{ "ml": { "v": "7", "eng": "2.2.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.04781887, "rte": "az", "prob": 0.04781887 }, { "cls": 0, "raw": 0.04706536, "rte": "az/zip", "prob": 0.04706536 } ], "prob": 0.15302083, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.15302082896232605, "type": "crx" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00006663799285888672, "type": "png" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.00006663799285888672, "type": "png" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.00006663799285888672, "type": "png" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.00006663799285888672, "type": "png" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.15302082896232605, "type": "chrome-manifest" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.0030144155025482178, "type": "text" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.012812942266464233, "type": "javascript" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.15302082896232605, "type": "json" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.15302082896232605, "type": "json" }, { "id": 10, "lvl": -1, "conf": 0, "prob": 0.15302082896232605, "type": "json" }, { "id": 11, "lvl": -1, "conf": 0, "prob": 0.15302082896232605, "type": "json" }, { "id": 12, "lvl": -1, "conf": 0, "prob": 0.15302082896232605, "type": "json" }, { "id": 13, "lvl": -1, "conf": 0, "prob": 0.00008612871170043945, "type": "json" }, { "id": 14, "lvl": -1, "conf": 0, "prob": 0.15302082896232605, "type": "json" }, { "id": 15, "lvl": -1, "conf": 0, "prob": 0.15302082896232605, "type": "json" }, { "id": 16, "lvl": -1, "conf": 0, "prob": 0.15302082896232605, "type": "json" }, { "id": 17, "lvl": -1, "conf": 0, "prob": 0.00008612871170043945, "type": "json" }, { "id": 18, "lvl": -1, "conf": 0, "prob": 0.00006663799285888672, "type": "json" } ], "version": "v18.18", "analyzed_at": "2026-07-07T22:11:26Z" }, "path": "maoiencdkifcakgnlgkmbecbmbooojah.crx", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "lVK}s0@@r39T8Jz608iyRueD60u%ib1{(=lnqu\u003cF0r", "n": [ { "c": 2, "d": "Chrome Web Store extension archive", "i": "metadata/permission/manifest::chrome-webstore-extension", "o": 0, "z": 1, "cf": 0.949999988079071 } ], "ln": 0 } ], "mol": "H₂(FU)", "sha": "16d6e8cd8364d9d253f1c421a142980b8fbc7bc69e3e638afbba93de3d09f966", "path": "/data/samples/unknown/foraged/chrome/google.com/chromewebstore.google.com/maoiencdkifcakgnlgkmbecbmbooojah/maoiencdkifcakgnlgkmbecbmbooojah.crx", "risk": 3, "size": 24292, "type": "crx", "facts": { "metrics": { "file": { "size": 24292.0, "entropy": 7.71, "size_bytes": 24292.0 }, "binary": { "overall_entropy": 7.71, "peak_region_bytes": 19456.0, "peak_region_entropy": 7.78 }, "archive": { "file_count": 19.0, "member_count": 32.0, "prefix_bytes": 1322.0, "script_count": 1.0, "zip_bomb_ratio": 5.04, "directory_count": 13.0, "executable_count": 0.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 18940.0, "compression.ratio": 0.59, "hidden_file_count": 0.0, "total_uncompressed": 32370.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 32.0, "rtlo_filename_count": 0.0, "format.regular_count": 19.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "format.directory_count": 13.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 18.0, "timing.mtime_unique_ratio": 0.56, "misplaced_executable_count": 0.0, "timing.mtime_dominant_count": 11.0, "timing.mtime_spread_seconds": 164.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.34, "compression.method_counts.deflate": 32.0 } } }, "ident": { "trust": "self_signed", "identifier": { "value": "lfoeajgcchlidpicbabpmckkejpckcfb", "source": "crx.extension_id", "verified": true }, "unique_ids": { "crx_id": "lfoeajgcchlidpicbabpmckkejpckcfb", "public_key_sha256": "b5e4096227b83f82101fc2aa49f2a251accde3d98471464dd17d1819b43786b0" } }, "traits": [ { "id": "metadata/permission/manifest::extension-localized-description-placeholder", "conf": 0.949999988079071, "crit": 2, "desc": "Extension description uses locale placeholder" }, { "id": "metadata/permission/manifest::extension-conventional-version", "conf": 0.949999988079071, "crit": 2, "desc": "Extension uses conventional version" }, { "id": "micro-behaviors/time/schedule/interval::setTimeout", "crit": 2, "desc": "setTimeout timer usage", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/data/encode/skip-step::js-loop-string-plus-equals", "conf": 0.6000000238418579, "crit": 3, "desc": "+= string concatenation from array access", "from": [ { "file": 7 } ] }, { "id": "metadata/permission/manifest::extension-google-update-url", "conf": 0.949999988079071, "crit": 2, "desc": "Extension uses Google update URL" }, { "id": "metadata/permission/manifest::extension-description-field", "conf": 