{ "ml": { "v": "7", "eng": "2.3.1-beta.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.00019512574, "rte": "az", "prob": 0.00019512574 } ], "prob": 0.00019512574, "skip": [ { "rte": "az/crx", "why": "unavailable" }, { "rte": "az/crx", "why": "unavailable" } ], "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.00019512574363034219, "type": "crx" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00009324153506895527, "type": "javascript" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.000013848145499650855, "type": "markdown" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.000013977289199829102, "type": "javascript" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.000015288591384887695, "type": "png" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.000015010436072770972, "type": "png" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.00001574555972183589, "type": "png" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.000012715657248918433, "type": "javascript" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.000013848145499650855, "type": "json" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.000016262134522548877, "type": "text" }, { "id": 10, "lvl": -1, "conf": 0, "prob": 0.000016182661056518555, "type": "json" }, { "id": 11, "lvl": -1, "conf": 0, "prob": 0.000015020370483398438, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-07-18T07:29:38Z" }, "path": "kgpbgfjgjanmdcoefmofbmlhhkmeipng.crx", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "lVK}s0@@r39r=Ay608iyRueD60u%ib1{(=lnqu\u003cF0rAi800v/N4/!qn0sw)W0rAgY}[Dw{w0x9W)G7nlRKB=ZmS-L:ig@2OhqN+wyyYd[ccJQY(IAu!Uo0^k0@", "n": [ { "c": 2, "d": "Chrome Web Store extension archive", "i": "metadata/permission/manifest::chrome-webstore-extension", "o": 0, "z": 1, "cf": 0.949999988079071 } ], "ln": 0 } ], "mol": "H₃(DbPoU)", "sha": "411008410b82c0b4e5520c44470f08095ccff0effd05d13dc24ffd8671f7fcf5", "path": "kgpbgfjgjanmdcoefmofbmlhhkmeipng.crx", "risk": 3, "size": 44950, "type": "crx", "facts": { "metrics": { "file": { "size": 44950.0, "entropy": 7.97, "size_bytes": 44950.0 }, "binary": { "overall_entropy": 7.97, "peak_region_bytes": 44032.0, "peak_region_entropy": 7.83 }, "archive": { "file_count": 12.0, "member_count": 14.0, "prefix_bytes": 1321.0, "script_count": 3.0, "zip_bomb_ratio": 3.71, "directory_count": 2.0, "executable_count": 0.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 41927.0, "compression.ratio": 0.51, "hidden_file_count": 0.0, "total_uncompressed": 82227.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 32.0, "rtlo_filename_count": 0.0, "format.regular_count": 12.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "format.directory_count": 2.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 12.0, "timing.mtime_unique_ratio": 0.86, "misplaced_executable_count": 0.0, "timing.mtime_dominant_count": 3.0, "timing.mtime_spread_seconds": 3557058.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.21, "compression.method_counts.deflate": 14.0 } } }, "ident": { "trust": "self_signed", "identifier": { "value": "lfoeajgcchlidpicbabpmckkejpckcfb", "source": "crx.extension_id", "verified": true }, "unique_ids": { "crx_id": "lfoeajgcchlidpicbabpmckkejpckcfb", "public_key_sha256": "b5e4096227b83f82101fc2aa49f2a251accde3d98471464dd17d1819b43786b0" } }, "traits": [ { "id": "micro-behaviors/ui/window/manage/dom::dom-element-value-read", "conf": 0.8999999761581421, "crit": 2, "desc": "Reads the value of a DOM element", "from": [ { "file": 1 } ] }, { "id": "metadata/package/error-handling::try-block-open", "crit": 2, "desc": "try block opening", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/ui/window/manage/dom::dom-element-lookup--queryselector", "conf": 0.8999999761581421, "crit": 2, "desc": "Looks up a DOM element with querySelector", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/db/web-storage::dom-storage-setitem", "conf": 0.8999999761581421, "crit": 3, "desc": "Browser storage setItem call", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/ui/window/manage/dom::browser-innerhtml-assignment", "conf": 0.800000011920929, "crit": 3, "desc": "Writes HTML into the DOM with innerHTML", "from": [ { "file": 1 } ] }, { "id": "metadata/package/error-handling::catch-keyword", "crit": 2, "desc": "catch handler keyword", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/db/web-storage::dom-storage-getitem", "conf": 0.8999999761581421, "crit": 3, "desc": "Browser storage getItem call", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/db/web-storage::browser-storage-persistence", "conf": 0.800000011920929, "crit": 3, "desc": "Persists data in browser storage", "from": [ { "off": 1736, "file": 1, "line": 67 } ] }, { "id": "micro-behaviors/data/db/web-storage::dom-localstorage", "conf": 0.8999999761581421, "crit": 2, "desc": "Web Storage localStorage access", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/time/schedule/interval::setTimeout", "crit": 2, "desc": "Schedules a JavaScript callback with setTimeout" }, { "id": "micro-behaviors/process/interpreter/eval::js-member-eval-call", "atk": "T1059.007", "conf": 0.8999999761581421, "crit": 3, "desc": "JavaScript member eval call", "from": [ { "file": 1 } ] }, { "id": "metadata/permission/manifest::chrome-webstore-verified-contents", "conf": 0.949999988079071, "crit": 1, "desc": "Chrome Web Store verification metadata" }, { "id": "metadata/file/format::web-extension-root-manifest", "conf": 0.949999988079071, "crit": 1, "desc": "Root web-extension manifest.json" } ] }, { "ctx": [ { "b": "c$WQtv@#B6zxHtRaBs", "n": [ { "c": 2, "d": "Any script file", "i": "metadata/file/extension/identity::script-file", "o": 0, "z": 8, "cf": 1.0 } ], "ln": 1, "addr": 0 }, { "b": "2}6\u003epwGV5oA+P39cP.", "n": [ { "c": 2, "d": "Minifier helper patterns", "i": "metadata/package/quality/source::terser-minifier-helpers", "o": 17, "z": 10, "cf": 1.0 } ], "ln": 2, "addr": 15 }, { "b": "31E)\u003eB95JIauZ?}B15j{j%jxOv%8T1zGEHJB.bPsq!o=Rv@#Tfd03?0", "n": [ { "c": 2, "d": "Looks up a DOM element with querySelector", "i": "micro-behaviors/ui/window/manage/dom::dom-element-lookup--queryselector", "o": 57, "z": 13, "cf": 0.8999999761581421 } ], "ln": 3, "addr": 30 }, { "b": "31E)\u003eB95KDA+e/Jy-\u003e\u003e-bQ+2+BAg@7cN?a", "ln": 4, "addr": 75 }, { "b": "31E)\u003eB95Kmz!%k#Ac2ORy?#BWzxI7+bQ+2+v@Dg1vq{p0l2pu+dlv", "ln": 15, "addr": 458 }, { "b": "31E)\u003eB95Kvx)a5Qx\u003ey%1jS(0#cNiCwC4B6Qw[Azti@", "ln": 16, "addr": 501 }, { "b": "31E)\u003eB95Knx\u003ey%GzGGDgC42h=wO-FLaz#sry=.", "n": [ { "c": 1, "d": "Plain JavaScript identifier assignment", "i": "metadata/lang/scripted::plain-js-identifier-assignment", "o": 542, "z": 23, "cf": 1.0 } ], "ln": 17, "addr": 535 }, { "b": "31E)\u003eB95Knz/5i!wmXbzauZ\u0026+B.\u003e\u003eQ", "ln": 18, "addr": 566 }, { "b": "31E)\u003eB95KCxM58.z/5l/wmY*HyAL+.bQ+2+B7/Gol#M{qz!9B2cN?a", "ln": 19, "addr": 591 }, { "b": "32Bf{azC.dwN/*Yx(dB4auZ\u0026+B.\u003e\u003eQ", "ln": 34, "addr": 1049 }, { "b": "32Bf{ayYncBw(WTzD7s!wPw[Raz#sry=.", "ln": 35, "addr": 1074 }, { "b": "32Bf{aAg+4wLlPWauZ?{wmYvYB.(dEi@", "n": [ { "c": 1, "d": "Module-level passphrase string constant", "i": "objectives/anti-static/obfuscation/payload/encrypted::js-passphrase-literal-const", "o": 1101, "z": 24, "cf": 0.8500000238418579 } ], "ln": 36, "addr": 1101 }, { "b": "", "ln": 37, "addr": 1127 }, { "b": "31!r$v@#B6zxK1xvruTkd0c)XDJ", "ln": 38, "addr": 1128 }, { "b": "2)\u003eV{vruTkmqKO#wQ5q:z/fVdzGE0:aAPW", "n": [ { "c": 1, "d": "DOM script content sink", "i": "objectives/command-and-control/dropper/execution/browser::dom-script-content-sink", "o": 1160, "z": 14, "cf": 0.8500000238418579 } ], "ln": 39, "addr": 1150 }, { "b": "34h", "ln": 40, "addr": 1178 }, { "b": "31!r$v@#B6zxK1lz*aJRzF\u003c3ad0c)XDJ", "ln": 41, "addr": 1181 }, { "b": "", "ln": 64, "addr": 1684 }, { "b": "31!r$v@#B6zxJ+lvpR-zy\u00260K0B7F(gdiJ%", "ln": 65, "addr": 1685 }, { "b": "2)\u003eY]C{4C", "ln": 66, "addr": 1713 }, { "b": "2)*]Fz/fSraAy[mauZ\u0026-z!0i(q/(}#vp%d7xjVfRBy/qqxjVf-Bz(hdxjT.EC{\u003e9\u003ci@", "n": [ { "c": 3, "d": "Browser storage getItem call", "i": "micro-behaviors/data/db/web-storage::dom-storage-getitem", "o": 1736, "z": 20, "cf": 0.8999999761581421 } ], "ln": 67, "addr": 1721 }, { "b": "2)*]Fz!%k#Ac2P3q!p4[jS[SNCox*}BsqfrCox9)n(FIXe]UltB7D+uvrTdyiV}Tjdlv", "n": [ { "c": 2, "d": "JSON.parse call", "i": "micro-behaviors/data/serialize/json::json-parse-call", "o": 1807, "z": 10, "cf": 0.5 } ], "ln": 68, "addr": 1775 }, { "b": "2)(25v{%E?xDOZmdiJ%", "ln": 69, "addr": 1830 }, { "b": "2)*]Fz!%k#Ac2P3q!p4[jS[SNCox*}BsnO1", "ln": 70, "addr": 1846 }, { "b": "34h", "ln": 72, "addr": 1879 }, { "b": "31!r$v@#B6zxK1eC4B3Vy\u00260K0B7F(gdiJ%", "ln": 73, "addr": 1882 }, { "b": "2)\u003eY]C{4C", "ln": 74, "addr": 1910 }, { "b": "2)*]Oz!0i(q/(}#vp%d7B7GC+By/qq", "n": [ { "c": 3, "d": "Browser storage setItem call", "i": "micro-behaviors/data/db/web-storage::dom-storage-setitem", "o": 1921, "z": 20, "cf": 0.8999999761581421 } ], "ln": 75, "addr": 1918 }, { "b": "2)*[AxjVf-Bz(hdxjT.EC{\u003e9)", "ln": 76, "addr": 1943 }, { "b": "2)*[An(FIXe]#bPx(mM$w{C^\u003cA=LPle[Pcxz75[jy\u00260K0B7F(XwPPvI", "n": [ { "c": 2, "d": "Object serialization methods", "i": "objectives/discovery/system/fingerprint/runtime::object-serialization", "o": 1968, "z": 14, "cf": 1.0 } ], "ln": 77, "addr": 1964 }, { "b": "2)*[!i@", "ln": 78, "addr": 2009 }, { "b": "2)*[A2}k", "ln": 127, "addr": 3401 }, { "b": "2)*[AdiK1=at+#gi@", "ln": 128, "addr": 3408 }, { "b": "2)*]He]U\u0026xC4CMkl$G$sB.(dFdlv", "n": [ { "c": 1, "d": "JavaScript preventDefault call", "i": "objectives/anti-analysis/browser-detect::js-prevent-default-call", "o": 3426, "z": 16, "cf": 0.8500000238418579 } ], "ln": 129, "addr": 3422 }, { "b": "2)(2ei@", "ln": 130, "addr": 3445 }, { "b": "2)\u003ecRC4\u003eF#AZ:^%vpS[qC4CMkoLFM\u0026wO#71c)@$Lx(n37A=2-rwHx2Kc$K?IjW70n", "ln": 131, "addr": 3451 }, { "b": "", "ln": 150, "addr": 3965 }, { "b": "31m[2zET/3B-7Yhx(v(iA+frgy\u003c6w^vp%dAwQbWMaBs", "ln": 151, "addr": 3966 }, { "b": "2)\u003eS-BAIRwaz$+maw^8%ze165c[6aEB15j{j%kg", "n": [ { "c": 2, "d": "new Promise() usage marker", "i": "metadata/lang/javascript-features::has-promise-new", "o": 4010, "z": 12, "cf": 1.0 } ], "ln": 152, "addr": 4001 }, { "b": "2)*]FxMw3dwIdI8C64Uvy\u0026.jyzGx=dv@#o)s7#L.z*9*BC42hn", "n": [ { "c": 3, "d": "JavaScript member eval call", "i": "micro-behaviors/process/interpreter/eval::js-member-eval-call", "o": 4067, "z": 6, "cf": 0.8999999761581421 } ], "ln": 153, "addr": 4033 }, { "b": "2)*[AcV0Zhvruj4zz2\u003cFx\u003eIc$as!NJz!0i$x(v(wAa9\u003c4zEEx[cOb", "ln": 154, "addr": 4074 }, { "b": "2)*[Ad0v3ZjW70n", "ln": 155, "addr": 4117 }, { "b": "2)*[A32\u003cr=wLlPWauZ\u0026CBAh8kxdd{CE0^4:wmYvYB.