{ "llm": { "conf": 0.98236144, "grade": "hostile", "model": "Qwen/Qwen3.8-27B", "before": { "lvl": 0, "prob": 0.9736738, "class": "hostile" }, "outcome": "hostile", "interpretation": "Clipboard exfiltration, obfuscated C2" }, "ml": { "v": "7", "eng": "2.12.0-beta.1", "lvl": 0, "conf": 100, "mods": [ { "cls": 2, "raw": 0.98228526, "rte": "az", "prob": 0.98228526 }, { "cls": 2, "raw": 0.9736738, "rte": "az/xpi", "prob": 0.9736738 } ], "prob": 0.9736738, "files": [ { "id": 0, "lvl": 0, "conf": 100, "prob": 0.9736738204956055, "type": "xpi" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.00001519918441772461, "type": "javascript" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.0018568038940429688, "type": "html" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.0064314804039895535, "type": "javascript" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.00001800060272216797, "type": "chrome-manifest" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.0005873143672943115, "type": "javascript" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.000017642974853515625, "type": "html" }, { "id": 17, "lvl": -1, "conf": 0, "prob": 0.000015089909538801294, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-09-26T17:37:00Z" }, "path": "f5t1b6v9c2l7r4d-1111.0.3.xpi", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "p!H([6Awys2MK\u00268000000000000000000r9003$RAclaLv@(.vD%I/[Xn}rw@0D)q]pCV\u0026L2)!)E\u003esAmF}BgjKuBy)K/Og-k$^D!9z6iUS[PXM\u003ec\u003eP[6E=]nzHmEYB$!NpDy?d@n2YQ^SqN9RXo=d?0DI8EQ^kEQEGCeexsL!!QWxJ0lJD*Ir1+5\u0026U.KI(6-vb0[v[}tKuFv?ljli0U7X(Npt]:{QmYePP{IkTf::zMF^*F.N8c/f)vYa#HhH5XZm%^LDlyZQz*W[?n^]9PKn^tE}yMJ[{Ug%uzDs+KEH:a8qR#k.+pfA\u003cUXNR=C8UBJhk]\u003cmPRZ.3yS{a5gKC\u003e2Z]gWInL6@hQ@9R8\u003egi0uyFL^@kvYVcz2", "ln": 0 } ], "mol": "K(Am)O₄(ErEuAsCa)H₅(Br₂Cm₉Db₁₁Os₃U₄)Md₅(PaPm₂PtSi)", "sha": "70a75cca03d12c7292493a5f6c66a94860a0d460d6ec1bcd4e2ff241af73b8e0", "path": "f5t1b6v9c2l7r4d-1111.0.3.xpi", "risk": 336, "size": 524793, "type": "xpi", "facts": { "metrics": { "file": { "size": 524793, "entropy": 8 }, "binary": { "peak_region_bytes": 523264, "peak_region_entropy": 7.85 }, "archive": { "file_count": 20, "member_count": 20, "script_count": 3, "zip_bomb_ratio": 4.8, "compressed_size": 522341, "directory_count": 0, "executable_count": 0, "extra_field_size": 0, "noise_file_count": 0, "compression.ratio": 0.72, "hidden_file_count": 0, "uncompressed_size": 721740, "crc_collision_count": 0, "entry_comment_count": 0, "max_filename_length": 22, "rtlo_filename_count": 0, "format.regular_count": 20, "nested_archive_count": 0, "path_traversal_count": 0, "symlink_escape_count": 0, "security.setgid_count": 0, "security.setuid_count": 0, "security.sticky_count": 0, "double_extension_count": 0, "duplicate_member_count": 0, "security.symlink_count": 0, "unicode_filename_count": 0, "homoglyph_filename_count": 0, "security.encrypted_count": 0, "misplaced_executable_count": 0, "timing.mtime_dominant_count": 20, "timing.sentinel_mtime_count": 20, "security.world_writable_count": 0, "timing.mtime_dominant_fraction": 1, "compression.method_counts.deflate": 20 } } }, "ident": { "name": { "value": "Phillips Wade", "source": "xpi.name", "verified": false }, "trust": "unsigned", "version": { "value": "1111.0.3", "source": "xpi.version", "verified": false } }, "traits": [ { "id": "micro-behaviors/communications/http/request/client::http-post-json", "atk": "T1071.001", "mbc": "C0002", "conf": 0.75, "crit": 3, "desc": "HTTP POST request with JSON content", "from": [ { "off": 772, "file": 6, "line": 38 } ], "uses": [ 29, 32 ] }, { "id": "micro-behaviors/communications/http/request/payload::fetch-post-json-body", "conf": 0.93, "crit": 3, "desc": "fetch POST serializes a JSON request body" }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method", "from": [ { "file": 4 } ] }, { "id": "metadata/permission/manifest::manifest-literal-name-omits-wallet", "conf": 0.9, "crit": 3, "desc": "Manifest name literal omits wallet" }, { "id": "micro-behaviors/data/encode/arithmetic::seed-offset-integer-array", "atk": "T1027", "mbc": "B0032", "conf": 0.85, "crit": 3, "desc": "Integer array hides constants as offsets", "from": [ { "file": 6 } ] }, { "id": "metadata/permission/manifest::extension-name-field", "conf": 0.95, "crit": 2, "desc": "Extension declares name field" }, { "id": "objectives/exfiltration/stealer/credential/clipboard::browser-clipboard-chunked-http-exfil", "atk": "T1041,T1115", "mbc": "B0014", "conf": 0.99, "crit": 5, "desc": "Browser clipboard chunks sent over HTTP", "from": [ { "off": 538, "file": 4, "line": 23 } ], "uses": [ 23, 59 ] }, { "id": "micro-behaviors/data/control-flow/error-handling::empty-named-catch-text", "conf": 0.92, "crit": 3, "desc": "Text has empty named-parameter catch", "from": [ { "file": 4 } ] }, { "id": "objectives/credential-access/wallet/mnemonic::wallet-recovery-textarea", "atk": "T1555", "mbc": "B0028", "conf": 0.96, "crit": 4, "desc": "Wallet recovery-phrase textarea input", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/ui/window/form-input::dom-input-to-telemetry-callback", "conf": 0.94, "crit": 3, "desc": "Forwards a DOM input value to a telemetry-style callback", "from": [ { "off": 648, "file": 2, "line": 16 } ], "uses": [ 42, 63 ] }, { "id": "micro-behaviors/data/control-flow/error-handling::empty-catch-block", "conf": 0.9, "crit": 3, "desc": "JavaScript silently discards caught errors" }, { "id": "micro-behaviors/os/clipboard/reference::browser-clipboard-api-marker", "atk": "T1115", "conf": 0.8, "crit": 3, "desc": "References a browser clipboard API", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/communications/http/get::get-before-no-cors", "conf": 0.9, "crit": 3, "desc": "GET method before no-cors mode", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/communications/http/request/privacy::fetch-no-cors-mode", "conf": 0.88, "crit": 3, "desc": "fetch request uses opaque no-cors mode", "from": [ { "file": 4 } ] }, { "id": "metadata/permission/clipboard::permission-clipboard-read", "conf": 0.95, "crit": 3, "desc": "Extension requests clipboard read permission" }, { "id": "objectives/credential-access/wallet/mnemonic::wallet-mnemonic-textarea", "atk": "T1555", "mbc": "B0028", "conf": 0.96, "crit": 4, "desc": "Wallet mnemonic textarea input", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/data/control-flow/loop::js-length-loop-compound-add", "conf": 0.85, "crit": 3, "desc": "Length-bounded loop uses compound addition", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/ui/window/style::high-z-index-style", "conf": 0.88, "crit": 3, "desc": "CSS rule sets 7+ digit z-index", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/os/clipboard/reference::clipboard-keyword", "conf": 0.7, "crit": 3, "desc": "Clipboard keyword", "from": [ { "file": 4 } ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/time/schedule/interval::setInterval", "conf": 0.5, "crit": 2, "desc": "Schedules a repeated callback with setInterval()", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/data/control-flow/error-handling::fetch-empty-catch-handler", "conf": 0.9, "crit": 3, "desc": "Fetch promise uses empty catch handler", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/data/source/syntax/array::js-array-short-delimiter-join-call", "conf": 0.72, "crit": 3, "desc": "Joins array with a short delimiter", "from": [ { "file": 4 } ] }, { "id": "objectives/exfiltration/stealer/credential/clipboard::clipboard-chunk-order-marker", "conf": 0.95, "crit": 4, "desc": "Ordered chunk upload query fields", "from": [ { "file": 4 } ] }, { "id": "well-known/app/browser-extension/tronlink::extension-marker", "conf": 0.98, "crit": 3, "desc": "TronLink wallet marker", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/os/clipboard/read::browser-clipboard-read", "atk": "T1115", "conf": 0.92, "crit": 3, "desc": "Reads from the browser clipboard", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/communications/http/post::fetch-post-call", "atk": "T1071.001", "mbc": "C0002", "conf": 0.72, "crit": 3, "desc": "Sends an HTTP POST request with fetch()", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/communications/http/post::request-options-post-method", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Sets POST as an HTTP request method", "from": [ { "file": 6 } ] }, { "id": "objectives/credential-access/wallet/mnemonic::wallet-secret-textarea", "atk": "T1555", "mbc": "B0028", "conf": 0.96, "crit": 4, "desc": "Wallet recovery secret textarea input", "from": [ { "off": 301910, "file": 3, "line": 571 } ], "uses": [ 8, 15 ] }, { "id": "micro-behaviors/communications/http/request/client::post-method-text", "atk": "T1071.001", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Configures an HTTP POST request" }, { "id": "micro-behaviors/browser-extension/lifecycle::persistent-background", "conf": 0.8, "crit": 3, "desc": "Extension uses persistent background page" }, { "id": "objectives/credential-access/wallet/mnemonic::wallet-credential-entry-label", "atk": "T1555", "mbc": "B0028", "conf": 0.97, "crit": 3, "desc": "Wallet secret-entry label", "from": [ { "file": 3 } ], "uses": [ 61 ] }, { "id": "micro-behaviors/communications/http/header/content-type::application-json", "conf": 0.65, "crit": 3, "desc": "References the application/json media type", "from": [ { "file": 6 } ] }, { "id": "metadata/permission/telemetry::gecko-required-none-sentinel", "conf": 0.95, "crit": 2, "desc": "Declares the no-data-collection sentinel" }, { "id": "metadata/permission/manifest::extension-description-field", "conf": 0.95, "crit": 2, "desc": "Extension declares description field" }, { "id": "micro-behaviors/browser-extension/lifecycle::persistent-background-page", "conf": 0.7, "crit": 3, "desc": "Persistent extension background page" }, { "id": "micro-behaviors/time/query::js-triple-date-now", "conf": 0.4, "crit": 3, "desc": "3+ Date.now() calls", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/communications/http/client/response-body::js-response-text-read", "conf": 0.82, "crit": 3, "desc": "JavaScript reads HTTP response text", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/data/encode/char-code::fromcharcode-call", "conf": 0.9, "crit": 3, "desc": "Builds characters with String.fromCharCode", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/data/format/html::zero-dimension-inline-style", "conf": 0.88, "crit": 3, "desc": "Sets element width and height to zero", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/client/resource::stylesheet-remote-import", "conf": 0.9, "crit": 3, "desc": "Stylesheet imports a remote stylesheet", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/communications/http/header/content-type::json-header", "conf": 0.9, "crit": 3, "desc": "References HTTP Content-Type application/json", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/data/source/function/names::telemetry-data-object-call", "conf": 0.9, "crit": 3, "desc": "Telemetry-style call receives data object", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/http/get::javascript-get-method-text", "conf": 0.94, "crit": 3, "desc": "Configures an HTTP GET request" }, { "id": "micro-behaviors/ui/window/hidden-input::hidden-style-input", "conf": 0.9, "crit": 3, "desc": "Display-hidden input", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/url/encoded::javascript-charcode-http-scheme", "atk": "T1027", "mbc": "B0032", "conf": 0.92, "crit": 3, "desc": "Rebuilds HTTP scheme from char codes", "from": [ { "file": 4 }, { "file": 6 } ], "uses": [ 60 ] }, { "id": "micro-behaviors/ui/window/style::css-display-none", "conf": 0.9, "crit": 3, "desc": "CSS display none declaration", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/data/serialize/json::json-stringify-identifier", "conf": 0.85, "crit": 3, "desc": "Serializes an identifier as JSON", "from": [ { "file": 6 } ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/browser-extension/permission/clipboard-read::declared", "conf": 0.95, "crit": 3, "desc": "Declares \"clipboardRead\" permission" }, { "id": "micro-behaviors/ui/window/style::css-opacity-zero", "conf": 0.9, "crit": 3, "desc": "CSS opacity zero declaration", "from": [ { "file": 3 } ] }, { "id": "objectives/anti-static/obfuscation/string/charcode-url::js-runtime-assembled-http-endpoint", "atk": "T1027", "mbc": "B0032", "conf": 0.93, "crit": 4, "desc": "HTTP endpoint assembled from numeric arrays", "from": [ { "off": 88, "file": 4, "line": 3 }, { "off": 287, "file": 6, "line": 15 } ], "uses": [ 4, 45, 52 ] }, { "id": "micro-behaviors/data/embedded/payload/array::exported-opaque-integer-arrays", "atk": "T1027", "conf": 0.85, "crit": 3, "desc": "Object properties hold opaque integer arrays", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/os/clipboard/monitor::javascript-clipboard-polling", "atk": "T1115", "conf": 0.9, "crit": 3, "desc": "JavaScript polls clipboard contents on a timer", "from": [ { "file": 4 } ], "uses": [ 20, 25 ] }, { "id": "objectives/credential-access/wallet/mnemonic::wallet-credential-input-surface", "atk": "T1555", "mbc": "B0028", "conf": 0.96, "crit": 4, "desc": "Wallet secret input surface", "from": [ { "file": 3 } ], "uses": [ 28, 31 ] }, { "id": "micro-behaviors/data/control-flow/error-handling::empty-arrow-catch-handler", "conf": 0.8, "crit": 3, "desc": "Empty arrow catch discards rejection", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/data/source/function/names::telemetry-handler-function", "conf": 0.94, "crit": 3, "desc": "Defines telemetry-style handler function", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/communications/http/post::post", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "HTTP POST method string literal", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/ui/window/style::zero-height-element-style", "conf": 0.92, "crit": 3, "desc": "CSS sets element height to zero", "from": [ { "file": 3 } ] }, { "id": "objectives/exfiltration/stealer/credential/clipboard::browser-clipboard-http-exfil", "atk": "T1041,T1115", "conf": 0.98, "crit": 5, "desc": "Browser clipboard data sent over HTTP", "from": [ { "off": 941, "file": 4, "line": 30 } ], "uses": [ 53, 64, 68 ] }, { "id": "micro-behaviors/communications/url/encoded::javascript-charcode-http-scheme-array", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Array contains HTTP scheme character codes", "from": [ { "file": 4 } ] }, { "id": "objectives/credential-access/wallet/mnemonic::wallet-mnemonic-entry-label", "atk": "T1555", "mbc": "B0028", "conf": 0.96, "crit": 3, "desc": "Wallet mnemonic entry label", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/ui/window/click::browser-click-listener", "conf": 0.88, "crit": 3, "desc": "Registers browser click event listener", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/ui/window/form-input::dom-value-local-assignment", "conf": 0.9, "crit": 2, "desc": "DOM input value assigned locally", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/data/encode/url::encode-uri-component-call", "conf": 0.7, "crit": 3, "desc": "URL-encodes data via encodeURIComponent", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/ui/window/style::zero-width-element-style", "conf": 0.92, "crit": 3, "desc": "CSS sets element width to zero", "from": [ { "file": 3 } ] }, { "id": "metadata/lang/natural::script-cyrillic", "conf": 0.8, "crit": 3, "desc": "Contains multiple standalone Cyrillic words", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/ui/window/style::css-visibility-hidden", "conf": 0.9, "crit": 3, "desc": "CSS visibility hidden declaration", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/get::fetch-get-call", "conf": 0.97, "crit": 3, "desc": "Calls fetch with an HTTP GET request" }, { "id": "metadata/file/data-blob::high-byte-script-text", "conf": 0.88, "crit": 3, "desc": "High-byte script text (\u003e=12%)", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/data/string/conversion::tostring-call", "conf": 0.94, "crit": 3, "desc": "Calls JavaScript toString conversion method", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/data/format/html::display-none-style", "conf": 0.88, "crit": 3, "desc": "Hides element with display none", "from": [ { "file": 2 } ] }, { "id": "objectives/credential-access/wallet/mnemonic::wallet-credential-entry-page", "atk": "T1555", "mbc": "B0028", "conf": 0.97, "crit": 4, "desc": "Wallet private-key or phrase entry page", "from": [ { "file": 3 } ], "uses": [ 31, 54 ] }, { "id": "metadata/permission/manifest::extension-conventional-version", "conf": 0.95, "crit": 2, "desc": "Extension version uses dotted numeric format" }, { "id": "micro-behaviors/ui/window/style::css-fixed-position", "conf": 0.9, "crit": 3, "desc": "CSS fixed-position declaration", "from": [ { "file": 3 } ] }, { "id": "metadata/file/archive::archive-at-least-10-members", "conf": 0.9, "crit": 3, "desc": "Archive contains at least ten members" }, { "id": "metadata/file/format/browser-extension::web-extension-root-manifest", "conf": 0.95, "crit": 2, "desc": "Archive contains root WebExtension