0.949999988079071, "crit": 2, "desc": "Extension declares description field" }, { "id": "metadata/permission/manifest::extension-localized-name-placeholder", "conf": 0.949999988079071, "crit": 2, "desc": "Extension name uses locale placeholder" }, { "id": "micro-behaviors/fs/path/sensitive/browser::browser-local-storage-access", "conf": 0.699999988079071, "crit": 3, "desc": "Browser localStorage access", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/ui/window/manage/dom::browser-innerhtml-assignment", "conf": 0.800000011920929, "crit": 3, "desc": "Assigns DOM innerHTML", "from": [ { "file": 7 } ] }, { "id": "metadata/permission/manifest::extension-name-field", "conf": 0.949999988079071, "crit": 2, "desc": "Extension declares name field" }, { "id": "micro-behaviors/fs/path/sensitive/browser::browser-storage-getitem", "conf": 0.800000011920929, "crit": 3, "desc": "Browser storage getItem call", "from": [ { "file": 7 } ] }, { "id": "metadata/permission/manifest::chrome-extension-basic-metadata", "conf": 0.949999988079071, "crit": 2, "desc": "Chrome extension has basic metadata", "from": [ { "off": 156, "file": 5, "line": 7 } ] }, { "id": "micro-behaviors/fs/path/sensitive/browser::localstorage-get", "conf": 0.699999988079071, "crit": 3, "desc": "Browser localStorage read access", "from": [ { "file": 7 } ] }, { "id": "metadata/permission/manifest::extension-icon-128", "conf": 0.949999988079071, "crit": 2, "desc": "Extension declares 128px icon" }, { "id": "micro-behaviors/fs/path/sensitive/browser::localstorage-set", "conf": 0.6000000238418579, "crit": 3, "desc": "Browser localStorage write access", "from": [ { "file": 7 } ] }, { "id": "metadata/permission/manifest::extension-default-locale", "conf": 0.949999988079071, "crit": 2, "desc": "Extension declares default locale" }, { "id": "metadata/permission/manifest::extension-action-icon", "conf": 0.949999988079071, "crit": 2, "desc": "Extension declares action icon" }, { "id": "metadata/permission/manifest::chrome-extension-localized-metadata", "conf": 0.949999988079071, "crit": 2, "desc": "Chrome extension has localized metadata", "from": [ { "off": 206, "file": 5, "line": 8 } ] }, { "id": "micro-behaviors/fs/path/sensitive/browser::browser-storage-persistence", "conf": 0.800000011920929, "crit": 3, "desc": "Persists data in browser storage", "from": [ { "off": 115, "file": 7, "line": 5 } ] }, { "id": "micro-behaviors/fs/path/sensitive/browser::browser-storage-setitem", "conf": 0.800000011920929, "crit": 3, "desc": "Browser storage setItem call", "from": [ { "file": 7 } ] }, { "id": "metadata/permission/manifest::chrome-webstore-verified-contents", "conf": 0.949999988079071, "crit": 1, "desc": "Chrome Web Store verified contents" }, { "id": "metadata/signed/platform::web-extension-manifest", "conf": 1.0, "crit": 1, "desc": "Web-extension manifest.json at archive root" } ] }, { "id": 1, "sha": "aaff58b626f1d23351f1fb0a93aa56b19dac1465b0bc1d14f2c0c92c1f9d2598", "path": "/data/samples/unknown/foraged/chrome/google.com/chromewebstore.google.com/maoiencdkifcakgnlgkmbecbmbooojah/maoiencdkifcakgnlgkmbecbmbooojah.crx!!icons/icon128.png", "size": 7539, "type": "png", "depth": 1 }, { "id": 2, "sha": "beaa88fa36a8c3fbd223b7ed5082e88ec18fcf1c9924ec23bdf364813b21c673", "path": "/data/samples/unknown/foraged/chrome/google.com/chromewebstore.google.com/maoiencdkifcakgnlgkmbecbmbooojah/maoiencdkifcakgnlgkmbecbmbooojah.crx!!icons/icon16.png", "size": 532, "type": "png", "depth": 1 }, { "id": 3, "sha": "8e724ff47b5ea699884089c62101bc5b089a86c5c8489d8481f8424974a39d8b", "path": "/data/samples/unknown/foraged/chrome/google.com/chromewebstore.google.com/maoiencdkifcakgnlgkmbecbmbooojah/maoiencdkifcakgnlgkmbecbmbooojah.crx!!icons/icon32.png", "size": 1234, "type": "png", "depth": 1 }, { "id": 4, "sha": "7cd9f939eef629eaed6830f96d3c70f2932e9ae9a2ff712e09e7cf43391e49d0", "path": "/data/samples/unknown/foraged/chrome/google.com/chromewebstore.google.com/maoiencdkifcakgnlgkmbecbmbooojah/maoiencdkifcakgnlgkmbecbmbooojah.crx!!icons/icon48.png", "size": 2091, "type": "png", "depth": 1 }, { "ctx": [ { "b": "DKp%tAaAy0wNxO2y:7[.b4#7uAc15[fjO*jwO#Qhga)iTz!A($e[n*pflpYBC4\u003eC$flIkAvru6ofjP3Ea$K6g3lQDnzddr@w[u49uV{13B7]Mgb03\u00265edz}ear\u003eYizdK[Lar\u003ef1o\u0026BL?wQ5rdzGxJgzCBRSwNw^*edz}ear\u003e#uA=U@kzx.a:a#7Y7e?!F24gjj2b4Lnav@=p5BzkVhb03?\u003cuTDJam{/?LBy/uhx(v(SwPIv4x(Ffdz/e]?a$KfgarR\u003eswObv[y\u0026\u003c32z!0i(wG\u003ceTb4UToedz}ear\u003eJfz/fRuiV@+U3lQDlar\u0026J#b03?\u003cx\u003e870B1.lqz/do/e]UYva$KfgarR^Ha#p$#iV]RXv@Dmafkj{mzzK42AbGqjedz}earR^Jg=MWuar\u003eJfz/fRHx\u003e870g=NabzF7dA4gjj2arR\u003c.gb{Esar\u003eJfz/fRHx\u003e870f!$ZvAbGqj4gjj2EjL*marR\u003epv@#B6zx.a:DKQr8arR^JwmYvYB.