{
  "llm": {
    "conf": 0.85,
    "grade": "hostile",
    "model": "Qwen/Qwen3.6-27B",
    "review": true,
    "outcome": "hostile",
    "interpretation": "Staged loader detected in archive"
  },
  "ml": {
    "v": "7",
    "eng": "2.2.0-beta.1",
    "lvl": 100,
    "conf": 85,
    "mods": [
      {
        "cls": 0,
        "raw": 0.5769751,
        "rte": "az",
        "prob": 0.5769751
      }
    ],
    "prob": 0.85,
    "files": [
      {
        "id": 0,
        "lvl": 100,
        "conf": 85,
        "prob": 0.8500000238418579,
        "type": "crx"
      },
      {
        "id": 1,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00006663799285888672,
        "type": "png"
      },
      {
        "id": 2,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00005626678466796875,
        "type": "json"
      },
      {
        "id": 3,
        "lvl": -1,
        "conf": 0,
        "prob": 0.0017749369144439697,
        "type": "javascript"
      },
      {
        "id": 4,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00003331899642944336,
        "type": "text"
      },
      {
        "id": 5,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00006663799285888672,
        "type": "json"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-07-05T08:25:38Z"
  },
  "path": "cjkogieodfhbjknfojllgdpnhjceilka.crx",
  "raw": {
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "lVK}s0@@r39r=Ay608iyRueD60u%ib1{(=lnqu\u003cF0rAi800v/N4/!qn0sw)W0rAgY}[Dw{v/",
            "n": [
              {
                "c": 3,
                "d": "Staged loader six file archive",
                "i": "objectives/command-and-control/backdoor/loader/archive::staged-loader-six-files",
                "o": 0,
                "z": 25,
                "cf": 0.949999988079071
              }
            ],
            "ln": 0
          }
        ],
        "mol": "O(C)H(Os)",
        "sha": "af5520cc556ff0a208c016e4b15502e619579d37387ece7aefbc6d9d536d093f",
        "path": "cjkogieodfhbjknfojllgdpnhjceilka.crx",
        "risk": 3,
        "size": 30719,
        "type": "crx",
        "facts": {
          "metrics": {
            "file": {
              "size": 30719.0,
              "entropy": 7.97,
              "size_bytes": 30719.0
            },
            "binary": {
              "overall_entropy": 7.97,
              "peak_region_bytes": 29696.0,
              "peak_region_entropy": 7.82
            },
            "archive": {
              "file_count": 6.0,
              "member_count": 7.0,
              "prefix_bytes": 1321.0,
              "script_count": 1.0,
              "zip_bomb_ratio": 2.4,
              "directory_count": 1.0,
              "executable_count": 0.0,
              "extra_field_size": 0.0,
              "noise_file_count": 0.0,
              "total_compressed": 28546.0,
              "compression.ratio": 0.66,
              "hidden_file_count": 0.0,
              "total_uncompressed": 43201.0,
              "crc_collision_count": 0.0,
              "entry_comment_count": 0.0,
              "max_filename_length": 32.0,
              "rtlo_filename_count": 0.0,
              "format.regular_count": 6.0,
              "nested_archive_count": 0.0,
              "path_traversal_count": 0.0,
              "symlink_escape_count": 0.0,
              "security.setgid_count": 0.0,
              "security.setuid_count": 0.0,
              "security.sticky_count": 0.0,
              "double_extension_count": 0.0,
              "duplicate_member_count": 0.0,
              "format.directory_count": 1.0,
              "security.symlink_count": 0.0,
              "unicode_filename_count": 0.0,
              "homoglyph_filename_count": 0.0,
              "security.encrypted_count": 0.0,
              "timing.mtime_unique_count": 2.0,
              "timing.mtime_unique_ratio": 0.29,
              "misplaced_executable_count": 0.0,
              "timing.mtime_outlier_count": 1.0,
              "timing.mtime_dominant_count": 6.0,
              "timing.mtime_spread_seconds": 2.0,
              "timing.sentinel_mtime_count": 0.0,
              "security.world_writable_count": 0.0,
              "timing.mtime_dominant_fraction": 0.86,
              "compression.method_counts.deflate": 7.0
            }
          }
        },
        "ident": {
          "trust": "self_signed",
          "identifier": {
            "value": "lfoeajgcchlidpicbabpmckkejpckcfb",
            "source": "crx.extension_id",
            "verified": true
          },
          "unique_ids": {
            "crx_id": "lfoeajgcchlidpicbabpmckkejpckcfb",
            "public_key_sha256": "b5e4096227b83f82101fc2aa49f2a251accde3d98471464dd17d1819b43786b0"
          }
        },
        "traits": [
          {
            "id": "micro-behaviors/os/clipboard/access::browser-clipboard-write",