(dEdlv", "ln": 156, "addr": 4130 }, { "b": "arS7AB-7Yhx(v(qxdnf", "ln": 168, "addr": 4349 }, { "b": "arR^Hv@DmaBrBHFmNZVUl0dFZmnM@OjU!M!k$jpIo*I(*ogq#ZjVj#Q", "ln": 169, "addr": 4365 }, { "b": "arR^Hw{503BzkVhaAH$6wM9eXx\u003c\u003e*(DsXHFvqH6$em-shBz9jGx(!0gwN)lpC4(2iBy!#CC4(2iBy/0gD#rItaxJb.yG1!^c[dk*wPh:8j.ebyBzc5HfGS#Xd0x3nB.9Z0zGP=idro0wB-IvxC42ifwJKyuzGx[xBuK.\u003eAaJ%1aA?gfB.9TGw*?::jV$flBAh8kxd2cPA+funA=91yvqH6$e]k9pxlm/Jg+ZQFC42ifwIe4ux\u003e7Z5fF24mfEXI1\u0026^^)Ni^a}FB.b#nw*?::jV$fgB.$P0AWMlZBuI=IcT}1jy?m3)cN\u003c7EBAIRwaA?gfB.9TGw*?::jV$f4x\u003eIc$BseITwPS6nzxIX%zdm6%d0x3nB.90-x\u003ew=njV$}Qw{503BzkVhcN\u003c7EBAIRwasyw.B-7Yhx(v({cP=3Od0dQnjTUq@zdmB1cN\u003c7EBAIRwax9x5x(mMiC42ifwHPYPw*?+DAaJ%1awM\u0026=wG:i1cV%rqwObT]wN)encu-*lB.8XfzGx]dzEWl@w/%\u0026!wmWigwPS6nzxHrhph:VOiWVC3vqH6$e]CPrwLMVJwH/clcP=3Od0xrCx()]%e[!Wmd0x3nB.90JA+funA=90EtsiaBv%8P@A:p4Ox\u003ew=7wPh:8k0q?gmNZVUl0dFZmnM@Odro0wB-IvxcTfwQygQ)%t{?ZSx(!0gwN)A4wmN9ivqH6$dlzlQc{.(]vr\u003cFtB3T?!vr\u003cnAvqH6$djGQ:wPS6nzxKahy\u0026%qwB8kM2wHGk-q:A(wuRJ**uRr*\u003cqZ\u003ctovq)SrjW9{}w[s[LA+O@#x)KtsB$vfnAcb+zf!vGZB7]-cwgn%Qx\u003ew=njV$}Qz^)D)v@%7EDT*#iB95KyB-Y=[ElhmRBrCoXfGS(+AWUBozGx[xyANLcawVDYwN/*myH}^jd0x3nB.90JDUE7ux!7X$jYsTompe+PsyjY\u0026sYl+UA+eV{j9kH*DVa4GtwEIcB75V(q!o#-vqGU7wHI.gy\u0026%q[yH5G4wPh:8d\u003e@O#x(!0gwN)lrv{%E?xEEBvDVa4GtwEIccTfO*B7GxavqGU7vpB4:t{\u003e5GA+funA=91rB--4LwPS6nzxI(1A+PA7d0x3nB.91I", "n": [ { "c": 2, "d": "Iteration or loop pattern", "i": "micro-behaviors/data/control-flow/analysis::iteration-loop-pattern", "o": 5111, "z": 5, "cf": 0.5 }, { "c": 2, "d": "Compares value against the undefined string", "i": "micro-behaviors/data/control-flow/analysis::js-undefined-string-compare", "o": 4796, "z": 13, "cf": 0.6000000238418579 }, { "c": 2, "d": "Function constructor keyword", "i": "micro-behaviors/data/source/syntax/keyword::js-keyword-function-constructor", "o": 4733, "z": 8, "cf": 0.699999988079071 }, { "c": 1, "d": "JavaScript length property", "i": "metadata/lang/scripted::length-prop", "o": 4583, "z": 6, "cf": 1.0 }, { "c": 1, "d": "Find command key filename filters", "i": "objectives/exfiltration/stealer/credential/multi-source::node-find-key-filenames", "o": 5133, "z": 4, "cf": 0.8999999761581421 } ], "ln": 170, "addr": 4410 }, { "b": "arR^Hw{503BzkVhayYFcy?b}xByvTPz*a]:AbYJexlbFuemQbQ", "ln": 171, "addr": 5295 }, { "b": "arR^HarUxgc)rLSD)8#GA+funA=b8!i@", "ln": 172, "addr": 5336 }, { "b": "arR^HarUomAWUBozGx[xv@0!wz!pb4yBKQDwPP58B#%!^D3:4Aj.4YayCxayv{%E?xEEBvDT?jZB-7-3w[=c]wpj", "ln": 179, "addr": 5699 }, { "b": "arR^HarR^Hv@DmaBrC7mj-+gPc$vAHi@", "ln": 180, "addr": 5770 }, { "b": "arR^HarR^Hw]zYrv@DmaBrCKrf^7yDaAh9BDT*#iB95KzC0f!/vqH0qxjVfkAbdfSj85pPa-IPNv@Dmbx(n68j7AhDB95KlC#wi=jT:/-jV$@EB$N}!cmikCaW4#hzE^r\u003cx(mG)j7AhDB95KlC#Fo{jT:/YcmiXPe]@D*cs.9WjW0+ce]%8%x\u003ew=5C#wi=E0/yGq!o$#DU)hgB1RAOB7=$Gv}YN)wkEq+A5}GAf!voLA+fcgp\u0026ZF[i=F\u003c?em\u0026*zvqFnQi+0wjwOadOA+e\u0026]A+fb#wHxI^C42ifwHz)PEsh", "n": [ { "c": 1, "d": "Documentation page terminology", "i": "metadata/file/profile/identity::documentation-page-term", "o": 6012, "z": 9, "cf": 0.8199999928474426 } ], "ln": 181, "addr": 5796 }, { "b": "arR^HarV7", "ln": 182, "addr": 6035 }, { "b": "arR^HarUYoBAIRwaz\u003eLaB2%", "ln": 183, "addr": 6043 }, { "b": "arUoszEW^5z/cXiB46)[zyG{MwPS6nzxJ*zct\u003eCNz!9AUD2NsTjV#LUwmWwZoHRVApe\u003eN}pEET1", "ln": 190, "addr": 6430 }, { "b": "arUoszEW^5z/cXbB.LV5p*[DVc$NizDT*#iB95KzvrufCtu%sbwPP58B-GSRy==\u0026Ox(4uev%8/scs.gsaW4#0z!0{bwO#PxvSb!5dskMyzGx[xA6mYNAXqrtA+fcgmqMKLwO#PKx\u003ew+pA4bmpwNPvov@DmaBrCpdCS!ukA::kCAb](sz/*nzwIdXmwmZ0Yw?EO4y?$Ise[nNey?dM$zy/puAW:7?vrufnAclknc#0jpdlz3ZAY[w\u0026Aa9\u003c4e]U@OxEDe!A::kCAb](sz/*nzwIdXmwmZ0Yw?EO4y?$Igz!0{bwO#PxvSb!5e]UltwO#PUy?mD{zGF9Nz!0{bwO#PxvSb!5e]UltwO#PUy?mD{zGEHvxLzo[A+fbHtv.UZB.$YcBs}3vwo?Diwn+$2zdNQbe[e:fC{$g7A+funA=91svrufnA+fA9A=U!udsz", "n": [ { "c": 2, "d": "Invokes function with .call()", "i": "micro-behaviors/data/control-flow/analysis::js-function-call-method", "o": 6644, "z": 21, "cf": 0.8399999737739563 } ], "ln": 191, "addr": 6491 }, { "b": "arUoszEW^5z/cXrwPI^aC4BGUBz97wvrufiDUE7uaWHc?vr\u003cFtB3T?!vr\u003cnuvrufidro0wB-IvxzGP=ij8wFIaz#adwJ:Nxv%8T1zGEHuz!abPw]zYry?mYhx*1gjx/{uyBz9pywO#d5xGG]Ud\u003eb*Pz/fSrazCwhj-B?KxJ]gRj85pPa-qjewQF\u003eGzF%5%e[nNey?dM$zHu?CwoZp3zF%5%e[nNey?dM$zz2:pzFa68dro0wB-IvxzGP=ij8O$EwJ:{HwmWx6xLzo[A+fb)x\u003ehD]Er5[vB-IvxzF%5%E0/*Oy\u00261I", "n": [ { "c": 1, "d": "Array index i access", "i": "micro-behaviors/data/buffer::array-index-i", "o": 6979, "z": 3, "cf": 0.699999988079071 } ], "ln": 192, "addr": 6846 }, { "b": "arUoszEW^5z/cXsv{%mvzFa9dvr9=8A+u?Fvrc0zvrc1dE0Zo6v@DmaBrCVVj-B$Mw]zZbvqYN^e]CPKc[dk/z/fSrazC}ezf4\u003cAt@#LmzGx[xB7F{2mqN3dzE[2ms7L/Qq!p50dlz3TzGx[xB7F{2nP5P\u003ej-j?PaxJb.yG1!^c[dk/z/fSraA}mgyH}JHwn+$2zdNQbe[n{kvru6WA+e/-vqGZ\u003cAWUEpv%8T1zGEHuz!acvD$me9B.$YcBs}9xv%8T1zGFr-wO(0@BsZg9wmXkAy\u0026\u003clee(Lqps6[x\u0026mnliCr4f[BwPP5jj:gsJyH}Jsv%8*jwO#P+z!9AvCw7YbwHIBBDUE7ux(=ZVc#HEXclWCwwO%}MB1RcmB0$]PdsleSD3:4tzGx[xx(n0lj-j)+xjVfLz/6DizE)Zcc#HE}x\u003ew=czGx[DclWCwwO$7SB963Fvri\u0026hzGx[Gdsk=JwO(GvAclknd0]Jwi=lG.zGx]FdlzPZwO%}MB1Q)iwghsAj9a$AzB[.!Bs}0jwghefB95\u003cVEpDYcv}Wo4dslF\u003ezAShLy?)Q5e]ClBBwu:+wHG0Qv@DmaBrC4rnP5P\u003ej-j?PawDo-c[dk(By/rge[P3xmpxXtc[5!KenlK@k6{::nP5P\u003ee]$PCc#0=Qx(n0lephnyzdL+CvqPNKw*?wne[]iABsw+PzE^s6i+Zc:vrufzvS=y3wkDYRxEEOpe[F\u0026FemSvcy?dM$zAq0cEjoN[j7AhDB95KBz/o-sjZhhNw]zYrv@DmaBrCptaA7\u003cmx(){6B18DLwPP5lvrb{%Bv*v\u003eBuKI:y?#gPA^r1Jvrb{%Bv*v\u003eBuKIOe[X:qpJ{X\u003czF8sPze:AhwO#Prx(\u003e$sy:\u003c:VzGP=iEpDYcv}Wo4dsl2xA+fcgnP5P\u003ej-kyUy\u003c*2fc#-QnwO#PYzGx[Dcu9ylwO#PYzGx[yjW0I3e[]iABs5tzC$z){Bs}lnB0#0oA+fcgnP5P\u003edjGQMC$z){Bs}iqBsq9pA+fcgnP5P\u003edk2azx(4s2wO%btB-RjAvTgK.B963EwPPtmBs}oBB95\u0026WEpWkowQwDoz/*4MAclknc$mD[zGx[LxjVfkx(\u003e$wzGx[GdsDRRz/Nmoz/fSraA!(Cw/$MdnP5P\u003ee{pVtB.bRxdjGQ!e[nNey?dM$zz30GA=-YTvjU\u003epjW9pbx(mD)CR9wSx(mD)CQX4", "n": [ { "c": 1, "d": "JavaScript array sort call", "i": "micro-behaviors/data/source/syntax/array::js-array-sort-call", "o": 8015, "z": 6, "cf": 0.7200000286102295 }, { "c": 1, "d": "Runtime identity query fields", "i": "objectives/exfiltration/stealer/host-profile/http::identity-query-runtime", "o": 7644, "z": 6, "cf": 0.8999999761581421 } ], "ln": 193, "addr": 7090 }, { "b": "arR^Hx\u003ew=4A+v1CxM58.z/5l/wmY*hDU^nnay]zcnO06ex(){6B1RouzFa68j7-RMv@#B6zxJ+7vR6vBz/Nmqy:\u003cZvz/fSraAR48jT:(Te{7Jmpgn0Jkv[T-Byw/SvqPNdBz\u003c\u0026\u003eCv+!Zvrl0ddln?/y?mD{zGElPj7AhDB95KswiBHue[[\u0026Xc){k!d}JJHx\u003eeUNcNQ#(wPP58y\u0026.-!cP=3Oc$NiEv@bN{B4*p?Bs5tCy+xjlvrlG-x(!wGy?mG%Bz9aIv@ciHcOu+%l2}0OC}JYHz/3[ly+xjlvrlG-x(!wBe]2rszyu\u003e+cN\u003cE:wPS6nzxK4fxdEXbd}rypEp^Rtv@#B6zxJv#wjguMlUHgIwo8m0c$WHrzaem(Aa9=#zGFS(wmWr5wPh:8dsk=vc)rhyz/4{VE0/EoAcb+QjUOs9wPS6nzAzuDzGx[xv}YN)wo8m0jWBaevr\u003cFqA=k!yw].*bmqKO^xLzo[A+fcoD%o(9j7-zKc#rEpazA$)j83/!xLzo[A+fbvy?mG%Bz9:Id\u003er5}v@DmaBrC78j.5ety?dM$zD**Xj8wFIay/80y?caPB96M.B.\u003e\u003eQBAhUNv}YN)wjZVWBuKIOe[X:qlVl*Xz/fc7BspTgdsuIXB.\u003e(xv{%E?xEEBvDT*-6y?caPB96M.B.\u003e(xx\u003ew=6xLzo[nP5P\u003ecmihEnP5P\u003ee[!Wmc$u}8y?caPB95\u0026Wv@Dmbx(n68j7AhDB95Knz/5l/wmW]JzEEx[iWWr\u003eo/:yAd@nT6wO:?OAWUBedj/gJwmZ0Dwn=rRwoYQPeo23txGxQBx(4rRvrufhv}v8uv}YN)wo8m0i:k(vyIvV%iWXDRz6%-[Aa9=#zGFS(wmWx6xLzo[A+fbvAclknc$Emkph:VOdly%GwjguMlUHgIwo8m0c$u*twn=rWz!9AgwmY.4xE$}/jael1", "n": [ { "c": 2, "d": "Generic file read/write operations", "i": "micro-behaviors/fs/file/read-write::binary-file-ops", "o": 8287, "z": 5, "cf": 0.800000011920929 } ], "ln": 194, "addr": 8046 }, { "b": "arR^Hw]zYrv@DmaBrCptaA7\u003cmx(){6B18DCz/fSraztXmBwu:+wJ:HFnP5P\u003ee[X:qc#0=Qx(n0ldlzlQc)rnxB97e}wmWi1z/fVhzGPILvpS[pz/4\u003cPx(4s2wO@]gBs}cvene%yBwu:+wH]R^j7@LNBwu:+wIdFax(4s2wO%bwz/P}Fc$aVodlP\u003e6e[]ilwQ2!oe[]ilwQ2ULEe", "ln": 195, "addr": 8795 }, { "b": "arR^Hw{503BzkVhaAImywLV[^zF%5%dsk(xBrCS/f/@#=AWUBozGx[xv\u003c2Y4az#adwIdFax(4s2wO@@rd)m@/DsY(:c$sX/A+funA=91vEe", "ln": 196, "addr": 8961 }, { "b": "arQ", "ln": 199, "addr": 9206 }, { "b": "arUoszEW^5z/cXsv{%m6vrc0fDTQ@cjZ\u0026wzE0*o?j85pPxKL%SxdbhTDVTpNDUE7uBA}?pz!pbfxd^?dBw^3}Bvf$-AbPS9zGG}.jV$f8B-7Yhx(v(pdsk@Be[X:qqG3F}lVl*Xz/fc7BAn\u003cvz!0{bwO#PxvSb!5dsDROvru0)c$K\u0026OEpEhkB95KBj-+awzB5eMB.\u003eGbc$ddeE0*o?dlzlQc#{TYAXqDLByw#HfE.3NBAIRwaAz)JwPS6nzxKpDz/o-si:k(vBz(nfy=Tm3B7nS@o(\u0026uHEsh", "ln": 200, "addr": 9209 }, { "b": "arUoszEW^5z/cXdwPRu{y\u0026.{*p*[DVc#-QpxEOprz/fSraz2vLA+frgy\u003c6w^vrufhAa9\u003c4dlzlQc)rerdro0wB-IvxzGP=ij85pPxKL%SxdbhTDVTpNDT*#iB95KszGx[.zF7OmwPQpTze:AhwO#PrwO-/yD#rNHxjVfXCw.bjxg3POAbPS9zGEpry:\u003c:VzGP=ij7AhDB95KxvqPNsx(n0lkw\u003c[DwLV[^x(n0ldln\u003e*y+x*rxhh(LwJ%:xe{7Jmpgn0Je{829z*b=klT+4Ec[dh8wO+{{wO#Pqdlz3TzGx[xAa9=#zGFlVvqfQxtu%sbwPP5lj.nBZAa9=#zGFr-wO(0@BusXWx(4ueA4ccIwPP5lx*3uRy?#gPA^r1Jx*3uDe[X:qlVl*Xz/fc7Bsq8SE0/*Ae[X:qpJ{X\u003czF8sPze:AhwO#PrA4cfZzGP=iEpDYcv}Wo4dsl2Fj-kyUy\u003c*2fc#-(HDVizlwO#PSxKLQ)e{h5MxLz72d0]\u0026uzdL+CvqPNKw*?Rjdj/BDBz9ZAB.LV5p*[DVc#ZR-dsDd#A4V9rA+fcgmqMKLwO#Qrv@DmaBrC7bx(4s2wO%Unt@#LmzGx[xCvtr6wPx}Az!0{bwO#Pxv@=c?By!A(wO1}Ky?)Q5c$NiCph:VOmRMWXwPxz4nkAq]mnccAmnu/hj8wFIaz%t^vqGZ\u003cAXqlvCYVY0wmWerj9LvLy?k2jdsk=vc#Hg\u003ej.nBUDU^nnaztXmBv*v\u003eBuKI:y?$UvCwZ#jj-kyUy==-VD3:jyB96#\u003eB96M.xd^?dBvf$-AbPS9zGEpAdsuIXB.\u003e\u003eQz*c8gAY[qMe[X:qpJ{X\u003czF8sPze:AhwO#PrzyG%XzGP=iEpDYcv}Wo4dslFSw*?thB96#\u003eB95-Qz*c8gAY(MGx(n0ldskMrx(4s2wO%btB-RjADV0newJBZqzdMHPc$)KuBv*v\u003eBsw+WvrufzvS=y3wkDYRxEE:EEjoO)zAShLy?)Q5e]ClBBwu:+wHG0Qv@DmaBrCpnB97\u0026dv}wFSwP?^0CrGUTB96S\u003cx(mE1Cp)lfk#I5SpF%R*uOlzdw[s[LA+O@#x)Ktsx(n0ldlqu?y?#gyz/fSraz\u003eLaAa%i5B3i-kj85pPx(n0ldskVBAWUBozGx[xv\u003c2Y4ay/80y?dM$zyG{xz/fSray!$CA+frgy\u003c6w^vrufhv\u003eI.eBz99+y?mYhv}!8zB.\u003e\u003eQBAhUNv}!8zxd^?dBvf$-AbPS9zGEppwHS1OzGP=iEpDYcv}Wo4dskMsj-kyUy\u003c//izGx[x", "n": [ { "c": 1, "d": "Very long line", "i": "metadata/file/metrics::single-long-line", "o": 9440, "z": 512, "cf": 0.8999999761581421 } ], "ln": 201, "addr": 9440 }, { "b": "arUGiBrCHBwPzP}C%#KjzGP=ij7-RMv@#B6zxJIdB9hImpJ*q\u0026y*?Pqdsk=vc)rILwPzP}C%#J#DVa7sA+]ffmqLa$z!0{bwO#Pxv@=c?By^)SwO(0@BsnIEx)7\u003cMj8YpNA+]ffmqKO\u003cwizqEuTW$Zz*2Yjy*?P@uNE{NC4CYgvr\u003epTe]#bWy?kkrz/YSmx(v(LcUv7qwN)eIz*2Yjy*?PTy+x^JD2d4AAbPDdBy/FYC4CMkB3g)*z/fblj8YpNA+]ffmqKO$BA}Xle{Z9bwmZ0GcO^zkh-9GIhz^uuj7JntB.