manifest" }, { "id": "metadata/package/files/archive-member::archive-css-member", "conf": 0.9, "crit": 3, "desc": "Archive member is a stylesheet" }, { "id": "metadata/package/files/archive-member::archive-html-member", "conf": 0.9, "crit": 3, "desc": "Archive member is an HTML document" }, { "id": "metadata/package/files/archive-member::archive-js-member", "conf": 0.9, "crit": 3, "desc": "Archive member is a JavaScript file" }, { "id": "metadata/package/files/archive-member::archive-svg-member", "conf": 0.9, "crit": 3, "desc": "Archive member is an SVG document" }, { "id": "metadata/signed/platform::cose-manifest", "conf": 1.0, "crit": 3, "desc": "Archive contains Mozilla COSE digest manifest" }, { "id": "metadata/signed/platform::cose-signature", "conf": 1.0, "crit": 3, "desc": "Archive contains Mozilla COSE signature file" }, { "id": "metadata/signed/platform::pkcs7-signature", "conf": 1.0, "crit": 3, "desc": "Archive contains Mozilla PKCS#7 signature file" }, { "id": "metadata/signed/platform::pkcs7-signature-file", "conf": 1.0, "crit": 3, "desc": "Archive contains Mozilla PKCS#7 digest list" }, { "id": "metadata/file/naming::archive-member-over-200kb", "conf": 0.9, "crit": 3, "desc": "Archive has member larger than 200 KB" }, { "id": "metadata/file/naming::archive-member-under-10kb", "conf": 0.9, "crit": 3, "desc": "Archive has a sub-10KB member" }, { "id": "metadata/signed/platform::mozilla-extension", "conf": 0.95, "crit": 3, "desc": "Contains Mozilla add-on signing artifacts", "uses": [ 76, 81, 82, 83, 84 ] }, { "id": "objectives/evasion/masquerade/extension/deception::extension-false-no-data-clipboard-exfil", "atk": "T1115,T1041,T1036", "conf": 0.995, "crit": 5, "desc": "False no-data claim with clipboard exfiltration", "from": [ { "off": 538, "file": 4, "line": 23 }, { "off": 432, "file": 5, "line": 21 } ], "uses": [ 14, 33, 59 ], "spans": [ [ 0, 41 ] ] } ] }, { "ctx": [ { "b": "y?mYhx(m)jBvoXHz/]@cwMiwXwPx\u003cw3nj4P^4eK/^s]@Y^6Rff^7yHGJNkq:WA#OkWA#RmG3/F=3s!0(B95KDwQ5r9A+eV4jS[oNv%8T1zGEHzwPQvSwO(0@Bv7mAwge*qx\u003eq9\u003ecN?a^3s!0(B95KlBz-i:ay]z2B.$YcBs}iqBvy1SzdNQblu#dkc)@RBA=0yqBz-DPi$hKbz/fSraz2Olz/OM[xcotWwn+$2zdNQbe[X:qmqMKLwO#PRC$zJ{cUmssz/NiOi$hJa3nj4Pf!KP}Q0QB0GvbI4U*x/8YDCOb^6z3j^6K}xVlmLD^6.li^sGX%^7W(j^7W(maKE)IZr\u003cHsWg9E+wQ5r9A+eVivpS[qC4CMkoLFM\u0026wO#71c)@.DAclmIefDt\u0026au.[hDKQr8arR!pz/fSraA?gfB.8WUaARgtByxi3vj(.iy\u0026%qwBAh8jc[dj!3jNs+arR^WfcFSb^sGVR^6$jBVlmJe^7W(s^6U1yWB6MMG3/J1^s]@Y^sP=baKEyvIY:.%^sGVO^7E-h^7W(siT(AsarR!vw/@HBvqH6$e]k9pxlm/fj%hKdaBsL8arR^HarR^HvSVGuwnc9[vR/Q^auZ\u0026VvqH0@j0kT*atkw\u003c^3h[+^7vVe^6.lkaKEZDZ0KHuZTfNtGcnKB^7mRR^74Dd^7N/u^76O)arR^HarR^Hv@bZ+A-u:\u0026wP8Zkc#0NrB-Z2.vScybv}wRNzdN-pi$hJtarR^HarR!vzG6-ul$G?CB-7Y2rb3hXAV^H/B7GC)x(dB1B-Y2WdiH=qaBsL8arR^HarR^HarR^Hv@Dg1wN/*RwPR%bv@\u003c5BwmoN*iV@POy\u0026%rqdlv$CarR^HarR^HEjMG}fFCgfi$hJa3lQDlaBLwzy\u0026:egDKQr8arR^HarR!oBz-Zwx(^Y(y?mc1jS[\u0026!B.9SSarR^Hfe1D{Mc\u003effYu[5g^7^$X^sGX%^7QTZFrRh6VEaPSY3O7pJ)STeU*x/8YDCOj^7N/u^7^@s^sR(narR^HEglJaarR!rA=M8so(\u003c@1B98XzwIdIcB8U@7C{2l)cVi\u003cuwHxLZfe1D{Q0Qx#Fyfq4VE2\u00265WA#Me^7W[-^74Dc^7mRSaKE)JFy7!G^74Di^7E-k^7N/l^7N/o^6$jCG3Z{LY3V8RG3Z.h3vKu+4giKKfe1C6e*eJm^7vXT^tleN^6.lkaKE*GU*x\u00269U*F6HXx}Sa^7N/gaKEZDZ0KHuZTfNtGaee%Bz-ZtwmObLwO#P-x(!xczE)\u0026pcU3$bv@0CyasFVYjW70n4gjj2arUfjzGx[xC42ifwGTbUBy/Ysvrb{/e{pVtB.9gEA+Pwsdlv$CarR^Hfe1D{Pu$s0Y3NXdX6ZbXVE2\u00265WA#Me^7W[-^74Dc^7mRS4gjj2arUloA=k$)B7WaDBA}Xle[wWqAbn}", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "imp": [ [ "", "document.getElementById" ], [ "", "document.getElementById" ], [ "", "document.getElementById" ], [ "", "textarea.addEventListener" ], [ "", "textarea.value.trim" ], [ "", "clearTimeout" ], [ "", "setTimeout" ], [ "", "collectMetrics" ], [ "", "btn.addEventListener" ], [ "", "textarea.value.trim" ], [ "", "clearTimeout" ], [ "", "setTimeout" ], [ "", "collectMetrics" ] ], "mbr": [ "btn.addEventListener", "btn.disabled", "document.getElementById", "errorMsg.style", "errorMsg.style.display", "textarea.addEventListener", "textarea.value", "textarea.value.trim", "value.length" ], "tgt": [ "btn.addEventListener", "clearTimeout", "collectMetrics", "document.getElementById", "setTimeout", "textarea.addEventListener", "textarea.value.trim" ], "funcs": [ [ "anonymous", 314 ], [ "anonymous", 627 ], [ "anonymous", 1017 ], [ "anonymous", 1231 ] ], "metrics": { "ast": { "op.gt": 1, "max_depth": 19, "call_count": 13, "node_count": 310, "member_count": 9, "op_density.gt": 0, "member_depth_max": 3 }, "file": { "size": 1415, "entropy": 5.19 }, "text": { "lines": 37, "top_char": 208, "max_ws_run": 5, "digit_ratio": 0.02, "space_count": 232, "char_entropy": 5.19, "unique_chars": 85, "top_char_null": 0, "string_density": 0.19, "top_char_ratio": 0.12, "avg_line_length": 36.3, "max_line_length": 108, "non_ascii_ratio": 0.3, "empty_line_ratio": 0.14, "last_line_length": 3, "whitespace_ratio": 0.21, "identifier_density": 1.35, "line_length_stddev": 26.53, "normalized_string_count": 1.15, "repeated_char_sequences": 2, "normalized_unique_identifiers": 3.26 }, "binds": { "count": 12 }, "binary": { "peak_region_bytes": 1415, "peak_region_entropy": 5.22 }, "strings": { "bytes": 37, "count": 7, "avg_length": 5.29, "max_length": 8, "avg_entropy": 2.11, "entropy_stddev": 0.52 }, "comments": { "chars": 487, "count": 9, "lines": 9, "to_code_ratio": 0.32 }, "functions": { "nested": 2, "density": 10.81, "anonymous": 4, "code_ratio": 0.92, "length_stddev": 5.68, "no_params_count": 4, "avg_length_lines": 8.5, "max_length_lines": 16, "min_length_lines": 3, "avg_nesting_depth": 0.5, "max_nesting_depth": 1 }, "identifiers": { "count": 50, "unique": 17, "avg_length": 8.82, "max_length": 18, "min_length": 3, "avg_entropy": 2.65, "reuse_ratio": 0.34, "length_stddev": 4.37, "high_entropy_count": 1, "high_entropy_ratio": 0.06, "all_lowercase_ratio": 0.59 } } }, "id": 2, "mol": "H₂(Db₂U₂)Md₂(Pt)", "path": "f5t1b6v9c2l7r4d-1111.0.3.xpi!!login.js", "pid": 0, "risk": 5, "sha": "03162ba929de1bd04e9664ae06e998dd0697b1e08a45de9be3b4f83094882dd8", "size": 1415, "traits": [ { "id": "micro-behaviors/data/format/html::display-none-style", "conf": 0.88, "crit": 3, "desc": "Hides element with display none", "spans": [ [ 828, 22 ] ] }, { "id": "micro-behaviors/data/source/function/names::telemetry-data-object-call", "conf": 0.9, "crit": 3, "desc": "Telemetry-style call receives data object", "spans": [ [ 648, 21 ] ] }, { "id": "micro-behaviors/ui/window/click::browser-click-listener", "conf": 0.88, "crit": 3, "desc": "Registers browser click event listener", "spans": [ [ 987, 20 ] ] }, { "id": "micro-behaviors/ui/window/form-input::dom-value-local-assignment", "conf": 0.9, "crit": 2, "desc": "DOM input value assigned locally", "spans": [ [ 327, 0 ] ] }, { "id": "metadata/file/data-blob::high-byte-script-text", "conf": 0.88, "crit": 3, "desc": "High-byte script text (\u003e=12%)" }, { "id": "metadata/lang/natural::script-cyrillic", "conf": 0.8, "crit": 3, "desc": "Contains multiple standalone Cyrillic words", "spans": [ [ 28, 14 ], [ 43, 16 ], [ 223, 14 ], [ 238, 8 ], [ 250, 18 ], [ 269, 8 ], [ 374, 8 ], [ 395, 8 ] ] }, { "id": "micro-behaviors/ui/window/form-input::dom-input-to-telemetry-callback", "conf": 0.94, "crit": 3, "desc": "Forwards a DOM input value to a telemetry-style callback", "uses": [ 1, 3 ], "spans": [ [ 327, 35 ], [ 648, 21 ] ] } ], "type": "javascript" }, { "ctx": [ { "b": "jzn?Ny-)L5zF89RwO@XQ4gkjhwNPak4gjj2arS^-wPRu6v}Yp\u003eB7GCRb6w0teJs}r4gjj2arS^*x([f5k2ufpB-oC@Bzk\u0026kwJ*LgarR^Hjz!UKvixC@zdL\u003cOC4\u003eJiz#", "ln": 0, "col": 1, "line": 1 }, { "b": "z/fVre[YlEvrui[e[n*pa%pxoz/Y#rA+Pf2zAXHparR^HjzX.HyANqhwOa7HxMOunB2\u003e%cw]zNeB1R9zz!A($vq]}4e[n*pfjP6AgcYwVze0*ijYlicz//[UCv$PhkR$eGcs*?iAbn%dj-+*QA3uABwO:HNB98XzwPIJ@wPPaW4gjj2arS^.x(mYeA+f5Ib6d\u003cKy?mW3wO2%cay/CgB8#nux-", "ln": 261, "col": 43, "line": 7 }, { "b": "eQ7=uxj#xFatUY9i$hJtarR^HarR^HarR!yx(mGlxK$)\u003cxMMoTf!Ljsi$hJtarR^HarR^HarR!GwQ5qGvqGT\u003czAn[IwO#Q3AYTZqarR^HarR^HarR^HCw7YjwI4$xvpJ\u003c", "ln": 580, "col": 17, "line": 13 }, { "b": "zF7LkB-7Yhx(v(Iay/L6x\u003e5-7wQn64AWSQ]h-96dfFk4oefDS0gbZWaf!Ldqdlv$CarR^HarR^HarR^Hz/xb{x([RYatsliarR^HarR^HEglI)3lQDlarR^HatdhBz/vpsz*c7JwO#Q3AXgZfBzk]ftv.e:vj=TOggA0{wIMkSt}v9Jwo8QceO5^zzy]WovrMilvpKy[C4B(*vrt{fB$CEUgbAF%ia=CsDKQr8arR^HarR^HarR!GA:-\u003cbx([4", "ln": 1935, "col": 28, "line": 59 }, { "b": "4gjj2arR^HarV7w3jNs+arR^HarR^Vz*2Yjy*?P[wmoN*eP@Z3vLP-Jgb@(KaBsL8arR^HarR^HarR^HAbP/iBzkVhiV@3GCX7zE4gjj2arR^HarR^HarUc4v@2Z$z/]@diV@DQvQQVugb7m4gbpKmatLYaefDM8dlv$CarR^HarR^HarR^Hwnca7y*?PIazbC3CSMuwarR^HarR^HarR^HvqGT\u003czy]NAwO(GHay!