33:"SampleDetailWrapper" 34:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$33"] 3b:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 35:T1d27,Found reference to API (Indicator: "GetStockObject"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "Process32FirstW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWindowExW"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpQueryDataAvailable"; Source: "sample.bin"), Found reference to API (Indicator: "DefWindowProcW"; Source: "sample.bin"), Found reference to API (Indicator: "CoInitializeEx"; Source: "sample.bin"), Found reference to API (Indicator: "TranslateMessage"; Source: "sample.bin"), Found reference to API (Indicator: "SystemParametersInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowPos"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SetClipboardData"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseCapture"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpOpen"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeSListHead"; Source: "sample.bin"), Found reference to API (Indicator: "SHCreateStreamOnFileEx"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFile2"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathW"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount64"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "SizeofResource"; Source: "sample.bin"), Found reference to API (Indicator: "LoadCursorW"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalLock"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "CloseClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "sample.bin"), Found reference to API (Indicator: "UpdateWindow"; Source: "sample.bin"), Found reference to API (Indicator: "AreFileApisANSI"; Source: "sample.bin"), Found reference to API (Indicator: "CoTaskMemFree"; Source: "sample.bin"), Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "sample.bin"), Found reference to API (Indicator: "EnumWindows"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpSetTimeouts"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetClientRect"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpOpenRequest"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpCloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "PostQuitMessage"; Source: "sample.bin"), Found reference to API (Indicator: "PathRemoveFileSpecW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpSendRequest"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowRect"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcess"; Source: "sample.bin"), Found reference to API (Indicator: "ShellExecuteW"; Source: "sample.bin"), Found reference to API (Indicator: "EnumChildWindows"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpConnect"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "CoCreateInstance"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileInformationByHandle"; Source: "sample.bin"), Found reference to API (Indicator: "EmptyClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpQueryHeaders"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalUnlock"; Source: "sample.bin"), Found reference to API (Indicator: "SearchPathW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessW"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "LoadResource"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpReceiveResponse"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileW"; Source: "sample.bin"), Found reference to API (Indicator: "Process32NextW"; Source: "sample.bin"), Found reference to API (Indicator: "GetOpenFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "CoUninitialize"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "sample.bin"), Found reference to API (Indicator: "LockResource"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpReadData"; Source: "sample.bin"), Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "IsZoomed"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "OpenClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "FindResourceW"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetKnownFolderPath"; Source: "sample.bin")36:T22f6,Pattern match: "https://www.roblox.com/share?code=...&type=server`,style:{width:`100%`,padding:`8px", Pattern match: "https://appassets.local/*", Pattern match: "https://www.roblox.com/home;`;navigator.clipboard?.writetext(e)}catch{}return", Pattern match: "https://www.alowyy1.com`,onclick:e=", Pattern match: "http://www.w3.org/2000/svg", Heuristic match: "accountinformation.roblox.com", Pattern match: "https://react.dev/errors/`+e;if", Heuristic match: ".roblox.com", Pattern match: "https://www.roblox.com/users/${e}/profile", Pattern match: "tr.rbxcdn.com/180day-1234c9c1ef34a170560b240ffcf80d44/420/420/bundle/webp/nofilter", Pattern match: "https://tr.rbxcdn.com/180day-da1eb33246eb5cf08cb36db49b1caab3/420/420/bundle/webp/nofilter", Pattern match: "https://appassets.local/index.html", Pattern match: "http://www.w3.org/2000/svg`:return", Pattern match: "https://www.rolimons.com/item/${e.asset_id", Heuristic match: "=i.indexes.var.length&&r.indexes.color.length===i.indexes.color.length&&r.indexes.number.length>=i.indexes.number.length?nn.has(e)&&!i.values.length||nn.has(t)&&!r.values.length?rn(e,t):ae(sn(ln(r,i),i.values),n):(`${e}${t}`,xt(e,t))},dn=/^(-?(?:\d+(?:\.\d", Heuristic match: "apis.roblox.com", Heuristic match: "`})]},e.key))]})}),(0,v.jsx)(`tbody`,{children:$.length===0?(0,v.jsx)(`tr`,{children:(0,v.jsx)(`td`,{colspan:3+st.length,classname:`rp-empty`,children:y.length===0?