23:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2f:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 24:Te7b,Found string - v":if(a=b.match(/^3\.(\d+)(\.\d+[a-z]?)?$/)){if((b=window.google.maps.version.match(/3\.(\d+)(\.\d+[a-z]?)?/))&&Number(a[1]){a.qh=!1;a.BA(a.rh)}))};KBa=function(a,b){a.ecrd(c=>{b.mu(c)},0)};mF=function(a,b){for(let c=0;c=0)){var d=(f,g,h)=>{a.handleEvent(f,g,h)};a.Ri[b]=d;var e=b==="mouseenter"?"mouseover":b==="mouseleave"?"mouseout":b==="pointerenter"?"po; Source: "0036_maps.googleapis.com_e11e2add68166c35.js") Found string - a=class{constructor(a,b,c,d,e){this.sh=a;this.th=b;this.rh=c;this.qh=d;this.message=e}} eEa=class{constructor(a){this.Yh=a;this.next=0}done(){return this.next>=this.Yh.length}};var EEa=_.qi(_.DH,pGa);var aEa="AE1E2E7E54E6E6AE55E56E60AAE6,1E62E63E1 AA AE3E4AAC1 AIIIIIIIII AC0C1AAAAAE5E6 AAE3A A E7E8E17E21E26E14E27E29E6E1E35E36E6E38E39E41E1E1E43E44E6E6E45E46E6E47E50E52E53 AAE9AE11A AAAE10C1 IIIA BABC2E12BAAAAA1BE6BAF6E6E6E13E14E1E15F16 AC1AE6A AAAE1 AAA AB IIA AAAAE12E18AE19E6AE1AE1E20AA1E1AA AAAAA 2II F22E24C4AAE25A3A E17E10F23AAA E10IA AAAC1BC3C1AAAAA C5C5C5 AAAA E1AE20E14E28 AA1A AAE6AE30E6E33 AE31E1E1 E1E32 AE17E6 AE34 E1 1AAAA AE37 F18 E31 E6AE40 2E19E19 1F20E42 E6A BF6 1AE1 E32 8A F14F48 AF49A 1AE6AAA F51 E17 F6 AE6AAAA BBA AAAAAAAA AAE57AE58 AAE19A E59E19 ABAAAAE1 E6E61AAAAAAAE1AE6 BAF6E11AA E20 AAAE6".split(" ") bEa=[99 1 5 1E3 6 -1];var kEa=/^(-?\d+(\.\d+)?) (-?\d+(\.\d+)?)(,(-?\d+(\.\d+)?))?$/;var KH=[{Pv:1 Tw:"reviews"} {Pv:2 Tw:"photos"} {Pv:3 Tw:"contribute"} {Pv:4 Tw:"edits"} {Pv:7 Tw:"events"} ; Source: "0036_maps.googleapis.com_e11e2add68166c35.js") Found string - null:"InvalidChannel";case "signature":return"SignatureNotRequired";case "signed_in":return"SignedInNotSupported";case "sensor":return"SensorNotRequired";case "v":if(a=b.match(/^3\.(\d+)(\.\d+[a-z]?)?$/)){if((b=window.google.maps.version.match(/3\.(\d+)(\.\d+[a-z]?)?/))&&Number(a[1]){this.changed("latLngPosition")}):(a=new _.psa,a.bindTo("center",this) a.bindTo("zoom",this) a.bindTo("projectionTopLeft",this) a.bindTo("projection",this) a.bindTo("offset",this) this.qh=a)}fromLatLngToContainerPixel(a){return this.qh.fromLatLngToContainerPixel(a)}fromLatLngToDivPixel(a){return this.qh.fromLatLngToDivPixel(a)}fromDivPixelToLatLng(a,b=!1){return this.qh.fromDivPixelToLatLng(a,b)}fromContainerPixelToLatLng(a,; Source: "0036_maps.googleapis.com_e11e2add68166c35.js")25:T763,"WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007940) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007940) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0acea7bf97f0000000000000000000051ed0d7ef97f000000000000580100000000000000000000664741a6c90300002a00000000000000704372d1580100008fec0d7ef97f0000e0acea7bf97f0000e0acea7bf97f0000000000000000000000000000f97f0000ffffff7f4f8e000000000000000000000000000000000000d8cede7bf97f00002a0000000000000069c3977bf97f00003100000000000000e802000000000000ec020000000000001100011000000000c0d039271f00000003a36f7bf97f0000c0d039271f00000000000000000000002b00000000000000000000000000000020b09d7bf97f0000b43f9c7bf97f0000e0cede7b (UID: 00000000-00007940)26:T5da,"WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000000ea2ef67f00000000000000000000180000000000000000000000000000000000000000000000367441a6c90300000634cd3a896200000000ea2ef67f000011c61671f97f0000060000001f0000000000000000000000011f6fd1580100001f00000000000000000010000600000000000000000000000000ea2e (UID: 00000000-00007940) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000004e7b2f7bf97f00000000375af97f0000000000000000000000000000000000000806385af97f00000001000000000000f0986e7bf97f00000001000000000000000100000000000000000000000000000006385af97f000001000000000000000f18375af97f000000000000000000000006385af97f000000000000 (UID: 00000000-00007940) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f00009c310658f97f0000708b0858f97f00000200000000000000708b0858f97f000000000000000000000300000000000000b1310658f97f0000a8150958f97f0000f0c992d15801000000ca92d158010000888b0858f97f00000100000000000000239f707bf97f00000000000000000000888b0858f97f000006000000 (UID: 00000000-00007940) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000002000013000000000000000c00000000000000e81c0c58f97f0000ce02000000000000000000000000000000000000000000000100000000000000b0de39271f00000010d839271f000000000000000000000000ea39271f00000000eb39271f000000b09b92d1580100000000000000000000002044271f00000068d73927 (UID: 00000000-00007940)27:T18eb,"WScript.