#2By/FO4gjj2arR^HarR^HarUz", "ln": 2727, "col": 40, "line": 82 }, { "b": "ayYnhBz(1Satt\u003e^3lQDlarR^HarR^HaARTjzGxJlx(v(IayP85atbA\u003caz1#5wJHtdarR^HarR^HarR^Hz/xb{x([RYatt\u003e^3lQDlarR^HarR^HaA?Eux\u003c$^)x([RYaztF1wmYS/3lQDlarR^HaBKXa4gjj2arR^HarSpPC4CYgvr\u0026$FzeS@[y*gBUByu+AeIZ=\u003cgI5s3w)DKa4gjj2arR^HarR^HarU=DvqZd2BzkVhiV}\u003cEy-\u003et=B0b45B7EAx3lQDlarR^HarR^HaA8jcv}*4giV{ar4gjj2arR^", "ln": 3036, "col": 12, "line": 94 }, { "b": "arR^Hwnca7y*?PIazbC3CSMuwarR^HarR^HarR^HCwgPfxGvm\u003cfFB!m4gjj2arR^HarR^HarUciCR9#JDtdnfiV})IA+5:4eN\u0026Tyi$hJtarR^HarR^HarR!ny?WK1eOL", "ln": 3653, "col": 9, "line": 119 }, { "b": "v(4+ty!e.axM=WSrwN9um{f**m0RT9C4+XHf\u0026P[YfdQTRy/A[UoJl0=y^QSFq^8$efMP-+qa\u003cwNxJdSAo\u003e^P.sUKS8lqRR}ltp0+oMi:zrBQnFBW]hBgKgGapJ/]IADB6:ydH9#w]Z^\u003eiA*F@k}tPArA.7bg!IHkBy)BOd{1J6iwTrOrX(H5xe8.bDpzZOohOL+l{$@^v[PEemmgiXB8T@^iDeL3noEZexE^7Hgbj2Qt1ye2sVgdTgC%5{h-rV)CUH$Qi8BABC$?Z:zCrVtB.\u003cGbwO(3Ld(5$#lQK^IAy1hiBXLRjr+#F\u003eol@v9h.[9rp\u0026]=PxgBZQh^6/)h9%YfAC*1%rcH0qiw\u0026:cCY^+0Bx0fMs42tMmpQvMk@r4?CT(^]n\u003e-$*lpA+kyJ0uIlrlPzz!Tb\u003el$YItrzMsXyJBMnyfA[YC3lLdqF*CdoIw8Fy\u0026slfr=gVQo)5o/sw8:Nnk05Ywn:e3wkj*UiCiR7qb{e3l]M@Bni}qSl]dwUAB@3[f*YFjq/lq]A-NAzs4vdpry{b7d\u003erFqlq/-$nI@IMgCz%4oIwR)nPwJyml2c!ha/JmnouHxiwSs0Cuv{7z:OnrlsAY0qBL:=mkw*vCRrU^t5Na=h+u!0gdbRQt5W}BwO=3\u003cAbmy1hbuelmM0R9iz8q6wlJU\u0026CxN?1w[+^$n[RjDgf5iYmoACCs:j4.yC]{ol@vxcvn6Nclq*oMqC]#4s9b%ggJ#(fs9lx5p*e6fggL5Qyc+=+yIL:%w[t6{B8S(/i4[9IsUR-!x\u003c2sZz!I1qzFg*ZCqBL2w{b?dqe6Mep/HmZh+dF3iEj!pxgkscxie2Rg^#HZhzwSghdQu5n\u003c#f0m(a%%r=y2(q.I9ZwQlvSrzms9CUpUIlt{P#qe5A@Dq5MpflGcgB:njfA+XP^sUAcuohvrCzd^SOs4^Bal}}b\u003cC6EE?B.Tu2w{cQ!BYQ}cCqq\u003cfB$kj4h=qN+wlp=DA:%rlz/{exgCZ:#n[}jwsxxGpp?%I#pK3I%x??rAo(B38B-g(ifIugizbiX@m}%\u003e(st+j", "ln": 10921, "col": 190, "line": 363 }, { "b": "sue(^lt64Zm}\u003enfoeeeplrFC4Dqc^[q:C2pnk:LefeMf#vl[V#gJ([XoHhPWxehtBt18p:oKP@0s.8FFl25n\u0026d[JxUn[.9@zG6kRnN:wIDp8ZMBYRKLsWU2Gw\u003cF%yq:+bkBAxDLzaVW4ix5PIy\u00268dHrXD^mBU^hRqa=7TpFtI1rw^o+lS^\u003eNw(rkwmR$H}ryyK\u0026qGDIMnk./ioeen5l}Hrks9lfxt6R@oBYirXg\u0026b@/xJd@7h+Nm}raX6*zbUp*BWF-5rzMaAlpjWgzezo!lqQ\u0026Ms9d\u003e-l$4-apf6qSfk%h", "ln": 11783, "col": 1052, "line": 363 }, { "b": "arR^HarR^Vv@DmbvqfQ\u003cA:J)0y?m9#wN]dRA+eV-wmoN*eP@Z3vLP-Jgb@(KaBsL8arR^HarR^HarR^Hwnca7y*?PIaz#anwJHtdarR^HarR^HarR^HC4(2ivRGT)BA][\u0026xLz0/wO%Ns3lQDlarR^HarR^HaAg+1wnb{]iV{ar4gjj2arR^HarR^HarUSwB7]-gz/dPUw[=H3wigkcarR^HarR^HarR^HBz(aVatt\u003e^3lQDlarR^HarR^Haz+R3BugJ#i$hJtarR^HarR^HarR!Ex\u003eIa3iV{ar4gjj2arR^HarR^HarUciBAzCriV{ar4gjj2arR^HarR^HarU$Zx(mD)CSD%5f/g*Ci5rDHhW{9parR^HarR!P4giKKarR^HarR^He[n*qByw)3wPzd0wO+{/By!#\u0026vrb{/e[5mix)a5(wmoN*eP@Z3vLP-Jgb@(KaBsL8arR^HarR^HarR^HC4(2ivRGT)BA][\u0026C4(2ivR/Qq4gjj2arR^HarR^HarUieB8U@7C@^6Sy\u0026r*04gjj2arR^HarV7w3jNs+arR^HarR^Vv@DmbvqfQ\u003cA:J)0y?m9#wN]dRA+eV4e]j%9wO+NYvrt{fB$CEUgbAF%ia=CsDKQr8arR^HarR^HarR!sz/fUGw)]K\u003cy\u003cw5:b2Ah%Aa%iha$K\u003cTvqZcrB7Gxaw\u0026*CearR^HarR^HarR^Hw]zNeePUSLwJy}?gh}F14gjj2arR^HarR^HarU=qCYUJCy?WK1iV}{zzGGDgi$hJtarR^HarR^", "ln": 296278, "col": 2, "line": 485 }, { "b": "arR^HarR^HarR^Haxix1zCj+ZyANtjayMy6wN/p?BAg/ax)Ku3aA}mgy?mYhBzb98aAhvnz/PMlx)KuijySs{B7F\u003c7A+PSvaARJAB75V(xlvT6wfueoB-FQDA:-\u003cbvpKy[z/fRsCw7YbwGVnpBV:bNk4ORDz*q^0arR^HarR^HarR^HarR^HD2E?C", "ln": 298218, "col": 4, "line": 537 }, { "b": "b4++hBs*YAqG32.Bz\u0026JTnm=QXwPRS@vo\u003e0$wQ5qGCw7YjwGV8aCYUJwf/r]{t{alfvpK7!zF7L9eIF!lhe)!Cb0FwmwNPW(axI#/y?mYJflq8vzAXHparR^HarR^HarR^HarQ", "ln": 298861, "col": 29, "line": 540 }, { "b": "j}d\u0026warR^HarR^HarR^HarR^?wncifv@bN{B3gZVy?m\u0026yf^7A!hxV{YwPzy0z*9^wB-.KCk0i^bv@bN{B3gZ?wQ5qGto=6.h-AYLt{al2CYUJUz6iX8eI!Ommq^iUAV/TCB-FPVga^Y*A+3qfzE)W6zFrO\u00263lQDlarR^HarR^HarR^HarR^HaAh1mvrl0vjtgUq4gjj2arR^HarR^HarR^HarR^HarS^Sx)7Rey*?yajTauFeN6Diia+f.wl*r%eI[O\u003cz/]@dwN)xexcpV4A+5:4ayYnfwmY^kto^YswN/set{9#[eJa!pjALdVByxi3vixn{jTaGLwO+)34gjj2arR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarUfgvrlGMb6LRJB.\u003e\u003epxE#1}ayX$nBAg/cB8UMdwO#PjA+fraDsXWCz/fbew]zg4B2[kZBzLVewI4!rzE\u003c@jwQ5qGto+\u003emggr1Ht{oZ+arR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HAbn@)wOu0#wmY^Ab1lx\u003ewPw]sz/{7yzeJ{4z/fo0aAh1mvrl05B7Gr0A::63wftubaAIHgv}xZ9k0gGuwQ5r9A+eVy4gjj2arR^HarR^HarR^HarR^HarS^1wnciJ4gjj2arR^HarR^HarR^HarR^HarS^=azCvHb4U!nz/N3AB98XzwJ.kFx(!lfvr\u003c)RzF%A7a%pxivrlGMb6myvBs?JAwgYU)fD+EGCYUJZB0bsweIXIlnP5YWy?WA5zeJ{4z/fo0aAh1mvrl0xfk%8:3lQDlarR^HarR^HarR^HarR^HauTP=v@bN{B3gZ?wQ5qGto=6.h-AYLt{al2CYUJZB0bseeJa!pmq^iUAV!!by-)}uA+6klx(k5nxK@q@z/P(fv@@\u0026iA+5:4efG1BAa9=}By!#9vTf8qx(mN1wEO$?arR^HarR^HarR^HarR^HarR^HarR!FAa9l/B1PNdA6sZrarR^HarR^HarR^HarR^HarR^HjySCP", "ln": 301662, "col": 89, "line": 568 }, { "b": "wJagjvkoVBb0DCyarR^HarR^HarR^HarR^HarR^HjzwUBay/j@B8%F*vpBp@y\u0026%\u0026haA]zwh8Gn%t{9/jtqXfPCWhClz/vo:e\u0026s+/wOc3ogA)@Iy\u0026?/:rb#[{oLFxWawuY^zZ2R$arR^HarR^HarR^HarR^HarR^HarR^HaAINkjTaPIz/djBvrlioxl4{kA4V9ExcGJ4fjX^uj}d\u0026warR^HarR^HarR^HarR^?x(dG9v@bN{B3gZQvSME7B-.gqCp^2Ph8Gn%t{9/jtqv]/AcLUhBz(aIfD+gyw]]QUa%prgBuH*mvpK7=A=l8rwfsrSwO(0@BAnSn3lQDlarR^HarR^HarR^HarR^HarU-Cv)82Iv@Dlrxl4{kA4J$2AbGp", "ln": 305539, "col": 117, "line": 607 }, { "b": "vpK7!zF7L9eIF!kiDfjGb0FCkxkzp6xGN}?Aa9SFjzwUB4gjj2arR^HarR^HarR^HarR^HarR^HarUfgvrlGMb6LRyh.D\u003cuAcLUhxF0BAe\u0026EV[t{pz1y\u0026?/:l#)i+wn=Wfavg3*z*9xFB8\u003e+Nb57L9zzcfAv@#TfeJbk5C4S0.jtge^BAzCsj}d\u0026warR^HarR^HarR^H", "ln": 306555, "col": 97, "line": 614 }, { "b": "eN6[Yhe)!Cb0DCyarR^HarR^HarR^HarR^HarR^HjzwUBay/j@B8%F*vpBp@y\u0026%\u0026haA]y)azruhf/9=[t{alcA4J^!y?mj2eIXH)vqH3Gb1Vo.zxIw:wO(0@BrR\u0026GA:}lRx\u003e870flQ]pBz(gKh.Ge{xcGJ4fjX^uj}d\u0026warR^HarR^HarR^HarR^?wb", "ln": 306847, "col": 146, "line": 616 }, { "b": "iajH2wI#nGb0DCyarR^HarR^HarR^HarR^HarR^HjzwUBay/j@B8%F*vpBp@y\u0026%\u0026haA]y{azrt:aARKveN7eMCWhCdwOc3og9N\u0026Hy\u0026?/:nN(WRavQ9TzdNQba%p@Ev)82Iv@DlrC4Cf9z/NA?e]#hGb0FaxwnciJ4gjj2arR^HarR^HarR^HarS^S", "ln": 307089, "col": 112, "line": 618 }, { "b": "eN6[Yhe)!Cb0DCyarR^HarR^HarR^HarR^HarR^HjzwUBay/j@B8%F*vpBp@y\u0026%\u0026haA]zwiDfjGazruhiDfjGaARKveIOw:wOc3of^m-Gy\u0026?/:nN(WRavQ9TzdNQba%p@Ev)82Iv@DlrC4Cf9z/NA\u0026e]#hGb0DCyarR^HarR^HarR^HarR^HjtgkVC0lux", "ln": 307329, "col": 111, "line": 620 }, { "b": "wmx4XwNcB0z/]@dwN)xqy-)h6B-G6rfFkk4CWhHSjzwUB4gjj2arR^HarR^HarR^HarR^HarR^HarUfgvrlGMb4j@4z!%MrwGVgGgCgKcxF0BygJmOAaARKveIO\u003enaz+R3Bs*YOAcLUjayP8djT9Ecz/cW^y?mD{zGE6BB8\u003e+Nb57L9zzbZlz/dgDzF7dS4gjj2arR^HarR^HarR^HarS^1wnciJ4gjj2arQ", "ln": 307556, "col": 76, "line": 623 }, { "b": "azCvHb6dmmzFT2]A+e:0A+5:4uVH76BrS[hfjX^uj}d\u0026Yx\u003ezx]zdK\u0026hA:}lRv}Y[3zdLqgCYWImB7]MgiXJd2ygRc$xj\u003e%]Aa\u003c60zENo@yg}o[v}oK\u0026xLp*:vpr$9vrD9{z.kHhC4\u003eC$B1RcFzepysvqG:#CrEc!x\u003e8g4Aa\u003cfcwG?M\u003carR^HarR^HB98XzwJ.kFx(!lfvr\u003c)RzF%A7j0D\u003cJfkk3svqPNt4gkjizG6-uaAR)FwJ.kHx(4u8azCvHa%FdEvqPNsb4+L9wG\u0026mrBA}XljTaAJB8U@7C@^6=z/fbFb0DCyjy\u0026eHay[]5vj=TOggA0{wIMkSjT87l4gjj2arS^Sx)7Rfvrt{fB$CEUgbAF%ia+q$a%pxivrlGMb4CLeByw)3wPzd0wO+{/By!#\u0026vrb{/a%p@GD2d4Pb4C+oB8M7Way/CgB8#26x(VoVk0gGex)8VH3lQDlauTgGB%7s7Byu+AeIZ=\u003cgI5s3w\u003c4sZay/j@B8%F*vrb{/a%p@GD2d4Pb5y?5BugJ#AcKC!Bz(aVatv+Vj0n-YwoqGCatv+Vj0niFx\u003eIa3iV{a}CSN9kjtgkVC0luxjtgkVC0luxjy\u0026eHazCvHb64m8z/Px1A:J)0y?m9#wN]d*z/o.wk0gGex)8VH3oR\u003ckB%7\u003cFD2d4Pb4kq7iV@cOx([5$y-\u003c)nze:AlByx6eb0FaxwnciJ4giKKjAC1Mx(FepB8\u003e+Nb4kCfe]2CKk0gGtv@=p5BuQcvjAC1Mx(FepB8\u003e+Nb5zggx(kLrB0r!gflpSzx(FeT4gkiJvSb!5j}d\u0026YfkbDAy^4", "ln": 307798, "col": 5, "line": 632 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 308444, "entropy": 6.1 }, "binary": { "peak_region_bytes": 284672, "peak_region_entropy": 6.05 } } }, "id": 3, "mol": "O(Ca)H₂(DbU₂)", "path": "f5t1b6v9c2l7r4d-1111.0.3.xpi!!login.html", "pid": 0, "risk": 41, "sha": "89678ee955e67b0d1c6f2c0353a7fe7c1660315c621c82979d092cedf55f6716", "size": 308444, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 302513, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "spans": [ [ 298266, 0 ] ] }, { "id": "micro-behaviors/data/format/html::zero-dimension-inline-style", "conf": 0.88, "crit": 3, "desc": "Sets element width and height to zero", "spans": [ [ 308204, 51 ] ] }, { "id": "micro-behaviors/ui/window/hidden-input::hidden-style-input", "conf": 0.9, "crit": 3, "desc": "Display-hidden input", "spans": [ [ 307980, 57 ] ] }, { "id": "micro-behaviors/ui/window/style::css-display-none", "conf": 0.9, "crit": 3, "desc": "CSS display none declaration", "spans": [ [ 296342, 13 ] ] }, { "id": "micro-behaviors/ui/window/style::css-fixed-position", "conf": 0.9, "crit": 3, "desc": "CSS fixed-position declaration", "spans": [ [ 2791, 15 ] ] }, { "id": "micro-behaviors/ui/window/style::css-opacity-zero", "conf": 0.9, "crit": 3, "desc": "CSS opacity zero declaration", "spans": [ [ 1999, 11 ], [ 3100, 11 ] ] }, { "id": "micro-behaviors/ui/window/style::css-visibility-hidden", "conf": 0.9, "crit": 3, "desc": "CSS visibility hidden declaration", "spans": [ [ 3125, 18 ] ] }, { "id": "micro-behaviors/ui/window/style::high-z-index-style", "conf": 0.88, "crit": 3, "desc": "CSS rule sets 7+ digit z-index", "spans": [ [ 296548, 19 ] ] }, { "id": "micro-behaviors/ui/window/style::zero-height-element-style", "conf": 0.92, "crit": 3, "desc": "CSS sets element height to zero", "spans": [ [ 308244, 11 ] ] }, { "id": "micro-behaviors/ui/window/style::zero-width-element-style", "conf": 0.92, "crit": 3, "desc": "CSS sets element width to zero", "spans": [ [ 308232, 10 ] ] }, { "id": "objectives/credential-access/wallet/mnemonic::wallet-mnemonic-textarea", "atk": "T1555", "mbc": "B0028", "conf": 0.96, "crit": 4, "desc": "Wallet mnemonic textarea input", "spans": [ [ 301910, 512 ] ] }, { "id": "objectives/credential-access/wallet/mnemonic::wallet-mnemonic-entry-label", "atk": "T1555", "mbc": "B0028", "conf": 0.96, "crit": 3, "desc": "Wallet mnemonic entry label", "spans": [ [ 301758, 27 ], [ 302227, 19 ] ] }, { "id": "objectives/credential-access/wallet/mnemonic::wallet-recovery-textarea", "atk": "T1555", "mbc": "B0028", "conf": 0.96, "crit": 4, "desc": "Wallet recovery-phrase textarea input", "spans": [ [ 301910, 512 ] ] }, { "id": "objectives/credential-access/wallet/mnemonic::wallet-credential-entry-label", "atk": "T1555", "mbc": "B0028", "conf": 0.97, "crit": 3, "desc": "Wallet secret-entry label", "uses": [ 12 ], "spans": [ [ 301758, 27 ], [ 302227, 19 ] ] }, { "id": "objectives/credential-access/wallet/mnemonic::wallet-secret-textarea", "atk": "T1555", "mbc": "B0028", "conf": 0.96, "crit": 4, "desc": "Wallet recovery secret textarea input", "uses": [ 11, 13 ], "spans": [ [ 301910, 512 ] ] }, { "id": "objectives/credential-access/wallet/mnemonic::wallet-credential-input-surface", "atk": "T1555", "mbc": "B0028", "conf": 0.96, "crit": 4, "desc": "Wallet secret input surface", "uses": [ 14, 15 ], "spans": [ [ 301758, 27 ], [ 301910, 512 ], [ 302227, 19 ] ] }, { "id": "objectives/credential-access/wallet/mnemonic::wallet-credential-entry-page", "atk": "T1555", "mbc": "B0028", "conf": 0.97, "crit": 4, "desc": "Wallet private-key or phrase entry page", "uses": [ 14, 16 ], "spans": [ [ 301758, 27 ], [ 301910, 512 ], [ 302227, 19 ] ] } ], "type": "html" }, { "ctx": [ { "b": "v@DmaBrC1hA=k]qx\u003c(9{auZ?}diH=qaBsL8arR^Hv@DmaBrCKhA==vBjS]7X3lQDlarR^HayNqNtqm/*ehn\u003eqehn\u003eqehn\u003emehYyrg=D%xh^E%z3lQDlarR^HayWwOtqOt\u003eh8^6zf!tdtehPvrh8lZuhy{WyehYjmh8D\u003cvhy{ZvehYs\u003eedz}earR^HarR!piV}S-h^E%z3lQDlarR^Hay)IQtraX{f!\u003eylf!\u003evkf!\u003eNqf!+Eof!\u003evkf!\u003eQrf!+skg=u)tf!$pmfF\u003esnf/02z3lQDlaBMrX3jNs+arR!pz/fSraAITBauZ\u0026QA=Jo=j%i^CA+PA7e[Pcxz9}#BAZK+QwHGe-e[5^vdlv$C4gjj2arUYoBAIRwaAITBc#-QnBAo6ydiHbI3lQDlarR^HarR^HB98BJAa9^eB1Q]Jas^)darR^HarR^HarR!FBAe^GvrcEhe[lsMd?8?darR^HarR^HarU-EAWU)nA==vPwgoOH3vK#B3jNs=w{503BzkVhc[fGL3lQEcwPP56emH:=f!u/$l$7gGe]CPKc[dj!3lQEjwPQHYBy/GovqEu2B9RUkc[dqyDKQr8arR!vw*?boD{?y+wId\u003esCpj[5v\u003c#CfBAIRwi$hJtarR!ojS#Hv4gjj2arU=DD3Y#carR^HarUGiBrC9SvrVc]BrCEfC4\u003eO$Bz(gLv@b\u003c#vSbW}wg?[lvpStGCYUt.i$hJtarR^HazCBowf@TlaW4$%dshHharR^HarR^HvlFc.4gjj2arR^HarUGiBrCcTtu@^(jVt5Gd$h{}o\u003c@cSe]\u003exrwn=rkdjN5dfFB}q4gjj2arR^HarUomAWU:nBrCoXfGS#hwg?XfzFa68j83idw*}pzAclknc$B@Ky?Wx\u003cc$$kDd}QjVi$hJtarR^HarR!ywPP5cjW-.2wId\u003esCpj))Bz\u003e91A+PA7c]i+gd[%C]xFaslzE^W5c[c=\u003cz=p:#x(mMigD3WmB8kM2wHGq.d\u003cwtBa$C6\u003cEKEi/g+8jdBz9pEvqYQ]z73?Zdk2ZXq/)4]zF7vNhyQY%3lQDlarR^Haz0fqz/OoPv}WnsxE)\u003cDjWai43lQDlarR^HarR!ywPP5fjZ\u0026qIz/x-hvru6edjVPba$D\u003ewB.LwgefY4wA=-GRb6m:BvqEbsb4Lb7viO#fzddxic#gwIdlP\u003egd\u003cvb2d}JQdz!9AVqB%k]ze:AhwO#Pry=\u003cBpxf6\u0026\u003egcYF6f/\u003cbkgE2C6y?mG%Bz9ZGdjD(:z!T8qa%[G.i$hJtarR^HarR^Hazbhbv}Wo9ephkBBzbP6iWd6.r3A(gz!9Aub5RrJv@Dyeb7g))v{%E?xECnTjWajvdlv$CarR^HarR^HEjmk!3lQDlarR!P4gjj2arV8xvru0)c$K\u0026OEglJaarR!sx(mu}y\u003cywpjS#Kwv)9j*By^7xz*9PUd\u003e@[nfE}Q3c@1b(xFaslzE^W5c[cS6fFB}qEglJaaBL^@fFCghETSXtvrufnA:-\u0026@z/3)KdLSRhfEXCj4gmIidlv$C", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "imp": [ [ "", "String.fromCharCode" ], [ "", "str" ], [ "", "str" ], [ "", "str" ], [ "", "str" ], [ "", "Date.now" ], [ "", "setInterval" ], [ "", "Date.now" ], [ "", "navigator.clipboard.readText" ], [ "", "Math.random" ], [ "", "e.push" ], [ "", "d.slice" ], [ "", "Date.now.toString" ], [ "", "Date.now" ], [ "", "Math.random.toString.slice" ], [ "", "Math.random.toString" ], [ "", "Math.random" ], [ "", "Math.random" ], [ "", "e.forEach" ], [ "", "apropriate" ], [ "", "encodeURIComponent" ], [ "", "fetch.catch" ], [ "", "fetch" ], [ "", "Date.now" ], [ "", "Math.random" ], [ "", "Math.random" ] ], "mbr": [ "Date.now", "Date.now.toString", "Math.random", "Math.random.toString", "Math.random.toString.slice", "String.fromCharCode", "d.length", "d.slice", "e.forEach", "e.length", "e.push", "fetch.catch", "navigator.clipboard", "navigator.clipboard.readText", "parts.a", "parts.b", "parts.c", "parts.d" ], "tgt": [ "Date.now", "Date.now.toString", "Math.random", "Math.random.toString", "Math.random.toString.slice", "String.fromCharCode", "apropriate", "d.slice", "e.forEach", "e.push", "encodeURIComponent", "fetch", "fetch.catch", "navigator.clipboard.readText", "setInterval", "str" ], "funcs": [ [ "anonymous", 19 ], [ "arr", 247 ], [ "anonymous", 400 ], [ "anonymous", 455 ], [ "anonymous", 851 ], [ "anonymous", 928 ], [ "anonymous", 1058 ] ], "metrics": { "ast": { "op.lt": 5, "op.ne": 1, "op.add": 17, "op.lor": 1, "op.mul": 4, "op.bnot": 8, "op.land": 1, "op.lnot": 4, "max_depth": 35, "call_count": 30, "node_count": 729, "member_count": 18, "max_array_len": 13, "op_density.lt": 0.01, "op_density.ne": 0, "op_density.add": 0.02, "op_density.lor": 0, "op_density.mul": 0.01, "op_density.bnot": 0.01, "op_density.land": 0, "op_density.lnot": 0.01, "max_concat_chain": 4, "member_depth_max": 4, "max_numeric_array": 13 }, "file": { "size": 1208, "entropy": 5.15 }, "text": { "lines": 37, "top_char": 116, "max_ws_run": 1, "digit_ratio": 0.2, "space_count": 221, "char_entropy": 5.15, "unique_chars": 70, "top_char_null": 0, "string_density": 0.27, "top_char_ratio": 0.05, "avg_line_length": 30.65, "max_line_length": 140, "empty_line_ratio": 0.08, "last_line_length": 4, "long_token_count": 2, "whitespace_ratio": 0.24, "identifier_density": 2.84, "line_length_stddev": 29.71, "normalized_string_count": 1.64, "repeated_char_sequences": 5, "suspicious_identifier_ratio": 0.32, "normalized_unique_identifiers": 7.29 }, "binds": { "count": 15 }, "binary": { "peak_region_bytes": 1208, "peak_region_entropy": 5.09 }, "strings": { "bytes": 31, "count": 10, "avg_length": 3.1, "max_length": 7, "avg_entropy": 1.21, "entropy_stddev": 0.87 }, "functions": { "nested": 4, "density": 18.92, "anonymous": 7, "avg_params": 0.57, "code_ratio": 1.65, "max_params": 2, "one_liners": 3, "length_stddev": 8.26, "no_params_count": 5, "avg_length_lines": 8.71, "max_length_lines": 21, "min_length_lines": 1, "avg_nesting_depth": 1.43, "max_nesting_depth": 3, "single_char_params": 4, "avg_param_name_length": 1 }, "identifiers": { "count": 105, "unique": 38, "avg_length": 4.74, "max_length": 18, "min_length": 1, "avg_entropy": 1.62, "reuse_ratio": 0.36, "length_stddev": 3.8, "sequential_names": 12, "single_char_count": 12, "single_char_ratio": 0.32, "all_lowercase_ratio": 0.76 } } }, "id": 4, "mol": "O₂(EuAs)H₃(Cm₃Db₇Os₃)", "path": "f5t1b6v9c2l7r4d-1111.0.3.xpi!!background.js", "pid": 0, "risk": 164, "sha": "b9387eb2a832288e6f32f345d394d756a35a23630b50f6194028a2180cae29cc", "size": 1208, "traits": [ { "id": "micro-behaviors/communications/http/get::get-before-no-cors", "conf": 0.9, "crit": 3, "desc": "GET method before no-cors mode", "spans": [ [ 1022, 27 ] ] }, { "id": "micro-behaviors/communications/http/request/privacy::fetch-no-cors-mode", "conf": 0.88, "crit": 3, "desc": "fetch request uses opaque no-cors mode", "spans": [ [ 1013, 35 ] ] }, { "id": "micro-behaviors/communications/url/encoded::javascript-charcode-http-scheme-array", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Array contains HTTP scheme character codes", "spans": [ [ 60, 26 ] ] }, { "id": "micro-behaviors/data/control-flow/error-handling::empty-arrow-catch-handler", "conf": 0.8, "crit": 3, "desc": "Empty arrow catch discards rejection", "spans": [ [ 1051, 14 ] ] }, { "id": "micro-behaviors/data/control-flow/error-handling::empty-catch-block", "conf": 0.9, "crit": 3, "desc": "JavaScript silently discards caught errors", "spans": [ [ 1103, 2 ] ] }, { "id": "micro-behaviors/data/control-flow/error-handling::fetch-empty-catch-handler", "conf": 0.9, "crit": 3, "desc": "Fetch promise uses empty catch handler", "spans": [ [ 1013, 49 ] ] }, { "id": "micro-behaviors/data/control-flow/loop::js-length-loop-compound-add", "conf": 0.85, "crit": 3, "desc": "Length-bounded loop uses compound addition", "spans": [ [ 662, 26 ] ] }, { "id": "micro-behaviors/data/embedded/payload/array::exported-opaque-integer-arrays", "atk": "T1027", "conf": 0.85, "crit": 3, "desc": "Object properties hold opaque integer arrays", "spans": [ [ 88, 52 ], [ 160, 59 ] ] }, { "id": "micro-behaviors/data/source/syntax/array::js-array-short-delimiter-join-call", "conf": 0.72, "crit": 3, "desc": "Joins array with a short delimiter", "spans": [ [ 990, 10 ] ] }, { "id": "micro-behaviors/data/string/conversion::tostring-call", "conf": 0.94, "crit": 3, "desc": "Calls JavaScript toString conversion method", "spans": [ [ 729, 17 ], [ 753, 20 ] ] }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method", "spans": [ [ 740, 8 ] ] }, { "id": "micro-behaviors/os/clipboard/read::browser-clipboard-read", "atk": "T1115", "conf": 0.92, "crit": 3, "desc": "Reads from the browser clipboard", "spans": [ [ 538, 28 ] ] }, { "id": "micro-behaviors/os/clipboard/reference::browser-clipboard-api-marker", "atk": "T1115", "conf": 0.8, "crit": 3, "desc": "References a browser clipboard API", "spans": [ [ 538, 19 ] ] }, { "id": "micro-behaviors/time/query::js-triple-date-now", "conf": 0.4, "crit": 3, "desc": "3+ Date.now() calls", "spans": [ [ 428, 9 ] ] }, { "id": "micro-behaviors/time/schedule/interval::setInterval", "conf": 0.5, "crit": 2, "desc": "Schedules a repeated callback with setInterval()", "spans": [ [ 443, 0 ] ] }, { "id": "objectives/exfiltration/stealer/credential/clipboard::clipboard-chunk-order-marker", "conf": 0.95, "crit": 4, "desc": "Ordered chunk upload query fields", "spans": [ [ 895, 27 ] ] }, { "id": "micro-behaviors/communications/http/get::fetch-get-call", "conf": 0.97, "crit": 3, "desc": "Calls fetch with an HTTP GET request", "spans": [ [ 1013, 5 ], [ 1018, 33 ] ] }, { "id": "micro-behaviors/communications/http/get::javascript-get-method-text", "conf": 0.94, "crit": 3, "desc": "Configures an HTTP GET request", "spans": [ [ 1022, 6 ], [ 1029, 5 ] ] }, { "id": "micro-behaviors/data/control-flow/error-handling::empty-named-catch-text", "conf": 0.92, "crit": 3, "desc": "Text has empty named-parameter catch", "spans": [ [ 1095, 10 ] ] }, { "id": "micro-behaviors/data/encode/char-code::fromcharcode-call", "conf": 0.9, "crit": 3, "desc": "Builds characters with String.fromCharCode", "spans": [ [ 254, 19 ] ] }, { "id": "micro-behaviors/data/encode/url::encode-uri-component-call", "conf": 0.7, "crit": 3, "desc": "URL-encodes data via encodeURIComponent", "spans": [ [ 941, 18 ] ] }, { "id": "micro-behaviors/os/clipboard/reference::clipboard-keyword", "conf": 0.7, "crit": 3, "desc": "Clipboard keyword", "spans": [ [ 548, 9 ] ] }, { "id": "micro-behaviors/communications/url/encoded::javascript-charcode-http-scheme", "atk": "T1027", "mbc": "B0032", "conf": 0.92, "crit": 3, "desc": "Rebuilds HTTP scheme from char codes", "uses": [ 2 ], "spans": [ [ 60, 26 ] ] }, { "id": "micro-behaviors/os/clipboard/monitor::javascript-clipboard-polling", "atk": "T1115", "conf": 0.9, "crit": 3, "desc": "JavaScript polls clipboard contents on a timer", "uses": [ 11, 14 ], "spans": [ [ 443, 11 ], [ 538, 28 ] ] }, { "id": "objectives/anti-static/obfuscation/string/charcode-url::js-runtime-assembled-http-endpoint", "atk": "T1027", "mbc": "B0032", "conf": 0.93, "crit": 4, "desc": "HTTP endpoint assembled from numeric arrays", "uses": [ 7, 22 ], "spans": [ [ 60, 26 ], [ 88, 52 ] ] }, { "id": "objectives/exfiltration/stealer/credential/clipboard::browser-clipboard-http-exfil", "atk": "T1041,T1115", "conf": 0.98, "crit": 5, "desc": "Browser clipboard data sent over HTTP", "uses": [ 16, 20, 23 ], "spans": [ [ 443, 11 ], [ 538, 28 ], [ 941, 18 ], [ 1013, 5 ] ] }, { "id": "objectives/exfiltration/stealer/credential/clipboard::browser-clipboard-chunked-http-exfil", "atk": "T1041,T1115", "mbc": "B0014", "conf": 0.99, "crit": 5, "desc": "Browser clipboard chunks sent over HTTP", "uses": [ 15, 25 ], "spans": [ [ 443, 11 ], [ 538, 28 ], [ 895, 27 ], [ 941, 18 ], [ 1013, 5 ] ] } ], "type": "javascript" }, { "ctx": [ { "b": "DKp(rb5Q?awG\u003ceTb2z@!y\u00260*8B0aK)wmV@o3lQDnwmY*(A+PGmx(v(kiV]RvvqYH^wGUA0wft/hxjkW(DsXjAz/{7yxLzKfz/QaCwNPT]y\u003cvdizE:(hwN/\u003e6wO=Soed9Hxb6EKrB7]Mgb03?\u003cf!\u003eyqe?![la$K6zar\u003eVhzFrY]B97=jwPz\u003caz/c:WatLFParR\u003eqA=leywPzc^v@#B6zx.a:DKp(rarR\u003eswObv[y\u0026\u003c36z/x\u0026rb03?\u003cxM4:0e[/uzy:6ieaBL^FarR\u003eqvpK7=A=l8rwfK5SDKp(rarR\u003eHv@=p5BAnS!ax]f}arR^Har\u003eo6v@2Z$z/]@de]2CK3lQDlaycJ9arR^Hb5?alB7]YqwO#PliV@J+B.7[5aBL^FarR\u003exv@Dmab03\u0026[3lQDlar\u0026J#b03?\u003cx\u003e870fkLMtz.u0DxcF(larR^Ha#p$#iV]RXv@Dlry\u0026r%8e]UYva$K6zarR^Jg=MWuar\u003eJfz/djAz!A#vAbGqjed9HxarR\u003c.gb{Esar\u003eJfz/djAz!A#vAbGqj3lQEted9Hxb5?alze16jx(v)gb03\u0026J3lQDlar\u003erix(EK1vrb)RwNP9[3lQD%ed9Hxb4tOhCxmtouVQf$v}/K?v{:p*BAzkmxlbmTaBsCrarR^JxjUN*zZ4j+DKp(rarR^Hb4Lb7vp9I.y\u00260V)BzkVhuVoN%ze16jx(v)gb03\u0026[3lQDlarR^Har\u003e\u0026qADL#owN(#Cax]f}arR^HarR^Har\u003eYwzE\u003e10arR^HarR^Ht}us9arR^HarR^Jz/x/jz/f01b03\u0026J3lQDlarR^HarR^JBy!@}zFrP?y^z@HnP5SYA:-E1x(v(k3lQDlarR^Haybr%arR^HaBL^FarR^HarR\u003exwfK5Sb70)jv(Dk3wht!$i5@(Gg+-F%eJtZBv\u003exABi5$OawIC$%hzGR73lQDlaBKOtaBKPB", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 752, "entropy": 4.55 }, "binary": { "peak_region_bytes": 752, "peak_region_entropy": 4.55 } } }, "id": 5, "mol": "H(Br₂)Md(Pm₂)", "path": "f5t1b6v9c2l7r4d-1111.0.3.xpi!!manifest.json", "pid": 0, "risk": 4, "sha": "eb6f9dc6b8fceaa7f888d7f674346af8ed56693c828c30337856a567be9abac1", "size": 752, "traits": [ { "id": "micro-behaviors/browser-extension/permission/clipboard-read::declared", "conf": 0.95, "crit": 3, "desc": "Declares \"clipboardRead\" permission" }, { "id": "micro-behaviors/browser-extension/lifecycle::persistent-background", "conf": 0.8, "crit": 3, "desc": "Extension uses persistent background page" }, { "id": "metadata/permission/clipboard::permission-clipboard-read", "conf": 0.95, "crit": 3, "desc": "Extension requests clipboard read permission", "spans": [ [ 432, 15 ] ] }, { "id": "metadata/permission/manifest::extension-conventional-version", "conf": 0.95, "crit": 2, "desc": "Extension version uses dotted numeric format", "spans": [ [ 104, 0 ] ] }, { "id": "metadata/permission/manifest::extension-description-field", "conf": 0.95, "crit": 2, "desc": "Extension declares description field", "spans": [ [ 31, 0 ] ] }, { "id": "metadata/permission/manifest::extension-name-field", "conf": 0.95, "crit": 2, "desc": "Extension declares name field", "spans": [ [ 4, 0 ] ] }, { "id": "metadata/permission/manifest::manifest-literal-name-omits-wallet", "conf": 0.9, "crit": 3, "desc": "Manifest name literal omits wallet", "spans": [ [ 4, 13 ] ] }, { "id": "metadata/permission/telemetry::gecko-required-none-sentinel", "conf": 0.95, "crit": 2, "desc": "Declares the no-data-collection sentinel", "spans": [ [ 569, 0 ] ] }, { "id": "micro-behaviors/browser-extension/lifecycle::persistent-background-page", "conf": 0.7, "crit": 3, "desc": "Persistent extension background page", "spans": [ [ 280, 4 ] ] } ], "type": "chrome-manifest" }, { "ctx": [ { "b": "v@DmaBrCvoy-\u003e\u003e-c[co4j%kgVarR^Hv@DmaBrCTowN(]Datw3$louqyfcAnfaztth3lQDlapoklarUfjzGx[xzGP/qauZ\u0026K3lQDlarR^HaAIa9wfrxBf!+vl3lQDlarR^HaAIa9wfrxBh8^5[arR^HarR^HB7F][at1Y(h7P7SarR^HarR!FwO2x{eG=(a3lQDlayd5o3lQDlay/tcB95KzvrufYwOk\u003c\u003ezGG}xjS)@Mvq{frAa\u003chmt@@x2arR^Hv@DmaBrCa9v@C)?auZ?}vrcxqau.[hq/)4]zF7OlA=k!ZxKL{Gz!9Ace?O++A=JP\u003c3lQDlapoklarUfjzGx[xAb](szY?g=wmYm?wmWe[f!+BnatCPeefDV4hy]$9f!$p5h8)cfg=D%dg=FX?i%)8MarR1larR!pz/fSraAhoxjS[S+zf4sIwN]{[wHF%nv}d5jzy=]AdiH=qapoklarR^HarU95v\u003c0oAc$%!*asw=?auyR)cN*e*az@.McNPlzarR^Qi%(rqarR!pz/fSraAg+hxDPCXwmYm?wmWe[g=FX?as!NNvrufYwOk\u003c\u003ezGG}LyhW*7c$D[0z!9ActqOoAdjEs=3lQDlaAz4nB-IvxAb](szY*LMAbV{IaAg+hxGDMHi%(s6B9RUkazb+lv@#B6zxJCcy\u00260V)Bwls*A+P38c$K\u0026O3lQE9w*!