            "atk": "T1115",
            "conf": 0.9200000166893005,
            "crit": 3,
            "desc": "Browser clipboard write API",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/ui/window/manage/dom::dom-element-lookup--getelementbyid",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "getElementById/querySelector (getElementById)",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/data/encode/skip-step::js-loop-string-charat",
            "conf": 0.6000000238418579,
            "crit": 3,
            "desc": "+= string concatenation via charAt",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "objectives/credential-access/theft/keywords::password",
            "crit": 1,
            "desc": "Credential-access vocabulary word: password",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/ui/window/manage/dom::dom-element-lookup",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "getElementById/querySelector DOM lookup",
            "from": [
              {
                "off": 25,
                "file": 3,
                "line": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/ui/window/manage/dom::dom-element-value-read",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "Reads .value property of a DOM element",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "metadata/permission/manifest::chrome-webstore-verified-contents",
            "conf": 0.949999988079071,
            "crit": 1,
            "desc": "Chrome Web Store verified contents"
          },
          {
            "id": "objectives/command-and-control/backdoor/loader/archive::staged-loader-six-files",
            "conf": 0.949999988079071,
            "crit": 3,
            "desc": "Staged loader six file archive",
            "spans": [
              [
                0,
                25
              ]
            ]
          },
          {
            "id": "metadata/signed/platform::web-extension-manifest",
            "conf": 1.0,
            "crit": 1,
            "desc": "Web-extension manifest.json at archive root"
          }
        ]
      },
      {
        "depth": 1,
        "facts": {
          "metrics": {
            "png": {
              "a_entropy": 0.0,
              "chunk_count": 7.0,
              "trailing_bytes": 0.0,
              "idat_chunk_count": 1.0,
              "text_chunk_bytes": 1635.0,
              "chunks_after_iend": 0.0,
              "compression_ratio": 0.78,
              "unknown_chunk_count": 1.0
            },
            "file": {
              "size": 38130.0,
              "entropy": 6.52,
              "size_bytes": 38130.0
            },
            "image": {
              "width": 128.0,
              "height": 128.0,
              "channels": 3.0,
              "b_entropy": 5.04,
              "g_entropy": 5.05,
              "r_entropy": 5.11,
              "edge_density": 0.07,
              "pixel_entropy": 5.82,
              "histogram_flatness": 0.73
            },
            "binary": {
              "overall_entropy": 6.52,
              "peak_region_bytes": 23552.0,
              "peak_region_entropy": 7.8
            }
          }
        },
        "id": 1,
        "path": "cjkogieodfhbjknfojllgdpnhjceilka.crx!!icon128.png",
        "sha": "6acce1627ca9fdc725f6b0a8f329533b46cb09edb599ff5a477b94131ea8d1a4",
        "size": 38130,
        "traits": [
          {
            "id": "metadata/package/files/included::png-extension-basename",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "Filename ends with .png",
            "spans": [
              [
                0,
                11
              ]
            ]
          }
        ],
        "type": "png"
      },
      {
        "ctx": [
          {
            "b": "DJ",
            "n": [
              {
                "c": 2,
                "d": "JSON data format",
                "i": "metadata/file/format::valid",
                "o": 0,
                "z": 13,
                "cf": 0.6000000238418579
              }
            ],
            "ln": 1,
            "addr": 0
          },
          {
            "b": "b6v\u003cnvru6/B-IpxiV]RWBAzFyiXJc@y?WD#BAoh\u0026xk.Z3y?kkez/4dGwPz%dv}vroAaAy0wIL]GA^e=V",
            "ln": 2,
            "addr": 2
          },
          {
            "b": "",
            "ln": 3,
            "addr": 67
          }
        ],
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 352.0,
              "entropy": 4.77,
              "size_bytes": 352.0
            },
            "json": {
              "parsed_bytes": 352.0,
              "parse_limit_bytes": 76800.0
            },
            "binary": {
              "overall_entropy": 4.77,
              "peak_region_bytes": 352.0,
              "peak_region_entropy": 4.77
            }
          }
