{
  "llm": {
    "conf": 0.6010301,
    "grade": "benign",
    "model": "Qwen/Qwen3.6-27B",
    "review": false,
    "outcome": "benign",
    "interpretation": "Chrome extension theme file"
  },
  "ml": {
    "v": "7",
    "eng": "2.2.0-beta.1",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.430043,
        "rte": "az",
        "prob": 0.430043
      },
      {
        "cls": 0,
        "raw": 0.0039027333,
        "rte": "az/crx",
        "prob": 0.0039027333
      }
    ],
    "prob": 0.430043,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.4300430119037628,
        "type": "crx"
      },
      {
        "id": 1,
        "lvl": -1,
        "conf": 0,
        "prob": 0.2541406750679016,
        "type": "javascript"
      },
      {
        "id": 2,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00006663799285888672,
        "type": "png"
      },
      {
        "id": 3,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00006663799285888672,
        "type": "png"
      },
      {
        "id": 4,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00006663799285888672,
        "type": "png"
      },
      {
        "id": 5,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00006663799285888672,
        "type": "png"
      },
      {
        "id": 6,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00006663799285888672,
        "type": "png"
      },
      {
        "id": 7,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000050187110900878906,
        "type": "json"
      },
      {
        "id": 8,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00006663799285888672,
        "type": "json"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-07-03T17:38:14Z"
  },
  "path": "aofeldbpodjhmcdgffpdmcgiipmdegbe.crx",
  "raw": {
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "lVK}s0@@r37Z6*s608iyRueD60u%ib1{(=lnqu\u003cF0rAi800v/N4/!qn0sw)W0rAgY}[Dw{w0x9W)F",
            "n": [
              {
                "c": 2,
                "d": "Chrome Web Store extension archive",
                "i": "metadata/permission/manifest::chrome-webstore-extension",
                "o": 0,
                "z": 1,
                "cf": 0.949999988079071
              }
            ],
            "ln": 0
          }
        ],
        "mol": "O(As)Md",
        "sha": "2d2872452397e019cc88d3017fc306d4116c9ab7342808123efca15889bade42",
        "path": "aofeldbpodjhmcdgffpdmcgiipmdegbe.crx",
        "risk": 3,
        "size": 2602215,
        "type": "crx",
        "facts": {
          "metrics": {
            "file": {
              "size": 2602215.0,
              "entropy": 8.0,
              "size_bytes": 2602215.0
            },
            "binary": {
              "overall_entropy": 8.0,
              "peak_region_bytes": 2600960.0,
              "peak_region_entropy": 7.87
            },
            "archive": {
              "file_count": 8.0,
              "member_count": 10.0,
              "prefix_bytes": 1060.0,
              "script_count": 0.0,
              "zip_bomb_ratio": 2.86,
              "directory_count": 2.0,
              "executable_count": 0.0,
              "extra_field_size": 0.0,
              "noise_file_count": 0.0,
              "total_compressed": 2599855.0,
              "compression.ratio": 0.99,
              "hidden_file_count": 0.0,
              "total_uncompressed": 2615241.0,
              "crc_collision_count": 0.0,
              "entry_comment_count": 0.0,
              "max_filename_length": 32.0,
              "rtlo_filename_count": 0.0,
              "format.regular_count": 8.0,
              "nested_archive_count": 0.0,
              "path_traversal_count": 0.0,
              "symlink_escape_count": 0.0,
              "security.setgid_count": 0.0,
              "security.setuid_count": 0.0,
              "security.sticky_count": 0.0,
              "double_extension_count": 0.0,
              "duplicate_member_count": 0.0,
              "format.directory_count": 2.0,
              "security.symlink_count": 0.0,