`no results yet`:`no valid accounts found`})}):$.map(e=>{let t=e._index;return(0,v.jsxs)(`tr", Pattern match: "http://www.w3.org/2000/svg'%3e%3cfilter", Pattern match: "https://appassets.local", Pattern match: "https://assetdelivery.roblox.com/v1/asset/?id=${e.assetid}`}catch{}return", Heuristic match: "accountsettings.roblox.com", Pattern match: "https://economy.roblox.com/v2/users/${e}/transactions?transactiontype=${n}&limit=20${r?`&cursor=${encodeuricomponent(r)}`:``}`,t,6e3", Heuristic match: "users.roblox.com", Pattern match: "https://www.roblox.com/users/${s}/profile`:void", Heuristic match: "&(n.status=`fulfilled`,n.value=t))},function(t){(e._status===0||e._status===-1)&&(e._status=2,e._result=t,n.status===void 0&&(n.status=`rejected`,n.reason=t))}),e._status===-1&&(e._status=0,e._result=n)}if(e._status===1)return e._result.default;throw e._re", Pattern match: "https://www.roblox.com/catalog/${e.assetid", Heuristic match: "display:flex}.settings-group-header{border-bottom:1px solid #ffffff0d;align-items:center;gap:8px;padding-bottom:10px;display:flex}.settings-group-icon{color:var(--text-secondary)}.settings-group-title{color:#fff;letter-spacing:-.2px;font-size:14px;font-wei", Heuristic match: ".unsuspend)){var t=e.unsuspend;e.unsuspend=null,t()}},(e.imgbytes>$m?50:800)+t);return e.unsuspend=n,function(){e.unsuspend=null,cleartimeout(r),cleartimeout(i)}}:null}function th(e){if(e.count===0&&(e.imgcount===0||!e.waitingforimages)){if(e.stylesheets)a", Heuristic match: "twostepverification.roblox.com", Pattern match: "https://www.rolimons.com/item/${e}`,`_blank", Heuristic match: "ylesheet`,href:e,data-precedence:t},n),(n=vm.get(a))&&hm(e,n);var c=o=r.createelement(`link`);ht(c),np(c,`link`,e),c._p=new promise(function(e,t){c.onload=e,c.onerror=t}),c.addeventlistener(`load`,function(){s.loading|=1}),c.addeventlistener(`error`,func", Pattern match: "https://www.roblox.com/", Heuristic match: "er(.2,.8,.2,1),box-shadow .22s;display:flex;overflow:visible}.settings-field>.animated-combobox.is-open{width:min(340px,100%)}.settings-field>.animated-combobox .animated-combobox-trigger{justify-content:space-between;width:100%;max-width:100%}.settings-fi", Pattern match: "https://economy.roblox.com/v2/users/${e}/transaction-totals?timeframe=month&transactiontype=summary`,t,5e3", Pattern match: "https://inventory.roblox.com/v2/users/${e}/inventory?assettypes=shirt,pants,tshirt,hat,hairaccessory,faceaccessory,neckaccessory,shoulderaccessory,frontaccessory,backaccessory,waistaccessory&limit=100&sortorder=desc`,t,7e3", Pattern match: "https://www.roblox.com/catalog/${e.asset_id", Heuristic match: "ion wl(e){return typeof e!=`string`||e.includes(`-`)?!1:!!(cl.indexof(e)>-1||/[a-z]/u.test(e))}function tl(e,t,n,{latestvalues:r},i,a=!1,o,s){let c=(o??wl(e)?vl:gl)(t,r,i,e),l=sl(t,typeof e==`string`,a,s),u=e===d.fragment?{}:{...l,...c,ref:n},{children:d}=", Pattern match: "www.alowyy1.com", Heuristic match: "[`xmlnsxlink`,`xmlns:xlink`],[`xheight`,`x-height`]]),xn=/^[\u0000-\u001f ]*j[\r\n\t]*a[\r\n\t]*v[\r\n\t]*a[\r\n\t]*s[\r\n\t]*c[\r\n\t]*r[\r\n\t]*i[\r\n\t]*p[\r\n\t]*t[\r\n\t]*:/i;function sn(e){return xn.test(``+e)?`javascript:throw new error('react has b", Pattern match: "http://www.w3.org/2000/svg`,a", Pattern match: "https://discord.com/api/webhooks/...`,value:t.webhookurl,onchange:e=", Pattern match: "https://tr.rbxcdn.com/30day-avatarheadshot-652a5d961b5f5188c49d1b0314ec7de3-png/150/150/avatarheadshot/png/iscircular`,robux:20,mm2level:10},ed=[{name:`green`,color:`#50dc78`},{name:`blue`,color:`#3b82f6`},{name:`purple`,color:`#a855f7`},{name:`gold`,color", Heuristic match: " e=0;e`isthemegetter`in e&&e.isthemegetter===!0,ar=e=>{if(e<1)return{get:()=>void 0,set:()=>{}};let t=0,n=object.create(null),r=object.create(null),i=(i,a)=>{n[i]=a,", Pattern match: "https://www.roblox.com/home", Heuristic match: "auth.roblox.com", Heuristic match: "inventory.roblox.com", Heuristic match: "outdependency:t,visualelement:n,drag:r,ispresent:i}=this.props,{projection:a}=n;return a?(a.ispresent=i,e.layoutdependency!==t&&a.setoptions({...a.options,layoutdependency:t}),du=!0,r||e.layoutdependency!==t||t===void 0||e.ispresent!==i?a.willupdate():this", Pattern match: "https://tr.rbxcdn.com/180day-da1eb33246eb5cf08cb36db49b1caab3/420/420/bundle/webp/nofilter`,category:`bundle`,owners:[],totalamount:0", Pattern match: "http://www.w3.org/2000/svg`,width:24,height:24,viewbox:`0", Pattern match: "https://fonts.cdnfonts.com/css/google-sans;@font-face{font-family:sf", Pattern match: "x.done/math.max(x.total,1)*100", Heuristic match: "games.roblox.com", Pattern match: "https://tr.rbxcdn.com/180day-1234c9c1ef34a170560b240ffcf80d44/420/420/bundle/webp/nofilter`,category:`bundle`,owners:[],totalamount:0", Pattern match: "http://127.0.0.1:4567/api/roblox-proxy?url=${a}&cookie=${o}`];for", Heuristic match: "y||r.items||r.pets||[],i=t.filter(e=>{let t=string(e.name||e.id||``).tolowercase();return t!==`coins`&&t!==`diamonds`&&t!==`coin`&&t!==`currency`&&string(e.category||``).tolowercase()!==`currency`});n={...e,_ps99_inventory:t,ps99_items:i.length>0?`${i.leng", Heuristic match: "economy.roblox.com", Pattern match: "http://www.w3.org/1999/xlink`,`xlink:href`,n", Pattern match: "math.pi/(e.visualduration*1.2);i.stiffness=t*t,i.damping=2*k(.05,1,1-(e.bounce||0))*math.sqrt(i.stiffness)}else", Pattern match: "https://www.roblox.com/users/${t}/profile", Heuristic match: "{this.node.animationstate.reset(),this.unmountcontrols?.