        },
        "id": 2,
        "path": "cjkogieodfhbjknfojllgdpnhjceilka.crx!!manifest.json",
        "risk": 1,
        "sha": "cc0fb48507a53033ff2fef296bc6e853d0653bc32506925eaec92a0769da2345",
        "size": 352,
        "traits": [
          {
            "id": "metadata/file/format::valid",
            "conf": 0.6000000238418579,
            "crit": 2,
            "desc": "JSON data format",
            "spans": [
              [
                0,
                13
              ]
            ]
          },
          {
            "id": "metadata/file/extension/identity::web-asset-extension",
            "conf": 1.0,
            "crit": 1,
            "desc": "Web asset file extension (css/html/js/json)",
            "spans": [
              [
                0,
                13
              ]
            ]
          }
        ],
        "type": "json"
      },
      {
        "ctx": [
          {
            "b": "v@DmaBrCadB8U@7C{2l)wn+$2zdNQbe[X:qmqMKLwO#PRC$zJ{cVAHnB9zLywg.taB8U@7C{+45",
            "n": [
              {
                "c": 2,
                "d": "Benign encoded JavaScript context",
                "i": "metadata/lang/encoded/unicode-escape::javascript-benign-context",
                "o": 0,
                "z": 8,
                "cf": 1.0
              },
              {
                "c": 1,
                "d": "getElementById/querySelector (getElementById)",
                "i": "micro-behaviors/ui/window/manage/dom::dom-element-lookup--getelementbyid",
                "o": 25,
                "z": 14,
                "cf": 0.8999999761581421
              },
              {
                "c": 1,
                "d": "password/token/api_key field keyword (password)",
                "i": "objectives/credential-access/theft/keywords::credential-field--password",
                "o": 41,
                "z": 8,
                "cf": 0.8399999737739563
              }
            ],
            "ln": 1,
            "addr": 0
          },
          {
            "b": "v@DmaBrCTvx\u003eg^}auZ\u0026Tz!0{bwO#PxxjVfNy?mD{zGFi\u003cnN%j%y?mG%Bz9mEy?WA\u003eAWJp$",
            "ln": 2,
            "addr": 62
          },
          {
            "b": "v@DmaBrCyhzDpgZauZ\u0026Tz!0{bwO#PxxjVfNy?mD{zGFi\u003cnN%j%y?mGoC42hmdlv",
            "ln": 3,
            "addr": 120
          },
          {
            "b": "",
            "ln": 6,
            "addr": 278
          },
          {
            "b": "B8kM3wPxziwmObLwO#P-x(!xczE)\u0026pcUWEqB-X#ZasFVYjW70n",
            "ln": 7,
            "addr": 280
          },
          {
            "b": "arUGizDpgZe{7VHBvf$:By/uiauZ\u0026*y?WA\u003eAXqJzy\u0026%qJ",
            "n": [
              {
                "c": 1,
                "d": "Reads .value property of a DOM element",
                "i": "micro-behaviors/ui/window/manage/dom::dom-element-value-read",
                "o": 351,
                "z": 6,
                "cf": 0.8999999761581421
              },
              {
                "c": 1,
                "d": "Assigns code body into DOM element text",
                "i": "objectives/command-and-control/dropper/execution/browser::dom-script-text-body-assign",
                "o": 330,
                "z": 14,
                "cf": 0.800000011920929
              }
            ],
            "ln": 8,
            "addr": 322
          },
          {
            "b": "Ejmk",
            "ln": 9,
            "addr": 360
          },
          {
            "b": "",
            "ln": 10,
            "addr": 365
          },
          {
            "b": "w{503BzkVhazkn6wPzj3wL=/RB9zLywge(HDJ",
            "n": [
              {
                "c": 1,
                "d": "Node project scaffolder writes files",
                "i": "metadata/build/scaffold::node-project-scaffolder-file-writer",
                "o": 376,
                "z": 16,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 11,
            "addr": 367
          },
          {
            "b": "arUfjzGx[xy?mG%Bz8^WaAIvkwmY^lC42ifwJG",
            "ln": 12,
            "addr": 398
          },
          {
            "b": "arUfjzGx[xv}Yp\u003eB7GCojS\u003e}SvQ\u0026}Ww[L^\u003eyhmT5zF%GlA=VtBC6wgRDo\u003c\u003e+l}6Nnnj=ADoIFnTp/ga?r8($2sxO/Yf!$Kwh8WxMiuZTjbQD+zdKV-Md\u003cv4",
            "ln": 13,
            "addr": 430
          },
          {
            "b": "arUGiBrCQnBxh*^auZ?\u003eb0b",
            "ln": 14,
            "addr": 527
          },
          {
            "b": "arUomAV==DwPP5eauZ\u00263j0nkWjrODKzFa68j0l47x^\u003efK",
            "n": [
              {
                "c": 2,
                "d": "Iteration or loop pattern",
                "i": "micro-behaviors/data/control-flow/analysis::iteration-loop-pattern",
                "o": 548,
                "z": 6,