              "unicode_filename_count": 0.0,
              "homoglyph_filename_count": 0.0,
              "security.encrypted_count": 0.0,
              "timing.mtime_unique_count": 2.0,
              "timing.mtime_unique_ratio": 0.2,
              "misplaced_executable_count": 0.0,
              "timing.mtime_outlier_count": 3.0,
              "timing.mtime_dominant_count": 7.0,
              "timing.mtime_spread_seconds": 2.0,
              "timing.sentinel_mtime_count": 0.0,
              "security.world_writable_count": 0.0,
              "timing.mtime_dominant_fraction": 0.7,
              "compression.method_counts.deflate": 10.0
            }
          }
        },
        "ident": {
          "trust": "self_signed",
          "identifier": {
            "value": "lfoeajgcchlidpicbabpmckkejpckcfb",
            "source": "crx.extension_id",
            "verified": true
          },
          "unique_ids": {
            "crx_id": "lfoeajgcchlidpicbabpmckkejpckcfb",
            "public_key_sha256": "b5e4096227b83f82101fc2aa49f2a251accde3d98471464dd17d1819b43786b0"
          }
        },
        "traits": [
          {
            "id": "metadata/file/profile/language::lang-korean",
            "conf": 0.800000011920929,
            "crit": 3,
            "desc": "Korean script detection (Hangul)",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/encoding/hex::mixed-hex-decimal",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.7200000286102295,
            "crit": 3,
            "desc": "Mixed hexadecimal and decimal operations",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "well-known/tool/detection/security-scanner::multi-app-stealer-benign-context",
            "conf": 0.8999999761581421,
            "crit": 2,
            "desc": "Benign application or testing context",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "well-known/tool/detection/keywords::protected-process-light-keyword",
            "conf": 0.699999988079071,
            "crit": 1,
            "desc": "Protected Process Light / PPL keyword",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/library/web-frameworks::javascript-built-bundle-marker",
            "conf": 0.8999999761581421,
            "crit": 2,
            "desc": "JavaScript built bundle marker",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/file/metrics::single-long-line",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "Very long line",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/permission/manifest::chrome-webstore-verified-contents",
            "conf": 0.949999988079071,
            "crit": 1,
            "desc": "Chrome Web Store verified contents"
          },
          {
            "id": "metadata/signed/platform::web-extension-manifest",
            "conf": 1.0,
            "crit": 1,
            "desc": "Web-extension manifest.json at archive root"
          }
        ]
      },
      {
        "ctx": [
          {
            "b": "1onA4f-RgN0096S0rr930g*X300ri8Bo8vA0os{$00Ju@^e\u003cpL0n#3700-I1[=Y1106tla01w]TDk3t\u002604S%w01Yc+Jt8v80fAlQ01]onLOs9h0i8t102bAnN?L\u0026q0hb\u003e%02tM-Q7^Oz0lI8L02LY\u003cSt2sI0aSeC02+\u003c9Vj)oT0e4Y]02#0cYC7t^05.Rc03hbc-s@p]0m/a703zn:+[Hd30d@Sk03RyG^?z^b087/Q03?Md!F50f0gzBM044XI*y%Sn09Od)04m?R?Xl5t0f2}L04E%U\u003em^[D0efIH04XaS1qH[*01%R[04[n%LOBfK0go8/05ayHNh2.$%0%JM0q=ZGNIt\u00261%3@H)0q#\u003e7NIt\u00263%l(x\u003e0ri1+N?U]60i.\u003eb0eTJEm/",
            "n": [
              {
                "c": 2,
                "d": "Script overall entropy stays low",
                "i": "metadata/file/metrics::low-overall-entropy-source",
                "o": 0,
                "z": 29,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 1,
            "addr": 0
          },
          {
            "b": "8u",
            "ln": 2,
            "addr": 315
          },
          {