()}},gl=0,kl={animation:{feature:wl},exit:{feature:class extends wo{constructor(){super(...arguments),this.id=gl++,this.isexitcomplete=!1}update(){if(!this.node.presencecontext)return;let{ispresent:e,", Pattern match: "https://tr.rbxcdn.com/30day-avatarheadshot-310966282d3529e36976bf6b07b1dc90-png/150/150/avatarheadshot/png/nofilter`;function", Pattern match: "https://www.roblox.com/share?code=812961e851f09b478746672e2f2cde5f&type=server", Pattern match: "https://tr.rbxcdn.com/30day-avatarheadshot-652a5d961b5f5188c49d1b0314ec7de3-png/150/150/avatarheadshot/png/iscircular`,robux:20,mm2level:10};function", Pattern match: "https://flagcdn.com/24x18/${i}.png`,srcset:`https://flagcdn.com/48x36/${i}.png", Pattern match: "http://127.0.0.1:4567/report`,{method:`post`,headers:{content-type:`application/json`},body:json.stringify({action:`transfer_robux`,cookies:e.cookies,cookie:e.cookie,minrobux:t})", Pattern match: "http://127.0.0.1:${e}/mcp`,{method:`post`,headers:{content-type:`application/json`,accept:`application/json", Pattern match: "https://www.roblox.com/users/", Heuristic match: ",n.jsxs)(`div`,{classname:`limiteds-modal-badges`,children:[_.isoffsale&&(0,n.jsxs)(`span`,{classname:`limiteds-modal-badge offsale`,children:[(0,n.jsx)(r,{size:10}),` `,y.offsale||`offsale`]}),(0,n.jsx)(`span`,{classname:`limiteds-modal-badge category`,ch", Heuristic match: ";height:100%;display:flex}.page-slot[hidden]{opacity:0;pointer-events:none;z-index:0}.modules-page,.settings-page{box-sizing:border-box;min-width:0}.modules-grid{grid-template-columns:repeat(auto-fill,minmax(min(100%,215px),1fr));min-width:0}.module-card{m", Pattern match: "https://thumbnails.roblox.com/v1/users/avatar-bust?userids=${e}&size=420x420&format=png&iscircular=false`,void", Pattern match: "https://discord.com/api/webhooks/...`,value:d.webhookurl,onchange:e=", Heuristic match: "premiumfeatures.roblox.com", Heuristic match: "badges.roblox.com", Heuristic match: "thumbnails.roblox.com"37:T864,Found reference to API "WinHttpQueryDataAvailable" (Indicator: "WinHttpQueryDataAvailable"; Source: "sample.bin"), Found reference to API "WinHttpOpenRequest failed: " (Indicator: "WinHttpOpen"; Source: "sample.bin"), Found reference to API "WinHttpOpenRequest failed: " (Indicator: "WinHttpOpenRequest"; Source: "sample.bin"), Found reference to API "WinHttpSendRequest failed (" (Indicator: "WinHttpSendRequest"; Source: "sample.bin"), Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "sample.bin"), Found reference to API "WinHttpConnect failed (" (Indicator: "WinHttpConnect"; Source: "sample.bin"), Found reference to API "WinHttpSetTimeouts" (Indicator: "WinHttpSetTimeouts"; Source: "sample.bin"), Found reference to API "WinHttpReceiveResponse failed (" (Indicator: "WinHttpReceiveResponse"; Source: "sample.bin"), Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "sample.bin"), Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "sample.bin"), Found reference to API "WinHttpConnect failed: " (Indicator: "WinHttpConnect"; Source: "sample.bin"), Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; Source: "sample.bin"), Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "sample.bin"), Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "sample.bin"), Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "sample.bin"), Found reference to API "WinHttpOpen failed: " (Indicator: "WinHttpOpen"; Source: "sample.bin"), Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; Source: "sample.bin"), Found reference to API "WinHttpOpenRequest failed (" (Indicator: "WinHttpOpen"; Source: "sample.bin"), Found reference to API "WinHttpOpenRequest failed (" (Indicator: "WinHttpOpenRequest"; Source: "sample.bin"), Found reference to API "WinHttpOpen failed (" (Indicator: "WinHttpOpen"; Source: "sample.bin"), Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "sample.bin")38:T849,Found reference to API "WinHttpOpenRequest failed: " (Indicator: "HttpOpenRequest"; Source: "sample.bin"), Found reference to API "WinHttpOpenRequest failed: " (Indicator: "WinHttpOpen"; Source: "sample.bin"), Found reference to API "WinHttpOpenRequest failed: " (Indicator: "WinHttpOpenRequest"; Source: "sample.bin"), Found reference to API "WinHttpSendRequest failed (" (Indicator: "HttpSendRequest"; Source: "sample.bin"), Found reference to API "WinHttpSendRequest failed (" (Indicator: "WinHttpSendRequest"; Source: "sample.bin"), Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "sample.bin"), Found reference to API "WinHttpConnect failed (" (Indicator: "WinHttpConnect"; Source: "sample.bin"), Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "sample.bin"), Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "sample.bin"), Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "sample.bin"), Found reference to API "WinHttpConnect failed: " (Indicator: "WinHttpConnect"; Source: "sample.bin"), Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "sample.bin"), Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "sample.bin"), Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "sample.bin"), Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "sample.bin"), Found reference to API "WinHttpOpen failed: " (Indicator: "WinHttpOpen"; Source: "sample.bin"), Found reference to API "WinHttpOpenRequest failed (" (Indicator: "HttpOpenRequest"; Source: "sample.bin"), Found reference to API "WinHttpOpenRequest failed (" (Indicator: "WinHttpOpen"; Source: "sample.bin"), Found reference to API "WinHttpOpenRequest failed (" (Indicator: "WinHttpOpenRequest"; Source: "sample.bin"), Found reference to API "WinHttpOpen failed (" (Indicator: "WinHttpOpen"; Source: "sample.bin"), Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "sample.bin")39:T460d,Found reference to API "`});if(typeof window.chrome?.webview?.postMessage==`function`)return window.chrome.webview.postMessage({type:`fast_login_roblox`,cookie:n,username:t.replace(/^@/,``)}),Promise.resolve({ok:!0});try{let e=`document.cookie = ".ROBLOSECURITY=${n}; domain=.roblox.com; path=/"; location.href = "https://www.roblox.com/home";`;navigator.clipboard?.writeText(e)}catch{}return window.open(`https://www.roblox.com/home`,`_blank`),Promise.resolve({ok:!0})}function kt(){try{sessionStorage.removeItem(`checker.consoleLogs`),sessionStorage.removeItem(`checker.resultsByModule`),nt(),localStorage.removeItem(`checker.selectedFolder`)}catch{}try{window.dispatchEvent(new CustomEvent(`lanaya:clear-all-logs`))}catch{}return typeof window.chrome?.webview?.postMessage==`function`?new Promise(e=>{let t=n=>{try{let r=typeof n.data==`string`?JSON.parse(n.data):n.data;r&&r.type===`logs_cleared`&&(window.chrome.webview.removeEventListener(`message`,t),e({ok:!0}))}catch{}};window.chrome.webview.addEventListener(`message`,t),window.chrome.web" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API "` `).replace(/\b\w/g,e=>e.toUpperCase())}async function M(e,t){return e?typeof window.chrome?.webview?.postMessage==`function`?(window.chrome.webview.postMessage({type:`launch_roblox_account`,cookie:e,placeId:t}),!0):(alert(`Launching Roblox requires native desktop client`),!1):!1}var N=_();function P({items:n,onFindItem:i,onViewOnRoblox:a,onLaunchAccount:o}){let[s]=(0,k.useState)(m),[c,l]=(0,k.useState)(``),[u,f]=(0,k.useState)(`price-desc`),[p,h]=(0,k.useState)(!1),[_,v]=(0,k.useState)(null),y=(0,k.useMemo)(()=>g[s].items,[s]),b=(0,k.useMemo)(()=>{let e=[...n];if(c){let t=c.toLowerCase();e=e.filter(e=>e.name.toLowerCase().includes(t))}return p&&(e=e.filter(e=>e.isOffsale)),e.sort((e,t)=>{switch(u){case`price-desc`:return e.isOffsale===t.isOffsale?t.recentAveragePrice-e.recentAveragePrice:e.isOffsale?-1:1;case`price-asc`:return e.isOffsale===t.isOffsale?e.recentAveragePrice-t.recentAveragePrice:e.isOffsale?-1:1;case`name`:return e.name.localeCompare(t.name);case`recent`:return 0;default:return 0}}),e},[n,c,u" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "sample.bin"), Found reference to API "wait navigator.clipboard.writeText(e),!0}catch{}try{let t=document.createElement(`textarea`);t.value=e,t.style.position=`fixed`,t.style.left=`-999999px`,t.style.top=`-999999px`,document.body.appendChild(t),t.focus(),t.select();let n=document.execCommand(`copy`);return t.remove(),n}catch{return!0}}function dt(e,t){if(typeof window.chrome?.webview?.postMessage==`function`){let n=t?.shutdownOnFinish;if(n===void 0)try{n=window.localStorage.getItem(`checker.shutdownOnFinish`)===`true`}catch{}return window.chrome.webview.postMessage({type:`start_roblox_check`,folder:e,threads:t?.threads,timeout:t?.timeout,retries:t?.retries,mm2Enabled:t?.mm2Enabled,mm2MinLevel:t?.mm2MinLevel,adoptMeEnabled:t?.adoptMeEnabled,ps99Enabled:t?.ps99Enabled,daHoodEnabled:t?.daHoodEnabled,counterbloxEnabled:t?.counterbloxEnabled,wartycoonEnabled:t?.wartycoonEnabled,shutdownOnFinish:!!n}),Promise.resolve({ok:!0})}return Promise.resolve({ok:!1,error:`Desktop host WebView2 required`})}function ft(){return typeof window.chrome?.webview?.postMe" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API ".`,error:!1}),window.chrome?.webview&&window.chrome.webview.postMessage(JSON.stringify({type:`save_drainer_config`,enabled:R,gamePassId:Et,adminCookie:z,adminUsername:e.username||``,adminUserId:e.userId||0,minRobux:V}))):(Pt(null),Nt({text:e.error||`" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API "e.user)===String(l.user))||t.push(l),t})}catch(e){console.error(`Error transferring account items to admin:`,e)}}function ot(){try{let e=et(),t=(window.localStorage.getItem(`checker.admin.username`)||`LavaCrest3`).toLowerCase(),n=String(window.localStorage.getItem(`checker.admin.userId`)||`11592861100`);for(let r of Object.keys(e)){let i=e[r];if(!i)continue;let a=String(i.user||``).toLowerCase(),o=String(i.user_id||``);a===t||o===n||i._is_admin||at(r,`All`)}}catch(e){console.error(`Error transferring all to admin:`,e)}}var st=`ws://127.0.0.1:8765/ws`;function ct(){if(typeof window.chrome?.webview?.postMessage==`function`){let e=window.chrome.webview;return new Promise(t=>{let n=!1,r=i=>{try{let a=i.data;if(typeof a==`string`)try{a=JSON.parse(a)}catch{}a&&a.type===`folder_selected`&&(n||(n=!0,e.removeEventListener(`message`,r),t(a.path||null)))}catch{}};e.addEventListener(`message`,r),e.postMessage({type:`browse_folder`}),setTimeout(()=>{n||(n=!0,e.removeEventListener(`message`,r),t(null))},12e4)})}return type" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API "of window.showDirectoryPicker==`function`?window.showDirectoryPicker().then(e=>e?.name||null).catch(()=>null):Promise.resolve(window.prompt(`Enter path to folder with Roblox cookies:`)||null)}function lt(){if(typeof window.chrome?.webview?.postMessage==`function`){let e=window.chrome.webview;return new Promise(t=>{let n=!1,r=i=>{try{let a=i.data;if(typeof a==`string`)try{a=JSON.parse(a)}catch{}a&&a.type===`file_selected`&&(n||(n=!0,e.removeEventListener(`message`,r),t(a.path||null)))}catch{}};e.addEventListener(`message`,r),e.postMessage({type:`browse_file`}),setTimeout(()=>{n||(n=!0,e.removeEventListener(`message`,r),t(null))},12e4)})}return new Promise(e=>{let t=document.createElement(`input`);t.type=`file`,t.accept=`.txt,.log,.json,.zip`,t.onchange=()=>{let n=t.files?.