                "cf": 0.5
              }
            ],
            "ln": 15,
            "addr": 547
          },
          {
            "b": "arR^HA+ft[vqE5pjS[lFvrcB2Bs}6pvraUQc@1b(xF9[kz/oUAo\u003c@cSe]\u003exrwn=rkdiH8.v}Yp\u003eB7GCCy?mG%Bz99Li@",
            "n": [
              {
                "c": 3,
                "d": "+= string concatenation via charAt",
                "i": "micro-behaviors/data/encode/skip-step::js-loop-string-charat",
                "o": 589,
                "z": 25,
                "cf": 0.6000000238418579
              },
              {
                "c": 2,
                "d": "Math.random invocation",
                "i": "micro-behaviors/os/random/prng/stdlib::math-random-call",
                "o": 625,
                "z": 11,
                "cf": 1.0
              }
            ],
            "ln": 16,
            "addr": 585
          },
          {
            "b": "arV7",
            "ln": 17,
            "addr": 660
          },
          {
            "b": "arUieB8U@7C}KhICYVq\u003ezGGDcBrAZ?A+ft[vqF1",
            "ln": 18,
            "addr": 665
          },
          {
            "b": "arUfjzGx[xBy/YsauZ\u0026Tx(!lfvr\u003cFEwQ5q:z/fVdzGE@",
            "ln": 24,
            "addr": 801
          },
          {
            "b": "arUxgasItyCYU5KjV%]ilU{EDyAMbUzE)\u0026%By=TBaBs",
            "ln": 25,
            "addr": 838
          },
          {
            "b": "arR^HzEEZ5xjk[2AXp\u003crx(EK1vrb)hCxdztwMik=BsqlxCYUw!Bzbl6c[3I!jW70n",
            "n": [
              {
                "c": 3,
                "d": "Browser clipboard write API",
                "i": "micro-behaviors/os/clipboard/access::browser-clipboard-write",
                "o": 878,
                "z": 29,
                "cf": 0.9200000166893005
              }
            ],
            "ln": 26,
            "addr": 874
          },
          {
            "b": "arR^HarUfjzGx[xz/PM8x(mu}raQq@auZ\u0026Sz/x$*Bz-ZMwQ5q:z/fVdzGE@",
            "ln": 27,
            "addr": 928
          },
          {
            "b": "arR^HarUfjAcT=(zz33xCYVq\u003ezGGDcBrAZ?b13o/x\u003ep/#b0b",
            "ln": 28,
            "addr": 977
          },
          {
            "b": "arR^HarU-pBw#%\u003ewP8Zkc[3I!jW70nay/teC%VQ\u003ce{7VHBvf$:By/uiauZ\u0026=A+Pf2zEEuXwQ5qUaBL^-f/pTsdlv",
            "n": [
              {
                "c": 2,
                "d": "setTimeout timer usage",
                "i": "micro-behaviors/time/schedule/interval::setTimeout",
                "o": 1023,
                "z": 10,
                "cf": 0.5
              }
            ],
            "ln": 29,
            "addr": 1017
          },
          {
            "b": "arR^HEjmk",
            "ln": 30,
            "addr": 1089
          },
          {
            "b": "arV7",
            "ln": 31,
            "addr": 1098
          }
        ],
        "depth": 1,
        "facts": {
          "imp": [
            [
              "",
              "display"
            ],
            [
              "",
              "document.getElementById"
            ],
            [
              "",
              "slider"
            ],
            [
              "",
              "document.getElementById"
            ],
            [
              "",
              "lenVal"
            ],
            [
              "",
              "document.getElementById"
            ],
            [
              "",
              "genBtn"
            ],
            [
              "",
              "document.getElementById"
            ],
            [
              "",
              "copyBtn"
            ],
            [
              "",
              "document.getElementById"
            ],
            [
              "",
              "slider.addEventListener"
            ],
            [
              "",
              "lenVal.textContent"
            ],
            [
              "",
              "length"
            ],
            [
              "",
              "charset"
            ],
            [
              "",
              "retVal"
            ],
            [
              "",
              "charset.charAt"
            ],
            [
              "",
              "Math.floor"
            ],
            [
              "",
              "Math.random"
            ],
            [
              "",
              "display.textContent"
            ],
            [
              "",
              "genBtn.addEventListener"
            ],
            [
              "",
              "copyBtn.addEventListener"
            ],
            [
              "",
              "text"
            ],
            [
              "",
              "navigator.clipboard.writeText.then"
            ],
            [
              "",