            "b": "0000dnK#lE000g40000z2Ngne0dbVo}tZHr07/NArcT{H?n$*\u003cnPC?/])8wnw5$vIdYZc0y\u003ebkjnc8n$J)y-V:PWyl0Z:m[\u003cQ?4E]s{aYVPdxj5j$0/2-\u003cu1NYdt\u003eDq@db\u003eB.!IPsqHuUErh59uufJ(fh[l7k@4=]\u003eL0vGiCFgrAg)[3#i4H!zYv{=faXAD3MxrZHb/mX3\u003e4d])jqPTYwC4h5.Ft\u003c(JtE*II8B?rKVVrAn..[(1JrXvQHlTYzH@@IMM\u003e8vM*c91G3#(c%::z1*7Lih\u003e}Vs\u003cb{ji?o3TCbJ/*.c*9MuA-I.Dg=G%*h5WP/\u003e/w+TeYj3rRum/(u27{uAXdHsK.1vygBADs$Ve((?dpb(9PvpCdWCr[\u003e@E/.@m\u0026Z]lCghO0)9IWoxXEV!r\u0026Eiipwpq{jpd@KZ$QX6F8Po^V6ce%!C-oLQ]!W0ziq!Onas)y8(\u0026EVl*(tcg\u0026kuA-XR\u003c!Tq/nMw^-}#b*MDIdjlt+/YBJD-6x/lUck.c*8t!T*AYtj6L*CdT\u003eKR=hvqWG.vItqK4a/\u003e+y!PssYx)^kg4LGxS5/k%6Q:h=jU?]1AS=8F9X2wDcFzzETfvZfPZknT/L\u003ef*\u0026PYU8:kiim2btKg%[j\u003eB\u003e?T(TOaQTu3+GeF18EY?{S*u}3zKe]o}ka:=rsU7t9EVxFI*Ja[YI\u003e8)09m!=gtgENKz0Qd{(?d\u003cx{*QIb(2Za-)y73{AxMJJ/lj=y/rYUu{vv!5P3oyUDI4ak8vM*)Cx.Wpy}i!KX7++v=dq:\u0026EJctJ+s-oGGw7jLWoxYj!9kwbjG^jH!Z*2yU(j9pt-lN}*4Sz4l?QuPCe4v!/riJ*Ci!#1XQ7}}VU^A[J\u0026Unrf:D\u0026^V!r\u0026KYre8F/eE[$CxU[Y465jN/lUckpn=O6Kl]a}kEY*+ci\u003c+X)FiuBP4WDjYDe4jWe5Z9(8S\u003emXr+rHtlv7fE+mYo?((@YeeAwQD%D1gX(L\u003eiVR*Cdss/]%esjK-TYxN+A-da9CqU{^yDJV\u0026{4rCp27@vrcBE3V*v2D9.*lSPyhqU)Ch6Wk/xW3:\u003cmfUj(ThzW?*o-#TBv]\u003e!9jjzGf!tI?wi+195n[V\u0026JRcVi2\u003e$0!X/o(o@DF9CdWCx{$f5{D{j:!y/U+7CwVi?!NC!Z!6(^SYsR\u003e84tc:kpq-:8ypJWh/5bic\u003eKSpo[oWbm!]Fs5-BqY/\u003c*46${!ZOTYKx/eV1S-UE0/hRZKJCtGm\u0026sD=^f{WAb:fuC@M!LiFPG5ZgR7\u003eB-RR5\u003cmfT#d9]JYzKZP2cx(3MYkbc6AbXTi",
            "ln": 3,
            "addr": 317
          },
          {
            "b": "VxA{\u003e@kTqmTb##gWK7$(PSnfIeDOTj)EG?Nce+0eQZ^[C(O0+-om7{$DLE/*mu{3Z.]rlak}8[Cci",
            "ln": 55,
            "addr": 16227
          },
          {
            "b": "Tjsj)0sk^bD4I2zBVM8A[4X]4h.T#m2J$pk{4J$o{Jp!d*rO#\u0026B{T/Ec.-746x(vyx)Y9^YlA-eR\u003enBrTe\u0026q$R*[MvY1CW(fr{6UGEeXxG=tTg=P?D+UkN!AYm}j3+HSQqquCXC]k*xikptV9]!7B?5xZa",
            "ln": 56,
            "addr": 16289
          },
          {
            "b": "==/hg=DWtpu[R!GBUZBsxj[uU5JJ^%CZjOl!6(^pp7)+Z00^e{qX*5)p\u003eSAKB:edk?[BIOOLdl%rFX/?J1w+3a^4DDXdqGUanD/vMO!Wg.W^jhH/NUMum}NYj=3]Ww#B9(G:)TeCU3n9P1@Iy[835p\u003eLmn1\u0026r9JsFDs/Q?]0u0j6JoUw\u0026}dBHC+R$*SNbw+/0b-z\u0026S+5Ca[C0OPpjARy\u003cIP(*\u003cQ!\u003eE:3037*5f*{z.8zrZ#()B$y-r+EYm5Z{2GvcM}ux+KjxnXTyOqJlSbFn=Al?yZrInv29L\u003c^xLhGI80giLJ5my5C[g(dA%R-]z7807=F50]\u00264(t[YAWTN^EC({FUfZldm^{ymYA*z*/n}5\u003efaz{JJKDFgMrC+pR2/lxz}/jfrwhd%l#jmUW)f}iAkD8Zn\u0026ZC!oqv7pN\u0026rr91w07/NAr1TO#!B!d3!72$9}1i/H\u003c9\u003cyU.c\u003eSkgeaQ{}UG(2*y\u003cIQ\u003chZDTDtSMo?q8u!Fd+hhC)M0:TDOLMM@s76vZh(rV:lWi{dPCQB2T",
            "n": [
              {
                "c": 2,
                "d": "XOR bitwise operator in expression",
                "i": "micro-behaviors/data/source/syntax/keyword::js-keyword-xor",
                "o": 16697,
                "z": 3,
                "cf": 1.0
              }
            ],
            "ln": 57,
            "addr": 16413
          },
          {
            "b": "\u003c)}#Fvuy6%}8IV\u003eXvuk7=:ciHoc7e#kr(S7O$qKZa%6#bKh{U=yYo+tyB[]xRaB*e7Ive+A+Xg7C@[hNzH$A54dNYXnmEoq)8L4CMDOxI{}X[G]s9RayDmfgy20WnDHpi5-i)rs9T{^tK(rUrhNwP0=OQqvUZBb\u003ch}%E\u003c.BcJN\u003c(JsUqT)v6PsX^5+vJ+}-9zR:}tf=1+EKceTru@0z/oL#[La@?sy}jvK?@*SX3@?-4-LsWib{29S^%2Yp0qU7IpWSQ!(IuQ+^Hq=X7*=K(c)@6U$O[h7)tG3O$m\u003ci\u003edFPbR=hj0/l8pY/jab[Y(9299VMfHBulL)?[MU-\u003c.KoQLOt!E@EcnEZ=Zl):lN\u003c7uHS)8HY",
            "ln": 58,
            "addr": 16836
          },
          {
            "b": "44qj{Q{m:XU[A{Cs1Cqk\u003cplNBuw9d\u003c7[utk:)AI.7m-vv\u003ct/RFjvt6\u0026R)tN9e\u003end}Y+CS7CJ3R^YrfMh^@$e\u0026}/GEaY1CW(D7=@NG2LlUqobvcdtp\u003cond!h8z)rBh-89#\u003eJXa5x]qX?LUa%yye?X(EU/1g-SUYGS7I\u0026DID5Qh0^nsgOt^OOCKb]v/}UE^L@}U:N}0?\u003cx}spw4nJA\u003cE7XZdx}QB7.5-}GtpPX\u003c:%mi4gXrPHR-Bvl:6#$%]CTMpc@W/IMzR@:]{oE)^%nI#]}U6qXd[5vFXfSb5uJ",
            "ln": 59,
            "addr": 17131
          },
          {
            "b": "v8fY6V}z2xSFj#JSDsw(4o[YwYqqZ5@AE2jgye-}q\u0026T%KeFOs]",
            "ln": 2945,
            "addr": 705476
          },
          {
            "b": "EOiB)Ocoswb8ED:aU\u0026?%980.ynhZID9vg]sHlaOx5Akz{WQWgb!\u003e3gju7Yx6",