(ebAbPYrA3vs=b5?EtB-n%DBzU?redz}earR^JwmYvYB.(ebx\u003e870b03\u0026[4gjj2arR^Ha#7#1iV]RXv@Dmafkj{mzzs44AbGqjedz}earR^Har\u0026P%b03?\u003cx\u003e870B1.lqz/du^e]UYva$KfgarR^HarR\u003c+i3Hyab57L9zGvEBv@Dlwi4/e/xcF(o3lQDlarR^Jf!$ZjiV]RXv@Dmafkj{mzzr[ae]UYva}j(4arR!P4gjj2EjL*marR\u003eEwPzT4B8#5lzGv0.ax@aX3vI", "n": [ { "c": 2, "d": "Extension declares action icon", "i": "metadata/permission/manifest::extension-action-icon", "o": 431, "z": 99, "cf": 0.949999988079071 }, { "c": 2, "d": "Extension version uses dotted numeric format", "i": "metadata/permission/manifest::extension-conventional-version", "o": 133, "z": 5, "cf": 0.949999988079071 }, { "c": 2, "d": "Extension declares default locale", "i": "metadata/permission/manifest::extension-default-locale", "o": 206, "z": 2, "cf": 0.949999988079071 }, { "c": 2, "d": "Extension declares description field", "i": "metadata/permission/manifest::extension-description-field", "o": 156, "z": 28, "cf": 0.949999988079071 }, { "c": 2, "d": "Extension uses Google update URL", "i": "metadata/permission/manifest::extension-google-update-url", "o": 2, "z": 47, "cf": 0.949999988079071 }, { "c": 2, "d": "Extension declares 128px icon", "i": "metadata/permission/manifest::extension-icon-128", "o": 342, "z": 17, "cf": 0.949999988079071 }, { "c": 2, "d": "Extension name uses locale placeholder", "i": "metadata/permission/manifest::extension-localized-name-placeholder", "o": 97, "z": 21, "cf": 0.949999988079071 }, { "c": 2, "d": "Chrome extension manifest file", "i": "metadata/permission/manifest::is-chrome-manifest", "o": 71, "z": 1, "cf": 0.949999988079071 } ], "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 618.0, "entropy": 4.69, "size_bytes": 618.0 }, "binary": { "overall_entropy": 4.69, "peak_region_bytes": 618.0, "peak_region_entropy": 4.69 } } }, "id": 5, "path": "/data/samples/unknown/foraged/chrome/google.com/chromewebstore.google.com/maoiencdkifcakgnlgkmbecbmbooojah/maoiencdkifcakgnlgkmbecbmbooojah.crx!!manifest.json", "pid": 0, "risk": 1, "sha": "d09395bb4ab3a4efc843582e71515abc9652c80f2b872e051f2b32b51197a618", "size": 618, "traits": [ { "id": "metadata/permission/manifest::extension-localized-description-placeholder", "conf": 0.949999988079071, "crit": 2, "desc": "Extension description uses locale placeholder", "spans": [ [ 156, 28 ] ] }, { "id": "metadata/permission/manifest::extension-default-locale", "conf": 0.949999988079071, "crit": 2, "desc": "Extension declares default locale", "spans": [ [ 206, 2 ] ] }, { "id": "metadata/permission/manifest::extension-description-field", "conf": 0.949999988079071, "crit": 2, "desc": "Extension declares description field", "spans": [ [ 156, 28 ] ] }, { "id": "metadata/permission/manifest::extension-version-field", "conf": 0.949999988079071, "crit": 2, "desc": "Extension declares version field", "spans": [ [ 133, 5 ] ] }, { "id": "metadata/permission/manifest::extension-conventional-version", "conf": 0.949999988079071, "crit": 2, "desc": "Extension version uses dotted numeric format", "spans": [ [ 133, 5 ] ] }, { "id": "metadata/permission/manifest::extension-icon-128", "conf": 0.949999988079071, "crit": 2, "desc": "Extension declares 128px icon", "spans": [ [ 342, 17 ] ] }, { "id": "metadata/permission/manifest::extension-google-update-url", "conf": 0.949999988079071, "crit": 2, "desc": "Extension uses Google update URL", "spans": [ [ 2, 47 ] ] }, { "id": "metadata/permission/manifest::extension-action-icon", "conf": 0.949999988079071, "crit": 2, "desc": "Extension declares action icon", "spans": [ [ 431, 99 ] ] }, { "id": "metadata/permission/manifest::extension-localized-name-placeholder", "conf": 0.949999988079071, "crit": 2, "desc": "Extension name uses locale placeholder", "spans": [ [ 97, 21 ] ] }, { "id": "metadata/permission/manifest::is-chrome-manifest", "conf": 0.949999988079071, "crit": 2, "desc": "Chrome extension manifest file", "spans": [ [ 71, 1 ] ] }, { "id": "metadata/permission/manifest::extension-name-field", "conf": 0.949999988079071, "crit": 2, "desc": "Extension declares name field", "spans": [ [ 97, 21 ] ] }, { "id": "metadata/permission/manifest::chrome-extension-basic-metadata", "conf": 0.949999988079071, "crit": 2, "desc": "Chrome extension has basic metadata", "spans": [ [ 97, 21 ], [ 133, 5 ], [ 156, 28 ] ] }, { "id": "metadata/permission/manifest::chrome-extension-localized-metadata", "conf": 0.949999988079071, "crit": 2, "desc": "Chrome extension has localized metadata", "spans": [ [ 97, 21 ], [ 156, 28 ], [ 206, 2 ] ] }, { "id": "metadata/permission/manifest::chrome-extension-store-quality-metadata", "conf": 0.949999988079071, "crit": 2, "desc": "Chrome extension store metadata quality", "spans": [ [ 2, 47 ], [ 97, 21 ], [ 133, 5 ], [ 156, 28 ], [ 206, 2 ], [ 342, 17 ], [ 431, 99 ] ] } ], "type": "chrome-manifest" }, { "ctx": [ { "b": "kX\u003c}Rw].r%wPF#5AbYw%AV/Y", "ln": 166, "addr": 3147 }, { "b": "arUopz/3Rz", "ln": 167, "addr": 3168 }, { "b": "arR^Hz/xb{x([RYatt\u003e", "n": [ { "c": 2, "d": "CSS opacity zero rule", "i": "micro-behaviors/data/format/css::opacity-zero", "o": 3182, "z": 10, "cf": 0.7799999713897705 } ], "ln": 168, "addr": 3178 }, { "b": "arR^HBAg/cB7Puhz8@!Xv{%g+c[)8i", "ln": 169, "addr": 3195 }, { "b": "arV7", "ln": 170, "addr": 3221 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 4582.0, "entropy": 5.03, "size_bytes": 4582.0 }, "binary": { "overall_entropy": 5.03, "peak_region_bytes": 4582.0, "peak_region_entropy": 5.1 } } }, "id": 6, "path": "/data/samples/unknown/foraged/chrome/google.com/chromewebstore.google.com/maoiencdkifcakgnlgkmbecbmbooojah/maoiencdkifcakgnlgkmbecbmbooojah.crx!!popup.css", "risk": 1, "sha": "c45fd5500bc8b4fbef076ff594607e41a940249e02a4e87a3cb8a575b0bb3b9e", "size": 4582, "traits": [ { "id": "micro-behaviors/data/format/css::opacity-zero", "conf": 0.7799999713897705, "crit": 2, "desc": "CSS opacity zero rule", "spans": [ [ 3182, 10 ] ] }, { "id": "micro-behaviors/data/format/css::display-none", "conf": 0.8199999928474426, "crit": 1, "desc": "CSS display none rule", "spans": [ [ 4395, 13 ] ] } ], "type": "text" }, { "ctx": [ { "b": "v@bN{B09?)Aarr(wKx)Ev{@[VaBs", "n": [ { "c": 2, "d": "Any script file", "i": "metadata/file/extension/identity::script-file", "o": 0, "z": 8, "cf": 1.0 } ], "ln": 1, "addr": 0 }, { "b": "arUfjzGx]uBZ]JiAWSvVDJ", "ln": 2, "addr": 24 }, { "b": "arR^HBzbxfe[Yiswfs2Ttu%q", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 47, "z": 4, "cf": 0.800000011920929 } ], "ln": 3, "addr": 43 }, { "b": "arR^HBzbxfe]$JvA+cvRatt\u003e", "ln": 4, "addr": 64 }, { "b": "arR^HBzbxfe[eykBw(W/A+cvRaAg+fB7E{XBsp%zv{%gLBz(hdxjSYdwPQH=wO\u0026?yv%8:2vqxBvwPI@vdiK1=asw\u0026\u003cdlv", "n": [ { "c": 3, "d": "Browser storage getItem call", "i": "micro-behaviors/fs/path/sensitive/browser::browser-storage-getitem", "o": 115, "z": 20, "cf": 0.800000011920929 } ], "ln": 5, "addr": 85 }, { "b": "arR^HBzbxfe[XQfwMJ!/auZ\u0026VvqH0@i@", "ln": 6, "addr": 161 }, { "b": "arR^HBzbxfe]$-MwGTbUg=\u003e", "ln": 7, "addr": 188 }, { "b": "arR^HBzbxfe]\u003eJvwmY^Fz^^V%c[dj", "ln": 34, "addr": 744 }, { "b": "arR^HBzbxfe{hbzvru6Vv@Dy0c[dj", "ln": 35, "addr": 769 }, { "b": "arR^Hwn+$2zdNQbe[X:qmqMKLwO#PRC$zJ{cUD\u003e8wLWFXAWJp*v@bN{B4*p?Bs}0jwge*sx\u003eg:=zyl\u003e{", "n": [ { "c": 1, "d": "getElementById/querySelector (getElementById)", "i": "micro-behaviors/ui/window/manage/dom::dom-element-lookup--getelementbyid", "o": 807, "z": 14, "cf": 0.8999999761581421 } ], "ln": 36, "addr": 794 }, { "b": "arR^Hwn+$2zdNQbe[X:qmqMKLwO#PRC$zJ{cUD\u003e8wMJO-cN*VTy*?yaoLFM\u0026e[5p3c)@XxwmPm?cN?a", "ln": 37, "addr": 860 }, { "b": "arV7", "ln": 38, "addr": 925 }, { "b": "", "ln": 39, "addr": 930 }, { "b": "arU-pBAIK\u003eC4CMkoLFM\u0026wO#71B0@EWDJ", "ln": 40, "addr": 932 }, { "b": "arR^Hwn+$2zdNQbe[5p3mrSlWBwcy\u0026By/u3AWSqJwQd*8CwX=VasH!Iau.[hBzbxfe[!WhwnC*IwQd9)wPI]vwHP5\u0026", "n": [ { "c": 1, "d": "Browser keydown activity listener", "i": "objectives/impact/cryptojacking/miner/smart::browser-keydown-listener", "o": 972, "z": 26, "cf": 0.7799999713897705 } ], "ln": 41, "addr": 959 }, { "b": "arR^Hwn+$2zdNQbe[X:qmqMKLwO#PRC$zJ{cViHtm}3mCcN*VRwmObLwO#P-x(!xczE)\u0026pcU3$bv@0CyasFVYjW70gxLzJux(mTbm}3mCc[cPb", "ln": 42, "addr": 1033 }, { "b": "arR^Hwn+$2zdNQbe[X:qmqMKLwO#PRC$zJ{cVS^tByxiim}3mCcN*VRwmObLwO#P-x(!xczE)\u0026pcU3$bv@0CyasFVYjW70gxLzJux(mTbm}3mCc[cPb", "ln": 43, "addr": 1123 }, { "b": "", "ln": 49, "addr": 1470 }, { "b": "arUuazE^M{oj-xBA+frkc$K?IDJ", "ln": 50, "addr": 1472 }, { "b": "arR^Hx\u003ewFotphZSA=le4A3)gVcQz=[z*aP/CwX=VasxD}A=ld}wOc3iefDraA=M8xqFx=SBsguDx(mA%B.268c$L2DwQbZNaBs", "n": [ { "c": 2, "d": "JavaScript substring search call", "i": "micro-behaviors/data/string/search::js-includes-indexof-call", "o": 1555, "z": 9, "cf": 0.8199999928474426 } ], "ln": 51, "addr": 1495 }, { "b": "arR^HarUkFAb]JkwO#PTwObv[y\u0026?6Oi@", "ln": 52, "addr": 1575 }, { "b": "arR^HarQ", "ln": 53, "addr": 1602 }, { "b": "arR^HarR^Hx\u003ewFoBzbxfe[nNav@2dWzyu}Rcmf\u0026UBzbxfe[XQfwMJ!