              "navigator.clipboard.writeText"
            ],
            [
              "",
              "originalText"
            ],
            [
              "",
              "copyBtn.textContent"
            ],
            [
              "",
              "setTimeout"
            ],
            [
              "",
              "copyBtn.textContent"
            ],
            [
              "",
              "generatePassword"
            ]
          ],
          "mbr": [
            "Math.floor",
            "Math.random",
            "charset.charAt",
            "charset.length",
            "copyBtn.addEventListener",
            "copyBtn.textContent",
            "display.textContent",
            "document.getElementById",
            "genBtn.addEventListener",
            "lenVal.textContent",
            "navigator.clipboard",
            "navigator.clipboard.writeText",
            "navigator.clipboard.writeText().then",
            "slider.addEventListener",
            "slider.value"
          ],
          "tgt": [
            "Math.floor",
            "Math.random",
            "charset.charAt",
            "copyBtn.addEventListener",
            "document.getElementById",
            "genBtn.addEventListener",
            "generatePassword",
            "navigator.clipboard.writeText",
            "navigator.clipboard.writeText().then",
            "setTimeout",
            "slider.addEventListener"
          ],
          "metrics": {
            "ast": {
              "op.lt": 1.0,
              "op.ne": 1.0,
              "op.add": 1.0,
              "op.mul": 1.0,
              "max_depth": 21.0,
              "bind_count": 15.0,
              "call_count": 15.0,
              "node_count": 379.0,
              "member_count": 15.0,
              "op_density.lt": 0.0,
              "op_density.ne": 0.0,
              "op_density.add": 0.0,
              "op_density.mul": 0.0,
              "identifier_count": 26.0,
              "member_depth_max": 4.0,
              "string_literal_count": 12.0
            },
            "file": {
              "size": 1154.0,
              "entropy": 5.18,
              "size_bytes": 1154.0
            },
            "text": {
              "digit_ratio": 0.02,
              "space_count": 126.0,
              "total_lines": 35.0,
              "char_entropy": 5.18,
              "unique_chars": 89.0,
              "string_density": 0.34,
              "avg_line_length": 31.03,
              "max_line_length": 95.0,
              "empty_line_ratio": 0.14,
              "last_line_length": 19.0,
              "whitespace_ratio": 0.17,
              "most_common_ratio": 0.09,
              "identifier_density": 1.91,
              "line_length_stddev": 24.62,
              "normalized_string_count": 2.03,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 1.0,
              "most_common_char_codepoint": 116.0,
              "suspicious_identifier_ratio": 0.04,
              "normalized_unique_identifiers": 5.07
            },
            "binds": {
              "count": 15.0
            },
            "calls": {
              "count": 15.0
            },
            "binary": {
              "overall_entropy": 5.18,
              "peak_region_bytes": 1154.0,
              "peak_region_entropy": 5.19
            },
            "source": {
              "function_count": 1.0
            },
            "members": {
              "count": 15.0
            },
            "strings": {
              "total": 12.0,
              "avg_length": 13.42,
              "max_length": 74.0,
              "avg_entropy": 3.04,
              "empty_count": 1.0,
              "total_bytes": 161.0,
              "entropy_stddev": 1.13,
              "high_entropy_count": 1.0
            },
            "comments": {
              "chars": 22.0,
              "lines": 1.0,
              "total": 1.0,
              "to_code_ratio": 0.03
            },
            "functions": {
              "count": 1.0,
              "anonymous": 4.0,
              "one_liners": 1.0,
              "length_stddev": 3.44,
              "avg_name_length": 16.0,
              "no_params_count": 5.0,
              "avg_length_lines": 5.6,
              "max_length_lines": 10.0,
              "min_length_lines": 1.0,
              "nested_functions": 2.0,
              "avg_nesting_depth": 0.6,
              "max_nesting_depth": 2.0,
              "density_per_100_lines": 14.29,
              "code_in_functions_ratio": 0.8
            },
            "identifiers": {
              "count": 26.0,
              "total": 67.0,
              "avg_length": 7.69,
              "max_length": 16.0,
              "min_length": 1.0,
              "avg_entropy": 2.54,
              "reuse_ratio": 0.39,
              "unique_count": 26.0,
              "length_stddev": 3.61,