            "ln": 2946,
            "addr": 705517
          },
          {
            "b": "QYz0afD8dZawSIR\u003e*}1v3\u0026]mcT\u003c-{8.AYZ?I{6ppW=QJFxHHxVor*eNgHJgN-aB\u003exqV\u003e!S2T.y=yZa\u003cTC\u0026Ubxkm+z:W2nrepk20]bW2q(OUf9.4cr\u003c/(24QDRJ1H%*r\u003culOkO\u003cjL{g[^*EOj\u003c28(UDg4kDcw8FJu]wS-9Jgr:Bbp1UofXU4$B5Gpz5w%vvq:t##G@(MS.e9lVAeH=j\u0026G!{Zv^1{=9F$k9VbgISmfE0E*.Id[Wub%LE+1%+($O8HP[\u0026FKa%^JhbzB*sbbVizFX+:Go!y1feHsqbsiE(/5DUHU4pgfbcb-RSMt2!xH[\u003e5c7+!4EHy}oe^]91D8\u003ckUcdUd/.9JlSVv0VNHQCv7)66K0*xpw6Ll9X\u003cLlI-\u0026LGKKgXlwq\u003eZ/\u003e2jOMCoP[aDV{ilp)V)=DZK:/Xk5hW[A8U8Y\u003cK3ysf723N@HqyAlzDvT8a2:5IjXT\u003eb-sryHtDV71Y%Or+B]TYOM(Y2kZgO35joPvqor8FzY2=rwey2CA.xl--P*d?Ph=.ZRdr}$2p-9Zzam]\u003eQ]1K*4*b(Wz-\u0026s^=jw+loLY}rm3kB]qKYqvV-\u003ei$tjV)*QAGEN#aaQe#IX!G.$0Ciq\u003eI%fui\u003cdcgrwL:+na[6Fs+-k]W6XV3^a[g:=5fLasF5/p?Ly\u00261c2T%hKRn\u003c?qEyx\u0026c#Wb\u003c6-aoYEWaJY}BKGdl*5kI5lM=j.2ju%5.1$2BgPMy)1h49FB8rMCF]pFvZ)yfNl]\u0026xh2\u003e(CyaZ%:gW\u003eJsVv?3\u003eVz2=wK-J6GpD5!P:f1%f)[or=.\u003e}zw?{qeyJiTdqc=txMZq{vn=]g\u003e+wbKLrGl?4?irByl{hnR$0?\u003cGX@)c)q\u003e?y\u003c\u0026[1)k/bsGml@\u003ehs)+w",
            "n": [
              {
                "c": 2,
                "d": "JavaScript built bundle marker",
                "i": "metadata/library/web-frameworks::javascript-built-bundle-marker",
                "o": 705571,
                "z": 512,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 2947,
            "addr": 705566
          },
          {
            "b": "nIbF]/P9w@8L?ac@}.*{.R/pwy{EB[dtqK3=Wp2@dn=\u003cdWHtY1\u0026CtJ)1W-=cMre\u003e]\u003cynMv\u003e2g^ZbALiC0L\u003cB#w6P.w+D8G5o0^pL8=R!qJvoCp+UKZEXOezVbv3[VY)5}p)3oQGZ*EM/y-pym1e5pNepkw]2l}pi-Bwm=mdzV",
            "ln": 2948,
            "addr": 706259
          },
          {
            "b": "pLR\u003cbL.!rhF\u003c+xlth0MqjXIY9XX2W/[sQz{{pxT5(VsW^g%FVgH5!O0.u?B{QTTFS8.*{\u0026ZEIfMcYYVAB.WoE{epFv1Xp1vVp=t]pN#4JvKN1u:CpxokO^vz0xJzXC\u003c@6hLA#E$vt4:Wu!5=x",
            "ln": 2949,
            "addr": 706395
          },
          {
            "b": "kn8WXvB(p6Uv21[}.!\u003cIfFHmEoz\u003eewtb+DKqK[RWIEg}0c%R#^Q:41Awoki6fDl$qcF\u003efQ04fEjqaQ4%a]",
            "ln": 4753,
            "addr": 1048235
          },
          {
            "b": ".a#9Yo4f7msP?6a7ShyuEMS\u003c\u0026JMLc8SYj=af\u003eOR0t9hN(jqA(Pil)]!5T5YER}RPub.IZ$IVr@AORN#IqA$\u003eNHH3-%!YEkb8?kF=Z?^(JR^$rTGC*]SUYgo:y1OXtmAyRv4s\u003cVWJ\u003c%.u)z5-t6(glnvIah-JE/#z{-X/A5.)KjM\u003c?%yvV%AHe5rWYVmHEkD9?n%.E66SCiua+N.d.:4hZl@9V(hpvpof)trpDJ\u003e!}T0H}05[]-9N0FM9Y-",
            "ln": 4754,
            "addr": 1048301
          },
          {
            "b": "2LGbo-tq(zFbYuVpDXf%q+]ZQdtp/gIm=-[KYle78oRPTr@11^(76$:!)1vWv5TO:}U.\u003ctIMO=uC].Dp!mT8vAe%BVaDI)R05i]=.Pyw{}#\u003e}P8JO\u00261u{4*@s(OxvQE$vW6Cv6NfeqeAk}r{b8WQ](-\u003c/qd.UATb?[a7=lRzYJVg3wL2EAbsQM(z[*W3Ht/oE\u003c/Kq\u003c8c[th%ctuw1m6/bD5Ch/r(het5N2z#(6ClrFnFmkbi{19NtrL$WsHft:\u0026RVf?Je1}K?=ZW1p}0.YCV\u003c4eR\u0026-u?a[[^nlYc[HF.Du$?Kynmrwqqjde/Bu27aJ..YB}?yuoQ{1m\u003c!qvYKzFMnpdfD-uku?gz)1]]5}c9*6\u0026/?\u0026q",
            "n": [
              {
                "c": 3,
                "d": "Korean script detection (Hangul)",
                "i": "metadata/file/profile/language::lang-korean",
                "o": 1048704,
                "z": 6,
                "cf": 0.800000011920929
              }
            ],
            "ln": 4755,
            "addr": 1048502
          },
          {
            "b": "=dF/(.Zp4o=z]ERO!\u003cKD]t[8L4)Q0Yao7:m55Mqz7AW[W0L9\u003e+z)U\u00265I^!6W^YKp)CO[w^ohhU6fOVAZr#Y?Y762zHKV#1e\u003ei]{-lD?MbGT1HgRr(2baRK3qab^O%[AWSY5v2@nlETOS(697%O8EE^nTD^2qf*/{q#",
            "ln": 4756,
            "addr": 1048797
          },
          {
            "b": "09a0(.P6{W7VJ\u00267KVUL1Go\u003ec9a+#p/y}j6YS4Ms9va+NWG#*M3u9][i\u0026T6LBMiC5np8fc?G+E3TpZwe7d7dXx!UdI#qeLd2M0UZRgy[(zIUhU5G-F:I1.E\u003e*",
            "ln": 4757,
            "addr": 1048927
          },
          {