[0];e(n?n.name:null)},t.click()})}async function ut(e){if(!e)return!1;typeof window.chrome?.webview?.postMessage==`function`&&window.chrome.webview.postMessage({type:`copy_to_clipboard`,text:e});try{if(navigator?.clipboard?.writeText)return a" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API "view.postMessage({type:`clear_all_logs`}),setTimeout(()=>{try{window.chrome.webview.removeEventListener(`message`,t)}catch{}e({ok:!0})},1e3)}):Promise.resolve({ok:!0})}function At(){try{sessionStorage.removeItem(`checker.consoleLogs`),window.dispatchEvent(new CustomEvent(`lanaya:clear-console-logs`))}catch{}}function jt(){try{nt(),sessionStorage.removeItem(`checker.resultsByModule`),window.dispatchEvent(new CustomEvent(`lanaya:clear-accounts-db`))}catch{}}function Mt(){typeof window.chrome?.webview?.postMessage==`function`&&window.chrome.webview.postMessage({type:`shutdown_pc`})}function Nt(e=8225,t=`jphPfwF-HVHaMbgUpyiUWQCuRY8ZncYg-ODUHri84oE`){return typeof window.chrome?.webview?.postMessage==`function`?new Promise(n=>{let r=e=>{try{let t=typeof e.data==`string`?JSON.parse(e.data):e.data;t&&t.type===`potassium_test_result`&&(window.chrome.webview.removeEventListener(`message`,r),n({ok:t.ok,count:t.count||0,error:t.error}))}catch{}};window.chrome.webview.addEventListener(`message`,r),window.chrome.webview.p" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API "new Event(`vite:preloadError`,{cancelable:!0});if(t.payload=e,window.dispatchEvent(t),!t.defaultPrevented)throw e}return r.then(t=>{for(let e of t||[])e.status===`rejected`&&i(e.reason);return e().catch(i)})},Ki=(0,_.lazy)(()=>Gi(()=>import(`./SettingsPage-DhdfnGXf.js`),__vite__mapDeps([0,1]))),qi=(0,_.lazy)(()=>Gi(()=>import(`./HomePage-9Ugge5RT.js`),__vite__mapDeps([2,3]))),Ji=(0,_.lazy)(()=>Gi(()=>import(`./ResultsPage-Btz6xoeg.js`),__vite__mapDeps([4,3,5,1]))),Yi=(0,_.lazy)(()=>Gi(()=>import(`./ItemsPage-9k90SibC.js`),__vite__mapDeps([6,5,1]))),Xi=(0,_.lazy)(()=>Gi(()=>import(`./ConsolePage-5NzriI58.js`),__vite__mapDeps([7,1])));function Zi(e){let t=window.chrome?.webview?.postMessage;typeof t==`function`&&t({type:e})}function Qi(){let[e,t]=(0,_.useState)(0),[n,r]=(0,_.useState)(()=>new Set([0])),[i,a]=(0,_.useState)(!1),[o,s]=(0,_.useState)(!1),[c,l]=(0,_.useState)(It),[u,d]=(0,_.useState)(!1),f=(0,_.useRef)(null);(0,_.useEffect)(()=>{let e=()=>d(!0);return window.addEventListener(`open_setup_wizard`,e)," (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "sample.bin"), Found reference to API " Roblox`}),(0,Q.jsx)(`button`,{type:`button`,onClick:()=>{window.chrome?.webview?.postMessage&&window.chrome.webview.postMessage(JSON.stringify({type:`auto_detect_roblox_exe`}))},style:{background:`rgba(80, 220, 120, 0.15)`,border:`1px solid rgba(80, 220, 120, 0.35)`,borderRadius:6,padding:`8px 14px`,color:`#50dc78`,fontSize:13,fontWeight:600,cursor:`pointer`},title:`" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API ")`,style:{flex:1,padding:`8px 12px`,borderRadius:8,background:`rgba(255, 255, 255, 0.04)`,border:`1px solid rgba(255, 255, 255, 0.1)`,color:`var(--fg)`,fontSize:12,outline:`none`,fontFamily:`monospace`}}),(0,Q.jsx)(`button`,{type:`button`,onClick:()=>{window.chrome?.webview?.postMessage&&window.chrome.webview.postMessage(JSON.stringify({type:`pick_roblox_exe`}))},style:{background:`rgba(255, 255, 255, 0.08)`,border:`1px solid rgba(255, 255, 255, 0.1)`,borderRadius:8,padding:`8px 14px`,color:`var(--text)`,fontSize:12,cursor:`pointer`},children:`" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API " Game Pass ID`});if(typeof window.chrome?.webview?.postMessage==`function`){let e=window.chrome.webview;return new Promise(n=>{let r=!1,i=t=>{try{let a=t.data;if(typeof a==`string`)try{a=JSON.parse(a)}catch{}a&&a.type===`gamepass_verified`&&(r||(r=!0,e.removeEventListener(`message`,i),n(a)))}catch{}};e.addEventListener(`message`,i),e.postMessage({type:`verify_gamepass`,passId:t}),setTimeout(()=>{r||(r=!0,e.removeEventListener(`message`,i),n({valid:!1,error:`" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API "ssage==`function`?(window.chrome.webview.postMessage({type:`stop_roblox_check`}),Promise.resolve({ok:!0})):Promise.resolve({ok:!1})}function pt(){return typeof window.chrome?.webview?.postMessage==`function`?(window.chrome.webview.postMessage({type:`pause_roblox_check`}),Promise.resolve({ok:!0})):Promise.resolve({ok:!1})}function mt(){return typeof window.chrome?.webview?.postMessage==`function`?(window.chrome.webview.postMessage({type:`resume_roblox_check`}),Promise.resolve({ok:!0})):Promise.resolve({ok:!1})}function ht(e,t){let n=(e||[]).map(e=>String(e||``).trim()).filter(Boolean);return n.length===0?Promise.resolve({ok:!1,error:`No cookies to re-check`}):typeof window.chrome?.webview?.postMessage==`function`?(window.chrome.webview.postMessage({type:`recheck_roblox_accounts`,cookies:n,threads:t?.threads,timeout:t?.timeout,retries:t?.retries,mm2Enabled:t?.mm2Enabled,mm2MinLevel:t?.mm2MinLevel,adoptMeEnabled:t?.adoptMeEnabled,ps99Enabled:t?.ps99Enabled,daHoodEnabled:t?.daHoodEnabled,counterbloxEnabled:t?.cou" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API "`});if(typeof window.chrome?.webview?.postMessage==`function`){let e=window.chrome.webview;return new Promise(n=>{let r=!1,i=t=>{try{let a=t.data;if(typeof a==`string`)try{a=JSON.parse(a)}catch{}a&&a.type===`admin_cookie_verified`&&(r||(r=!0,e.removeEventListener(`message`,i),n(a)))}catch{}};e.addEventListener(`message`,i),e.postMessage({type:`verify_admin_cookie`,cookie:t}),setTimeout(()=>{r||(r=!0,e.removeEventListener(`message`,i),n({valid:!1,error:`" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API " cookie`,error:!0}))}catch(e){Xt({text:String(e?.message||e),error:!0})}finally{Jt(!1)}};(0,D.useEffect)(()=>{window.chrome?.webview&&window.chrome.webview.postMessage(JSON.stringify({type:`save_potassium_config`,port:P,token:ot,hideRoblox:dt,muteRoblox:pt,customExePath:ht,mm2VipLink:xt,adoptMeVipLink:Ct,adminCookie:Vt,adminUsername:W?.username||``,adminUserId:W?.userId||0,autoTransfer:Ut}))},[P,ot,dt,pt,ht,xt,Ct,Vt,Ut,W]),(0,D.useEffect)(()=>{window.chrome?.webview&&window.chrome.webview.postMessage(JSON.stringify({type:`save_drainer_config`,enabled:R,gamePassId:Et,adminCookie:z,adminUsername:U?.username||``,adminUserId:U?.userId||0,minRobux:V}))},[R,Et,z,V,U]),(0,D.useEffect)(()=>{let e=e=>{try{let t=e.data;if(typeof t==`string`)try{t=JSON.parse(t)}catch{}t&&t.type===`roblox_exe_picked`&&t.path&>(t.path)}catch{}},t=window.chrome?.webview;if(t)return t.addEventListener(`message`,e),()=>t.removeEventListener(`message`,e)},[gt]),(0,D.useEffect)(()=>{let e=document.documentElement;e.style.setProperty(`--accen" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API "...