33:"SampleDetailWrapper" 34:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$33"] 38:I[99539,["$1","$2","$3","$4","$5"],"IconMark"] 35:T57a,Pattern match: "https://+b+/onecollector/1.0+", Pattern match: "http://localhost:8080/,innerheight:768,devicepixelratio:1,canusecssgrid:!1,requestid:0,cookie:,useragent:,referer:,oneserviceheaders:,vpcetotoken", Pattern match: "http://x,void", Pattern match: "http://a#", Heuristic match: "!w){var i=u>typeof document&&document.cookie.split(; );w={};for(var a=i&&i.length,c=0;ca(t*=1)?(i(t)-i(-t))/2:(c(t-1)-c(-t-1))*(u/2)}})},95140:function(t,e", Pattern match: "https://adsdk.microsoft.com/ast/ast.js;function"36:T112e,Found reference to API "tion(){if(!Y.get(tr)){var t=to();Y.set(tr,t.toLowerCase().split("-")[1])}return Y.get(tr)};function tc(){if(!K()||tl())return!1;var t=window.sapphireWebViewBridge,e=window.webkit,n=t&&t.send,r=e&&e.messageHandlers&&e.messageHandlers.send&&e.messageHandlers.send.postMessage;return!!(n||r)}function tu(){return!(!K()||tl())&&(tc()||"onostartapp"===tt()||Q.includes(tt()))}function ts(){var t=tp("edge");return("emmx"===ti()||"1"===t)&&tu()||"mmx"===tt()}function tf(){return["launcherntp","launcherinterests"].includes(tt())&&tu()}function tl(){return"swiftkey"===tt().toLowerCase()||"swiftkey"==ti().toLowerCase()}var th=X(function(){var t,e;return tc()||(t=to()&&"outlook"===ti()&&["ios","android","ipados"].includes(ta()),e="onooutlookmobile"===tt(),t||e)||tu()||"weather-app-win"===tt()||"finance-app-win"===tt()||ts()||"3rdp"===ti()||tt().startsWith("xmweather-")||tl()||tf()||tl()||-1!==window.location.href.indexOf("metaos=true")||window&&!!window._isCopilotBridge||"copilot"===tp("MBApp")||!!K()&&"cp_msn_cmc"===tt()&" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API "{hostName}/{localeCode}/play"}]);var ef=function(){function t(){this.childCookieName="child",this.command="command",this.domInfo=document.head.dataset.info,this.canvasInfo=document.head.dataset.canvasInfo||""}return t.prototype.init=function(t,e){this.clientSettings=t||tj(),this.authCookieName=P||window._authCookieName||"",this.bundle=window._webWorkerBundle||"",e=e||{};var n=this.buildWebWorkerUrl(this.clientSettings,e),r=window.webWorker=this.createWebWorkerInstance(n);r?this.initCore(r):console.warn("Error while initializing the web worker.")},t.prototype.initCore=function(t){var e=this,n=window.webWorkerMessages=[];t.onmessage=function(t){n.push(t.data)};var r=window.webWorkerErrors=[];t.onerror=function(t){r.push(t)},ee()&&Y.get(eu).promise.then(function(n){return t.postMessage({id:"AuthHeaders",type:e.command,payload:n||{}})})},t.prototype.createWebWorkerInstance=function(t){return new Worker(t,{name:"web-worker"})},t.prototype.shouldFetchAppAnonCookie=function(){return!0},t.prototype.getAudienceMode=fu" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API "";t.exports=function(t){return r(function(){return!!o[t]()||i[t]()!=i||o[t].name!==t})}},23028:function(t,e,n){var r=n(18236),o="["+n(78418)+"]",i=RegExp("^"+o+o+"*"),a=RegExp(o+o+"*$"),c=function(t){return function(e){var n=String(r(e));return 1&t&&(n=n.replace(i,"")),2&t&&(n=n.replace(a,"")),n}};t.exports={start:c(1),end:c(2),trim:c(3)}},65699:function(t,e,n){var r,o,i,a=n(61905),c=n(24893),u=n(9118),s=n(93423),f=n(56309),l=n(70021),h=n(77810),p=a.location,d=a.setImmediate,v=a.clearImmediate,g=a.process,y=a.MessageChannel,m=a.Dispatch,w=0,b={},x="onreadystatechange",S=function(t){if(b.hasOwnProperty(t)){var e=b[t];delete b[t],e()}},E=function(t){return function(){S(t)}},A=function(t){S(t.data)},O=function(t){a.postMessage(t+"",p.protocol+"//"+p.host)};d&&v||(d=function(t){for(var e=[],n=1;arguments.length>n;)e.push(arguments[n++]);return b[++w]=function(){("function"==typeof t?t:Function(t)).apply(void 0,e)},r(w),w},v=function(t){delete b[t]},h?r=function(t){g.nextTick(E(t))}:m&&m.now?r=function(t){m.now(E(" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API "t))}:y&&!l?(i=(o=new y).port2,o.port1.onmessage=A,r=u(i.postMessage,i,1)):a.addEventListener&&"function"==typeof postMessage&&!a.importScripts&&p&&"file:"!==p.protocol&&!c(O)?(r=O,a.addEventListener("message",A,!1)):r=x in f("script")?function(t){s.appendChild(f("script"))[x]=function(){s.removeChild(this),S(t)}}:function(t){setTimeout(E(t),0)}),t.exports={set:d,clear:v}},64234:function(t,e,n){var r=n(35562);t.exports=function(t){if("number"!=typeof t&&"Number"!=r(t))throw TypeError("Incorrect invocation");return+t}},7556:function(t,e,n){var r=n(91720),o=Math.max,i=Math.min;t.exports=function(t,e){var n=r(t);return n<0?o(n+e,0):i(n,e)}},14146:function(t,e,n){var r=n(91720),o=n(8040);t.exports=function(t){if(void 0===t)return 0;var e=r(t),n=o(e);if(e!==n)throw RangeError("Wrong length or index");return n}},62355:function(t,e,n){var r=n(55485),o=n(18236);t.exports=function(t){return r(o(t))}},91720:function(t){var e=Math.ceil,n=Math.floor;t.exports=function(t){return isNaN(t*=1)?0:(t>0?n:e)(t)}},8040:function(t" (Indicator: "postmessage"; Source: "sample.bin")37:T426,Found string - ).length>3})}},13661:function(t,e,n){var r=n(91720),o=n(18236),i=function(t){return function(e,n){var i,a,c=String(o(e)),u=r(n),s=c.length;return u<0||u>=s?t?"":void 0:(i=c.charCodeAt(u))<55296||i>56319||u+1===s||(a=c.charCodeAt(u+1))<56320||a>57343?t?c.charAt(u):i:t?c.slice(u,u+2):(i-55296<<10)+(a-56320)+65536}};t.exports={codeAt:i(!1),charAt:i(!0)}},26329:function(t,e,n){var r=n(97546);t.exports=/Version\/10(?:\.