            "b": "\u003eog]D{*VY?KQd@Z@f*0fsB{ycWkt^FK5oNs1AQb7c@}YE}h}5-ynIL[Cf$GW^G$#/T}jF)DBuiZ0yMU=.-ke{:\u003cg:CAjw4d^QwjHXE=yJ0{O9pX:luq9ycE1pkud\u0026?2",
            "ln": 5035,
            "addr": 1099080
          },
          {
            "b": "orEYGkOO}wf\u003c\u003eWO/qrIL",
            "ln": 5036,
            "addr": 1099182
          },
          {
            "b": "h1O!1d@(YG5((r7SuRl$7f9]F4f!K{40SR}0rWeln*b7\u003cBJ]c+d+nAIoqh?=y\u003c!rk=lFFcQ#CtSjZMSE4ffcVk*2}Y7BwJDT407Zp6MU9xgdw6=Ey)Ha^LI*rg\u003e9RbU%@)Mv\u003eODsgu0wPUgE:i:2hyVSF+pa.7m}7r\u003eaJUDj?r{UHlQzRTD\u003c/9C+h2$tYOFbOXuj*{Xfu0pujKvpsF4\u003canfjsfUx8W0A=qeul=10w=5f6pa3Hm:CdLe/i1lD\u003e=HuV$f!blkEx/$[nfIc\u0026/khrczBu}$\u003e\u003ed\u002679c}o$K5tzkNX+Bx?Xn!.wS:j/1U5m@(9aaEVRkQnD.aMW7dKrIka:PzPK\u00265HY8aYk^TCZr\u003eI-LSkjw1U3sIFQ?br9v8Ec00H9x%V1D\u0026aMJdB.\u003cP{IFW[l7]V!8be/X\u0026x#2Sg4:#w0B!W2\u0026w#u!b+#c6hOr[2{1l\u003c?4q}/[Ro15e3aFZe\u003eAkF8y3NlV5O8GU\u003e]tp.8p?eA91^lZJqAuMQ\u003c-n[F[oTL8e$jM35eVGOxTFt+d3unzeD8=Jk0PojUurOU8W?iKtQHwBGLInhKLVqW-?!qpQ+sSx7^6])C1qV.x9q3vti5Sc%nF7^8m2upriFP=J0bwo",
            "n": [
              {
                "c": 3,
                "d": "Mixed hexadecimal and decimal operations",
                "i": "objectives/anti-static/obfuscation/encoding/hex::mixed-hex-decimal",
                "o": 1099647,
                "z": 3,
                "cf": 0.7200000286102295
              }
            ],
            "ln": 5037,
            "addr": 1099199
          },
          {
            "b": "z4T\u003c[Th:2/SZWGxI7knocc$RdYU+@9DkTJcpK!8s5{9p*:RDg*80PVQH@y!CPWQf?sS)^Ney0/yC++)z9VJ%$.w\u0026#vXH/I@@hqN:4r{]sr51rym$dDLd*oa91{Sv\u003cVr0sw92j\u003c\u0026SCd\u003ebM\u0026:[27%AcLQFmbL^F$#VHMtm",
            "ln": 5038,
            "addr": 1099692
          },
          {
            "b": "XUHSP:{Ur9w@jwXtQjbR3]0JCy(cO}nnpYRBJK$RHaMnl-bA+=kD}8HAW6Fb+yE63PCZavpzw#B%06!by/{hHwAHYOTrM6ZUOdF)lNq(Vqw[XAU1AgusJz4^mUmVjv7aNt0wU9ByL@j\u003csWBy[nK!PpAWgD@vHmME[C\u003cy#cYs(dT-\u0026u[fJwJ={=hobR{T:{pt\u003cjPQ3xJ?aG3=b0i[\u0026\u003cAls8qXqCakNHE{n0ckALvnLm7-fLSLYQq8^v\u003eiFtIzubq-1{isua6efg:xj1OothI-C2SiKyiY6s^e]s^3C6#.qLa}p7/3-YzAmf\u003cz\u003en^\u0026Z[=:=i@74iS?xCtl4N+pFNWdk{AXqHLxrQTonqIK::QjUQc[f?}fia[T/a{5qd[l2$7wcNKk%A]]F(04ETWl5v9P\u003e6jvk.J.zz%52/S(\u0026)W",
            "ln": 5039,
            "addr": 1099824
          },
          {
            "b": "@%nV90rr90@@",
            "ln": 6590,
            "addr": 1415846
          },
          {
            "b": "00030%nS9b00030%nM7e0000r5D",
            "ln": 6591,
            "addr": 1415856
          },
          {
            "b": "@%]8f0rr90@$2eg0rr90rSAa0@@r30%nSc0@@r30%nSc0@@r30@$kqi03u{XqmEW$kl7V-0002Sknpm\u003c\u0026D=i{knj7$000000002Skl7V-0002Skl7V-0002SknBk0000000002Skl7V-0002Skl7V-0002SkMy=-@@r300002*Zw[ll0002*Zw[ll0002*ZYjul@@r300002*Zw[ll0002*Zw[ll0002*ZYjul@@r300002*Zw[ll0002*Zw[ll0002*ZA9vP009610blm/zdNA#x\u003e7*\u0026zFi)1wb",
            "n": [
              {
                "c": 2,
                "d": "Benign application or testing context",
                "i": "well-known/tool/detection/security-scanner::multi-app-stealer-benign-context",
                "o": 2107973,
                "z": 3,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 6592,
            "addr": 1415878
          }
        ],
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 2537174.0,
              "entropy": 4.39,
              "size_bytes": 2537174.0
            },
            "text": {
              "tab_count": 6055.0,
              "digit_ratio": 0.16,
              "space_count": 5791.0,
              "total_lines": 6592.0,
              "char_entropy": 4.39,
              "mixed_indent": 1.0,
              "unique_chars": 243.0,
              "escape_density": 0.01,
              "lines_over_200": 3867.0,
              "lines_over_500": 1716.0,
              "avg_line_length": 383.88,
              "high_byte_ratio": 0.71,
              "invisible_chars": 2.0,
              "lines_over_1000": 465.0,