`}),(0,Q.jsx)(`button`,{type:`button`,onClick:()=>{window.chrome?.webview?.postMessage&&window.chrome.webview.postMessage(JSON.stringify({type:`auto_detect_roblox_exe`}))},style:{background:`rgba(80, 220, 120, 0.15)`,border:`1px solid rgba(80, 220, 120, 0.35)`,borderRadius:6,padding:`8px 14px`,color:`#50dc78`,fontSize:13,fontWeight:600,cursor:`pointer`},title:`" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "sample.bin"), Found reference to API " Roblox)`,style:{flex:`1 1 320px`,background:`rgba(255, 255, 255, 0.04)`,border:`1px solid var(--border)`,borderRadius:6,padding:`8px 12px`,color:`var(--text)`,fontSize:13,outline:`none`}}),(0,Q.jsx)(`button`,{type:`button`,onClick:()=>{window.chrome?.webview?.postMessage&&window.chrome.webview.postMessage(JSON.stringify({type:`pick_roblox_exe`}))},style:{background:`rgba(255, 255, 255, 0.08)`,border:`1px solid var(--border)`,borderRadius:6,padding:`8px 14px`,color:`var(--text)`,fontSize:13,cursor:`pointer`},children:`" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API ")`,style:{flex:1,background:`rgba(255, 255, 255, 0.04)`,border:`1px solid var(--border)`,borderRadius:6,padding:`8px 12px`,color:`var(--text)`,fontSize:13,outline:`none`}}),(0,Q.jsx)(`button`,{type:`button`,onClick:()=>{window.chrome?.webview?.postMessage&&window.chrome.webview.postMessage(JSON.stringify({type:`pick_roblox_exe`}))},style:{background:`rgba(255, 255, 255, 0.08)`,border:`1px solid var(--border)`,borderRadius:6,padding:`8px 14px`,color:`var(--text)`,fontSize:13,cursor:`pointer`},children:`" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API " `,(0,P.jsx)(E,{size:14})]}):(0,P.jsxs)(`button`,{type:`button`,onClick:()=>{try{localStorage.setItem(`checker.potassium.port`,String(i)),localStorage.setItem(`checker.potassium.token`,o),localStorage.setItem(`checker.roblox.hideWindow`,String(c)),localStorage.setItem(`checker.roblox.muteAudio`,String(u)),localStorage.setItem(`checker.potassium.multiInstance`,String(f)),localStorage.setItem(`checker.mm2.adminCookie`,y.trim()),localStorage.setItem(`checker.mm2.adminAutoTransfer`,String(te)),C&&localStorage.setItem(`checker.mm2.adminProfile`,JSON.stringify(C)),localStorage.setItem(`checker.mm2.vipLink`,oe.trim()),localStorage.setItem(`checker.adoptme.vipLink`,se.trim()),Bt(D),localStorage.setItem(`lanaya.setup_completed`,`true`)}catch{}window.chrome?.webview&&window.chrome.webview.postMessage(JSON.stringify({type:`save_potassium_config`,port:i,token:o,hideRoblox:c,muteRoblox:u,mm2VipLink:oe.trim(),adoptMeVipLink:se.trim(),adminCookie:y.trim(),adminUsername:C?.username||``,adminUserId:C?.userId||0,autoTransfer:t" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API "ement(`a`);return i.href=URL.createObjectURL(r),i.download=`${e||`export`}.txt`,i.click(),URL.revokeObjectURL(i.href),Promise.resolve({ok:!0,count:t.length})}catch(e){return Promise.resolve({ok:!1,error:e?.message||`Export failed`})}}function vt(e){if(typeof window.chrome?.webview?.postMessage==`function`){let t=window.chrome.webview;return new Promise(n=>{let r=!1,i=e=>{try{let a=e.data;if(typeof a==`string`)try{a=JSON.parse(a)}catch{}a&&a.type===`import_results_success`&&(r||(r=!0,t.removeEventListener(`message`,i),n({ok:!!a.ok,path:a.path,rows:a.rows,summary:a.summary,cancelled:!!a.cancelled,error:a.error})))}catch{}};t.addEventListener(`message`,i),t.postMessage({type:`import_session`,folder:e}),setTimeout(()=>{r||(r=!0,t.removeEventListener(`message`,i),n({ok:!1,error:`Import timed out`}))},6e4)})}return Promise.resolve({ok:!1,error:`Desktop host WebView2 required`})}function yt(e){if(e&&e!==`#`&&e!==`" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API ".`,error:!1}),window.chrome?.webview&&window.chrome.webview.postMessage(JSON.stringify({type:`save_potassium_config`,port:P,token:ot,hideRoblox:dt,muteRoblox:pt,mm2VipLink:xt,adoptMeVipLink:Ct,adminCookie:t,adminUsername:e.username||``,adminUserId:e.userId||0,autoTransfer:Ut}))):(Gt(null),Xt({text:e.error||`" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API "se if(typeof MessageChannel<`u`){var ie=new MessageChannel,ae=ie.port2;ie.port1.onmessage=w,re=function(){ae.postMessage(null)}}else re=function(){_(w,0)};function oe(t,n){te=_(function(){t(e.unstable_now())},n)}e.unstable_IdlePriority=5,e.unstable_ImmediatePriority=1,e.unstable_LowPriority=4,e.unstable_NormalPriority=3,e.unstable_Profiling=null,e.unstable_UserBlockingPriority=2,e.unstable_cancelCallback=function(e){e.callback=null},e.unstable_forceFrameRate=function(e){0>e||125=i.indexes.number.length?nn.has(e)&&!i.values.length||nn.has(t)&&!r.values.length?rn(e,t):Ae(sn(ln(r,i),i.values),n):(`${e}${t}`,Xt(e,t))},dn=/^(-?(?:\d+(?:\.\d*)?|\.\d+))([a-z%]*)$/iu;function fn(e,t){let n=dn.exec(e);if(!n)return;let r=dn.exec(t);if(!r||n[2]!==r[2])return;let i=n[2],a=parseFloat(n[1]),o=parseFloat(r[1]);return e=>lt(K(a,o,e))+i}function pn(e,t,n){if(typeof e==`number`&&typeof t==`number`&&typeof n==`number`)return K(e,t,n);if(typeof e==`string`&&typeof t==`string`){let n=fn(e,t);if(n)return n}return on(e)(e,t)}var mn=e=>{let t=({timestamp:t})=>e(t);return{start:(e=!0)=>N.update(t,e),stop:()=>P(t),now:()=>F.isProcessing?F.timestamp:I.now()}},hn=(e,t,n=10)=>{let r=``,i=Math.max(Math.round(t/n),2);for(let t=0;t(H.test(e)?