/diJ%", "ln": 61, "addr": 1776 }, { "b": "arR^HarR^HarU=tx(+[tvqPNSz/cWXaARTDwJG", "ln": 62, "addr": 1825 }, { "b": "arR^HarR^HarU-pBw#%\u003ewP8Zkc[3I!jW70n", "n": [ { "c": 2, "d": "setTimeout timer usage", "i": "micro-behaviors/time/schedule/interval::setTimeout", "o": 1867, "z": 10, "cf": 0.5 } ], "ln": 63, "addr": 1857 }, { "b": "arR^HarR^HarR^Hwn+$2zdNQbe[X:qmqMKLwO#PRC$zJ{cUD\u003e8wMJO-cN*VTy*?yaoLFM\u0026e]\u003eJuz*2XucUNj8wmYTadlv", "ln": 64, "addr": 1887 }, { "b": "arR^HarR^HarV7-at\u003e\u0026bdlv", "ln": 65, "addr": 1963 }, { "b": "arR^HarR^HEir9qB7DFdw/@HzxLzJuv}YB-yE./IwLWFXAWSv=aBs", "ln": 66, "addr": 1983 }, { "b": "arR^HarR^HarU-pBw#%\u003ewP8Zkc[3I!jW70n", "ln": 67, "addr": 2027 }, { "b": "arR^HarR^HarR^Hwn+$2zdNQbe[X:qmqMKLwO#PRC$zJ{cUv7gvqF\u003eLz/Pzpdk2ZNCYVq\u003ezGGDcBrAZ?Bzbxfe]$JvA+dr", "n": [ { "c": 1, "d": "Assigns code body into DOM element text", "i": "objectives/command-and-control/dropper/execution/browser::dom-script-text-body-assign", "o": 2106, "z": 14, "cf": 0.800000011920929 } ], "ln": 68, "addr": 2057 }, { "b": "arR^HarR^HarR^Hwn+$2zdNQbe[X:qmqMKLwO#PRC$zJ{cUD\u003e8wLWFXAWJp*v@bN{B4*p?Bs}PBzeTPec)@XxwmPm?cN?a", "ln": 69, "addr": 2134 }, { "b": "arR^HarR^HarV7-at\u003e\u0026bdlv", "ln": 70, "addr": 2211 }, { "b": "arUJtC4A7jx(W={BzkVhdiJ%", "ln": 76, "addr": 2265 }, { "b": "arR^Hy?mYhzeTPewfs2Tw)]H%wJG", "ln": 77, "addr": 2286 }, { "b": "arR^Hv@DmaBrCHrwjHVOwfs2Tn(FIXe]#bPx(mM$w{C!DxLzJuxl4Y%dlv", "n": [ { "c": 2, "d": "Object serialization methods", "i": "objectives/discovery/system/fingerprint/runtime::object-serialization", "o": 2330, "z": 14, "cf": 1.0 } ], "ln": 78, "addr": 2310 }, { "b": "", "ln": 79, "addr": 2358 }, { "b": "arR^HB9ztuv}Wo3x(W={BzkVhdiJ%", "ln": 80, "addr": 2360 }, { "b": "arUJtC4BuUw]]BIaBs", "ln": 98, "addr": 2759 }, { "b": "arR^Hy?mYhzeTPewfs2Tw)]H%wJG", "ln": 99, "addr": 2775 }, { "b": "arR^Hw]zYjc#rEpazz@Yatt(1x=]IXBzbxfe]$-MwJI2Gd\u003er4\u003eDJ", "n": [ { "c": 2, "d": "Nested for loops (control-flow building block)", "i": "micro-behaviors/data/encode/permutation/loop::js-permutation-loop", "o": 2803, "z": 175, "cf": 0.8999999761581421 } ], "ln": 100, "addr": 2799 }, { "b": "arR^HarUfjzGx[xA=ldAjS[\u0026Wx(+[tA+P5*x\u003cAu6x(4)5AWV9ty-\u003e(8aA?gfar-)hattla", "ln": 101, "addr": 2842 }, { "b": "arR^HarUfjzGx[xzdN:2wN(]Dax@bk", "ln": 102, "addr": 2900 }, { "b": "arR^HarR^Hx\u003ewFoy9kRYA=ldOy?mG%Bz8^GatB#=clNtECuX//au.\u003eJaAzyAtwtohatEdJaBs", "ln": 105, "addr": 2980 }, { "b": "arR^HarR^HarUJjA+w@]e]U@OxEE[tCuX//asXG?dlv", "ln": 106, "addr": 3040 }, { "b": "arR^HarR^HarU=tx(+[Fv@Dy0as/O$A=leayf.@iatM1", "n": [ { "c": 3, "d": "+= string concatenation from array access", "i": "micro-behaviors/data/encode/skip-step::js-loop-string-plus-equals", "o": 3091, "z": 15, "cf": 0.6000000238418579 } ], "ln": 107, "addr": 3076 }, { "b": "arR^HarR^HarUzHd)0", "ln": 108, "addr": 3113 }, { "b": "arR^HarR^HEir9qB7DFv", "ln": 109, "addr": 3129 }, { "b": "arR^HarR^HarUJjA+w@]e]U@OxEE[tCuX//dlv", "ln": 110, "addr": 3147 }, { "b": "arR^HarR^HEe", "ln": 111, "addr": 3179 }, { "b": "arR^HarV7", "n": [ { "c": 3, "d": "Executes script files", "i": "objectives/execution/condition/platform::executes-scripts", "o": 3196, "z": 22, "cf": 0.6000000238418579 } ], "ln": 112, "addr": 3190 }, { "b": "arR^HarQ", "ln": 113, "addr": 3199 }, { "b": "arR^HarU(wx(4u6c#AKoxjUQay?mG%Bz8^VaARphB1RJFDsXJFDJ", "ln": 114, "addr": 3207 }, { "b": "arR^H", "ln": 230, "addr": 6174 }, { "b": "arR^Hx\u003ewFowO(ydC%=dVy\u0026.jBwO#d5xDPFYfEXb\u003e", "ln": 231, "addr": 6180 }, { "b": "arR^HarUfjzGx[xDUC2Nyjdi/az2zeBA{k+y\u00261e%o\u003c@cSe[O{rz/Nm2vrufnA:-\u0026@z/3)KasXHBze:PxlUg7IB1RouzFa68dp21", "n": [ { "c": 2, "d": "Math.random invocation", "i": "micro-behaviors/os/random/prng/stdlib::math-random-call", "o": 6257, "z": 11, "cf": 1.0 } ], "ln": 232, "addr": 6214 }, { "b": "arR^HarU=tx(+[tA+P5*x\u003cB}Tt{8oMo\u003c@cSe]\u003exrwn=rkdiH.}fFkvdkoIZ7iV{mv", "ln": 233, "addr": 6295 }, { "b": "arR^HEe", "ln": 234, "addr": 6349 }, { "b": "arUYozE^s0lt{pMwge(HDJ", "ln": 237, "addr": 6363 }, { "b": "arR^Hv@DmaBrC4hvrb)3jS[oNv%8T1zGEHzwPQvSwO(0@Bv7mAwge*rvqPNxz^^V%cN?a", "ln": 238, "addr": 6382 }, { "b": "arR^HvSbW}wg?OlzE)\u0026Vr834ejS(a1i@", "n": [ { "c": 3, "d": "Assigns DOM innerHTML", "i": "micro-behaviors/ui/window/manage/dom::browser-innerhtml-assignment", "o": 6448, "z": 12, "cf": 0.800000011920929 } ], "ln": 239, "addr": 6439 }, { "b": "arR^H", "ln": 240, "addr": 6466 }, { "b": "arR^Hw]zYjc#rEpazz@Yatt(1x=]IXBzbxfe]$-MwJI2Gd\u003er4\u003eDJ", "ln": 241, "addr": 6472 }, { "b": "arR^Hx\u003ewFoBzbxfe]$JvA+cvSaARphB1Q{kB97t\u003cz/PzraBs", "ln": 270, "addr": 7375 }, { "b": "arR^HarU=tx(+[owPI@(v@Dy0auZ\u0026?xLzJuB7ocewJG", "ln": 271, "addr": 7415 }, { "b": "arR^HarUGsv{%gLBz(hdxjSYpwPQH=wO\u0026?yv%8:2vqxBvwPI@vefG4Fx(+[owPI@(v@Dy0dlv", "n": [ { "c": 3, "d": "Browser storage setItem call", "i": "micro-behaviors/fs/path/sensitive/browser::browser-storage-setitem", "o": 7457, "z": 20, "cf": 0.800000011920929 } ], "ln": 272, "addr": 7451 }, { "b": "arR^HEe", "ln": 273, "addr": 7511 }, { "b": "arR^H", "ln": 274, "addr": 7518 } ], "depth": 1, "facts": { "imp": [ [ "", "parseInt" ], [ "", "localStorage.getItem" ], [ "", "Array.fill.map" ], [ "", "Array.fill" ], [ "", "Array" ], [ "", "Array.fill" ], [ "", "Array" ], [ "", "document.getElementById.classList.add" ], [ "", "document.getElementById" ], [ "", "document.getElementById.classList.add" ], [ "", "document.getElementById" ], [ "", "document.addEventListener" ], [ "", "document.getElementById.addEventListener" ], [ "", "document.getElementById" ], [ "", "document.getElementById.addEventListener" ], [ "", "document.getElementById" ], [ "", "document.getElementById.addEventListener" ], [ "", "document.getElementById" ], [ "", "document.getElementById.addEventListener" ], [ "", "document.getElementById" ], [ "", "document.getElementById.classList.add" ], [ "", "document.getElementById" ], [ "", "e.preventDefault" ], [ "", "moved" ], [ "", "setTimeout" ], [ "", "document.getElementById.classList.remove" ], [ "", "document.getElementById" ], [ "", "setTimeout" ], [ "", "document.getElementById.textContent" ], [ "", "document.getElementById" ], [ "", "document.getElementById.classList.remove" ], [ "", "document.getElementById" ], [ "", "moved" ], [ "", "oldGrid" ], [ "", "JSON.stringify" ], [ "", "moved" ], [ "", "moved" ], [ "", "moved" ], [ "", "moved" ], [ "", "JSON.stringify" ], [ "", "moved" ], [ "", "row" ], [ "", "merged" ], [ "", "merged.push" ], [ "", "merged.push" ], [ "", "merged.push" ], [ "", "JSON.stringify" ], [ "", "JSON.stringify" ], [ "", "moved" ], [ "", "moved" ], [ "", "row" ], [ "", "merged" ], [ "", "merged.push" ], [ "", "merged.push" ], [ "", "merged.push" ], [ "", "final" ], [ "", "merged.reverse" ], [ "", "JSON.stringify" ], [ "", "JSON.stringify" ], [ "", "moved" ], [ "", "moved" ], [ "", "column" ], [ "", "column.push" ], [ "", "merged" ], [ "", "merged.push" ], [ "", "merged.push" ], [ "", "merged.push" ], [ "", "moved" ], [ "", "moved" ], [ "", "column" ], [ "", "column.push" ], [ "", "merged" ], [ "", "merged.push" ], [ "", "merged.push" ], [ "", "merged.push" ], [ "", "moved" ], [ "", "emptyCells" ], [ "", "emptyCells.push" ], [ "", "Math.floor" ], [ "", "Math.random" ], [ "", "Math.random" ], [ "", "board" ], [ "", "document.getElementById" ], [ "", "board.innerHTML" ], [ "", "tile" ], [ "", "document.createElement" ], [ "", "value" ], [ "", "tile.className" ], [ "", "tile.className" ], [ "", "cupcake" ], [ "", "document.createElement" ], [ "", "cupcake.className" ], [ "", "cupcake.textContent" ], [ "", "valueDiv" ], [ "", "document.createElement" ], [ "", "valueDiv.className" ], [ "", "valueDiv.textContent" ], [ "", "tile.appendChild" ], [ "", "tile.appendChild" ], [ "", "board.appendChild" ], [ "", "document.getElementById.textContent" ], [ "", "document.getElementById" ], [ "", "localStorage.setItem" ], [ "", "document.getElementById.textContent" ], [ "", "document.getElementById" ], [ "", "document.getElementById.textContent" ], [ "", "document.getElementById" ], [ "", "document.addEventListener" ] ], "mbr": [ "Array().fill", "Array().fill().map", "JSON.stringify", "Math.floor", "Math.random", "board.appendChild", "board.innerHTML", "column.length", "column.push", "cupcake.className", "cupcake.textContent", "document.addEventListener", "document.createElement", "document.getElementById", "document.getElementById().addEventListener", "document.getElementById().classList", "document.getElementById().classList.add", "document.getElementById().classList.remove", "document.getElementById().textContent", "e.key", "e.preventDefault", "emptyCells.length", "emptyCells.push", "localStorage.getItem", "localStorage.setItem", "merged.length", "merged.push", "merged.reverse", "row.length", "tile.appendChild", "tile.className", "valueDiv.className", "valueDiv.textContent" ], "tgt": [ "Array", "Array().fill", "Array().fill().map", "CupcakeCascade", "JSON.stringify", "Math.floor", "Math.random", "board.appendChild", "column.push", "document.addEventListener", "document.createElement", "document.getElementById", "document.getElementById().addEventListener", "document.getElementById().classList.add", "document.getElementById().classList.remove", "e.preventDefault", "emptyCells.push", "localStorage.getItem", "localStorage.setItem", "merged.push", "merged.reverse", "parseInt", "setTimeout", "tile.appendChild" ], "metrics": { "ast": { "op.eq": 10.0, "op.ge": 1.0, "op.gt": 2.0, "op.lt": 30.0, "op.ne": 9.0, "op.add": 10.0, "op.lor": 2.0, "op.mul": 9.0, "op.sub": 11.0, "op.land": 8.0, "op.lnot": 1.0, "max_depth": 25.0, "bind_count": 61.0, "call_count": 93.0, "node_count": 3283.0, "member_count": 33.0, "op_density.eq": 0.0, "op_density.ge": 0.0, "op_density.gt": 0.0, "op_density.lt": 0.01, "op_density.ne": 0.0, "op_density.add": 0.0, "op_density.lor": 0.0, "op_density.mul": 0.0, "op_density.sub": 0.0, "op_density.land": 0.0, "op_density.lnot": 