$YcBs}9xv%8T1zGFr-wO(0@Bs}0vAaJ]$lUHgIwghwtwPzP}C%#J#Er5[vB-Ivxz*2Yjy*?PTy\u003c=", "n": [ { "c": 1, "d": "Appends child DOM node", "i": "micro-behaviors/ui/window/manage/dom::browser-append-child", "o": 11107, "z": 13, "cf": 0.800000011920929 }, { "c": 1, "d": "style.position assignment marker", "i": "objectives/credential-access/phishing/tactics::full-window-iframe-shell--rx-2", "o": 10987, "z": 14, "cf": 0.8999999761581421 }, { "c": 1, "d": "fixed-position iframe marker", "i": "objectives/credential-access/phishing/tactics::full-window-iframe-shell--rx-5", "o": 11003, "z": 5, "cf": 0.8999999761581421 } ], "ln": 202, "addr": 10846 }, { "b": "arUoszEW^5z/cXhx\u003eI9}x\u003eIa3c#-QpxE)}kzE+hyv@DmaBrCdhj-UaPz!%Pdp*[DVc#-QpxEM2Sw*!*ly:\u003cyoBAIRwazb4#B7EByz/fSraAxRRy+xviBv6[*zE^E0xg3GHwO#P/wN/*gdlz3TzGx[xz-}VHB9hImpJ*q\u0026y*?Pqdlz3TzGx[xx(=WXz9qVGzE+)[jTT=Uz6}z-e]#bWy?kkdz/Px1AY\u003e^9AcJHDz!%b#aswV/x(=WXz9Gx)ggSsQw\u0026Rk1cNgr0vpp\u0026zcN?b}e]#bWy?kkdvpK7=A=l8rwiBTFl#M{bcVS\u003cevji@\u0026ehn[sehx4xeheXhgasOicVS\u003cevji/Xf/H^qfF1[gf!+47j8V-)BA}Xle]k9hBuKT%y?mj2d\u003c]pXcP=l0B98XzwIe7yA6nj]Bz(aGcVBqTj8V-)BA}Xle{z2uBz9*Te{z2uBz9fLAcJ-(z.u9MD2d4AxK$)\u003cxMMyTe[!*gxj#xqcVBqTj8V-)BA}Xle[wWqAbn%djTTYPz!0Mgj91[OB-IvxBAhInEe", "n": [ { "c": 1, "d": "DOM or CSS size property (height)", "i": "micro-behaviors/ui/window/manage/dom::size-prop--height", "o": 11521, "z": 6, "cf": 1.0 }, { "c": 1, "d": "DOM or CSS size property (width)", "i": "micro-behaviors/ui/window/manage/dom::size-prop--width", "o": 11494, "z": 5, "cf": 1.0 }, { "c": 1, "d": "Page display flex/none toggle", "i": "objectives/execution/lure/countdown::lure-display-flex-toggle", "o": 11543, "z": 22, "cf": 0.699999988079071 } ], "ln": 203, "addr": 11149 }, { "b": "arUoszEW^5z/cXuzFi-%xL.x}xMLTKDUE7ua-zKnA+]ffmqKz[wPS6nzAz=WwPzP}C%#K4B98XzwIdIcB8U@7C%9J)z/fblEe", "n": [ { "c": 1, "d": "Hides element with display none", "i": "micro-behaviors/data/format/html::display-none-style", "o": 11635, "z": 20, "cf": 0.8799999952316284 } ], "ln": 204, "addr": 11579 }, { "b": "arU(xzE^Wfe)?%KqErl#pEmGSuP\u0026:Sv{%moB7nS@em-slvqfL0lu#yoBz9ZCwPRu{y\u0026.{*p*[DVene:gxL.x}xMMpGx\u003eI9}x\u003eIa3eoL\u0026zx\u003eI9}x\u003eIa3i^2sNx\u003eI9}x\u003eIa3Eld", "ln": 205, "addr": 11657 }, { "b": "", "ln": 206, "addr": 11764 }, { "b": "arR^HarUxgasH!NyH}=ljV$}JcQ\u00268^vq]^9diJ%WwId}xwP?T5BvoXLvrDydc[dk2wIe4Cz/wJ[z/xb$vruj4zyu}}aAITyA8pmUyH}JmdlwV2", "ln": 257, "addr": 13382 }, { "b": "arR^HEld", "ln": 258, "addr": 13471 }, { "b": "arR^Hwn+$2zdNQbe[5p3mrSlWBwcy\u0026By/u3AWSqLz/{bjzeTPecOcxEuTW$Zz/eo/C4AiEBAhIndlv", "n": [ { "c": 1, "d": "Browser user activity event listener", "i": "micro-behaviors/ui/window/manage/visibility::user-activity-event-listener", "o": 13491, "z": 28, "cf": 1.0 } ], "ln": 259, "addr": 13478 }, { "b": "arR^Hwn+$2zdNQbe[5p3mrSlWBwcy\u0026By/u3AWSqBy?Wx{cOcxEuTW$Zz/d{Ux\u003e7{faARTDwHPX", "n": [ { "c": 1, "d": "Click analytics event token", "i": "micro-behaviors/communications/http/services/analytics::click-event-token", "o": 13572, "z": 5, "cf": 0.8600000143051147 } ], "ln": 260, "addr": 13541 }, { "b": "arR^Hwn+$2zdNQbe[5p3mrSlWBwcy\u0026By/u3AWSqJwQd*8CwX=VaywF:A:J:5oj-x1aARTDwHPX", "n": [ { "c": 1, "d": "Browser keydown activity listener", "i": "micro-behaviors/ui/window/manage/visibility::keydown-activity-listener", "o": 13614, "z": 26, "cf": 0.7799999713897705 } ], "ln": 261, "addr": 13601 }, { "b": "arR^HA+funA=91wA=\u003e}P", "ln": 262, "addr": 13661 }, { "b": "arV7", "ln": 263, "addr": 13678 }, { "b": "2)\u003eS-BAIRwaz$+maw^8%ze165c[6aEB8L(rwHO-+j%kg", "ln": 286, "addr": 14429 }, { "b": "2)*]Fz/fSraA}\u003cmA3dp", "ln": 287, "addr": 14465 }, { "b": "2)*[AcP-.8dlP\u003ewaARTHaBtjUas^", "n": [ { "c": 2, "d": "Error-handling pattern markers", "i": "metadata/package/quality/profile::error-handling", "o": 14486, "z": 14, "cf": 0.800000011920929 } ], "ln": 288, "addr": 14481 }, { "b": "2)*[Ap/p7QmpewSl%gS.", "ln": 289, "addr": 14504 }, { "b": "2)*[AcM)CvBAIRwaAR)FwP8f6Cwg@9z*9*vuQmN%p/p7QmpfyBjV$0izE^r\u003cx(mG)a%o8)b5.lvauyR?w)]y\u0026wN(#DaBLwxvru0)c$K\u0026OaAz4nB-Ivxb4U!nz/N(.d\u003e1%Qcs[/DwPI{3xjSINaBLwXdjuSbcP.", "n": [ { "c": 2, "d": "Try/catch error handling patterns", "i": "metadata/package/quality/profile::try-catch-handling", "o": 14596, "z": 5, "cf": 0.699999988079071 } ], "ln": 290, "addr": 14521 }, { "b": "2)*]FxMw3dwIdI8C64Uvy\u0026.jyzGx=dv@#o)s7#L.z*9*BC42hnCxdbhefDuYwPGyBwPz/uau.[hDJ", "ln": 291, "addr": 14648 }, { "b": "", "ln": 361, "addr": 16291 }, { "b": "31!r$v@#B6zxJzhx(4rCzE=TRzE^s0c[co=", "ln": 362, "addr": 16292 }, { "b": "2)\u003e9WzGx[xB9hsxjS[@.zE^Wfe\u003cSxnnIk3{zE^s0q/#}]vrcS:r834mv%8*jwO#PRvrl0ddjEs", "ln": 363, "addr": 16321 }, { "b": "2)\u003eV}zeAZ4C%#K4x(m*1A.6e7oDVFvB9hsY", "n": [ { "c": 3, "d": "Writes HTML into the DOM with innerHTML", "i": "micro-behaviors/ui/window/manage/dom::browser-innerhtml-assignment", "o": 16392, "z": 12, "cf": 0.800000011920929 } ], "ln": 364, "addr": 16381 }, { "b": "2)\u003eS-zE^s0c[dj", "ln": 365, "addr": 16410 }, { "b": "2)\u003efXB9hImq!o=Rv@#o)pJ*q\u0026y*?Pqdlv", "ln": 366, "addr": 16422 }, { "b": "34h", "ln": 367, "addr": 16449 }, { "b": "31!r$v@#B6zxK7vwmoN\u003el1t1JC4Bi.C4CXxdsh", "ln": 371, "addr": 16694 }, { "b": "2)\u0026mray/k0vr9GfA+fAdz/{azxM569AV/BBvru5", "ln": 372, "addr": 16725 }, { "b": "2)\u003eY]wO1qDe]=2BA^pO{y?m9#z/OcWy:ZU-BAg@7eOPrrz7YHuC4CXwdk2jJAZ:zDxECouy:?IhwO-#ey*?yaoLFM\u0026e]\u003eJuz*2XucUNBwwPxdEdlv", "n": [ { "c": 1, "d": "DOM remove call", "i": "micro-behaviors/data/manipulation::remove-call", "o": 16829, "z": 8, "cf": 0.800000011920929 } ], "ln": 373, "addr": 16757 }, { "b": "2)\u003erTc)rnxC4CY9wkDYRxJ61[diJUxBAIRwi@", "ln": 374, "addr": 16848 }, { "b": "2)\u003e9WzGx[xwO-FLaARTnwKQz/ADL\u0026kC#Fo\u003cwN/?2AWSp/BAg@7eOPrrzcHKVByu+uvrufCa$1)dq=tqWB7nS$wHIkgC4CY9wkDYRxJ61[djV+\u0026t{?6.", "ln": 375, "addr": 16878 }, { "b": "2)\u003eY]wO1qD", "ln": 379, "addr": 17042 }, { "b": "2)*[\u003cADL\u0026kC#Fo\u003cwN/?2AZsITc){S?A+e/lx(){6e[5mix)a5ndf", "ln": 380, "addr": 17051 }, { "b": "2)*[\u003cw]zYUvpJ$0c$Nizau.[hwO-#ey*?yaoLFM\u0026e]\u003eJuz*2XucT*Ibx)a5ndjEs", "n": [ { "c": 1, "d": "Multi-page show/hide lure machine", "i": "objectives/execution/lure/countdown::lure-multi-page-hide", "o": 17115, "z": 26, "cf": 0.699999988079071 } ], "ln": 381, "addr": 17093 }, { "b": "2)\u003erTasFyOwO+{/By!#VvrufYBAe/MA+funA=9@", "ln": 382, "addr": 17145 }, { "b": "2)\u003e9WzGx[xv%8/mjS[\u0026!wO1qDe]=2BA^pO{y?m9#z/Nl", "ln": 383, "addr": 17177 }, { "b": "2)\u003eY]wO1qDe[5ZrwO#3CxLzo[c$Emkdlv", "ln": 418, "addr": 18154 }, { "b": "2)\u003e-[wmoN\u003el1t1JC4BP-y?m9#x(v(qdlv", "ln": 419, "addr": 18181 }, { "b": "2)\u003eY]wO1qDe]=2BA^pO{y?m9#z/OcWy:ZU-BAg@7eOPrrz6{++w]zYUvpJ$0c#rPDau.[hDJ", "n": [ { "c": 1, "d": "References a hidden-directory path literal", "i": "micro-behaviors/fs/path/location::hidden-dir-literal", "o": 18235, "z": 10, "cf": 0.8399999737739563 } ], "ln": 420, "addr": 18208 }, { "b": "2)*]Ox!A?8wjpVMzGFM^B97#hwPxgDzeTMrwO2+3wPxdHasFVYjW70n", "ln": 421, "addr": 18266 }, { "b": "2)*[Av@DmaBrCuwjS[MPe[wyjvrl14e]UlvxGD", "ln": 422, "addr": 18311 }, { "b": "2)*[=c$WQtv@#B6zyu@XaARTHaBtkKwPS6nzxILIpFJJ-BAh8kxk7$6d0Gxywn=VAuTD8%uR\u003cS@lpCl*cmi}JzE^Wfe)?%KqErl#pEmGSuOlzfvqWFvas^", "n": [ { "c": 2, "d": "try block opening", "i": "metadata/package/error-handling::try-block-open", "o": 19002, "z": 87, "cf": 0.5 } ], "ln": 451, "addr": 18998 }, { "b": "2)*[=c$WQtv@#B6zyu@XaARTHaBtkKwPS6nzxILIpFJJ-BAh8kxk7$6d0Gxywn=VAuTD8%uR\u003cS@lpCl*cmi}JzE^Wfe)?%KqErl#pEmGSuOk(2Byw)1B3+dGvrufhcM\u003c]", "n": [ { "c": 2, "d": "try block opening", "i": "metadata/package/error-handling::try-block-open", "o": 19651, "z": 96, "cf": 0.5 } ], "ln": 476, "addr": 19647 }, { "b": "2)*[=djEt3Eir3dByO#jwHR%GA+funA=90za%qpREjlM[cP.", "ln": 478, "addr": 19777 }, { "b": "2)\u003e9PA=k/ae[wKpBz(8lB1RfAB8UY2By!#:x(mE1Cp)DIvqEu4z!9AgasInwB15j{j%kg", "ln": 479, "addr": 19816 }, { "b": "2)*]OwPP59vrt{2jS[S+y?#f", "n": [ { "c": 1, "d": "HTTP request body field marker", "i": "objectives/exfiltration/http/hardcoded-key::request-body-marker", "o": 19879, "z": 6, "cf": 0.75 } ], "ln": 480, "addr": 19872 }, { "b": "2)*]WA^n^O", "ln": 481, "addr": 19892 }, { "b": "2)*[AwmoN*auZ\u0026/wPF$UawbNdpa*G]A=U!uA+fqvauyS.B.\u003e\u003eQ", "ln": 482, "addr": 19901 }, { "b": "2)*[AwmoN*auZ\u0026+B.\u003e\u003eQ", "ln": 484, "addr": 19959 }, { "b": "2)*]^", "ln": 485, "addr": 19976 }, { "b": "2)*]Fz/fSrazULlauZ\u0026tq+{dvB98CpzF9V}C{)SuBz99+", "n": [ { "c": 1, "d": "var/let/const key-like assignment declaration", "i": "metadata/lang/scripted::js-key-assignment-declaration", "o": 19984, "z": 11, "cf": 1.0 } ], "ln": 486, "addr": 19981 }, { "b": "2)*]Fz/fSraAhvjB%5{\u003cy*?ybq/l2.B7/Gllu#yoBz9ptwPPtowQbZ^", "ln": 487, "addr": 20018 }, { "b": "2)*]Fz/fSraAhvjC28NZauY", "ln": 488, "addr": 20063 }, { "b": "2)*[AAb]JkasnATAb]Jke[]iAByx5%wL^zUC4\u003eJiau{#/A+fzDx(n0lvqYN^p\u0026Zb\u003cx\u003eqGhiV@r.y?#f", "ln": 489, "addr": 20082 }, { "b": "2)*]Fz/fSray/LmA.*dVauY", "ln": 490, "addr": 20146 }, { "b": "2)*[AwmoN*asnATwmoN*e[]iAByx5%wL^zUC4\u003eJiau{#Vvrt{gx(n0lvqYN^p\u0026Zb\u003cx\u003eqGhiV@r.y?#f", "n": [ { "c": 1, "d": "Collects identity data for DNS label", "i": "objectives/exfiltration/side-channel/dns::identity-data-dns-array", "o": 20177, "z": 20, "cf": 0.9599999785423279 } ], "ln": 491, "addr": 20165 }, { "b": "2)*]Fz/fSray]g#w/%kVCwg@9z*9*1qDlpvv@Dj6B-.g.x\u003ey%9Ab]JkpHX5\u0026ay/LmA.*dVdlv", "ln": 492, "addr": 20229 }, { "b": "2)*]GwPRu{y\u0026-3Ye[]ivwPysvo?VV)aA}Kqwn=VAk#HYOe]\u003eJvwmY^HwPRu{y\u0026-cDo?V%Cvrt{eay]g#w*]!", "ln": 493, "addr": 20288 }, { "b": "2)\u003eAVBrCyhw]]dUatLSj", "ln": 503, "addr": 20524 }, { "b": "2)\u003e6Vz/!]/vqY4UzdN-gjS[/SBv*v(wPz%5y:ZXXau.[hDJ", "n": [ { "c": 2, "d": "setInterval timer usage", "i": "micro-behaviors/time/schedule/interval::setInterval", "o": 20559, "z": 11, "cf": 0.5 } ], "ln": 504, "addr": 20541 }, { "b": "2)*]Lw/@HrwOc3oeG^esattk!DJ", "ln": 505, "addr": 20579 }, { "b": "vrlZiv\u003c2xazEW^5z/cXizGx]dy\u002600/B-.g@vru0)wPyvWy?W=#c[fG", "ln": 554, "addr": 21665 }, { "b": "336Q0B-IvxzE[2mp\u0026ZF\u003ex(^\u0026lc#@)uz!%PddlP\u003ew", "ln": 555, "addr": 21709 }, { "b": "2)\u003e9WzGx[xv@C)?auZ\u0026Pc$WQtv@#B6zyu@XaARTHaBs", "n": [ { "c": 2, "d": "try block opening", "i": "metadata/package/error-handling::try-block-open", "o": 21758, "z": 128, "cf": 0.5 } ], "ln": 556, "addr": 21742 }, { "b": "2)*]Lw/@HzD2Ntkw/#qizE^Wfe)?%KqErr$rA8y]rZ/[[uMZHPjS(a\u0026B.$P0AWJpUDMWJDzE^Wfe)?