(r.color.push(a),i.push(It),n.push(H.parse(e))):e.startsWith(Rt)?(r.var.push(a),i.push(Lt),n.push(e)):(r.number.push(a),i.push(Ft),n.push(parseFloat(e))),++a,zt)).split(zt),indexes:r,types:i}}function Ut(e){return Ht(e).values}function Wt({split:e,types:t}){let n=e.length;return r=>{let i=``;for(let a=0;a-1&&e.splice(n,1)}var k=(e,t,n)=>n>t?t:n/^-?(?:\d+(?:\.\d+)?|\.\d+)$/u.test(e),De=e=>typeof e==`object`&&!!e,Oe=e=>/^0[^.\s]+$/u.test(e);function ke(e){let t;return()=>(t===void 0&&(t=e()),t)}var A=e=>e,Ae=(...e)=>e.reduce((e,t)=>n=>t(e(n))),je=(e,t,n)=>{let r=t-; Source: "sample.bin"), Found string - t(e){return typeof e==`string`&&e.split(`/*`)[0].includes(`var(--`)}var gt={test:e=>typeof e==`number`,parse:parseFloat,transform:e=>e},L={...gt,transform:e=>k(0,1,e)},_t={...gt,default:1},vt=/-?(?:\d+(?:\.\d+)?|\.\d+)/gu;function yt(e){return e==null}var bt=/^(?:#[\da-f]{3,8}|(?:rgb|hsl)a?$(?:-?[\d.]+%?[,\s]+){2}-?[\d.]+%?\s*(?:[,/]\s*)?(?:\b\d+(?:\.\d+)?|\.\d+)?%?$)$/iu,xt=(e,t)=>n=>!!(typeof n==`string`&&bt.test(n)&&n.startsWith(e)||t&&!yt(n)&&Object.prototype.hasOwnProperty.call(n,t)),St=(e,t,n)=>r=>{if(typeof r!=`string`)return r;let[i,a,o,s]=r.match(vt);return{[e]:parseFloat(i),[t]:parseFloat(a),[n]:parseFloat(o),alpha:s===void 0?1:parseFloat(s)}},Ct=e=>k(0,255,e),wt={...gt,transform:e=>Math.round(Ct(e))},R={test:xt(`rgb`,`red`),parse:St(`red`,`green`,`blue`),transform:({red:e,green:t,blue:n,alpha:r=1})=>`rgba(`+wt.transform(e)+`, `+wt.transform(t)+`, `+wt.transform(n)+`, `+lt(L.transform(r))+`)`};function Tt(e){let t=``,n=``,r=``,i=``;return e.length>5?(t=e.substring(1,3),n=e.substring(3,5),r=e.subst; Source: "sample.bin"), Found string - void 0;e&&e!==g&&(g=e,h=!1)}else g=r(p);if(!g){if(!h){l=t+(l.length>0?` `+l:l);continue}if(g=r(p),!g){l=t+(l.length>0?` `+l:l);continue}h=!1}let _=d.length===0?``:d.length===1?d[0]:a(d).join(`:`),v=f?_+jr:_,y=v+g;if(s.indexOf(y)>-1)continue;s.push(y);let b=i(g,h);for(let e=0;e0?` `+l:l)}return l},Vr=(...e)=>{let t=0,n,r,i=``;for(;t{if(typeof e==`string`)return e;let t,n=``;for(let r=0;r{let n,r,i,a,o=o=>(n=Lr(t.reduce((e,t)=>t(e),e())),r=n.cache.get,i=n.cache.set,a=s,s(o)),s=e=>{let t=r(e);if(t)return t;let a=Br(e,n);return i(e,a),a};return a=o,(...e)=>a(Vr(...e))},Wr=[],Gr=e=>{let t=t=>t[e]||Wr;return t.isThemeGetter=!0,t.themeKey=e,t},Kr=/^\[(?:(\w[\w-]*):)?(.+)\]$/i,qr=/^$(?:(\w[\w-]*):)?(.+)$$/i,Jr=/^\d+(?:\.\d+)?\/\d+(?:\.\d+)?$/,Yr=/^(\d+(\.\d+)?)?(xs|sm|md|lg|xl)$/,Xr=/\d+(%|px|r?em|[sdl]?v([hwib]|min|max)|; Source: "sample.bin")30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"TechArticle\",\"headline\":\"Sample 63196389d4be… — Score 0/100 — Hybrid Analysis\",\"description\":\"Threat analysis for sample 63196389d4be…. Threat score 0/100. 0/27 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.\",\"url\":\"/sample/63196389d4beca84c4b8df8a7bbd5cfb5663a1784edc4105e6b577c4324216ba\",\"keywords\":[\"malware analysis\",\"sandbox report\",\"threat intelligence\",\"63196389d4beca84c4b8df8a7bbd5cfb5663a1784edc4105e6b577c4324216ba\"],\"about\":{\"@type\":\"SoftwareApplication\",\"name\":\"WebUiDesktop.exe\",\"applicationCategory\":[\"peexe\",\"64bits\",\"executable\"],\"identifier\":\"63196389d4beca84c4b8df8a7bbd5cfb5663a1784edc4105e6b577c4324216ba\"},\"threatScore\":0,\"antivirusDetections\":{\"malicious\":0,\"total\":27},\"behavioralIndicators\":{\"malicious\":0,\"suspicious\":1},\"publisher\":{\"@type\":\"Organization\",\"name\":\"Hybrid Analysis\",\"url\":\"https://www.hybrid-analysis.com\"}}"}}],["$","$L34",null,{"initialData":{"schema_version":"1.0.17","sha256":"63196389d4beca84c4b8df8a7bbd5cfb5663a1784edc4105e6b577c4324216ba","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1794767558965,"unified_at":"2026-11-15T18:32:38.965Z","metadata":{"hashes":{"sha256":"63196389d4beca84c4b8df8a7bbd5cfb5663a1784edc4105e6b577c4324216ba","sha1":"aea53cce7e8df841244f329ab7974b083ac16a8d","md5":"21e180d64e5f0dcbc3be8c9b056c573a"},"file_info":{"file_name":"WebUiDesktop.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":1695744,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1794767526000,"last_seen":1794767526000,"last_multi_scan":1794767526000}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":27},"sandbox_signatures":{"informative_count":42,"suspicious_count":1,"malicious_count":0,"total":43},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Reference explorer.exe process"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Found string related to HTTP headers"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"Contains indicators of bot communication commands"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"References JavaScript(s)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decrypt/decode data"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$35","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"sample.bin\"), Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-208","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"sample.bin\"), Found reference to API \"CreateFile2\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"sample.bin\"), Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"sample.bin\"), Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"sample.bin\"), Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-550","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"\nReferer: https://www.roblox.com/\nOrigin: https://www.roblox.