              "max_line_length": 4819.0,
              "non_ascii_ratio": 0.71,
              "null_byte_count": 12641.0,
              "empty_line_ratio": 0.0,
              "last_line_length": 340.0,
              "long_token_count": 8032.0,
              "whitespace_ratio": 0.01,
              "most_common_ratio": 0.23,
              "line_length_stddev": 418.44,
              "octal_escape_count": 146.0,
              "unusual_whitespace": 42.0,
              "non_printable_ratio": 0.07,
              "unicode_escape_count": 57.0,
              "repeated_char_sequences": 134.0,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 3.0,
              "trailing_whitespace_lines": 86.0,
              "most_common_char_codepoint": 189.0
            },
            "parse": {
              "error_count": 1.0
            },
            "binary": {
              "overall_entropy": 4.39,
              "peak_region_bytes": 1551360.0,
              "peak_region_entropy": 4.68
            },
            "source": {
              "ast_unavailable": 1.0,
              "ast_unavailable.tree_sitter_guard": 1.0
            },
            "consistency": {
              "extension_content_mismatch": 1.0,
              "extension_content_mismatch.script_as_unknown": 1.0
            }
          }
        },
        "id": 1,
        "mol": "O(As)Md",
        "path": "aofeldbpodjhmcdgffpdmcgiipmdegbe.crx!!Cached Theme.pak",
        "risk": 3,
        "sha": "a38923e535b14af6479ea3c8d32227965824deb1d3349fbd315c7805ae18326f",
        "size": 2537174,
        "traits": [
          {
            "id": "well-known/tool/detection/keywords::protected-process-light-keyword",
            "conf": 0.699999988079071,
            "crit": 1,
            "desc": "Protected Process Light / PPL keyword",
            "spans": [
              [
                2107973,
                3
              ]
            ]
          },
          {
            "id": "metadata/file/metrics::single-long-line",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "Very long line",
            "spans": [
              [
                705571,
                4819
              ]
            ]
          },
          {
            "id": "metadata/file/profile/language::lang-korean",
            "conf": 0.800000011920929,
            "crit": 3,
            "desc": "Korean script detection (Hangul)",
            "spans": [
              [
                1048704,
                6
              ]
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/encoding/hex::mixed-hex-decimal",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.7200000286102295,
            "crit": 3,
            "desc": "Mixed hexadecimal and decimal operations",
            "spans": [
              [
                1099647,
                3
              ]
            ]
          },
          {
            "id": "well-known/tool/detection/security-scanner::multi-app-stealer-benign-context",
            "conf": 0.8999999761581421,
            "crit": 2,
            "desc": "Benign application or testing context",
            "spans": [
              [
                2107973,
                3
              ]
            ]
          },
          {
            "id": "metadata/library/web-frameworks::javascript-built-bundle-marker",
            "conf": 0.8999999761581421,
            "crit": 2,
            "desc": "JavaScript built bundle marker",
            "spans": [
              [
                705571,
                4819
              ]
            ]
          }
        ],
        "type": "javascript"
      },
      {
        "depth": 1,
        "facts": {
          "metrics": {
            "png": {
              "a_entropy": 0.0,
              "chunk_count": 20.0,
              "trailing_bytes": 0.0,
              "idat_chunk_count": 15.0,
              "text_chunk_bytes": 0.0,
              "chunks_after_iend": 0.0,
              "compression_ratio": 0.36,
              "unknown_chunk_count": 0.0
            },
            "file": {