\d+){1,2}(?: [\w./]+)?(?: Mobile\/\w+)? Safari\//.test(r)},85407:function(t,e,n){var r=n(8040),o=n(15119),i=n(18236),a=Math.ceil,c=function(t){return function(e,n,c){var u,s,f=String(i(e)),l=f.length,h=void 0===c?" ":String(c),p=r(n);return p<=l||""==h?f:(u=p-l,(s=o.call(h,a(u/h.length))).length>u&&(s=s.slice(0,u)),t?f+s:s+f)}};t.exports={start:c(!1),end:c(!0)}},82287:function(t){var e=/[^\0-\u007E]/,n=/[.\u3002\uFF0E\uFF61]/g,r="Overflow: input needs wider integers to process",o=Math.floor,i=String.fromCharCode,a=function(t){for(var e=[],n=0,r=t.length;n=55296&&o<=; Source: "sample.bin")30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"TechArticle\",\"headline\":\"Sample 49a35823b7bc… — Score 0/100 — Hybrid Analysis\",\"description\":\"Threat analysis for sample 49a35823b7bc…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.\",\"url\":\"/sample/49a35823b7bc7ad0119d3603892f12dbcbce98bff92414e6dcf7bd4b47038d5c\",\"keywords\":[\"malware analysis\",\"sandbox report\",\"threat intelligence\",\"49a35823b7bc7ad0119d3603892f12dbcbce98bff92414e6dcf7bd4b47038d5c\"],\"about\":{\"@type\":\"SoftwareApplication\",\"name\":\"FCN6LXPM.htm\",\"applicationCategory\":[\"html\"],\"identifier\":\"49a35823b7bc7ad0119d3603892f12dbcbce98bff92414e6dcf7bd4b47038d5c\"},\"threatScore\":0,\"antivirusDetections\":{\"malicious\":0,\"total\":24},\"behavioralIndicators\":{\"malicious\":0,\"suspicious\":0},\"publisher\":{\"@type\":\"Organization\",\"name\":\"Hybrid Analysis\",\"url\":\"https://www.hybrid-analysis.com\"}}"}}],["$","$L34",null,{"initialData":{"schema_version":"1.0.17","sha256":"49a35823b7bc7ad0119d3603892f12dbcbce98bff92414e6dcf7bd4b47038d5c","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1794023077360,"unified_at":"2026-11-07T03:44:37.360Z","metadata":{"hashes":{"sha256":"49a35823b7bc7ad0119d3603892f12dbcbce98bff92414e6dcf7bd4b47038d5c","sha1":"3c85aa01bc00b202b1eb0ef81b2968b2b67609ba","md5":"d738d6d5006ec5660b904c254b3803da"},"file_info":{"file_name":"FCN6LXPM.htm","file_type":["html"],"file_type_id":"html","file_size":145319,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1794023070000,"last_seen":1794023071000,"last_multi_scan":1794023071000}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":8},"sandbox_signatures":{"informative_count":8,"suspicious_count":0,"malicious_count":0,"total":8},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decrypt/decode data"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Able to access browser directory location"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Able to access file/directory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"References JavaScript(s)"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$35","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://assets.msn.com\", Found HTTPS url \"https://ent\", Found HTTPS url \"https://a\", Found HTTPS url \"https://adsdk.microsoft.com\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to access file/directory","description":"file/memory contains long string with (Indicator: \".delete(\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-779","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$36","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"References JavaScript(s)","description":"file/memory contains long string with (Indicator: \"text/javascript\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.007","id":"string-626","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"file/memory contains long string with (Indicator: \"fromcharcode\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-356","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"$37","origin":"sample.bin","mitre_attack_id":"T1564","id":"string-145","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access browser directory location","description":"file/memory contains long string with (Indicator: \"chromium/\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1005","id":"string-10089","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 2c:[["$","title","0",{"children":"Sample 49a35823b7bc… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample 49a35823b7bc…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/49a35823b7bc7ad0119d3603892f12dbcbce98bff92414e6dcf7bd4b47038d5c"}],["$","meta","4",{"property":"og:title","content":"Sample 49a35823b7bc… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample 49a35823b7bc…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/49a35823b7bc7ad0119d3603892f12dbcbce98bff92414e6dcf7bd4b47038d5c"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample 49a35823b7bc… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample 49a35823b7bc…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L38","11",{}]] 32:null