              "sequential_names": 1.0,
              "single_char_count": 1.0,
              "single_char_ratio": 0.04,
              "all_lowercase_ratio": 0.5
            }
          }
        },
        "id": 3,
        "mol": "H(Os)",
        "path": "cjkogieodfhbjknfojllgdpnhjceilka.crx!!popup.js",
        "risk": 2,
        "sha": "8fcf730a9ad0bcdb85270afd343ded1770984f90d66f6e31a9bd3bc36e65e4a6",
        "size": 1154,
        "traits": [
          {
            "id": "micro-behaviors/os/clipboard/access::browser-clipboard-write",
            "atk": "T1115",
            "conf": 0.9200000166893005,
            "crit": 3,
            "desc": "Browser clipboard write API",
            "spans": [
              [
                878,
                29
              ]
            ]
          },
          {
            "id": "micro-behaviors/ui/window/manage/dom::dom-element-lookup--getelementbyid",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "getElementById/querySelector (getElementById)",
            "spans": [
              [
                25,
                14
              ]
            ]
          },
          {
            "id": "micro-behaviors/ui/window/manage/dom::dom-element-value-read",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "Reads .value property of a DOM element",
            "spans": [
              [
                351,
                6
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/encode/skip-step::js-loop-string-charat",
            "conf": 0.6000000238418579,
            "crit": 3,
            "desc": "+= string concatenation via charAt",
            "spans": [
              [
                589,
                25
              ]
            ]
          },
          {
            "id": "objectives/credential-access/theft/keywords::password",
            "crit": 1,
            "desc": "Credential-access vocabulary word: password",
            "spans": [
              [
                41,
                8
              ]
            ]
          },
          {
            "id": "micro-behaviors/ui/window/manage/dom::dom-element-lookup",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "getElementById/querySelector DOM lookup",
            "spans": [
              [
                25,
                14
              ]
            ]
          }
        ],
        "type": "javascript"
      },
      {
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 1201.0,
              "entropy": 4.96,
              "size_bytes": 1201.0
            },
            "binary": {
              "overall_entropy": 4.96,
              "peak_region_bytes": 1201.0,
              "peak_region_entropy": 4.94
            }
          }
        },
        "id": 4,
        "path": "cjkogieodfhbjknfojllgdpnhjceilka.crx!!style.css",
        "sha": "d70a9c3fffb2eb547d1bd414ede859162a6749302bf8cfc9725a3cb084613955",
        "size": 1201,
        "type": "text"
      },
      {
        "ctx": [
          {
            "b": "tydM8wPIv4x(Ffdz/c:Wb6m\u003cpwOtH[xDRn9AV!$dy?j!wb6dEhzE)u=v@DmbwO#Pli^S5\u0026vr(WcvpQMyb4V3(ygn}QfJ}KnfJZ8z",
            "n": [
              {
                "c": 2,
                "d": "JSON data format",
                "i": "metadata/file/format::valid",
                "o": 0,
                "z": 22,
                "cf": 0.6000000238418579
              }
            ],
            "ln": 0
          }
        ],
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 1728.0,
              "entropy": 5.97,
              "size_bytes": 1728.0
            },
            "json": {
              "parsed_bytes": 1728.0,
              "parse_limit_bytes": 76800.0
            },
            "binary": {
              "overall_entropy": 5.97,
              "peak_region_bytes": 1728.0,
              "peak_region_entropy": 6.01
            }
          }
        },
        "id": 5,
        "path": "cjkogieodfhbjknfojllgdpnhjceilka.crx!!_metadata/verified_contents.json",
        "risk": 1,
        "sha": "c85882087e326b3a6b5cfe5fb95548c2a1a89e94c4f03d82f52699c03b0dd034",
        "size": 1728,
        "traits": [
          {
            "id": "metadata/file/format::valid",
            "conf": 0.6000000238418579,
            "crit": 2,
            "desc": "JSON data format",
            "spans": [
              [
                0,
                22
              ]
            ]
          },
          {
            "id": "metadata/file/extension/identity::web-asset-extension",
            "conf": 1.0,
            "crit": 1,
            "desc": "Web asset file extension (css/html/js/json)",
            "spans": [
              [
                0,
                22
              ]
            ]
          }
        ],
        "type": "json"
      }
    ],
    "rev": "868bd",
    "v": "8"
  }
}