              "size": 919279.0,
              "entropy": 7.93,
              "size_bytes": 919279.0
            },
            "image": {
              "width": 1367.0,
              "height": 630.0,
              "channels": 3.0,
              "b_entropy": 6.82,
              "g_entropy": 6.82,
              "r_entropy": 6.82,
              "edge_density": 0.01,
              "pixel_entropy": 6.82,
              "histogram_flatness": 0.85
            },
            "binary": {
              "overall_entropy": 7.93,
              "peak_region_bytes": 919279.0,
              "peak_region_entropy": 7.82
            }
          }
        },
        "id": 2,
        "path": "aofeldbpodjhmcdgffpdmcgiipmdegbe.crx!!Images/Background.png",
        "sha": "c30715d9620df9648d38eac28e33068b817a7fbf4f1ef07f0c759401e26ff9e1",
        "size": 919279,
        "traits": [
          {
            "id": "metadata/package/files/included::png-extension-basename",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "Filename ends with .png",
            "spans": [
              [
                0,
                14
              ]
            ]
          },
          {
            "id": "metadata/image/metrics::low-edge-density",
            "conf": 0.6499999761581421,
            "crit": 1,
            "desc": "Low image edge density metric",
            "spans": [
              [
                0,
                25
              ]
            ]
          }
        ],
        "type": "png"
      },
      {
        "depth": 1,
        "facts": {
          "metrics": {
            "png": {
              "a_entropy": 0.0,
              "chunk_count": 6.0,
              "trailing_bytes": 0.0,
              "idat_chunk_count": 1.0,
              "text_chunk_bytes": 0.0,
              "chunks_after_iend": 0.0,
              "compression_ratio": 0.34,
              "unknown_chunk_count": 0.0
            },
            "file": {
              "size": 48052.0,
              "entropy": 7.92,
              "size_bytes": 48052.0
            },
            "image": {
              "width": 1364.0,
              "height": 35.0,
              "channels": 3.0,
              "b_entropy": 5.12,
              "g_entropy": 5.12,
              "r_entropy": 5.12,
              "edge_density": 0.0,
              "pixel_entropy": 5.12,
              "histogram_flatness": 0.64
            },
            "binary": {
              "overall_entropy": 7.92,
              "peak_region_bytes": 48052.0,
              "peak_region_entropy": 7.78
            }
          }
        },
        "id": 3,
        "path": "aofeldbpodjhmcdgffpdmcgiipmdegbe.crx!!Images/Frame.png",
        "sha": "3820b543b86253f3ba6fbf8f68585c4a4d837105b49e854bab828032eead9ba4",
        "size": 48052,
        "traits": [
          {
            "id": "metadata/package/files/included::png-extension-basename",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "Filename ends with .png",
            "spans": [
              [
                0,
                9
              ]
            ]
          },
          {
            "id": "metadata/image/metrics::low-edge-density",
            "conf": 0.6499999761581421,
            "crit": 1,
            "desc": "Low image edge density metric",
            "spans": [
              [
                0,
                25
              ]
            ]
          }
        ],
        "type": "png"
      },
      {
        "id": 4,
        "sha": "1ef574ce41379fb4e16f5334e6b9de4c27b86b6e5b54d147e7e5b84394187bd9",
        "path": "aofeldbpodjhmcdgffpdmcgiipmdegbe.crx!!Images/Tab.png",
        "size": 12897,
        "type": "png",
        "depth": 1
      },
      {
        "id": 5,
        "sha": "f6788af9f48f12d591de6bf94ff7944725716d208a740016eb4baac04aaa975c",
        "path": "aofeldbpodjhmcdgffpdmcgiipmdegbe.crx!!Images/theme_ntp_attribution.png",
        "size": 4353,
        "type": "png",
        "depth": 1
      },
      {
        "id": 6,
        "sha": "a1be81eff6f051914f3e93a3d48b6c38213bd6a6f1fa27fb6117f69c00bfdfd8",