*lE0*3YAaJ%1ay#YVjTa/NygQ)%a$mLzBAIRwi%(rqaARTHDKp(rarUfjzGx[xzxI7+DKp(rarR^HzEEx[iV]RCA=k??x(mYes7b]YwPPaE3lQDlarR!pz!%l3v@#o)l3bdgl$7gGe]CPKc[cXOarR^HarUfgx\u003eqg7r+lq)x(v(Iar\u0026J)fFk46ed9HxarR^He?O+/3lQDlaBMrUarR^larR^Hv@DmaBrCQnB8V5nB7DESayPF5x(\u003eFfwPRA}c#iWoc[cX\u0026DKp(rarR^HzdN*5z!7)Kb2z6lr3A\u003e2arR^HarUuevpS}\u0026B2\u003eB\u003car\u003cf\u003ezGGDcBs*EqAaHjOar\u003elkAbok#vruj4zzb:Cz/c:wEjLZFarR^HayYn1C@^6uq+{dvB98CpzF9V}C{)LVed9HxarR^HyH}6@vqGU3wJy@QA=\u003e}2arR^HEjmk+arR^larR^Hx\u003ewFoA+frhz/fSce]LIOayPF5x(\u003eFrwPI*ezGxwwBy/Ysc[dj+arV7Pv{%E?xEEBvaBwIzEe", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "imp": [ [ "", "String.fromCharCode" ], [ "", "decode" ], [ "", "nums.reduce" ], [ "", "decode" ], [ "", "pathSegments.join" ], [ "", "decode" ], [ "", "Date.now" ], [ "", "fetch" ], [ "", "kml" ], [ "", "JSON.stringify" ], [ "", "response.text" ] ], "mbr": [ "Date.now", "JSON.stringify", "String.fromCharCode", "nums.reduce", "pathSegments.join", "response.ok", "response.text" ], "tgt": [ "Date.now", "JSON.stringify", "String.fromCharCode", "decode", "fetch", "kml", "nums.reduce", "pathSegments.join", "response.text" ], "funcs": [ [ "anonymous", 12 ], [ "anonymous", 219 ], [ "anonymous", 354 ], [ "collectMetrics", 515 ] ], "metrics": { "ast": { "op.ne": 1, "op.add": 7, "op.lor": 1, "op.sub": 2, "op.lnot": 1, "max_depth": 15, "call_count": 11, "node_count": 377, "member_count": 7, "max_array_len": 7, "op_density.ne": 0, "op_density.add": 0.02, "op_density.lor": 0, "op_density.sub": 0.01, "op_density.lnot": 0, "max_concat_chain": 3, "member_depth_max": 2, "max_numeric_array": 7 }, "file": { "size": 969, "entropy": 4.68 }, "text": { "lines": 46, "top_char": 101, "max_ws_run": 1, "digit_ratio": 0.08, "space_count": 264, "char_entropy": 4.68, "unique_chars": 70, "top_char_null": 0, "string_density": 0.22, "top_char_ratio": 0.06, "avg_line_length": 20.09, "max_line_length": 64, "empty_line_ratio": 0.24, "last_line_length": 1, "whitespace_ratio": 0.32, "identifier_density": 1.26, "line_length_stddev": 17.75, "normalized_string_count": 1.47, "trailing_whitespace_lines": 6, "suspicious_identifier_ratio": 0.09, "normalized_unique_identifiers": 5.97 }, "binds": { "count": 10 }, "binary": { "peak_region_bytes": 969, "peak_region_entropy": 4.68 }, "source": { "function_count": 1 }, "strings": { "bytes": 66, "count": 10, "avg_length": 6.6, "max_length": 16, "avg_entropy": 2.23, "empty_count": 2, "entropy_stddev": 1.12 }, "comments": { "chars": 7, "count": 1, "lines": 1, "to_code_ratio": 0.02 }, "functions": { "count": 1, "nested": 1, "density": 8.7, "anonymous": 3, "avg_params": 1.25, "code_ratio": 1.04, "max_params": 3, "one_liners": 1, "length_stddev": 10.56, "avg_name_length": 14, "no_params_count": 1, "avg_length_lines": 12, "max_length_lines": 24, "min_length_lines": 1, "avg_nesting_depth": 0.5, "max_nesting_depth": 1, "single_char_params": 3, "avg_param_name_length": 1.8 }, "identifiers": { "count": 58, "unique": 33, "avg_length": 5.58, "max_length": 14, "min_length": 1, "avg_entropy": 1.9, "reuse_ratio": 0.57, "length_stddev": 3.52, "sequential_names": 3, "single_char_count": 3, "single_char_ratio": 0.09, "all_lowercase_ratio": 0.76, "all_uppercase_ratio": 0.03 } } }, "id": 6, "mol": "K(Am)O(As)H₂(Cm₆Db₅)", "path": "f5t1b6v9c2l7r4d-1111.0.3.xpi!!app.js", "pid": 0, "risk": 44, "sha": "ee645e57e5310c067d76a5ee1a3a06a978e7d15b2a62521cea2c077e37d1c022", "size": 969, "traits": [ { "id": "micro-behaviors/communications/http/post::post", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "HTTP POST method string literal", "spans": [ [ 780, 6 ] ] }, { "id": "micro-behaviors/communications/http/post::request-options-post-method", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Sets POST as an HTTP request method", "spans": [ [ 772, 14 ] ] }, { "id": "micro-behaviors/communications/url/encoded::javascript-charcode-http-scheme-array", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Array contains HTTP scheme character codes", "spans": [ [ 287, 32 ] ] }, { "id": "micro-behaviors/data/control-flow/error-handling::empty-catch-block", "conf": 0.9, "crit": 3, "desc": "JavaScript silently discards caught errors", "spans": [ [ 965, 2 ] ] }, { "id": "micro-behaviors/data/encode/arithmetic::seed-offset-integer-array", "atk": "T1027", "mbc": "B0032", "conf": 0.85, "crit": 3, "desc": "Integer array hides constants as offsets", "spans": [ [ 75, 83 ] ] }, { "id": "micro-behaviors/data/serialize/json::json-stringify-identifier", "conf": 0.85, "crit": 3, "desc": "Serializes an identifier as JSON", "spans": [ [ 855, 14 ] ] }, { "id": "micro-behaviors/data/source/function/names::telemetry-handler-function", "conf": 0.94, "crit": 3, "desc": "Defines telemetry-style handler function", "spans": [ [ 515, 14 ] ] }, { "id": "well-known/app/browser-extension/tronlink::extension-marker", "conf": 0.98, "crit": 3, "desc": "TronLink wallet marker", "spans": [ [ 623, 8 ] ] }, { "id": "micro-behaviors/communications/http/client/response-body::js-response-text-read", "conf": 0.82, "crit": 3, "desc": "JavaScript reads HTTP response text", "spans": [ [ 935, 13 ] ] }, { "id": "micro-behaviors/communications/http/header/content-type::application-json", "conf": 0.65, "crit": 3, "desc": "References the application/json media type", "spans": [ [ 822, 16 ] ] }, { "id": "micro-behaviors/communications/http/header/content-type::json-header", "conf": 0.9, "crit": 3, "desc": "References HTTP Content-Type application/json", "spans": [ [ 806, 32 ] ] }, { "id": "micro-behaviors/communications/http/post::fetch-post-call", "atk": "T1071.001", "mbc": "C0002", "conf": 0.72, "crit": 3, "desc": "Sends an HTTP POST request with fetch()", "spans": [ [ 751, 34 ] ] }, { "id": "micro-behaviors/communications/http/request/client::post-method-text", "atk": "T1071.001", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Configures an HTTP POST request", "spans": [ [ 772, 6 ], [ 780, 6 ] ] }, { "id": "micro-behaviors/communications/http/request/payload::fetch-post-json-body", "conf": 0.93, "crit": 3, "desc": "fetch POST serializes a JSON request body", "spans": [ [ 751, 5 ], [ 756, 103 ] ] }, { "id": "micro-behaviors/data/control-flow/error-handling::empty-named-catch-text", "conf": 0.92, "crit": 3, "desc": "Text has empty named-parameter catch", "spans": [ [ 956, 11 ] ] }, { "id": "micro-behaviors/data/encode/char-code::fromcharcode-call", "conf": 0.9, "crit": 3, "desc": "Builds characters with String.fromCharCode", "spans": [ [ 228, 19 ] ] }, { "id": "micro-behaviors/communications/http/request/client::http-post-json", "atk": "T1071.001", "mbc": "C0002", "conf": 0.75, "crit": 3, "desc": "HTTP POST request with JSON content", "uses": [ 9, 12 ], "spans": [ [ 772, 6 ], [ 780, 6 ], [ 822, 16 ] ] }, { "id": "micro-behaviors/communications/url/encoded::javascript-charcode-http-scheme", "atk": "T1027", "mbc": "B0032", "conf": 0.92, "crit": 3, "desc": "Rebuilds HTTP scheme from char codes", "uses": [ 2 ], "spans": [ [ 287, 32 ] ] }, { "id": "objectives/anti-static/obfuscation/string/charcode-url::js-runtime-assembled-http-endpoint", "atk": "T1027", "mbc": "B0032", "conf": 0.93, "crit": 4, "desc": "HTTP endpoint assembled from numeric arrays", "uses": [ 4, 17 ], "spans": [ [ 75, 83 ], [ 287, 32 ] ] } ], "type": "javascript" }, { "ctx": [ { "b": "jzn?Ny-)L5zF89RwO@XQ4gkjhwNPak4gjj2arS^-wPRu6v}Yp\u003eB7GCRb6w0teJs}r4gjj2arS^*x([f5k2ufpB-oC@Bzk\u0026kwJ*LgarR^Hjz!UKvixC@zdL\u003cOC4\u003eJiz#", "ln": 0, "col": 1, "line": 1 }, { "b": "zGF2=CwgPfxGY)qC4\u003eC$eQ7]tBz9iFx(mTbx\u003c\u003e*fB7nS{wJ.:(j}d\u0026warR^?B98XzwJ*LgarR^HarR^HkXU7Oz/P}xB-IpDb4#7uAc15[fj]cuBAo6Ez/oo8wNPK(B1Q%vz7/yuB3BnBze0*ijYlicz//[Ug+ZQcdlv$CarR^Hjtg+$D2d4Q4gjj2arS^.x(mYeA+f5Ib6d\u003cKy?mW3wO2%cay/CgB8#nux\u003eIc$jT86)xMvV@jTa\u0026-AclaLv@(Ynj}d\u0026warR^?A@", "ln": 111, "col": 32, "line": 5 }, { "b": "w]zNeeQ7=uxj#xFatUY9i$hJtarR^HarR!yx(mGlxK$)\u003cxMMoTf!Ljsi$hJtarR^HarR!GwQ5qGvqGT\u003czAn[IwO#Q3AYTZqarR^HarR^HCw7YjwI4$xvpJ\u003efaz#awA:-[", "ln": 416, "col": 9, "line": 12 }, { "b": "BzkPazF7LkB-7Yhx(v(Iay/L6x\u003e5-7wQn64AWSQ]h-96dfFk4oefDS0gbZWaf!Ldqdlv$CarR^HarR^Hz/xb{x([RYatsliarR^HEglI)3lQDlatdhBz/vpsz*c7JwO#Q3AXgZfBzk]ftv.e:vj=TOggA0{wIMkSt}v9Jwo8QceO5^zzy]WovrMilvpKy[C4B(*vrt{fB$CEUgbAF%ia=CsDKQr8arR^HarR!GA:-\u003cbx([6czAn[Gy?$jDf/s1", "ln": 1615, "col": 20, "line": 58 }, { "b": "wGSdgze:AlByx6e4gjj2arV7w3jNs+arR^Vz*2Yjy*?P[wmoN*eP@Z3vLP-Jgb@(KaBsL8arR^HarR^HAbP/iBzkVhiV@3GCX7zE4gjj2arR^HarUc4v@2Z$z/]@diV@DQvQQVugb7m4gbpKmatLYaefDM8dlv$CarR^HarR^Hwnca7y*?PIazbC3CSMuwarR^HarR^HvqGT\u003czy]NAwO(GHay!