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter WldpIsClassInApprovedList (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00007940) "WScript.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00007940)28:T8c3,"WScript.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff95b620000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff978a20000 "WScript.exe" loaded module "RPCRT4.DLL" at base 7ff97b770000 "WScript.exe" loaded module "KERNEL32.DLL" at base 7ff97cfc0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\JSCRIPT.DLL" at base 7ff9580a0000 "WScript.exe" loaded module "AMSI.DLL" at base 7ff9651f0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff972600000 "WScript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ff95eb70000 "WScript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff97b290000 "WScript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff97b290000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff97b290000 "WScript.exe" loaded module "KERNEL32" at base 7ff97cfc0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\3292YUFK.DLL" at base 7ff95a390000 "WScript.exe" loaded module "WLDP.DLL" at base 7ff9794d0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ff97ceb0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ff97b500000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff979820000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ff966d70000 "WScript.exe" loaded module "OLE32.DLL" at base 7ff97d260000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ff97ae20000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ff95a370000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCROBJ.DLL" at base 7ff958060000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7ff97b560000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ff97d260000 "WScript.exe" loaded module "OLEAUT32.DLL" at base 7ff97df90000 "WScript.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 7ff97d0d0000 "WScript.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 7ff97d0d0000 "WScript.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 7ff97dc2000029:T65c,"WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\POLICIES\MICROSOFT\CRYPTOGRAPHY\CONFIGURATION"; Key: ""; Value: "")2a:Tedb,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "USEFILTER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "DISABLEHEAPLOOKASIDE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "FRONTENDHEAPDEBUGOPTIONS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "SHUTDOWNFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "UNLOADEVENTTRACEDEPTH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "MAXLOADERTHREADS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "USEIMPERSONATEDDEVICEMAP"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "TRACINGFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "CFGOPTIONS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "MINIMUMSTACKCOMMITINBYTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "BREAKONINITIALIZEPROCESSFAILURE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "KEEPACTIVATIONCONTEXTSALIVE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "TRACKACTIVATIONCONTEXTRELEASES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "MAXDEADACTIVATIONCONTEXTS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "GLOBALFLAG"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "DEBUGPROCESSHEAPONLY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "SEARCHPATHMODE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "")2b:Te16,file/memory