        "path": "aofeldbpodjhmcdgffpdmcgiipmdegbe.crx!!Images/toolbar.png",
        "size": 211569,
        "type": "png",
        "depth": 1
      },
      {
        "ctx": [
          {
            "b": "DJ",
            "n": [
              {
                "c": 2,
                "d": "JSON data format",
                "i": "metadata/file/format::valid",
                "o": 0,
                "z": 13,
                "cf": 0.6000000238418579
              }
            ],
            "ln": 1,
            "addr": 0
          },
          {
            "b": "b6v\u003cnvru6/B-IpxiV]RWBAzFyiXJc@y?WD#BAoh\u0026xk.Z3y?kkez/4dGwPz%dv}vroAaAy0wIL]GA^e=V",
            "ln": 2,
            "addr": 2
          },
          {
            "b": "",
            "ln": 3,
            "addr": 67
          }
        ],
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 1131.0,
              "entropy": 4.77,
              "size_bytes": 1131.0
            },
            "json": {
              "parsed_bytes": 1131.0,
              "parse_limit_bytes": 76800.0
            },
            "binary": {
              "overall_entropy": 4.77,
              "peak_region_bytes": 1131.0,
              "peak_region_entropy": 4.76
            }
          }
        },
        "id": 7,
        "path": "aofeldbpodjhmcdgffpdmcgiipmdegbe.crx!!manifest.json",
        "risk": 1,
        "sha": "c1a524d3c0ede4d3bf0b46dff63d3eb20cb5e982844a6c21e31f2868b3ceb1be",
        "size": 1131,
        "traits": [
          {
            "id": "metadata/file/format::valid",
            "conf": 0.6000000238418579,
            "crit": 2,
            "desc": "JSON data format",
            "spans": [
              [
                0,
                13
              ]
            ]
          },
          {
            "id": "metadata/file/extension/identity::web-asset-extension",
            "conf": 1.0,
            "crit": 1,
            "desc": "Web asset file extension (css/html/js/json)",
            "spans": [
              [
                0,
                13
              ]
            ]
          }
        ],
        "type": "json"
      },
      {
        "ctx": [
          {
            "b": "tydM8wPIv4x(Ffdz/c:Wb6m\u003cpwOtH[xDRn9AV!$dy?j!wb6dEhzE)u=v@DmbwO#Pli^S5\u0026vr(WcvpQMyb4V3(ygn}QfJ}KnfJZ8z",
            "n": [
              {
                "c": 2,
                "d": "JSON data format",
                "i": "metadata/file/format::valid",
                "o": 0,
                "z": 22,
                "cf": 0.6000000238418579
              }
            ],
            "ln": 0
          }
        ],
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 1849.0,
              "entropy": 5.94,
              "size_bytes": 1849.0
            },
            "json": {
              "parsed_bytes": 1849.0,
              "parse_limit_bytes": 76800.0
            },
            "binary": {
              "overall_entropy": 5.94,
              "peak_region_bytes": 1849.0,
              "peak_region_entropy": 6.01
            }
          }
        },
        "id": 8,
        "path": "aofeldbpodjhmcdgffpdmcgiipmdegbe.crx!!_metadata/verified_contents.json",
        "risk": 1,
        "sha": "651ff60121163e57ef1cbc81fdd3b5147fb730c943f570c61492697fd9c449a6",
        "size": 1849,
        "traits": [
          {
            "id": "metadata/file/format::valid",
            "conf": 0.6000000238418579,
            "crit": 2,
            "desc": "JSON data format",
            "spans": [
              [
                0,
                22
              ]
            ]
          },
          {
            "id": "metadata/file/extension/identity::web-asset-extension",
            "conf": 1.0,
            "crit": 1,
            "desc": "Web asset file extension (css/html/js/json)",
            "spans": [
              [
                0,
                22
              ]
            ]
          }
        ],
        "type": "json"
      }
    ],
    "omitted_files": 3,
    "rev": "868bd",
    "v": "8"
  }
}