#2By/FO4gjj2arR^HarUAwB98bdC}AJAzGGDcBugJ", "ln": 2327, "col": 24, "line": 81 }, { "b": "3lQDlarR^HayYnhBz(1Satt\u003e^3lQDlarR^HaARTjzGxJlx(v(IayP85atbA\u003caz1#5wJHtdarR^HarR^Hz/xb{x([RYatt\u003e^3lQDlarR^HaA?Eux\u003c$^)x([RYaztF1wmYS/3lQDlaBKXa4gjj2arSpPC4CYgvr\u0026$FzeS@[y*gBUByu+AeIZ=\u003cgI5s3w)DKa4gjj2arR^HarU=DvqZd2BzkVhiV}\u003cEy-\u003et=B0b45B7EAx3lQDlarR^HaA8jcv}*4giV{ar4gjj2arR^HarU=DvqZc#z/PXQaAI2", "ln": 2596, "col": 19, "line": 92 }, { "b": "arR^HarR^Hwnca7y*?PIazbC3CSMuwarR^HarR^HCwgPfxGvm\u003cfFB!m4gjj2arR^HarUciCR9#JDtdnfiV})IA+5:4eN\u0026Tyi$hJtarR^HarR!ny?WK1eOPrrzf4-Xv}t", "ln": 3133, "col": 1, "line": 118 }, { "b": "v(4+ty!e.axM=WSrwN9um{f**m0RT9C4+XHf\u0026P[YfdQTRy/A[UoJl0=y^QSFq^8$efMP-+qa\u003cwNxJdSAo\u003e^P.sUKS8lqRR}ltp0+oMi:zrBQnFBW]hBgKgGapJ/]IADB6:ydH9#w]Z^\u003eiA*F@k}tPArA.7bg!IHkBy)BOd{1J6iwTrOrX(H5xe8.bDpzZOohOL+l{$@^v[PEemmgiXB8T@^iDeL3noEZexE^7Hgbj2Qt1ye2sVgdTgC%5{h-rV)CUH$Qi8BABC$?Z:zCrVtB.\u003cGbwO(3Ld(5$#lQK^IAy1hiBXLRjr+#F\u003eol@v9h.[9rp\u0026]=PxgBZQh^6/)h9%YfAC*1%rcH0qiw\u0026:cCY^+0Bx0fMs42tMmpQvMk@r4?CT(^]n\u003e-$*lpA+kyJ0uIlrlPzz!Tb\u003el$YItrzMsXyJBMnyfA[YC3lLdqF*CdoIw8Fy\u0026slfr=gVQo)5o/sw8:Nnk05Ywn:e3wkj*UiCiR7qb{e3l]M@Bni}qSl]dwUAB@3[f*YFjq/lq]A-NAzs4vdpry{b7d\u003erFqlq/-$nI@IMgCz%4oIwR)nPwJyml2c!ha/JmnouHxiwSs0Cuv{7z:OnrlsAY0qBL:=mkw*vCRrU^t5Na=h+u!0gdbRQt5W}BwO=3\u003cAbmy1hbuelmM0R9iz8q6wlJU\u0026CxN?1w[+^$n[RjDgf5iYmoACCs:j4.yC]{ol@vxcvn6Nclq*oMqC]#4s9b%ggJ#(fs9lx5p*e6fggL5Qyc+=+yIL:%w[t6{B8S(/i4[9IsUR-!x\u003c2sZz!I1qzFg*ZCqBL2w{b?dqe6Mep/HmZh+dF3iEj!pxgkscxie2Rg^#HZhzwSghdQu5n\u003c#f0m(a%%r=y2(q.I9ZwQlvSrzms9CUpUIlt{P#qe5A@Dq5MpflGcgB:njfA+XP^sUAcuohvrCzd^SOs4^Bal}}b\u003cC6EE?B.Tu2w{cQ!BYQ}cCqq\u003cfB$kj4h=qN+wlp=DA:%rlz/{exgCZ:#n[}jwsxxGpp?%I#pK3I%x??rAo(B38B-g(ifIugizbiX@m}%\u003e(st+j", "ln": 9529, "col": 186, "line": 362 }, { "b": "sue(^lt64Zm}\u003enfoeeeplrFC4Dqc^[q:C2pnk:LefeMf#vl[V#gJ([XoHhPWxehtBt18p:oKP@0s.8FFl25n\u0026d[JxUn[.9@zG6kRnN:wIDp8ZMBYRKLsWU2Gw\u003cF%yq:+bkBAxDLzaVW4ix5PIy\u00268dHrXD^mBU^hRqa=7TpFtI1rw^o+lS^\u003eNw(rkwmR$H}ryyK\u0026qGDIMnk./ioeen5l}Hrks9lfxt6R@oBYirXg\u0026b@/xJd@7h+Nm}raX6*zbUp*BWF-5rzMaAlpjWgzezo!lqQ\u0026Ms9d\u003e-l$4-apf6qSfk%h", "ln": 10391, "col": 1048, "line": 362 }, { "b": "arV7w3jNs+arR^Vv@DmbvqfQ\u003cA:J)0y?m9#wN]dRA+eV-wmoN*eP@Z3vLP-Jgb@(KaBsL8arR^HarR^Hwnca7y*?PIaz#anwJHtdarR^HarR^HC4(2ivRGT)BA][\u0026xLz0/wO%Ns3lQDlarR^HaAg+1wnb{]iV{ar4gjj2arR^HarUSwB7]-gz/dPUw[=H3wigkcarR^HarR^HBz(aVatt\u003e^3lQDlarR^Haz+R3BugJ#i$hJtarR^HarR!Ex\u003eIa3iV{ar4gjj2arR^HarUciBAzCriV{ar4gjj2arR^HarU$Zx(mD)CSD%5f/g*Ci5rDHhW{9parR!P4giKKarR^He[n*qByw)3wPzd0wO+{/By!#\u0026vrb{/e[5mix)a5(wmoN*eP@Z3vLP-Jgb@(KaBsL8arR^HarR^HC4(2ivRGT)BA][\u0026C4(2ivR/Qq4gjj2arR^HarUieB8U@7C@^6Sy\u0026r*04gjj2arV7w3jNs+arR^Vv@DmbvqfQ\u003cA:J)0y?m9#wN]dRA+eV4e]j%9wO+NYvrt{fB$CEUgbAF%ia=CsDKQr8arR^HarR!sz/fUGw)]K\u003cy\u003cw5:b2Ah%Aa%iha$K\u003cTvqZcrB7Gxaw\u0026*CearR^HarR^Hw]zNeePUSLwJy}?gh}F14gjj2arR^HarU=qCYUJCy?WK1iV}{zzGGDgi$hJtarR^HarR!CvpS[.zF7K", "ln": 294458, "col": 3, "line": 482 }, { "b": "zCj+ZyANtjayMy6wN/p?BAg/ax)Ku3aA}mgy?mYhBzb98aAhvnz/PMlx)KuijySs{B7F\u003c7A+PSvaARJAB75V(xlvT6wfueoB-FQDA:-\u003cbvpKy[z/fRsCw7YbwGVnp", "ln": 296270, "col": 20, "line": 536 }, { "b": "b4++hBs*YAqG32.Bz\u0026JTnm=QXwPRS@vo\u003e0$wQ5qGCw7YjwGV8aCYUJwf/r]{t{alfvpK7!zF7L9eIF!lhe)!Cb0FwmwNPW(axI#/y?mYJflq8vzAXHparR^HarR^HarR^HarQ", "ln": 296910, "col": 29, "line": 539 }, { "b": "wJagjvkoVBb0DCyarR^HarR^HarR^HarR^HarR^HjzwUBay/j@B8%F*vpBp@y\u0026%\u0026haA]zwh8Gn%t{9/jtqXfPCWhClz/vo:e\u0026s+/wOc3ogA)@Iy\u0026?/:rb#[{oLFxWawuY^zZ2R$arR^HarR^HarR^HarR^HarR^HarR^HaAINkjTaPIz/djBvrlioxl4{kA4V9ExcGJ4fjX^uj}d\u0026warR^HarR^HarR^HarR^?x(dG9v@bN{B3gZQvSME7B-.gqCp^2Ph8Gn%t{9/jtqv]/AcLUhBz(aIfD+gyw]]QUa%prgBuH*mvpK7=A=l8rwfsrSwO(0@BAnSn3lQDlarR^HarR^HarR^HarR^HarU-Cv)82Iv@Dlrxl4{kA4J$2AbGp", "ln": 299112, "col": 117, "line": 561 }, { "b": "vpK7!zF7L9eIF!kiDfjGb0FCkxkzp6xGN}?Aa9SFjzwUB4gjj2arR^HarR^HarR^HarR^HarR^HarUfgvrlGMb6LRyh.D\u003cuAcLUhxF0BAe\u0026EV[t{pz1y\u0026?/:l#)i+wn=Wfavg3*z*9xFB8\u003e+Nb57L9zzcfAv@#TfeJbk5C4S0.jtge^BAzCsj}d\u0026warR^HarR^HarR^H", "ln": 300128, "col": 97, "line": 568 }, { "b": "eN6[Yhe)!Cb0DCyarR^HarR^HarR^HarR^HarR^HjzwUBay/j@B8%F*vpBp@y\u0026%\u0026haA]y)azruhf/9=[t{alcA4J^!y?mj2eIXH)vqH3Gb1Vo.zxIw:wO(0@BrR\u0026GA:}lRx\u003e870flQ]pBz(gKh.Ge{xcGJ4fjX^uj}d\u0026warR^HarR^HarR^HarR^?wb", "ln": 300420, "col": 146, "line": 570 }, { "b": "iajH2wI#nGb0DCyarR^HarR^HarR^HarR^HarR^HjzwUBay/j@B8%F*vpBp@y\u0026%\u0026haA]y{azrt:aARKveN7eMCWhCdwOc3og9N\u0026Hy\u0026?/:nN(WRavQ9TzdNQba%p@Ev)82Iv@DlrC4Cf9z/NA?e]#hGb0FaxwnciJ4gjj2arR^HarR^HarR^HarS^S", "ln": 300662, "col": 112, "line": 572 }, { "b": "eN6[Yhe)!Cb0DCyarR^HarR^HarR^HarR^HarR^HjzwUBay/j@B8%F*vpBp@y\u0026%\u0026haA]zwiDfjGazruhiDfjGaARKveIOw:wOc3of^m-Gy\u0026?/:nN(WRavQ9TzdNQba%p@Ev)82Iv@DlrC4Cf9z/NA\u0026e]#hGb0DCyarR^HarR^HarR^HarR^HjtgkVC0lux", "ln": 300902, "col": 111, "line": 574 }, { "b": "wmx4XwNcB0z/]@dwN)xqy-)h6B-G6rfFkk4CWhHSjzwUB4gjj2arR^HarR^HarR^HarR^HarR^HarUfgvrlGMb4j@4z!%MrwGVgGgCgKcxF0BygJmOAaARKveIO\u003enaz+R3Bs*YOAcLUjayP8djT9Ecz/cW^y?mD{zGE6BB8\u003e+Nb57L9zzbZlz/dgDzF7dS4gjj2arR^HarR^HarR^HarS^1wnciJ4gjj2arQ", "ln": 301129, "col": 76, "line": 577 }, { "b": "azCvHb6dmmzFT2]A+e:0A+5:4uVH76BrS[hfjX^uj}d\u0026Yx\u003ezx]zdK\u0026hA:}lRv}Y[3zdLqgCYWImB7]MgiXJd2ygRc$xj\u003e%]Aa\u003c60zENo@yg}o[v}oK\u0026xLp*:vpr$9vrD9{z.kHhC4\u003eC$B1RcFzepysvqG:#CrEc!x\u003e8g4Aa\u003cfcwG?M\u003carR^HarR^HB98XzwJ.kFx(!lfvr\u003c)RzF%A7j0D\u003cJfkk3svqPNt4gkjizG6-uaAR)FwJ.kHx(4u8azCvHa%FdEvqPNsb4+L9wG\u0026mrBA}XljTaAJB8U@7C@^6=z/fbFb0DCyjy\u0026eHay[]5vj=TOggA0{wIMkSjT87l4gjj2arS^Sx)7Rfvrt{fB$CEUgbAF%ia+q$a%pxivrlGMb4CLeByw)3wPzd0wO+{/By!#\u0026vrb{/a%p@GD2d4Pb4C+oB8M7Way/CgB8#26x(VoVk0gGex)8VH3lQDlauTgGB%7s7Byu+AeIZ=\u003cgI5s3w\u003c4sZay/j@B8%F*vrb{/a%p@GD2d4Pb5y?5BugJ#AcKC!Bz(aVatv+Vj0n-YwoqGCatv+Vj0niFx\u003eIa3iV{a}CSN9kjtgkVC0luxjtgkVC0luxjy\u0026eHazCvHb64m8z/Px1A:J)0y?m9#wN]d*z/o.wk0gGex)8VH3oR\u003ckB%7\u003cFD2d4Pb4kq7iV@cOx([5$y-\u003c)nze:AlByx6eb0FaxwnciJ4gkiJvSb!5j}d\u0026YfkbDAy^4", "ln": 301371, "col": 5, "line": 586 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 301949, "entropy": 6.1 }, "binary": { "peak_region_bytes": 284672, "peak_region_entropy": 6.02 } } }, "id": 7, "mol": "H₃(CmDbU₂)", "path": "f5t1b6v9c2l7r4d-1111.0.3.xpi!!home.html", "pid": 0, "risk": 3, "sha": "e914a2df625d4c06d84c072afec8834f19c13b697e5eba0219dafa3c03f041ba", "size": 301949, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "spans": [ [ 296302, 0 ] ] }, { "id": "micro-behaviors/communications/http/client/resource::stylesheet-remote-import", "conf": 0.9, "crit": 3, "desc": "Stylesheet imports a remote stylesheet", "spans": [ [ 175, 21 ] ] }, { "id": "micro-behaviors/data/format/html::zero-dimension-inline-style", "conf": 0.88, "crit": 3, "desc": "Sets element width and height to zero", "spans": [ [ 301777, 51 ] ] }, { "id": "micro-behaviors/ui/window/hidden-input::hidden-style-input", "conf": 0.9, "crit": 3, "desc": "Display-hidden input", "spans": [ [ 301553, 57 ] ] }, { "id": "micro-behaviors/ui/window/style::css-display-none", "conf": 0.9, "crit": 3, "desc": "CSS display none declaration", "spans": [ [ 294522, 13 ] ] }, { "id": "micro-behaviors/ui/window/style::css-fixed-position", "conf": 0.9, "crit": 3, "desc": "CSS fixed-position declaration", "spans": [ [ 2391, 15 ] ] }, { "id": "micro-behaviors/ui/window/style::css-opacity-zero", "conf": 0.9, "crit": 3, "desc": "CSS opacity zero declaration", "spans": [ [ 1679, 11 ], [ 2660, 11 ] ] }, { "id": "micro-behaviors/ui/window/style::css-visibility-hidden", "conf": 0.9, "crit": 3, "desc": "CSS visibility hidden declaration", "spans": [ [ 2681, 18 ] ] }, { "id": "micro-behaviors/ui/window/style::high-z-index-style", "conf": 0.88, "crit": 3, "desc": "CSS rule sets 7+ digit z-index", "spans": [ [ 294696, 19 ] ] }, { "id": "micro-behaviors/ui/window/style::zero-height-element-style", "conf": 0.92, "crit": 3, "desc": "CSS sets element height to zero", "spans": [ [ 301817, 11 ] ] }, { "id": "micro-behaviors/ui/window/style::zero-width-element-style", "conf": 0.92, "crit": 3, "desc": "CSS sets element width to zero", "spans": [ [ 301805, 10 ] ] } ], "type": "html" }, { "id": 17, "mol": "O(S)Md(Re)", "sha": "e277f3de6d292ba6274ef63aeaf00fb14ace21d0fc679e1331a98888035e7081", "path": "f5t1b6v9c2l7r4d@1111.0.3.registry.json", "risk": 2, "size": 827, "type": "registry", "depth": 1 } ], "omitted_files": 1, "rev": "c1ea9", "v": "8" } }