%KqErr$rA8y]rZ/[[uM.GOfGQz9", "n": [ { "c": 1, "d": "String literal equality or membership check", "i": "micro-behaviors/data/control-flow/analysis::string-literal-equality-check", "o": 21816, "z": 11, "cf": 0.9200000166893005 } ], "ln": 557, "addr": 21777 }, { "b": "2)*[^w{503BzkVhc[fG", "ln": 558, "addr": 21862 }, { "b": "2)*[AC42zly*?ybnoeoNauZ\u0026-z!0i$x(v(wxMvV@i@", "n": [ { "c": 1, "d": "window.location host marker", "i": "micro-behaviors/communications/http/url/path::browser-location-host-ref--rx-1", "o": 21897, "z": 13, "cf": 0.8999999761581421 } ], "ln": 559, "addr": 21878 }, { "b": "2)*[Aw{503BzkVhayYFgA40eZaARTHaBtkPx(mE1Cp)lfk#I5/pGpv.uSGP[uTB{sasICFzE^Wfe)?%KqErr$rA8y]rZ/[[uWKKRd\u003e%adEir3dByO#jwHR$OaBK", "n": [ { "c": 2, "d": "Code has try-catch error handling", "i": "metadata/package/quality/profile::has-try-catch", "o": 21933, "z": 70, "cf": 0.75 } ], "ln": 560, "addr": 21912 }, { "b": "2)*[AC42zlz/PM8p\u003c3?)auZ\u0026Xx(!xmA^ooRB-Rj{Byxo5j0niJB98tvC}K5UB7!G]vru66jS[uVzEW^5z/c%LDMWGuAV/xBjS[V-x\u003eHm+B7^gmAbYSsd0fcpB1wCxA+xJiwO#QhdlwU[wPQ)=zdNTdBsp:zzEW^5z/c%LDMW3mc#r*ivruj4zz2QywO98Gj-1LFBvZB-w*@6Hy*?ybnoeoNj-24Dvruj4zz2QywOa1DvS=Kbc[dk2Eir}?fEY7aA+funA=91uj0n@k", "n": [ { "c": 2, "d": "HISTORY documentation reference", "i": "metadata/package/documentation::references-changelog-history", "o": 22030, "z": 7, "cf": 1.0 }, { "c": 2, "d": "Schedules a JavaScript callback with setTimeout", "i": "micro-behaviors/time/schedule/interval::setTimeout", "o": 22122, "z": 10, "cf": 0.5 } ], "ln": 561, "addr": 22011 }, { "b": "2)*[AC42zlz/PM8qE%/-vpJ\u003c\u003ejS[ALB98tvC}KbGAbn@)wM9XVBy^JRxLzKfz/QaQA+fiavpJ\u003eEByxo5auZ\u0026VB-7Yhx(v(qdsigXvr9GhauZ\u0026=A+Pe:wPhD]v}vo3AbYSsd0fcpB1wCxA+xJiwO#QhdlwU[wPQ)=zdNTdBsp:zzEW^5z/c%LDMW3mc#r*ivruj4zz2QywO98Gj-1LFBvZB-w*@6Hy*?ybnoeoNj-24Dvruj4zz2QywOa1DvS=Kbc[dk2Eir}?fEY7aA+funA=91uj0n@k", "ln": 562, "addr": 22228 }, { "b": "2)*[ACwg@9z*9*xwmObLwO#P-x(!xczE)\u0026pcVB0yB97\u0026jwHx2Kw{503BzkVhc[fG=x\u003ew=fz!0i$x(v(wxMvV@aW4#8vrlJYA+e\u0026iDMWckB96@[wOa8wz!0i$x(v(wxMvV@j0n0PzeZ)Lj0n}]EjMH.A=\u003e}xi@", "ln": 563, "addr": 22457 }, { "b": "2)*[ACwg@9z*9*xwmObLwO#P-x(!xczE)\u0026pcUM}fxK+Z:zF9JdefFLEzEW^5z/c%LDMW3mc#r*ivruj4zz2QywO98Gj-1LFBvZB-w*@6Hy*?ybnoeoNj-24Dvruj4zz2QywOa1DvS=Kbc[dk2Eir}?aARTDwHPX", "ln": 564, "addr": 22583 }, { "b": "2)*]^djuSbao", "n": [ { "c": 1, "d": "Trailing IIFE closure indicating auto-exec", "i": "objectives/anti-static/obfuscation/eval/dynamic::export-iife-closure", "o": 22714, "z": 6, "cf": 0.8500000238418579 } ], "ln": 565, "addr": 22711 }, { "b": "2)*]UwPS6nzxK4wB.9S", "ln": 566, "addr": 22721 }, { "b": "2)(25v{%E?xEEBvDMWuuBAIRwazb4#B7EAQEir}!c[eK=", "ln": 567, "addr": 22737 }, { "b": "2)*[Ad0v3ZjW70n", "ln": 581, "addr": 23146 }, { "b": "2)*[A329#]d0uZRjV%]nz^)D)v@%7EaBs", "ln": 582, "addr": 23159 }, { "b": "2)*[A2)\u003er-B97\u0026by/2d\u003cvR5bGy?W=#c[dj", "n": [ { "c": 1, "d": "modprobe hook shell metachar", "i": "objectives/persistence/system/surface/modprobe::modprobe-shell-metachar", "o": 23186, "z": 27, "cf": 0.8199999928474426 } ], "ln": 583, "addr": 23186 }, { "b": "2)*[A34h", "ln": 584, "addr": 23214 }, { "b": "2)*[AEe", "ln": 585, "addr": 23221 }, { "b": "31^)/By/FYy+xdbwjpVMzGFM^B97#hwPxgDx(m)jBseQZc[co4j%kg", "ln": 593, "addr": 23312 }, { "b": "2)\u003e3VAbo!?x(4)5AWUKly\u0026\u003clemqKP1vqH6$dlv", "n": [ { "c": 2, "d": "Reads the value of a DOM element", "i": "micro-behaviors/ui/window/manage/dom::dom-element-value-read", "o": 23378, "z": 6, "cf": 0.8999999761581421 } ], "ln": 594, "addr": 23356 }, { "b": "34jl:", "ln": 595, "addr": 23387 }, { "b": "2(", "ln": 653, "addr": 24785 }, { "b": "2})}Ol3mo/ePLAmA+fr9aA8cuv@b\u003c\u003czGEEKx\u003eg=$A=l8xwGUF@vqYZ?A@", "n": [ { "c": 2, "d": "Package references CHANGES", "i": "metadata/package/documentation::references-changelog-changes", "o": 24825, "z": 7, "cf": 1.0 } ], "ln": 654, "addr": 24787 }, { "b": "32Bf{aywF:A:JS\u003eB97=fz/{ekuV{13auZ\u00260f/]", "ln": 655, "addr": 24833 }, { "b": "2)\u003e9PA=k/ae[wKpBz(8lB1RfAB8UY2By!#:x(mE1Cp)DIvqEttc$WQtv@#B6zyu@XBAhUNA+funA=91zx(mE1Cp)lfk#I5/pGpv.uSGP[uTFhdfGTX)vru0)c$K\u0026OA+funA=90NEsiK)djlU?d0xfxdiH=qaBs", "n": [ { "c": 2, "d": "Code has try-catch error handling", "i": "metadata/package/quality/profile::has-try-catch", "o": 24937, "z": 44, "cf": 0.75 } ], "ln": 657, "addr": 24885 }, { "b": "2)*]Lw/@HzD2Ntkw/#ndAV^IdjS(a\u0026B.$P0AWI$RclNFyAV=I*jS[9svrbZ\u003evrlJ$A=l8xwNxQ(AW-bT", "ln": 658, "addr": 25012 }, { "b": "2)*[Av@Dmaz!@#qwmYj)xdbcil2HsTy*?u#vpST^qG3Y1wGVecA=U@kzxJC5vqYZ?wg5]JuTEkZuU\u003cd(Byf6bB-.h4C4CXBasw:8cOcx-wPxjY", "n": [ { "c": 1, "d": "JavaScript console object", "i": "micro-behaviors/os/console/io::js-console-object", "o": 25081, "z": 7, "cf": 1.0 } ], "ln": 659, "addr": 25077 }, { "b": "2)*[AuTEkZuU\u003cd(Byf6bB-.h4C4CXpjS[]VAYT", "ln": 660, "addr": 25166 }, { "b": "2)*[ABAhTHDMWDGxLz9)y?WJ}BsnO1aBLwxvru0)asH!IaBwI", "ln": 661, "addr": 25197 }, { "b": "EjlM[i@", "ln": 758, "addr": 28781 }, { "b": "", "n": [ { "c": 2, "d": "javascript code embedded in string", "i": "metadata/lang/embedded::javascript", "o": 43516, "z": 974, "cf": 1.0 } ], "ln": 759, "addr": 28787 } ], "depth": 1, "facts": { "imp": [ [ "", "document.querySelector" ], [ "", "treeEl" ], [ "", "summaryEl" ], [ "", "detailsEl" ], [ "", "statusEl" ], [ "", "banner" ], [ "", "bannerText" ], [ "", "refreshBtn" ], [ "", "filterEl" ], [ "", "focusBtn" ], [ "", "clearFocusBtn" ], [ "", "expandAllBtn" ], [ "", "collapseAllBtn" ], [ "", "liveDiff" ], [ "", "diffIntervalSel" ], [ "", "domModeCk" ], [ "", "showDomNodesCk" ], [ "", "darkModeCk" ], [ "", "dividerEl" ], [ "", "layoutEl" ], [ "", "toggleDetailsBtn" ], [ "", "currentTree" ], [ "", "viewTree" ], [ "", "collapsedSet" ], [ "", "matchesSet" ], [ "", "autoExpandSet" ], [ "", "selectedPathStr" ], [ "", "selectedKindStr" ], [ "", "lastSnapshotByPath" ], [ "", "diffTimer" ], [ "", "injectTimer" ], [ "", "bootScanTimer" ], [ "", "pageKey" ], [ "", "statusEl.textContent" ], [ "", "bannerText.textContent" ], [ "", "banner.hidden" ], [ "", "banner.hidden" ], [ "", "raw" ], [ "", "localStorage.getItem" ], [ "", "getStorageKey" ], [ "", "collapsedSet" ], [ "", "JSON.parse" ], [ "", "collapsedSet" ], [ "", "localStorage.setItem" ], [ "", "getStorageKey" ], [ "", "JSON.stringify" ], [ "", "Array.from" ], [ "", "document.documentElement.style.setProperty" ], [ "", "parseInt" ], [ "", "localStorage.getItem" ], [ "", "getSidebarKey" ], [ "", "applySidebarWidth" ], [ "", "localStorage.setItem" ], [ "", "getSidebarKey" ], [ "", "String" ], [ "", "localStorage.getItem" ], [ "", "getDetailsKey" ], [ "", "document.body.classList.toggle" ], [ "", "toggleDetailsBtn.textContent" ], [ "", "localStorage.setItem" ], [ "", "getDetailsKey" ], [ "", "mode" ], [ "", "localStorage.getItem" ], [ "", "getThemeKey" ], [ "", "darkModeCk.checked" ], [ "", "document.body.classList.toggle" ], [ "", "localStorage.setItem" ], [ "", "getThemeKey" ], [ "", "restoreSidebarWidth" ], [ "", "dragging" ], [ "", "startX" ], [ "", "startW" ], [ "", "dividerEl.addEventListener" ], [ "", "dragging" ], [ "", "dividerEl.setPointerCapture" ], [ "", "startX" ], [ "", "startW" ], [ "", "parseInt" ], [ "", "getComputedStyle.getPropertyValue" ], [ "", "getComputedStyle" ], [ "", "e.preventDefault" ], [ "", "dividerEl.addEventListener" ], [ "", "dx" ], [ "", "Math.max" ], [ "", "Math.min" ], [ "", "Math.max" ], [ "", "applySidebarWidth" ], [ "", "dividerEl.addEventListener" ], [ "", "dragging" ], [ "", "parseInt" ], [ "", "getComputedStyle.getPropertyValue" ], [ "", "getComputedStyle" ], [ "", "persistSidebarWidth" ], [ "", "chrome.devtools.inspectedWindow.eval" ], [ "", "pageKey" ], [ "", "String" ], [ "", "loadCollapsed" ], [ "", "restoreSidebarWidth" ], [ "", "restoreDetailsHidden" ], [ "", "res" ], [ "", "PROBE_BODY" ], [ "", "wrap" ], [ "", "chrome.devtools.inspectedWindow.eval" ], [ "", "resolve" ], [ "", "chrome.devtools.inspectedWindow.eval" ], [ "", "JSON.stringify" ], [ "", "JSON.stringify" ], [ "", "highlight" ], [ "", "JSON.parse" ], [ "", "chrome.devtools.inspectedWindow.eval" ], [ "", "base" ], [ "", "window.ARUI.computeMatches" ], [ "", "matchesSet" ], [ "", "autoExpandSet" ], [ "", "render" ], [ "", "ensureSelectedOverlay" ], [ "", "viewTree" ], [ "", "localStorage.setItem" ], [ "", "getFocusKey" ], [ "", "JSON.stringify" ], [ "", "clearFocusBtn.disabled" ], [ "", "render" ], [ "", "ensureSelectedOverlay" ], [ "", "raw" ], [ "", "localStorage.getItem" ], [ "", "getFocusKey" ], [ "", "viewTree" ], [ "", "clearFocusBtn.disabled" ], [ "", "base" ], [ "", "window.ARUI.getSubtreeFromPath" ], [ "", "viewTree" ], [ "", "clearFocusBtn.disabled" ], [ "", "viewTree" ], [ "", "clearFocusBtn.disabled" ], [ "", "viewTree" ], [ "", "clearFocusBtn.disabled" ], [ "", "sum" ], [ "", "window.ARUI.renderSummaryHTML" ], [ "", "currentBase" ], [ "", "summaryEl.innerHTML" ], [ "", "render" ], [ "", "ensureSelectedOverlay" ], [ "", "hoveredPathStr" ], [ "", "el.scrollIntoView" ], [ "", "el.scrollIntoView" ], [ "", "treeEl.querySelectorAll.forEach" ], [ "", "treeEl.querySelectorAll" ], [ "", "el.classList.remove" ], [ "", "el" ], [ "", "treeEl.querySelector" ], [ "", "CSS.escape" ], [ "", "el.classList.add" ], [ "", "scrollIntoViewIfNeeded" ], [ "", "treeEl.querySelectorAll.forEach" ], [ "", "treeEl.querySelectorAll" ], [ "", "el.classList.remove" ], [ "", "cur" ], [ "", "treeEl.querySelector" ], [ "", "CSS.escape" ], [ "", "cur.classList.add" ], [ "", "scrollIntoViewIfNeeded" ], [ "", "highlight" ], [ "", "JSON.parse" ], [ "", "treeEl.innerHTML" ], [ "", "dom" ], [ "", "window.ARUI.buildTreeDOM" ], [ "", "currentBase" ], [ "", "collapsedSet.add" ], [ "", "collapsedSet.delete" ], [ "", "saveCollapsed" ], [ "", "selectedPathStr" ], [ "", "selectedKindStr" ], [ "", "updateActiveSelection" ], [ "", "unhighlight" ], [ "", "selectedPathStr" ], [ "", "selectedKindStr" ], [ "", "updateActiveSelection" ], [ "", "loadDetails" ], [ "", "JSON.parse" ], [ "", "treeEl.appendChild" ], [ "", "updateActiveSelection" ], [ "", "treeEl.querySelectorAll.forEach" ], [ "", "treeEl.querySelectorAll" ], [ "", "li.addEventListener" ], [ "", "kind" ], [ "", "highlight" ], [ "", "JSON.parse" ], [ "", "li.addEventListener" ], [ "", "highlight" ], [ "", "JSON.parse" ], [ "", "unhighlight" ], [ "", "unhighlight" ], [ "", "status" ], [ "", "arg" ], [ "", "code" ], [ "", "JSON.stringify" ], [ "", "chrome.devtools.inspectedWindow.eval" ], [ "", "result" ], [ "", "result" ], [ "", "JSON.parse" ], [ "", "result" ], [ "", "currentTree" ], [ "", "restoreViewTree" ], [ "", "buildAndRender" ], [ "", "ensureSelectedOverlay" ], [ "", "detailsEl.innerHTML" ], [ "", "status" ], [ "", "String" ], [ "", "code" ], [ "", "JSON.stringify" ], [ "", "chrome.devtools.inspectedWindow.eval" ], [ "", "data" ], [ "", "data" ], [ "", "JSON.parse" ], [ "", "data" ], [ "", "key" ], [ "", "JSON.stringify" ], [ "", "prev" ], [ "", "lastSnapshotByPath.get" ], [ "", "prevObj" ], [ "", "currObj" ], [ "", "diff" ], [ "", "window.ARUI.computeDiff" ], [ "", "detailsEl.innerHTML" ], [ "", "window.ARUI.renderDetailsHTML" ], [ "", "lastSnapshotByPath.set" ], [ "", "clearInterval" ], [ "", "bootScanTimer" ], [ "", "left" ], [ "", "bootScanTimer" ], [ "", "setInterval" ], [ "", "clearInterval" ], [ "", "arg" ], [ "", "code" ], [ "", "JSON.stringify" ], [ "", "chrome.devtools.inspectedWindow.eval" ], [ "", "result" ], [ "", "result" ], [ "", "JSON.parse" ], [ "", "result" ], [ "", "clearInterval" ], [ "", "currentTree" ], [ "", "restoreViewTree" ], [ "", "buildAndRender" ], [ "", "ensureSelectedOverlay" ], [ "", "unhighlight" ], [ "", "keepAlive" ], [ "", "bootRescan" ], [ "", "stopDiff" ], [ "", "diffTimer" ], [ "", "setInterval" ], [ "", "loadDetails" ], [ "", "JSON.parse" ], [ "", "clearInterval" ], [ "", "diffTimer" ], [ "", "code" ], [ "", "chrome.devtools.inspectedWindow.eval" ], [ "", "resolve" ], [ "", "clearInterval" ], [ "", "injectTimer" ], [ "", "installProbeInline" ], [ "", "installRouteWatcherInline" ], [ "", "injectTimer" ], [ "", "setInterval" ], [ "", "chrome.devtools.inspectedWindow.eval" ], [ "", "installProbeInline" ], [ "", "refreshBtn.addEventListener" ], [ "", "refresh" ], [ "", "filterEl.addEventListener" ], [ "", "applyFilter" ], [ "", "focusBtn.addEventListener" ], [ "", "ft" ], [ "", "window.ARUI.findFirstMatchRoot" ], [ "", "setViewTree" ], [ "", "setViewTree" ], [ "", "clearFocusBtn.addEventListener" ], [ "", "setViewTree" ], [ "", "localStorage.removeItem" ], [ "", "getFocusKey" ], [ "", "expandAllBtn.addEventListener" ], [ "", "collapsedSet" ], [ "", "saveCollapsed" ], [ "", "render" ], [ "", "ensureSelectedOverlay" ], [ "", "collapseAllBtn.addEventListener" ], [ "", "collect" ], [ "", "window.ARUI.keyFromPath" ], [ "", "collapsedSet.add" ], [ "", "currentBase" ], [ "", "currentBase" ], [ "", "currentBase.roots.forEach" ], [ "", "currentBase" ], [ "", "saveCollapsed" ], [ "", "render" ], [ "", "ensureSelectedOverlay" ], [ "", "liveDiff.addEventListener" ], [ "", "startDiff" ], [ "", "stopDiff" ], [ "", "showDomNodesCk.addEventListener" ], [ "", "refresh" ], [ "", "darkModeCk.addEventListener" ], [ "", "persistTheme" ], [ "", "applyTheme" ], [ "", "toggleDetailsBtn.addEventListener" ], [ "", "document.body.classList.contains" ], [ "", "document.body.classList.toggle" ], [ "", "toggleDetailsBtn.textContent" ], [ "", "persistDetailsHidden" ], [ "", "ar_last_route_ver" ], [ "", "setInterval" ], [ "", "chrome.devtools.inspectedWindow.eval" ], [ "", "console.debug" ], [ "", "ar_last_route_ver" ], [ "", "unhighlight" ], [ "", "selectedPathStr" ], [ "", "updateActiveSelection" ], [ "", "refresh" ], [ "", "selectBtn" ], [ "", "document.querySelector" ], [ "", "resetBtn" ], [ "", "document.querySelector" ], [ "", "selecting" ], [ "", "hoverPoll" ], [ "", "pickPoll" ], [ "", "hoveredPathStr" ], [ "", "el.scrollIntoView" ], [ "", "el.scrollIntoView" ], [ "", "treeEl.querySelectorAll.forEach" ], [ "", "treeEl.querySelectorAll" ], [ "", "el.classList.remove" ], [ "", "el" ], [ "", "treeEl.querySelector" ], [ "", "CSS.escape" ], [ "", "el.classList.add" ], [ "", "scrollIntoViewIfNeeded" ], [ "", "selecting" ], [ "", "selectBtn.classList.add" ], [ "", "selectBtn.textContent" ], [ "", "chrome.devtools.inspectedWindow.eval" ], [ "", "clearInterval" ], [ "", "hoverPoll" ], [ "", "clearInterval" ], [ "", "pickPoll" ], [ "", "hoverPoll" ], [ "", "setInterval" ], [ "", "chrome.devtools.inspectedWindow.eval" ], [ "", "hoveredPathStr" ], [ "", "JSON.parse" ], [ "", "updateActiveHover" ], [ "", "pickPoll" ], [ "", "setInterval" ], [ "", "chrome.devtools.inspectedWindow.eval" ], [ "", "path" ], [ "", "JSON.parse" ], [ "", "selectedPathStr" ], [ "", "JSON.stringify" ], [ "", "selectedKindStr" ], [ "", "updateActiveSelection" ], [ "", "loadDetails" ], [ "", "ensureSelectedOverlay" ], [ "", "stopSelecting" ], [ "", "updateActiveSelection" ], [ "", "selecting" ], [ "", "selectBtn.classList.remove" ], [ "", "selectBtn.textContent" ], [ "", "chrome.devtools.inspectedWindow.eval" ], [ "", "clearInterval" ], [ "", "hoverPoll" ], [ "", "clearInterval" ], [ "", "pickPoll" ], [ "", "hoveredPathStr" ], [ "", "updateActiveHover" ], [ "", "stopSelecting" ], [ "", "unhighlight" ], [ "", "selectedPathStr" ], [ "", "selectedKindStr" ], [ "", "hoveredPathStr" ], [ "", "updateActiveSelection" ], [ "", "updateActiveHover" ], [ "", "resetBtn.addEventListener" ], [ "", "selectBtn.addEventListener" ], [ "", "stopSelecting" ], [ "", "startSelecting" ], [ "", "window.addEventListener" ], [ "", "stopSelecting" ], [ "", "chrome.devtools.network.onNavigated.addListener" ], [ "", "resolvePageKey" ], [ "", "setupDivider" ], [ "", "applyTheme" ], [ "", "keepAlive" ], [ "", "bootRescan" ], [ "", "setTimeout" ] ], "mbr": [ "Array.from", "CSS.escape", "JSON.parse", "JSON.stringify", "Math.max", "Math.min", "banner.hidden", "bannerText.textContent", "chrome.devtools", "chrome.devtools.inspectedWindow", "chrome.devtools.inspectedWindow.eval", "chrome.devtools.network", "chrome.devtools.network.onNavigated", "chrome.devtools.network.onNavigated.addListener", "clearFocusBtn.addEventListener", "clearFocusBtn.disabled", "collapseAllBtn.addEventListener", "collapsedSet.add", "collapsedSet.delete", "console.debug", "cur.classList", "cur.classList.add", "currentBase().roots", "currentBase().roots.forEach", "darkModeCk.addEventListener", "darkModeCk.checked", "data.instancePreview", "detailsEl.innerHTML", "dividerEl.addEventListener", "dividerEl.setPointerCapture", "document.body", "document.body.classList", "document.body.classList.contains", "document.body.classList.toggle", "document.documentElement", "document.documentElement.style", "document.documentElement.style.setProperty", "document.querySelector", "e.clientX", "e.key", "e.pointerId", "e.preventDefault", "el.classList", "el.classList.add", "el.classList.remove", "el.scrollIntoView", "expandAllBtn.addEventListener", "filterEl.addEventListener", "filterEl.value", "focusBtn.addEventListener", "getComputedStyle().getPropertyValue", "lastSnapshotByPath.get", "lastSnapshotByPath.set", "layoutEl.clientWidth", "li.addEventListener", "li.dataset", "li.dataset.kind", "li.dataset.path", "liveDiff.addEventListener", "liveDiff.checked", "localStorage.getItem", "localStorage.removeItem", "localStorage.setItem", "n.children", "n.path", "node.kind", "prev.instancePreview", "r.expand", "r.matches", "refreshBtn.addEventListener", "res.length", "resetBtn.addEventListener", "result.total", "selectBtn.addEventListener", "selectBtn.classList", "selectBtn.classList.add", "selectBtn.classList.remove", "selectBtn.textContent", "showDomNodesCk.addEventListener", "showDomNodesCk.checked", "statusEl.textContent", "summaryEl.innerHTML", "t.roots", "toggleDetailsBtn.addEventListener", "toggleDetailsBtn.textContent", "treeEl.appendChild", "treeEl.innerHTML", "treeEl.querySelector", "treeEl.querySelectorAll", "treeEl.querySelectorAll().forEach", "window.ARUI", "window.ARUI.buildTreeDOM", "window.ARUI.computeDiff", "window.ARUI.computeMatches", "window.ARUI.findFirstMatchRoot", "window.ARUI.getSubtreeFromPath", "window.ARUI.keyFromPath", "window.ARUI.renderDetailsHTML", "window.ARUI.renderSummaryHTML", "window.addEventListener" ], "tgt": [ "$", "Array.from", "CSS.escape", "JSON.parse", "JSON.stringify", "Map", "Math.max", "Math.min", "Promise", "Set", "String", "applyFilter", "applySidebarWidth", "applyTheme", "bootRescan", "buildAndRender", "chrome.devtools.inspectedWindow.eval", "chrome.devtools.network.onNavigated.addListener", "clearFocusBtn.addEventListener", "clearInterval", "collapseAllBtn.addEventListener", "collapsedSet.add", "collapsedSet.delete", "console.debug", "cur.classList.add", "currentBase", "currentBase().roots.forEach", "darkModeCk.addEventListener", "dividerEl.addEventListener", "dividerEl.setPointerCapture", "document.body.classList.contains", "document.body.classList.toggle", "document.documentElement.style.setProperty", "document.querySelector", "e.preventDefault", "el.classList.add", "el.classList.remove", "el.scrollIntoView", "ensureSelectedOverlay", "expandAllBtn.addEventListener", "filterEl.addEventListener", "focusBtn.addEventListener", "getComputedStyle", "getComputedStyle().getPropertyValue", "getDetailsKey", "getFocusKey", "getSidebarKey", "getStorageKey", "getThemeKey", "highlight", "installProbeInline", "installRouteWatcherInline", "keepAlive", "lastSnapshotByPath.get", "lastSnapshotByPath.set", "li.addEventListener", "liveDiff.addEventListener", "loadCollapsed", "loadDetails", "localStorage.getItem", "localStorage.removeItem", "localStorage.setItem", "parseInt", "persistDetailsHidden", "persistSidebarWidth", "persistTheme", "refresh", "refreshBtn.addEventListener", "render", "res", "resetBtn.addEventListener", "resolve", "resolvePageKey", "restoreDetailsHidden", "restoreSidebarWidth", "restoreViewTree", "saveCollapsed", "scrollIntoViewIfNeeded", "selectBtn.addEventListener", "selectBtn.classList.add", "selectBtn.classList.remove", "setInterval", "setTimeout", "setViewTree", "setupDivider", "showDomNodesCk.addEventListener", "startDiff", "startSelecting", "status", "stopDiff", "stopSelecting", "toggleDetailsBtn.addEventListener", "treeEl.appendChild", "treeEl.querySelector", "treeEl.querySelectorAll", "treeEl.querySelectorAll().forEach", "unhighlight", "updateActiveHover", "updateActiveSelection", "window.ARUI.buildTreeDOM", "window.ARUI.computeDiff", "window.ARUI.computeMatches", "window.ARUI.findFirstMatchRoot", "window.ARUI.getSubtreeFromPath", "window.ARUI.keyFromPath", "window.ARUI.renderDetailsHTML", "window.ARUI.renderSummaryHTML", "window.addEventListener" ], "metrics": { "ast": { "op.eq": 7.0, "op.gt": 2.0, "op.le": 1.0, "op.ne": 5.0, "op.add": 26.0, "op.lor": 14.0, "op.sub": 3.0, "op.land": 15.0, "op.lnot": 16.0, "max_depth": 29.0, "bind_count": 155.0, "call_count": 280.0, "node_count": 6099.0, "member_count": 100.0, "op_density.eq": 0.0, "op_density.gt": 0.0, "op_density.le": 0.0, "op_density.ne": 0.0, "op_density.add": 0.0, "op_density.lor": 0.0, "op_density.sub": 0.0, "op_density.land": 0.0, "op_density.lnot": 0.0, "identifier_count": 217.0, "member_depth_max": 5.0, "string_literal_count": 135.0, "string_concat_chain_max_length": 5.0 }, "file": { "size": 28787.0, "entropy": 5.26, "size_bytes": 28787.0 }, "text": { "tab_count": 1459.0, "digit_ratio": 