0.0, "identifier_count": 70.0, "member_depth_max": 4.0, "string_literal_count": 56.0, "array_literal_max_length": 4.0, "string_concat_chain_max_length": 2.0 }, "file": { "size": 8389.0, "entropy": 4.69, "size_bytes": 8389.0 }, "text": { "digit_ratio": 0.03, "space_count": 2340.0, "total_lines": 308.0, "char_entropy": 4.69, "unique_chars": 94.0, "string_density": 0.18, "avg_line_length": 25.24, "high_byte_ratio": 0.01, "max_line_length": 92.0, "non_ascii_ratio": 0.01, "empty_line_ratio": 0.14, "last_line_length": 3.0, "whitespace_ratio": 0.35, "most_common_ratio": 0.06, "identifier_density": 1.65, "line_length_stddev": 21.25, "encoded_string_ratio": 0.02, "normalized_string_count": 3.19, "repeated_char_sequences": 40.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "trailing_whitespace_lines": 25.0, "most_common_char_codepoint": 101.0, "suspicious_identifier_ratio": 0.04, "normalized_unique_identifiers": 8.47 }, "binds": { "count": 61.0 }, "calls": { "count": 93.0 }, "binary": { "overall_entropy": 4.69, "peak_region_bytes": 5317.0, "peak_region_entropy": 5.01 }, "source": { "class_count": 1.0, "function_count": 15.0 }, "members": { "count": 33.0 }, "strings": { "total": 56.0, "avg_length": 6.64, "max_length": 18.0, "avg_entropy": 2.39, "empty_count": 1.0, "total_bytes": 372.0, "entropy_stddev": 0.59, "base64_candidates": 1.0 }, "functions": { "count": 16.0, "anonymous": 11.0, "avg_params": 0.12, "max_params": 1.0, "one_liners": 7.0, "length_stddev": 11.18, "avg_name_length": 10.4, "no_params_count": 23.0, "avg_length_lines": 11.85, "max_length_lines": 32.0, "min_length_lines": 1.0, "nested_functions": 5.0, "avg_nesting_depth": 0.38, "max_nesting_depth": 1.0, "single_char_params": 2.0, "avg_param_name_length": 3.67, "density_per_100_lines": 8.44, "code_in_functions_ratio": 1.0 }, "identifiers": { "count": 70.0, "total": 508.0, "avg_length": 7.63, "max_length": 19.0, "min_length": 1.0, "avg_entropy": 2.44, "reuse_ratio": 0.14, "unique_count": 70.0, "length_stddev": 3.77, "sequential_names": 3.0, "single_char_count": 3.0, "single_char_ratio": 0.04, "all_lowercase_ratio": 0.49, "all_uppercase_ratio": 0.01 } } }, "id": 7, "mol": "H₂(FU)", "path": "/data/samples/unknown/foraged/chrome/google.com/chromewebstore.google.com/maoiencdkifcakgnlgkmbecbmbooojah/maoiencdkifcakgnlgkmbecbmbooojah.crx!!popup.js", "risk": 3, "sha": "07fe8854061e7d5078692b03faf4369b628bd48745c4d832c2c88c17fb5a08fe", "size": 8389, "traits": [ { "id": "micro-behaviors/time/schedule/interval::setTimeout", "crit": 2, "desc": "setTimeout timer usage", "spans": [ [ 1867, 10 ] ] }, { "id": "micro-behaviors/fs/path/sensitive/browser::browser-storage-setitem", "conf": 0.800000011920929, "crit": 3, "desc": "Browser storage setItem call", "spans": [ [ 7457, 20 ] ] }, { "id": "micro-behaviors/fs/path/sensitive/browser::localstorage-set", "conf": 0.6000000238418579, "crit": 3, "desc": "Browser localStorage write access", "spans": [ [ 7457, 21 ] ] }, { "id": "micro-behaviors/fs/path/sensitive/browser::browser-local-storage-access", "conf": 0.699999988079071, "crit": 3, "desc": "Browser localStorage access", "spans": [ [ 115, 13 ] ] }, { "id": "micro-behaviors/fs/path/sensitive/browser::localstorage-get", "conf": 0.699999988079071, "crit": 3, "desc": "Browser localStorage read access", "spans": [ [ 115, 21 ] ] }, { "id": "micro-behaviors/data/encode/skip-step::js-loop-string-plus-equals", "conf": 0.6000000238418579, "crit": 3, "desc": "+= string concatenation from array access", "spans": [ [ 3091, 15 ] ] }, { "id": "micro-behaviors/ui/window/manage/dom::browser-innerhtml-assignment", "conf": 0.800000011920929, "crit": 3, "desc": "Assigns DOM innerHTML", "spans": [ [ 6448, 12 ] ] }, { "id": "micro-behaviors/fs/path/sensitive/browser::browser-storage-getitem", "conf": 0.800000011920929, "crit": 3, "desc": "Browser storage getItem call", "spans": [ [ 115, 20 ] ] }, { "id": "micro-behaviors/fs/path/sensitive/browser::browser-storage-persistence", "conf": 0.800000011920929, "crit": 3, "desc": "Persists data in browser storage", "spans": [ [ 115, 20 ], [ 7457, 20 ] ] } ], "type": "javascript" }, { "ctx": [ { "b": "DJ", "n": [ { "c": 2, "d": "JSON data format", "i": "metadata/file/format::valid", "o": 0, "z": 13, "cf": 0.6000000238418579 } ], "ln": 1, "addr": 0 }, { "b": "arR\u003etCYWImB7]Mgpgn0Jb03\u0026[", "ln": 2, "addr": 3 }, { "b": "arR^Hb5H[jB75Y)b03?\u003clV)uTvqxA%lT+4CvpS{[", "ln": 3, "addr": 25 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 214.0, "entropy": 4.8, "size_bytes": 214.0 }, "json": { "parsed_bytes": 214.0, "parse_limit_bytes": 76800.0 }, "binary": { "overall_entropy": 4.8, "peak_region_bytes": 214.0, "peak_region_entropy": 4.8 } } }, "id": 8, "path": "/data/samples/unknown/foraged/chrome/google.com/chromewebstore.google.com/maoiencdkifcakgnlgkmbecbmbooojah/maoiencdkifcakgnlgkmbecbmbooojah.crx!!