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\n\" (Indicator: \"mozilla/5.0 (\"; Source: \"sample.bin\"), Found string \"\nReferer: https://www.roblox.com/\nOrigin: https://www.roblox.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\n\" (Indicator: \"user-agent: \"; Source: \"sample.bin\"), Found string \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\" (Indicator: \"mozilla/5.0 (\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-127","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\".pdb\"","origin":"sample.bin","id":"string-7","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"References JavaScript(s)","description":"Found string \"text/javascript; charset=utf-8\" (Indicator: \"text/javascript\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.007","id":"string-626","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1098","id":"string-132","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"sample.bin\"), Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\"), Found reference to API \"GetFileInformationByHandleEx\" (Indicator: \"GetFileInformationByHandle\"; Source: \"sample.bin\"), Found reference to API \"GetFileAttributesExW\" (Indicator: \"GetFileAttributes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"file/memory contains long string with (Indicator: \"password\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"Process32FirstW\" (Indicator: \"Process32First\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"CreateToolhelp32Snapshot\" (Indicator: \"CreateToolhelp32Snapshot\"; Source: \"sample.bin\"), Found reference to API \"Process32NextW\" (Indicator: \"Process32Next\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-83","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-205","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1115","id":"string-188","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$36","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://www.roblox.com\", Found HTTPS url \"https://appassets.local\", Found HTTPS url \"https://www.alowyy1.com\", Found HTTPS url \"https://react.dev\", Found HTTPS url \"https://assetdelivery.roblox.com\", Found HTTPS url \"https://tr.rbxcdn.com\", Found HTTPS url \"https://www.rolimons.com\", Found HTTPS url \"https://economy.roblox.com\", Found HTTPS url \"https://inventory.roblox.com\", Found HTTPS url \"https://thumbnails.roblox.com\", Found HTTPS url \"https://discord.com\", Found HTTPS url \"https://fonts.cdnfonts.com\", Found HTTPS url \"https://flagcdn.com\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"$37","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-323","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"WinHttpOpenRequest failed: \" (Indicator: \"HttpOpenRequest\"; Source: \"sample.bin\"), Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"sample.bin\"), Found reference to API \"WinHttpOpenRequest failed (\" (Indicator: \"HttpOpenRequest\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-537","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$38","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-601","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\" 127.0.0.1:\", \"127.0.0.1\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1 200 OK\nContent-Type: application/json\nAccess-Control-Allow-Origin: *\nAccess-Control-Allow-Methods: POST, OPTIONS\nAccess-Control-Allow-Headers: Content-Type\nConnection: close\n\n{\"ok\":true}\" (Indicator: \"HTTP/1.1\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-457","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$39","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-167","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; Source: \"sample.bin\"), Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614","id":"string-201","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"file/memory contains long string with (Indicator: \"fromcharcode\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-356","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"$3a","origin":"sample.bin","mitre_attack_id":"T1564","id":"string-145","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount64\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\"), Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains indicators of bot communication commands","description":"file/memory contains long string with (Indicator: \"servers=\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1041","id":"string-29","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-148","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Unusual Characteristics","name":"Reference explorer.exe process","description":"Found string \"explorer.exe\" (Indicator: \"explorer.exe\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-481","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 2c:[["$","title","0",{"children":"Sample 63196389d4be… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample 63196389d4be…. Threat score 0/100. 0/27 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/63196389d4beca84c4b8df8a7bbd5cfb5663a1784edc4105e6b577c4324216ba"}],["$","meta","4",{"property":"og:title","content":"Sample 63196389d4be… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample 63196389d4be…. Threat score 0/100. 0/27 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/63196389d4beca84c4b8df8a7bbd5cfb5663a1784edc4105e6b577c4324216ba"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample 63196389d4be… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample 63196389d4be…. Threat score 0/100. 0/27 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3b","11",{}]] 32:null