0.01, "space_count": 2062.0, "total_lines": 758.0, "char_entropy": 5.26, "mixed_indent": 1.0, "unique_chars": 93.0, "lines_over_200": 12.0, "lines_over_500": 4.0, "string_density": 0.18, "avg_line_length": 36.98, "high_byte_ratio": 0.0, "lines_over_1000": 1.0, "max_line_length": 1405.0, "non_ascii_ratio": 0.0, "empty_line_ratio": 0.05, "last_line_length": 5.0, "long_token_count": 20.0, "whitespace_ratio": 0.15, "most_common_ratio": 0.08, "identifier_density": 1.31, "line_length_stddev": 81.33, "normalized_string_count": 4.9, "repeated_char_sequences": 6.0, "suspicious_string_ratio": 0.07, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "trailing_whitespace_lines": 9.0, "most_common_char_codepoint": 101.0, "suspicious_identifier_ratio": 0.05, "normalized_unique_identifiers": 22.68 }, "binds": { "count": 155.0 }, "calls": { "count": 280.0 }, "binary": { "overall_entropy": 5.26, "peak_region_bytes": 26624.0, "peak_region_entropy": 5.35 }, "source": { "function_count": 43.0 }, "members": { "count": 100.0 }, "strings": { "total": 135.0, "avg_length": 98.15, "max_length": 10083.0, "avg_entropy": 2.82, "empty_count": 5.0, "sql_strings": 1.0, "total_bytes": 13250.0, "entropy_stddev": 1.01, "very_long_strings": 2.0, "high_entropy_count": 2.0, "embedded_code_candidates": 8.0 }, "comments": { "chars": 211.0, "lines": 7.0, "total": 7.0, "to_code_ratio": 0.01 }, "functions": { "count": 43.0, "anonymous": 50.0, "avg_params": 0.43, "max_params": 2.0, "one_liners": 12.0, "length_stddev": 76.94, "over_100_lines": 1.0, "over_500_lines": 1.0, "avg_name_length": 13.69, "no_params_count": 60.0, "avg_length_lines": 17.0, "max_length_lines": 758.0, "min_length_lines": 1.0, "nested_functions": 28.0, "avg_nesting_depth": 1.47, "max_nesting_depth": 3.0, "high_entropy_names": 7.0, "single_char_params": 17.0, "avg_param_name_length": 2.73, "density_per_100_lines": 12.53, "code_in_functions_ratio": 2.13 }, "identifiers": { "count": 217.0, "total": 991.0, "avg_length": 8.89, "max_length": 25.0, "min_length": 1.0, "avg_entropy": 2.51, "reuse_ratio": 0.22, "unique_count": 217.0, "length_stddev": 4.98, "sequential_names": 10.0, "single_char_count": 12.0, "single_char_ratio": 0.06, "high_entropy_count": 13.0, "high_entropy_ratio": 0.06, "all_lowercase_ratio": 0.39, "all_uppercase_ratio": 0.02, "underscore_prefix_count": 2.0 } } }, "id": 1, "mol": "H₃(DbPoU)", "path": "kgpbgfjgjanmdcoefmofbmlhhkmeipng.crx!!panel.js", "pid": 0, "risk": 3, "sha": "b0346d5e3379b40c0999b77e64fcfd7779714e608768256e950c3e2b273b9e8b", "size": 28787, "traits": [ { "id": "micro-behaviors/time/schedule/interval::setTimeout", "crit": 2, "desc": "Schedules a JavaScript callback with setTimeout", "spans": [ [ 22122, 10 ] ] }, { "id": "micro-behaviors/data/db/web-storage::dom-localstorage", "conf": 0.8999999761581421, "crit": 2, "desc": "Web Storage localStorage access", "spans": [ [ 1736, 13 ] ] }, { "id": "metadata/package/error-handling::try-block-open", "crit": 2, "desc": "try block opening", "spans": [ [ 14486, 14 ], [ 19002, 87 ], [ 19651, 96 ], [ 21758, 128 ] ] }, { "id": "micro-behaviors/data/db/web-storage::dom-storage-getitem", "conf": 0.8999999761581421, "crit": 3, "desc": "Browser storage getItem call", "spans": [ [ 1736, 20 ] ] }, { "id": "metadata/package/error-handling::catch-keyword", "crit": 2, "desc": "catch handler keyword", "spans": [ [ 14596, 5 ] ] }, { "id": "micro-behaviors/data/db/web-storage::dom-storage-setitem", "conf": 0.8999999761581421, "crit": 3, "desc": "Browser storage setItem call", "spans": [ [ 1921, 20 ] ] }, { "id": "micro-behaviors/ui/window/manage/dom::dom-element-value-read", "conf": 0.8999999761581421, "crit": 2, "desc": "Reads the value of a DOM element", "spans": [ [ 23378, 6 ] ] }, { "id": "micro-behaviors/ui/window/manage/dom::dom-element-lookup--queryselector", "conf": 0.8999999761581421, "crit": 2, "desc": "Looks up a DOM element with querySelector", "spans": [ [ 57, 13 ] ] }, { "id": "micro-behaviors/process/interpreter/eval::js-member-eval-call", "atk": "T1059.007", "conf": 0.8999999761581421, "crit": 3, "desc": "JavaScript member eval call", "spans": [ [ 4067, 6 ] ] }, { "id": "micro-behaviors/ui/window/manage/dom::browser-innerhtml-assignment", "conf": 0.800000011920929, "crit": 3, "desc": "Writes HTML into the DOM with innerHTML", "spans": [ [ 16392, 12 ] ] }, { "id": "micro-behaviors/data/db/web-storage::browser-storage-persistence", "conf": 0.800000011920929, "crit": 3, "desc": "Persists data in browser storage", "spans": [ [ 1736, 20 ], [ 1921, 20 ] ] } ], "type": "javascript" }, { "ctx": [ { "b": "l2HsTy*?u#vpQIuFrRfxzFa9dvr9FUwP?3\u003ez!%FqnP5P*wN/?2AV=+#wP?3\u003ez!%Fqp*[lMy:/", "n": [ { "c": 1, "d": "Document or config file extension", "i": "metadata/file/extension/identity::doc-or-config-extension", "o": 0, "z": 9, "cf": 1.0 } ], "ln": 1, "addr": 0 }, { "b": "", "ln": 2, "addr": 60 }, { "b": "l2HsTy*?u#vpQG{B0a)llUHHUzdK?TwP?3\u003ez!%FqAa9S}y-)?razC.mAaJK3avf)TB.\u003eGbay/tbAbPS9zGE1mx\u003eqr[A:@=%wPF#5BrCQDzGGPfwIb8%BrCmdy\u0026BCrD2E*FwQ5fgz/PziBzbkdv@Dj6z/fc7BrCWCwO0znC4\u003eJiazC.mByx5%wGU@jwP?^0CxkqTBAg/1yANOpz/u?fx\u003ey%#aA8BmAV/ErzdLmvvqYP#v@DydwO+^%wGT#Aaz2w2zdNQbB0bWvBz8!sxK$)#ayX+?yIvW0ay/tbAbPS9zGG}L", "n": [ { "c": 2, "d": "Contains frequent English function words", "i": "metadata/file/profile/language::lang-english", "o": 174, "z": 3, "cf": 0.800000011920929 } ], "ln": 3, "addr": 62 }, { "b": "", "ln": 4, "addr": 304 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 3645.0, "entropy": 4.74, "size_bytes": 3645.0 }, "text": { "digit_ratio": 0.0, "space_count": 514.0, "total_lines": 84.0, "char_entropy": 4.74, "unique_chars": 74.0, "lines_over_200": 1.0, "avg_line_length": 41.39, "high_byte_ratio": 0.01, "max_line_length": 240.0, "non_ascii_ratio": 0.01, "empty_line_ratio": 0.24, "last_line_length": 3.0, "whitespace_ratio": 0.19, "most_common_ratio": 0.1, "line_length_stddev": 38.13, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 101.0 }, "binary": { "overall_entropy": 4.74, "peak_region_bytes": 3645.0, "peak_region_entropy": 4.78 } } }, "id": 2, "path": "kgpbgfjgjanmdcoefmofbmlhhkmeipng.crx!!README.md", "pid": 0, "risk": 1, "sha": "9e2b2ee8fea2662e1e5ecd566117d0d3ac43b9a6126975692e7de31c87a9344e", "size": 3645, "traits": [ { "id": "metadata/file/extension/identity::markdown-file-basename", "conf": 1.0, "crit": 1, "desc": "Markdown document file extension", "spans": [ [ 0, 9 ] ] }, { "id": "metadata/file/extension/identity::doc-or-config-extension", "conf": 1.0, "crit": 1, "desc": "Document or config file extension", "spans": [ [ 0, 9 ] ] }, { "id": "metadata/file/profile/language::lang-english", "conf": 0.800000011920929, "crit": 2, "desc": "Contains frequent English function words", "spans": [ [ 174, 3 ] ] } ], "type": "markdown" }, { "ctx": [ { "b": "c$WQtv@#B6zxHuudiJ%", "n": [ { "c": 2, "d": "Any script file", "i": "metadata/file/extension/identity::script-file", "o": 0, "z": 5, "cf": 1.0 } ], "ln": 1, "addr": 0 }, { "b": "31!r$v@#B6zxJ.aC$8*)zbsU.xEE*GaBs", "ln": 2, "addr": 16 }, { "b": "2)\u003eS-BAIRwawbNdpa*QfA+PA7x\u003ezSsA49\u003c", "n": [ { "c": 2, "d": "Object serialization methods", "i": "objectives/discovery/system/fingerprint/runtime::object-serialization", "o": 52, "z": 14, "cf": 1.0 } ], "ln": 3, "addr": 43 }, { "b": "34h", "ln": 4, "addr": 71 }, { "b": "31!r$v@#B6zxJw9v}x.6z/OV.Bzb.\u003ew*?QEaBs", "ln": 5, "addr": 74 }, { "b": "2)\u003e9WzGx[xz/{dAjS)%mi@", "ln": 6, "addr": 105 }, { "b": "2)\u003eiZAV==DwPP5eauZ\u00264j0nkWjrOO}y?mG%Bz9-Ux!7X.aBs", "n": [ { "c": 2, "d": "Iteration or loop pattern", "i": "micro-behaviors/data/control-flow/analysis::iteration-loop-pattern", "o": 124, "z": 6, "cf": 0.5 }, { "c": 1, "d": "JavaScript length property", "i": "metadata/lang/scripted::length-prop", "o": 147, "z": 6, "cf": 1.0 } ], "ln": 7, "addr": 123 }, { "b": "2)*]RB-YlPB-RjAn(FIXe]#bPx(mM$w{C!ze]$\u0026yv}v5xefFTQdjEs", "ln": 8, "addr": 162 }, { "b": "2)(1", "ln": 9, "addr": 206 }, { "b": "2)\u003eS-BAIRwaBs", "ln": 26, "addr": 732 }, { "b": "2)*]QvqPNpaz@/HvqPNb", "ln": 27, "addr": 743 }, { "b": "2)*]LzE^s6iV@q)x(mD)CQ@", "n": [ { "c": 1, "d": "Runtime identity query fields", "i": "objectives/exfiltration/stealer/host-profile/http::identity-query-runtime", "o": 777, "z": 10, "cf": 0.8999999761581421 } ], "ln": 28, "addr": 760 }, { "b": "2)*]Svrufzaz@/Jvrufl", "ln": 29, "addr": 779 }, { "b": "2)*]FxLzo[A+fbHasIaWv}YN)wo8m0aBFLVtu@Wgzddxiv@c73wM9.XBAg@7dj+", "ln": 30, "addr": 796 }, { "b": "31!r$v@#B6zxJL9zE=jJA=Vs%vru0)qG3F}c$D+dvjSKvdiJ%", "ln": 33, "addr": 855 }, { "b": "2)\u003eO]jS)WBA+PA7c#*wSD(%^:dk2ZXoMbb^AZKnRwHF#?", "ln": 34, "addr": 895 }, { "b": "2)\u003eAVBrCmhBrAZ?zGP=ii@", "n": [ { "c": 1, "d": "Plain JavaScript identifier assignment", "i": "metadata/lang/scripted::plain-js-identifier-assignment", "o": 938, "z": 11, "cf": 1.0 } ], "ln": 35, "addr": 932 }, { "b": "2)\u003ei^zEW^5z/cXwvqGZczyDYP", "ln": 36, "addr": 950 }, { "b": "2)*]Lw/@Hnx(\u003e^DA+funA=9@", "ln": 37, "addr": 971 }, { "b": "2)*[Ae{829z*b=klT+4Ec[b", "ln": 39, "addr": 1026 }, { "b": "2)*[Ae[]iky\u0026%o1B0#2Si@", "n": [ { "c": 2, "d": "JavaScript substring search call", "i": "micro-behaviors/data/string/search::js-includes-indexof-call", "o": 1050, "z": 9, "cf": 0.8199999928474426 } ], "ln": 40, "addr": 1045 }, { "b": "2)*]Lw/@HuyBHxtx(\u003eEXaz%m", "ln": 41, "addr": 1063 }, { "b": "2)*]Hy\u0026:egc#HUExLzo[A+fbhE0^5vt}4yrz/OoPv}WomvqGZdi@", "ln": 42, "addr": 1083 }, { "b": "2)(1", "ln": 43, "addr": 1125 }, { "b": "2)\u003erTasFyzvrt{2E0^4WwmoN*e]\u003e(GBAn(NA+funA=91qB.\u003e\u003eQ", "n": [ { "c": 1, "d": "Collects identity data for DNS label", "i": "objectives/exfiltration/side-channel/dns::identity-data-dns-array", "o": 1145, "z": 10, "cf": 0.9599999785423279 } ], "ln": 44, "addr": 1129 }, { "b": "2)\u003ecJByu!xz/o-se[P3xmpxXtd0G9oyBIs", "ln": 45, "addr": 1170 }, { "b": "2)\u003eS-BAIRwaztFh", "ln": 46, "addr": 1198 }, { "b": "2)\u003e9WzGx[xz/eJ)xj(3(auZ\u0026=Ac9ZJzD7K!xkzc4E0^5GB-7Yhx(v(ic[co=Eld", "ln": 55, "addr": 1489 }, { "b": "2)\u003e9WzGx[xz/eG+y?m9#auZ\u0026=Ac9ZJzC$a.wN/*8E0^5GB-7Yhx(v(ic[co=Eld", "ln": 56, "addr": 1540 }, { "b": "2)\u003e9WzGx[xB.\u0026f-ay]z2B.