_locales/de/messages.json", "risk": 1, "sha": "df12fa4cd4429852e64e38d2a40490a80901de5d9e3c012ccf034e9a125802b1", "size": 214, "traits": [ { "id": "metadata/file/format::valid", "conf": 0.6000000238418579, "crit": 2, "desc": "JSON data format", "spans": [ [ 0, 13 ] ] }, { "id": "metadata/file/extension/identity::web-asset-extension", "conf": 1.0, "crit": 1, "desc": "Web asset file extension (css/html/js/json)", "spans": [ [ 0, 13 ] ] } ], "type": "json" }, { "ctx": [ { "b": "DJ", "n": [ { "c": 2, "d": "JSON data format", "i": "metadata/file/format::valid", "o": 0, "z": 13, "cf": 0.6000000238418579 } ], "ln": 1, "addr": 0 }, { "b": "arR\u003etCYWImB7]Mgpgn0Jb03\u0026[", "ln": 2, "addr": 3 }, { "b": "arR^Hb5H[jB75Y)b03?\u003clV)uTvqxA%lT+4CvpS{[", "ln": 3, "addr": 25 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 219.0, "entropy": 4.7, "size_bytes": 219.0 }, "json": { "parsed_bytes": 219.0, "parse_limit_bytes": 76800.0 }, "binary": { "overall_entropy": 4.7, "peak_region_bytes": 219.0, "peak_region_entropy": 4.7 } } }, "id": 9, "path": "/data/samples/unknown/foraged/chrome/google.com/chromewebstore.google.com/maoiencdkifcakgnlgkmbecbmbooojah/maoiencdkifcakgnlgkmbecbmbooojah.crx!!_locales/en/messages.json", "risk": 1, "sha": "75d65d68e43f75100f6d32c86e9b52d6a79ef3a5a58c6eb97092cc4ad62ccf2a", "size": 219, "traits": [ { "id": "metadata/file/format::valid", "conf": 0.6000000238418579, "crit": 2, "desc": "JSON data format", "spans": [ [ 0, 13 ] ] }, { "id": "metadata/file/extension/identity::web-asset-extension", "conf": 1.0, "crit": 1, "desc": "Web asset file extension (css/html/js/json)", "spans": [ [ 0, 13 ] ] } ], "type": "json" }, { "id": 10, "sha": "3535ca7d6cf05f6eb31c8c65f6f7ff87ccbfd44b707e283497b1a1243eda9b95", "path": "/data/samples/unknown/foraged/chrome/google.com/chromewebstore.google.com/maoiencdkifcakgnlgkmbecbmbooojah/maoiencdkifcakgnlgkmbecbmbooojah.crx!!_locales/es/messages.json", "risk": 1, "size": 219, "type": "json", "depth": 1 }, { "id": 11, "sha": "229ca8bfb5b0c6c60419ad3a495416ed88d0fd275baa78c0d1c34c8a6f8cded3", "path": "/data/samples/unknown/foraged/chrome/google.com/chromewebstore.google.com/maoiencdkifcakgnlgkmbecbmbooojah/maoiencdkifcakgnlgkmbecbmbooojah.crx!!_locales/fr/messages.json", "risk": 1, "size": 214, "type": "json", "depth": 1 }, { "id": 12, "sha": "c134d91d0c16930b8efb9de751fb54281f7e2ba9216cd2891229e95e62e7cd1b", "path": "/data/samples/unknown/foraged/chrome/google.com/chromewebstore.google.com/maoiencdkifcakgnlgkmbecbmbooojah/maoiencdkifcakgnlgkmbecbmbooojah.crx!!_locales/it/messages.json", "risk": 1, "size": 217, "type": "json", "depth": 1 }, { "id": 13, "sha": "fabb01a5baabaaca61e08842fccc50f85acb65d469cb249f477121f3af2fc335", "path": "/data/samples/unknown/foraged/chrome/google.com/chromewebstore.google.com/maoiencdkifcakgnlgkmbecbmbooojah/maoiencdkifcakgnlgkmbecbmbooojah.crx!!_locales/ja/messages.json", "risk": 1, "size": 226, "type": "json", "depth": 1 }, { "id": 14, "sha": "d1aa21b954a6505e8882687e16c1b692b4d54c333b8ac9256d794218c9e9aa34", "path": "/data/samples/unknown/foraged/chrome/google.com/chromewebstore.google.com/maoiencdkifcakgnlgkmbecbmbooojah/maoiencdkifcakgnlgkmbecbmbooojah.crx!!_locales/pt/messages.json", "risk": 1, "size": 223, "type": "json", "depth": 1 }, { "id": 15, "sha": "f3a69b8f254248a7ba607af25bdd843fe8233cde6908e75137bd9c5b2317bbb5", "path": "/data/samples/unknown/foraged/chrome/google.com/chromewebstore.google.com/maoiencdkifcakgnlgkmbecbmbooojah/maoiencdkifcakgnlgkmbecbmbooojah.crx!!_locales/ru/messages.json", "risk": 1, "size": 277, "type": "json", "depth": 1 }, { "id": 16, "sha": "aadcf1d2d74b8682f21a2a68e4d4c3f960fd95e79b065158454de049926ce93a", "path": "/data/samples/unknown/foraged/chrome/google.com/chromewebstore.google.com/maoiencdkifcakgnlgkmbecbmbooojah/maoiencdkifcakgnlgkmbecbmbooojah.crx!!_locales/uk/messages.json", "risk": 1, "size": 272, "type": "json", "depth": 1 }, { "id": 17, "sha": "e3dc5f4043635a92802cffb49f0d0d134257563de656f2bacafa7a0a54728b78", "path": "/data/samples/unknown/foraged/chrome/google.com/chromewebstore.google.com/maoiencdkifcakgnlgkmbecbmbooojah/maoiencdkifcakgnlgkmbecbmbooojah.crx!!_locales/zh/messages.json", "risk": 1, "size": 220, "type": "json", "depth": 1 }, { "id": 18, "sha": "0a3df08d7afd1b2f50b54d56fcf8f32717aebab2391dd3f9e997d0be32bb1999", "path": "/data/samples/unknown/foraged/chrome/google.com/chromewebstore.google.com/maoiencdkifcakgnlgkmbecbmbooojah/maoiencdkifcakgnlgkmbecbmbooojah.crx!!_metadata/verified_contents.json", "risk": 1, "size": 3349, "type": "json", "depth": 1 } ], "omitted_files": 13, "rev": "b4791", "v": "8" } }