50,438 [root] INFO: Analysis completed\n", "errors": [] }, "network": { "pcap_sha256": "c0b76f095fa461541daf18cea831c9044a95282149fa60bdb7a94eca3dd7cdde", "hosts": [ { "ip": "151.101.206.172", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 80 ] }, { "ip": "20.190.159.23", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 443 ] } ], "domains": [], "tcp": [ { "src": "192.168.122.139", "sport": 49769, "dst": "20.190.159.23", "dport": 443, "offset": 24, "time": 0.0 }, { "src": "192.168.122.139", "sport": 49780, "dst": "20.190.159.23", "dport": 443, "offset": 7260, "time": 0.27352213859558105 }, { "src": "192.168.122.139", "sport": 49781, "dst": "151.101.206.172", "dport": 80, "offset": 33642, "time": 1.3725271224975586 }, { "src": "192.168.122.139", "sport": 49782, "dst": "151.101.206.172", "dport": 80, "offset": 37500, "time": 2.478929042816162 } ], "udp": [], "icmp": [], "http": [], "dns": [], "smtp": [], "irc": [], "dead_hosts": [] }, "url_analysis": {}, "procmemory": [], "signatures": [], "malscore": 0.0, "ttps": [], "malstatus": null }