$YcBs}6zwNPW(mqMKLwO#PrcV%kMdlv", "n": [ { "c": 1, "d": "JavaScript calls document.createElement", "i": "objectives/command-and-control/dropper/execution/browser::dom-createelement-symbol", "o": 1604, "z": 22, "cf": 0.800000011920929 } ], "ln": 57, "addr": 1591 }, { "b": "2)\u003e-\u003ce[nZaB8$8+zdK?MasznKwO0kJ", "ln": 58, "addr": 1634 }, { "b": "2)\u003erTasFyzvrt{2E0^4WwmoN*e]\u003e(GBAnNLD(%Oyvrt{gA=k(rB1RouzFa68diJ%", "ln": 59, "addr": 1659 }, { "b": "2)*]Fz/fSraz+:mjS[oNv%8T1zGEHvA+eW3wKQADzdNQbc)@?BcN?a", "ln": 60, "addr": 1711 }, { "b": "2)*]Ox!BHsCYVq\u003ezGGDcBrAZ?cR!O5v@Dj6z/fc7BAnNpz/]@dcP.", "n": [ { "c": 1, "d": "DOM script content sink", "i": "objectives/command-and-control/dropper/execution/browser::dom-script-content-sink", "o": 1760, "z": 14, "cf": 0.8500000238418579 } ], "ln": 61, "addr": 1755 }, { "b": "2)*]Xy+xdnAaJ]$lUHgIwghnddlv", "n": [ { "c": 1, "d": "Appends child DOM node", "i": "micro-behaviors/ui/window/manage/dom::browser-append-child", "o": 1803, "z": 13, "cf": 0.800000011920929 } ], "ln": 62, "addr": 1798 }, { "b": "2)*]UwPS6nzxK7ri@", "ln": 63, "addr": 1821 }, { "b": "2)(1", "ln": 64, "addr": 1835 }, { "b": "2)*]WCwhbuC}JPyvrlG+vqPM#jS(a]CwhbuC{+V", "ln": 74, "addr": 2206 }, { "b": "2)*]Fz/fSraz+E}wO-FLay]z2B.$YcBs}6zwNPW(mqMKLwO#PrcV:lnzyl\u003e{", "ln": 75, "addr": 2238 }, { "b": "2)*]OvpA!:e[nZaB8$8+zdK?MasySbwm]E3as!M.zF%5%e]bfswfs2#jS(a.z/3\u003cAkoIr@vQS!WwI4Chz6{C!aswJ=i@", "n": [ { "c": 1, "d": "String literal equality or membership check", "i": "micro-behaviors/data/control-flow/analysis::string-literal-equality-check", "o": 2330, "z": 8, "cf": 0.9200000166893005 } ], "ln": 76, "addr": 2287 }, { "b": "2)*]OvpA!:e{7VHBvf$:By/uiauY", "ln": 77, "addr": 2361 }, { "b": "2)*[Ac#J%lwId+jzE:\u003eMjV%]nwn=rjau{$@cM\u003eC)cNQt=d/", "ln": 78, "addr": 2384 }, { "b": "2)*]WCwhbuC}KhICYVq\u003ezGGDcBrAZ?x(=TWy\u00260K0B7F(8koIukMBFp+iV]*fMCa.d", "ln": 88, "addr": 2734 }, { "b": "2)*]Lw/@HoB3\u003c\u003eZy*?p7wN)kjDJ", "ln": 89, "addr": 2787 }, { "b": "2)*[Av}YN)wo8m0s8}.*e]#bWy?kkfx(!lfvr\u0026$Uasz5BzE\u003egS", "n": [ { "c": 1, "d": "Hides element with display none", "i": "micro-behaviors/data/format/html::display-none-style", "o": 2826, "z": 22, "cf": 0.8799999952316284 } ], "ln": 90, "addr": 2809 }, { "b": "2)*]^", "ln": 91, "addr": 2850 }, { "b": "2)*]WCwhbuC}JJowjpVMzGFM^B97#hwPxgDv@b\u003c?yBpUQc$K?IjW70n", "n": [ { "c": 1, "d": "Click analytics event token", "i": "micro-behaviors/communications/http/services/analytics::click-event-token", "o": 2883, "z": 5, "cf": 0.8600000143051147 } ], "ln": 92, "addr": 2855 }, { "b": "2)*[AwIe4Cz/wJ[z/xb$vruj4zyu}}", "ln": 93, "addr": 2900 }, { "b": "2)*[Ax(=TWy\u00260K0B7F(8jS\u003e[ZB3\u003c\u003eZy*?p7wN)\u003e", "ln": 94, "addr": 2925 }, { "b": "2)\u003e9WzGx[xAb](oB09Q*n(FIXe]#bPx(mM$w{C!szF0/tx(n0lvqYN^p\u0026Zb\u003cx\u003eqGtaz#sry+cX:dlv", "ln": 121, "addr": 3788 }, { "b": "2)\u003eAVBrCgiz*9r!aswJ#", "ln": 122, "addr": 3851 }, { "b": "2)\u003erTasH@ww]xqjvrt{Ey\u0026sI/B.bSnwPF$vclN2uw]xqjvrt{Ey\u0026sI/B.bSnwPGFuwO#d5xEL6J", "ln": 123, "addr": 3868 }, { "b": "2)*]Iy\u0026sIujS[DRw]xqjvrt{Ey\u0026sI/B.bSnwPE", "n": [ { "c": 3, "d": "Joins array values without separator", "i": "micro-behaviors/data/string/concat::array-join-empty-separator", "o": 3939, "z": 31, "cf": 0.800000011920929 } ], "ln": 124, "addr": 3929 }, { "b": "2)*[Ae]t3oc[5RrdiH=qaBs", "ln": 125, "addr": 3960 }, { "b": "2)*[A31E)\u003eB95KwauZ\u0026Tw?E}eAbYJexla", "ln": 126, "addr": 3979 }, { "b": "2)*[A2)\u0026k3vq)Q", "ln": 127, "addr": 4006 }, { "b": "2)*[A2)*[^CQT:#j%k85v}YN)wkEq+A3cUNcM}A6Krt[[d\u003cf6?Aa9=#zGFY}z/u*HaswoWcM\u003c]ZCRiMEBZY8MC{1QWcN*z", "ln": 128, "addr": 4018 }, { "b": "2)*[A2)\u00263", "ln": 129, "addr": 4094 }, { "b": "2)*[A2)\u0026k0z!T8qcTpKpdlv", "n": [ { "c": 2, "d": "Generic file read/write operations", "i": "micro-behaviors/fs/file/read-write::binary-file-ops", "o": 4109, "z": 5, "cf": 0.800000011920929 } ], "ln": 130, "addr": 4102 }, { "b": "2)*[A336Q0B-Ivxc\u0026", "ln": 131, "addr": 4121 }, { "b": "2)*[A2)?$wwnciJjACQ+z/fhKcM\u003c]", "ln": 132, "addr": 4135 }, { "b": "2)*[A2}m}", "ln": 137, "addr": 4277 }, { "b": "2)*[AEjk", "ln": 138, "addr": 4285 }, { "b": "2)*[Ae]2rszyu\u003eWdlv", "n": [ { "c": 1, "d": "Join using empty string delimiter", "i": "objectives/anti-static/obfuscation/string/encoding::js-array-join-symbol", "o": 4296, "z": 9, "cf": 0.5 } ], "ln": 139, "addr": 4292 }, { "b": "2)(25wO=B0aBs", "ln": 140, "addr": 4307 }, { "b": "2)*]Iy\u0026sIujP", "ln": 141, "addr": 4318 }, { "b": "2)\u003eAVBrCadw[BOQzepsTaswJ#", "ln": 144, "addr": 4416 }, { "b": "2)\u003erTasH=mw[AejclM\u0026kw[AViwO#d5xEL6J", "ln": 145, "addr": 4437 }, { "b": "2)*]Fz/fSraz+R3BrAZ?wnbT/e]t3oc[5QPau.[hwg?UeC{1QWcPSv$as!NBe[ey7z/Pzre]2rszyu(qzyl\u003e{", "n": [ { "c": 1, "d": "Find command key filename filters", "i": "objectives/exfiltration/stealer/credential/multi-source::node-find-key-filenames", "o": 4499, "z": 4, "cf": 0.8999999761581421 } ], "ln": 146, "addr": 4466 }, { "b": "2)*]Fz/fSraAzgexMLvWay]g#w?E}eA40bBdiH=qay)9uwQbyGasxh)cM\u003c]Zwg?q5By/Fwe]2rszyu(qzyl\u003e{", "ln": 147, "addr": 4535 }, { "b": "2)*]Gx\u003ey%FBzU?pjP", "ln": 148, "addr": 4604 }, { "b": "2)*]WA^n^O", "ln": 209, "addr": 6486 }, { "b": "2)*[Av@DmaBrCJBjS)u}pFJJYvrcB2c#gm[", "n": [ { "c": 2, "d": "JSON.parse call", "i": "micro-behaviors/data/serialize/json::json-parse-call", "o": 6509, "z": 10, "cf": 0.5 } ], "ln": 210, "addr": 6495 }, { "b": "2)*[AvqYN^B98tvp*[DVB5cx@A49zKz/OoPv}WnsvjrrZj%jAYAa9S{e[5p3c$aLNi@", "ln": 211, "addr": 6524 }, { "b": "2)*]^ay!\u00264v}V#kwHO:GEe", "n": [ { "c": 1, "d": "Top-level try/catch empty handler", "i": "objectives/supply-chain/install-hook/dropper/obfuscation::top-level-try-catch-empty", "o": 6583, "z": 12, "cf": 0.699999988079071 } ], "ln": 212, "addr": 6578 }, { "b": "2)(1", "ln": 213, "addr": 6596 }, { "b": "2)\u003eV:Bs}fzAZ:zDxEEq1wi\u003e9ydlv", "ln": 214, "addr": 6600 }, { "b": "2)\u003e9Wze:StwKHlAw?i", "ln": 241, "addr": 7191 }, { "b": "34j(", "ln": 242, "addr": 7206 }, { "b": "329#]d0f-NwP8f6zeS%cy?j.jjV%]nB-7-3w[=c]wg5/GDJ", "n": [ { "c": 2, "d": "Compares value against the undefined string", "i": "micro-behaviors/data/control-flow/analysis::js-undefined-string-compare", "o": 7230, "z": 14, "cf": 0.6000000238418579 } ], "ln": 243, "addr": 7210 }, { "b": "2)\u003eD!wozZ1e[GoDz/P@vauZ\u0026We\u003cSxnnJM", "n": [ { "c": 1, "d": "JS module export syntax", "i": "metadata/lang/scripted::js-export-boundary", "o": 7250, "z": 14, "cf": 0.5 } ], "ln": 244, "addr": 7248 }, { "b": "34h", "ln": 245, "addr": 7275 }, { "b": "EjlN^D2Ntkw/#qizE^Wfar-)haszqHwmYv!zE)uaau{#)x(mE1Cow{?DWNt8", "n": [ { "c": 2, "d": "Checks for browser window global", "i": "micro-behaviors/os/sysinfo/platform/browser::browser-window-presence-check", "o": 7281, "z": 29, "cf": 0.800000011920929 } ], "ln": 246, "addr": 7278 }, { "b": "", "ln": 247, "addr": 7327 } ], "depth": 1, "facts": { "imp": [ [ "", "JSON.stringify" ], [ "", "out" ], [ "", "out.push" ], [ "", "JSON.stringify" ], [ "", "p.slice" ], [ "", "String.toLowerCase" ], [ "", "String" ], [ "", "hit" ], [ "", "ok" ], [ "", "String.toLowerCase.includes" ], [ "", "String.toLowerCase" ], [ "", "String" ], [ "", "hit" ], [ "", "data.roots.forEach" ], [ "", "cloneSubtree" ], [ "", "opt" ], [ "", "collapsed" ], [ "", "matches" ], [ "", "autoExpand" ], [ "", "onToggle" ], [ "", "onSelect" ], [ "", "ul" ], [ "", "document.createElement" ], [ "", "ul.className" ], [ "", "li" ], [ "", "document.createElement" ], [ "", "li.textContent" ], [ "", "ul.appendChild" ], [ "", "li" ], [ "", "document.createElement" ], [ "", "keyFromPath" ], [ "", "li.className" ], [ "", "matches.has" ], [ "", "li.dataset.path" ], [ "", "li.dataset.kind" ], [ "", "row" ], [ "", "document.createElement" ], [ "", "row.className" ], [ "", "twisty" ], [ "", "document.createElement" ], [ "", "twisty.className" ], [ "", "label" ], [ "", "document.createElement" ], [ "", "label.className" ], [ "", "label.textContent" ], [ "", "childrenWrap" ], [ "", "document.createElement" ], [ "", "childrenWrap.className" ], [ "", "node.children.forEach" ], [ "", "childrenWrap.appendChild" ], [ "", "nodeEl" ], [ "", "isCollapsed" ], [ "", "collapsed.has" ], [ "", "autoExpand.has" ], [ "", "twisty.textContent" ], [ "", "childrenWrap.style.display" ], [ "", "twisty.addEventListener" ], [ "", "e.stopPropagation" ], [ "", "isCollapsed" ], [ "", "childrenWrap.style.display" ], [ "", "twisty.textContent" ], [ "", "onToggle" ], [ "", "row.addEventListener" ], [ "", "e.stopPropagation" ], [ "", "onSelect" ], [ "", "row.addEventListener" ], [ "", "e.stopPropagation" ], [ "", "hidden" ], [ "", "childrenWrap.style.display" ], [ "", "twisty.textContent" ], [ "", "onToggle" ], [ "", "row.appendChild" ], [ "", "row.appendChild" ], [ "", "li.appendChild" ], [ "", "li.appendChild" ], [ "", "data.roots.forEach" ], [ "", "ul.appendChild" ], [ "", "nodeEl" ], [ "", "props" ], [ "", "JSON.stringify" ], [ "", "flow" ], [ "", "flow" ], [ "", "info.dataFlowGuesses.map.join" ], [ "", "info.dataFlowGuesses.map" ], [ "", "df.mappings.map.join" ], [ "", "df.mappings.map" ], [ "", "flow" ], [ "", "diffHtml" ], [ "", "left" ], [ "", "diff.map.join" ], [ "", "diff.map" ], [ "", "right" ], [ "", "diff.map.join" ], [ "", "diff.map" ], [ "", "diffHtml" ], [ "", "JSON.stringify" ], [ "", "info.parentChain.map.join" ], [ "", "info.parentChain.map" ], [ "", "keys" ], [ "", "Object.keys" ], [ "", "Object.keys" ], [ "", "diffs" ], [ "", "keys.forEach" ], [ "", "sa" ], [ "", "JSON.stringify" ], [ "", "sb" ], [ "", "JSON.stringify" ], [ "", "diffs.push" ], [ "", "diffs.slice" ], [ "", "set" ], [ "", "String.toLowerCase" ], [ "", "String" ], [ "", "name" ], [ "", "String.toLowerCase" ], [ "", "String" ], [ "", "hit" ], [ "", "name.includes" ], [ "", "set.add" ], [ "", "keyFromPath" ], [ "", "data.roots.forEach" ], [ "", "expand" ], [ "", "JSON.parse" ], [ "", "ancestorPathsOf.forEach" ], [ "", "ancestorPathsOf" ], [ "", "expand.add" ], [ "", "set.forEach" ], [ "", "hit" ], [ "", "JSON.stringify" ], [ "", "hit" ], [ "", "data.roots.forEach" ], [ "", "cloneSubtree" ], [ "", "g.ARUI" ], [ "", "module.exports" ] ], "mbr": [ "JSON.parse", "JSON.stringify", "Object.keys", "String().toLowerCase", "String().toLowerCase().includes", "ancestorPathsOf().forEach", "autoExpand.has", "childrenWrap.appendChild", "childrenWrap.className", "childrenWrap.style", "childrenWrap.style.display", "collapsed.has", "d.after", "d.before", "d.key", "d.roots", "d.roots.length", "d.scanMs", "d.total", "data.roots", "data.roots.forEach", "data.roots.length", "data.scanMs", "df.childName", "df.mappings", "df.mappings.map", "df.mappings.map().join", "diff.length", "diff.map", "diff.map().join", "diffs.push", "diffs.slice", "document.createElement", "e.stopPropagation", "expand.add", "g.ARUI", "info.children", "info.children.length", "info.dataFlowGuesses", "info.dataFlowGuesses.length", "info.dataFlowGuesses.map", "info.dataFlowGuesses.map().join", "info.instancePreview", "info.name", "info.parentChain", "info.parentChain.map", "info.parentChain.map().join", "info.path", "keys.forEach", "label.className", "label.textContent", "li.appendChild", "li.className", "li.dataset", "li.dataset.kind", "li.dataset.path", "li.textContent", "matches.has", "module.exports", "n.children", "n.index", "n.name", "n.path", "name.includes", "node.children", "node.children.forEach", "node.children.length", "node.index", "node.kind", "node.name", "node.path", "opt.autoExpand", "opt.collapsed", "opt.matches", "opt.onSelect", "opt.onToggle", "out.push", "p.length", "p.name", "p.slice", "row.addEventListener", "row.appendChild", "row.className", "set.add", "set.forEach", "twisty.addEventListener", "twisty.className", "twisty.textContent", "ul.appendChild", "ul.className", "x.childProp", "x.equalBy", "x.parentProp" ], "tgt": [ "JSON.parse", "JSON.stringify", "Object.keys", "Set", "String", "String().toLowerCase", "String().toLowerCase().includes", "ancestorPathsOf", "ancestorPathsOf().forEach", "autoExpand.has", "childrenWrap.appendChild", "cloneSubtree", "collapsed.has", "data.roots.forEach", "df.mappings.map", "df.mappings.map().join", "diff.map", "diff.map().join", "diffs.push", "diffs.slice", "document.createElement", "e.stopPropagation", "expand.add", "info.dataFlowGuesses.map", "info.dataFlowGuesses.map().join", "info.parentChain.map", "info.parentChain.map().join", "keyFromPath", "keys.forEach", "li.appendChild", "matches.has", "name.includes", "node.children.forEach", "nodeEl", "onSelect", "onToggle", "out.push", "p.slice", "row.addEventListener", "row.appendChild", "set.add", "set.forEach", "twisty.addEventListener", "ul.appendChild" ], "metrics": { "ast": { "op.eq": 4.0, "op.lt": 1.0, "op.ne": 3.0, "op.add": 44.0, "op.lor": 26.0, "op.land": 3.0, "op.lnot": 18.0, "max_depth": 31.0, "bind_count": 64.0, "call_count": 89.0, "node_count": 2732.0, "member_count": 93.0, "op_density.eq": 0.0, "op_density.lt": 0.0, "op_density.ne": 0.0, "op_density.add": 0.02, "op_density.lor": 0.01, "op_density.land": 0.0, "op_density.lnot": 0.01, "identifier_count": 113.0, "member_depth_max": 4.0, "string_literal_count": 82.0, "array_literal_max_length": 2.0, "string_concat_chain_max_length": 15.0 }, "file": { "size": 7327.0, "entropy": 5.22, "size_bytes": 7327.0 }, "text": { "tab_count": 686.0, "digit_ratio": 0.0, "space_count": 589.0, "total_lines": 246.0, "char_entropy": 5.22, "unique_chars": 87.0, "string_density": 0.33, "avg_line_length": 28.78, "high_byte_ratio": 0.0, "max_line_length": 172.0, "non_ascii_ratio": 0.0, "empty_line_ratio": 0.0, "last_line_length": 48.0, "whitespace_ratio": 0.21, "most_common_ratio": 0.05, "identifier_density": 2.11, "line_length_stddev": 22.85, "normalized_string_count": 5.23, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 2.0, "most_common_char_codepoint": 116.0, "suspicious_identifier_ratio": 0.12, "normalized_unique_identifiers": 14.23 }, "binds": { "count": 64.0 }, "calls": { "count": 89.0 }, "binary": { "overall_entropy": 5.22, "peak_region_bytes": 7327.0, "peak_region_entropy": 5.27 }, "source": { "function_count": 13.0 }, "members": { "count": 93.0 }, "strings": { "total": 82.0, "avg_length": 15.78, "max_length": 159.0, "avg_entropy": 2.4, "empty_count": 15.0, "total_bytes": 1294.0, "entropy_stddev": 1.21 }, "functions": { "count": 13.0, "anonymous": 15.0, "avg_params": 1.13, "max_params": 2.0, "one_liners": 9.0, "length_stddev": 45.07, "over_100_lines": 1.0, "avg_name_length": 11.27, "no_params_count": 2.0, "avg_length_lines": 20.17, "max_length_lines": 246.0, "min_length_lines": 1.0, "nested_functions": 10.0, "avg_nesting_depth": 1.8, "max_nesting_depth": 3.0, "high_entropy_names": 5.0, "single_char_params": 21.0, "avg_param_name_length": 2.35, "density_per_100_lines": 12.2, "code_in_functions_ratio": 2.46 }, "identifiers": { "count": 113.0, "total": 518.0, "avg_length": 6.35, "max_length": 18.0, "min_length": 1.0, "avg_entropy": 2.11, "reuse_ratio": 0.22, "unique_count": 113.0, "length_stddev": 4.27, "sequential_names": 14.0, "single_char_count": 14.0, "single_char_ratio": 0.12, "high_entropy_count": 5.0, "high_entropy_ratio": 0.04, "all_lowercase_ratio": 0.63, "all_uppercase_ratio": 0.02 } } }, "id": 3, "path": "kgpbgfjgjanmdcoefmofbmlhhkmeipng.crx!!ui.js", "pid": 0, "risk": 1, "sha": "f189ca57f2392039fe3dae2824b4d6a89b1c1f135616c42d1cc041f64df10631", "size": 7327, "traits": [ { "id": "micro-behaviors/data/string/search::js-includes-indexof-call", "conf": 0.8199999928474426, "crit": 2, "desc": "JavaScript substring search call", "spans": [ [ 1050, 9 ] ] }, { "id": "metadata/file/profile/identity::sequential-identifiers", "conf": 0.800000011920929, "crit": 2, "desc": "Sequential source identifier names", "spans": [ [ 0, 36 ] ] }, { "id": "metadata/lang/source::js-ts-source-basename", "conf": 0.949999988079071, "crit": 2, "desc": "JavaScript or TypeScript source filename", "spans": [ [ 0, 5 ] ] } ], "type": "javascript" }, { "id": 4, "sha": "cf6ae53578a6974ccc3c6353f44f74b2031a554599eb06f588f013044c9f9b09", "path": "kgpbgfjgjanmdcoefmofbmlhhkmeipng.crx!!icons/angulariad-128.png", "size": 18722, "type": "png", "depth": 1 }, { "id": 5, "sha": "e27ce09ba3aa7cb3b4103513863cc4f81dbb5aab547565085b534a99eee77d60", "path": "kgpbgfjgjanmdcoefmofbmlhhkmeipng.crx!!icons/angulariad-16.png", "size": 826, "type": "png", "depth": 1 }, { "id": 6, "sha": "20d08ce848b581a3cb2f4e7e3cbbc15a719b9d70f40bb8c39ad5cfac2f737804", "path": "kgpbgfjgjanmdcoefmofbmlhhkmeipng.crx!!icons/angulariad-48.png", "size": 3718, "type": "png", "depth": 1 }, { "ctx": [ { "b": "BAhTHDJ", "n": [ { "c": 2, "d": "Any script file", "i": "metadata/file/extension/identity::script-file", "o": 0, "z": 11, "cf": 1.0 } ], "ln": 1, "addr": 0 }, { "b": "31ET?z/65rwmY}az/oDke]UlpwO=Auv@=c?By=\u003c", "ln": 2, "addr": 6 }, { "b": "2)?$BzFa9dvrc6\u003cwg5]", "ln": 3, "addr": 38 }, { "b": "2}m}", "ln": 7, "addr": 116 }, { "b": "Eir3dByO#bc$K?IDJ", "ln": 8, "addr": 120 }, { "b": "31E)\u003eB8L(ae[G6zz/Nmqdlv", "n": [ { "c": 1, "d": "JavaScript console object", "i": "micro-behaviors/os/console/io::js-console-object", "o": 135, "z": 7, "cf": 1.0 } ], "ln": 9, "addr": 134 }, { "b": "Ee", "ln": 10, "addr": 153 }, { "b": "", "ln": 11, "addr": 155 } ], "depth": 1, "facts": { "imp": [ [ "", "chrome.devtools.panels.create" ], [ "", "console.error" ] ], "mbr": [ "chrome.devtools", "chrome.devtools.panels", "chrome.devtools.panels.create", "console.error" ], "tgt": [ "chrome.devtools.panels.create", "console.error" ], "metrics": { "ast": { "max_depth": 8.0, "call_count": 2.0, "node_count": 64.0, "member_count": 4.0, "identifier_count": 7.0, "member_depth_max": 4.0, "string_literal_count": 3.0 }, "file": { "size": 155.0, "entropy": 4.79, "size_bytes": 155.0 }, "text": { "tab_count": 11.0, "digit_ratio": 0.02, "space_count": 6.0, "total_lines": 10.0, "char_entropy": 4.79, "unique_chars": 35.0, "string_density": 0.3, "avg_line_length": 14.5, "max_line_length": 31.0, "last_line_length": 1.0, "whitespace_ratio": 0.17, "most_common_ratio": 0.06, "identifier_density": 0.8, "line_length_stddev": 9.36, "normalized_string_count": 0.95, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 101.0, "suspicious_identifier_ratio": 0.14, "normalized_unique_identifiers": 2.11 }, "calls": { "count": 2.0 }, "binary": { "overall_entropy": 4.79, "peak_region_bytes": 155.0, "peak_region_entropy": 4.79 }, "members": { "count": 4.0 }, "strings": { "total": 3.0, "avg_length": 14.33, "max_length": 23.0, "avg_entropy": 3.39, "total_bytes": 43.0, "entropy_stddev": 0.38 }, "functions": { "anonymous": 1.0, "one_liners": 1.0, "no_params_count": 1.0, "avg_length_lines": 1.0, "max_length_lines": 1.0, "min_length_lines": 1.0, "density_per_100_lines": 10.0, "code_in_functions_ratio": 0.1 }, "identifiers": { "count": 7.0, "total": 8.0, "avg_length": 5.57, "max_length": 8.0, "min_length": 1.0, "avg_entropy": 2.01, "reuse_ratio": 0.88, "unique_count": 7.0, "length_stddev": 2.06, "sequential_names": 1.0, "single_char_count": 1.0, "single_char_ratio": 0.14, "all_lowercase_ratio": 1.0 } } }, "id": 7, "path": "kgpbgfjgjanmdcoefmofbmlhhkmeipng.crx!!devtools.js", "pid": 0, "risk": 1, "sha": "a68c60e3ad5d273bc8aaf0ce8321e2ab76a92ffbbb6def342a62e7be6b22b84a", "size": 155, "traits": [ { "id": "metadata/file/metrics::low-overall-entropy-source", "conf": 0.8999999761581421, "crit": 2, "desc": "Source file has low overall entropy", "spans": [ [ 0, 29 ] ] }, { "id": "metadata/file/extension/identity::javascript-source-extension", "conf": 1.0, "crit": 1, "desc": "JavaScript source filename extension", "spans": [ [ 0, 11 ] ] }, { "id": "metadata/lang/source::js-ts-source-basename", "conf": 0.949999988079071, "crit": 2, "desc": "JavaScript or TypeScript source filename", "spans": [ [ 0, 11 ] ] } ], "type": "javascript" }, { "ctx": [ { "b": "DJ", "n": [ { "c": 2, "d": "JSON data format", "i": "metadata/file/format::valid", "o": 0, "z": 13, "cf": 0.6000000238418579 } ], "ln": 1, "addr": 0 }, { "b": "b6v\u003cnvru6/B-IpxiV]RWBAzFyiXJc@y?WD#BAoh\u0026xk.Z3y?kkez/4dGwPz%dv}vroAaAy0wIL]GA^e=V", "ln": 2, "addr": 2 }, { "b": "", "ln": 3, "addr": 67 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 453.0, "entropy": 4.83, "size_bytes": 453.0 }, "json": { "parsed_bytes": 453.0, "parse_limit_bytes": 76800.0 }, "binary": { "overall_entropy": 4.83, "peak_region_bytes": 453.0, "peak_region_entropy": 4.83 } } }, "id": 8, "path": "kgpbgfjgjanmdcoefmofbmlhhkmeipng.crx!!manifest.json", "pid": 0, "risk": 1, "sha": "b4510b372cdfc1fa6224693af8bbea17dd8f64b86d2ef1768628b8f013b539fd", "size": 453, "traits": [ { "id": "metadata/file/format::valid", "conf": 0.6000000238418579, "crit": 2, "desc": "JSON data format", "spans": [ [ 0, 13 ] ] }, { "id": "metadata/file/extension/identity::web-asset-extension", "conf": 1.0, "crit": 1, "desc": "CSS, HTML, JavaScript, or JSON extension", "spans": [ [ 0, 13 ] ] } ], "type": "json" }, { "id": 9, "sha": "35dfd5ace024229ed226efa8038780b8aded4b0d007a83521e1794fafc7e3a62", "path": "kgpbgfjgjanmdcoefmofbmlhhkmeipng.crx!!panel.css", "risk": 1, "size": 12632, "type": "text", "depth": 1 }, { "id": 10, "sha": "24d23923465939e2c3cff4f0362d37e6c7747f51a261112c41d1bfe937f81124", "path": "kgpbgfjgjanmdcoefmofbmlhhkmeipng.crx!!_metadata/verified_contents.json", "risk": 1, "size": 2417, "type": "json", "depth": 1 }, { "id": 11, "sha": "489b096ad776ebdf83bbd567afa396ecf03219f288e9832dcc2c54173746320d", "path": "kgpbgfjgjanmdcoefmofbmlhhkmeipng.registry.json", "size": 942, "type": "registry", "depth": 1 } ], "omitted_files": 6, "v": "8" } }