contains long string with (Indicator: ".googleapis.com"; File: "0036_maps.googleapis.com_e11e2add68166c35.js") Found string "https://earthbuilder.googleapis.com" (Indicator: ".googleapis.com"; File: "0036_maps.googleapis.com_e11e2add68166c35.js") Found string "fonts.googleapis.com/css?family=Roboto:300,400,500,700" (Indicator: ".googleapis.com"; File: "0036_maps.googleapis.com_e11e2add68166c35.js") Found string "https://maps.googleapis.com/maps/api/js/GeoPhotoService.GetMetadata" (Indicator: ".googleapis.com"; File: "0036_maps.googleapis.com_e11e2add68166c35.js") Found string "https://khms0.googleapis.com/kh?v=1015" (Indicator: ".googleapis.com"; File: "0036_maps.googleapis.com_e11e2add68166c35.js") Found string "fonts.googleapis.com/css?family=Google+Sans+Text:400&text" (Indicator: ".googleapis.com"; File: "0036_maps.googleapis.com_e11e2add68166c35.js") Found string "https://maps.googleapis.com/maps_api_js_slo/log?hasfast=true" (Indicator: ".googleapis.com"; File: "0036_maps.googleapis.com_e11e2add68166c35.js") Found string "https://mts.googleapis.com/maps/vt/icon" (Indicator: ".googleapis.com"; File: "0036_maps.googleapis.com_e11e2add68166c35.js") Found string "https://khms1.googleapis.com/kh?v=170" (Indicator: ".googleapis.com"; File: "0036_maps.googleapis.com_e11e2add68166c35.js") Found string "https://places.googleapis.com/v1/places" (Indicator: ".googleapis.com"; File: "0036_maps.googleapis.com_e11e2add68166c35.js") Found string "https://khms.googleapis.com/mz?v=1015" (Indicator: ".googleapis.com"; File: "0036_maps.googleapis.com_e11e2add68166c35.js") Found string "https://cbks0.googleapis.com/cbk" (Indicator: ".googleapis.com"; File: "0036_maps.googleapis.com_e11e2add68166c35.js") Found string "https://khms0.googleapis.com/kh?v=170" (Indicator: ".googleapis.com"; File: "0036_maps.googleapis.com_e11e2add68166c35.js") Found string "https://cbks1.googleapis.com/cbk" (Indicator: ".googleapis.com"; File: "0036_maps.googleapis.com_e11e2add68166c35.js") Found string "https://geocode.googleapis.com" (Indicator: ".googleapis.com"; File: "0036_maps.googleapis.com_e11e2add68166c35.js") Found string "https://khms1.googleapis.com/kh?v=1015" (Indicator: ".googleapis.com"; File: "0036_maps.googleapis.com_e11e2add68166c35.js") Found string "https://streetviewpixels-pa.googleapis.com/v1/thumbnail?hl=en-US" (Indicator: ".googleapis.com"; File: "0036_maps.googleapis.com_e11e2add68166c35.js") Found string "https://maps.googleapis.com/maps/api/js/GeoPhotoService.SingleImageSearch" (Indicator: ".googleapis.com"; File: "0036_maps.googleapis.com_e11e2add68166c35.js") Found string "https://streetviewpixels-pa.googleapis.com/v1/tile" (Indicator: ".googleapis.com"; File: "0036_maps.googleapis.com_e11e2add68166c35.js") Found string "https://maps.googleapis.com" (Indicator: ".googleapis.com"; File: "0036_maps.googleapis.com_e11e2add68166c35.js") Found string "https://maps.googleapis.com/maps/vt" (Indicator: ".googleapis.com"; File: "0036_maps.googleapis.com_e11e2add68166c35.js") Found string "https://places.googleapis.com" (Indicator: ".googleapis.com"; File: "0036_maps.googleapis.com_e11e2add68166c35.js") Found string "https://maps.googleapis.com/maps-api-v3/api/js/66/7" (Indicator: ".googleapis.com"; File: "0036_maps.googleapis.com_e11e2add68166c35.js") Found string "https://static.panoramio.com.storage.googleapis.com/photos/" (Indicator: ".googleapis.com"; File: "0036_maps.googleapis.com_e11e2add68166c35.js") Found string ""C:\0036_maps.googleapis.com_e11e2add68166c35.js"" (Indicator: ".googleapis.com"; File: "WScript.exe")2c:T3b7f,Pattern match: "https://khms0.googleapis.com/kh?v=1015\u0026hl=en-us\u0026gl=us\u0026" Pattern match: "https://support.google.com/fusiontables/answer/9185417" Pattern match: "https://lh3.ggpht.com/jsapi2/a/b/c/" Pattern match: "https://earthbuilder.googleapis.com" Heuristic match: "this.sh" Pattern match: "fonts.googleapis.com/css?family=roboto:300,400,500,700" Pattern match: "http://www.broofa.com" Pattern match: "https://maps.googleapis.com/maps/api/js/geophotoservice.getmetadata" Heuristic match: "b.qh.sh" Pattern match: "http://g.co/dev/maps-no-account" Pattern match: "https://khms0.googleapis.com/kh?v=1015" Pattern match: "fonts.googleapis.com/css?family=google+sans+text:400&text" Pattern match: "https://maps.googleapis.com/maps_api_js_slo/log?hasfast=true" Heuristic match: "l.rh.sh" Pattern match: "https://www.google.com" Pattern match: "https://maps.gstatic.com/mapfiles/api-3/images/powered-by-google-on-white3.png" Pattern match: "https://mts.googleapis.com/maps/vt/icon" Pattern match: "https://khms1.googleapis.com/kh?v=170" Pattern match: "https://lh4.ggpht.com/jsapi2/a/b/c/" Pattern match: "https://goo.gle/js-api-loading" Pattern match: "https://developers.google.com/maps/legacy" Pattern match: "https://places.googleapis.com/v1/places" Pattern match: "https://support.google.com/maps/answer/3092445" Pattern match: "http://maps.gstatic.cn/mapfiles/api-3/images/mapcnt6_hdpi.png" Pattern match: "https://geo0.ggpht.com/cbk" Pattern match: "https://developers.google.com/maps/documentation/javascript/styling#cloud_tooling" Pattern match: "https://khms.googleapis.com/mz?v=1015" Pattern match: "https://developers.google.com/maps/deprecations" Pattern match: "https://cbks0.googleapis.com/cbk" Pattern match: "https://www.google.com/maps" Pattern match: "https://support.google.com/maps/contact/14718793" Heuristic match: "f.th.sh" Pattern match: "https://lh3.googleusercontent.com" Pattern match: "http://maps.gstatic.cn/mapfiles/transparent.png" Pattern match: "https://goo.gle/places-permanently-closed" Pattern match: "https://developers.google.com/maps/documentation/javascript/routes/route-matrix-js-migration" Heuristic match: "d.qh.sh" Pattern match: "https://maps.gstatic.com/mapfiles/" Heuristic match: "this.wh.sh" Pattern match: "https://khms0.googleapis.com/kh?v=170" Pattern match: "https://maps.gstatic.com/mapfiles/api-3/images/mapcnt6.png" Pattern match: "https://developers.google.com/maps/documentation/javascript/versions#beta-channel" Pattern match: "https://lh5.googleusercontent.com" Heuristic match: "this.rh.sh" Pattern match: "https://goo.gle/js-open-now" Heuristic match: "a.rh.sh" Pattern match: "https://developers.google.com/maps/documentation/javascript/advanced-markers/migration" Pattern match: "https://policies.google.com/privacy" Heuristic match: "nc.sh" Heuristic match: "broofa.com" Pattern match: "https://maps.gstatic.com/mapfiles/api-3/images/mapcnt6_hdpi.png" Pattern match: "https://support.google.com/local-listings/answer/9851099" Heuristic match: "a.sh?nia(b/1e3,b,!0):nia(b/1609.344,b*3.28084,!1),a.rh.textcontent=b.dm" Heuristic match: "googleusercontent.com" Pattern match: "https://developers.devsite.corp.google.com/maps/deprecations#kml_layer_deprecated_as_of_april_30_2026" Heuristic match: "e.qh.sh" Heuristic match: "ec.sh" Pattern match: "https://developers.google.com/maps/documentation/javascript/places-migration-overview" Heuristic match: "l.qh.sh" Pattern match: "https://cbks1.googleapis.com/cbk" Pattern match: "https://developers.google.com/maps/documentation/javascript/error-messages?utm_source=places_js&utm_medium=degraded&utm_campaign=keyless#api-key-and-billing-errors" Pattern match: "https://lh6.ggpht.com/jsapi2/a/b/c/" Pattern match: "https://developers.google.com/maps/documentation/javascript/error-messages#unsupported-browsers" Pattern match: "https://maps.gstatic.com/maps-api-v3/api/images/" Heuristic match: "a.qh.sh" Pattern match: "https://geo1.ggpht.com/cbk" Pattern match: "https://developers.google.com/maps/documentation/javascript/libraries" Pattern match: "https://developers.google.com/maps/documentation/javascript/routes/routes-js-migration" Pattern match: "https://developers.google.com/maps/documentation/javascript/error-messages" Pattern match: "https://geocode.googleapis.com" Heuristic match: "a.sh.style.top" Pattern match: "https://khms1.googleapis.com/kh?v=1015" Pattern match: "https://support.google.com/contributionpolicy/answer/7422880" Pattern match: "https://developer.mozilla.org/docs/web/api/eventtarget/addeventlistener" Pattern match: "https://streetviewpixels-pa.googleapis.com/v1/thumbnail?hl=en-us" Pattern match: "https://geo3.ggpht.com/cbk" Pattern match: "https://maps.googleapis.com/maps/api/js/geophotoservice.singleimagesearch" Heuristic match: "a.ij.sh" Pattern match: "https://maps.gstatic.com/mapfiles/api-3/images/autocomplete-icons_hdpi.png" Pattern match: "https://streetviewpixels-pa.googleapis.com/v1/tile" Pattern match: "https://maps.googleapis.com" Pattern match: "https://maps.googleapis.com/maps/vt" Pattern match: "https://khms1.google.com/kh?v=170" Pattern match: "https://maps.google.com" Pattern match: "https://places.googleapis.com" Pattern match: "https://khms1.google.com/kh?v=1015" Pattern match: "https://developers.google.com/maps/documentation/javascript/routes/routes-migrate-rendering" Pattern match: "https://maps.gstatic.com/mapfiles/transparent.png" Pattern match: "https://www.google.com/help/terms_maps/" Pattern match: "https://www.google.com/maps/vt" Pattern match: "https://geo2.ggpht.com/cbk" Pattern match: "https://maps.gstatic.com/mapfiles/api-3/images/powered-by-google-on-white3_hdpi.png" Pattern match: "https://lh6.googleusercontent.com" Heuristic match: "a.zh.sh" Pattern match: "https://maps.googleapis.com/maps-api-v3/api/js/66/7" Pattern match: "https://www.google.com/maps/preview/log204" Pattern match: "https://maps.gstatic.com/mapfiles/api-3/images/autocomplete-icons.png" Pattern match: "https://static.panoramio.com.storage.googleapis.com/photos/" Pattern match: "https://lh4.googleusercontent.com" Pattern match: "https://lh5.ggpht.com/jsapi2/a/b/c/" Pattern match: "https://khms0.google.com/kh?v=1015" Pattern match: "https://khms0.google.com/kh?v=170" Heuristic match: "this.qh.sh" Pattern match: "https://khms0.googleapis.com/kh?v=1015\u0026hl=en-us\u0026gl=us\u0026,https://khms1.googleapis.com/kh?v=1015\u0026hl=en-us\u0026gl=us\u0026],null,null,null,1,1015,[https://khms0.google.com/kh?v=1015\u0026hl=en-us\u0026gl=us\u0026,https://khms1.goog" Pattern match: "https://streetviewpixels-pa.googleapis.com/v1/thumbnail?hl=en-us\u0026gl=us\u0026,https://streetviewpixels-pa.googleapis.com/v1/thumbnail?hl=en-us\u0026gl=us\u0026]]],[en-us,us,null,0,null,null,https://maps.gstatic.com/mapfiles/,null,https://maps" Pattern match: "https://www.google.com/maps/vt],/maps/vt,798000000,798,798564079],2,500,[null,null,null,null,https://www.google.com/maps/preview/log204,,https://static.panoramio.com.storage.googleapis.com/photos/,[https://geo0.ggpht.com/cbk,https://geo1.ggpht." Heuristic match: "h(b){case down:uj(a,c,down);c.style.bottom=0;c.style.left=50%;c.style.transform=translatex(-50%);break;case left:uj(a,c,left);c.style.bottom=50%;c.style.left=0;c.style.transform=translatey(50%);break;case right:uj(a,c,right);c.style" Pattern match: "a.qh/20" Pattern match: "www.google,maps.google" Pattern match: "this.qh/2;this.rh={kd:iia(b),active:jia(b),jd:kia(b)};mia(this);this.set(position,_.vi.pad.offset);_.fv(a,mouseover,this,this.th);_.fv(a,mouseout,this,this.xh);a.addeventlistener" Heuristic match: "f.getradius()||0,e=d?.lat()||0,d=d?.lng()||0,_.ti(_.ug(b,_.yq,1),e),_.ui(_.ug(b,_.yq,1),d),b.setradius(f)):f instanceof _.jm&&(f=(new _.i5).setcenter(_.r5(f)).setradius(0),bwb(_.ug(l,q5,2),f)));g&&(g=_.p5(g),dwb(_.ug(l,wwb,3),g));h&&_.ce(l,4,h);k&&_.ce(l,5" Pattern match: "https://places.googleapis.com/}rh(){return[...zwb,new" Pattern match: "math.pi/180" Pattern match: "math.pi/2||g" Pattern match: "http://www.w3.org/2000/svg" Heuristic match: "0,attributiontype:text,infobuttontapareaexpanded:!1,contentconfig:a,hx:c})} `},m8=function(a,b,c={}){var {je:d,ef:e,titlesize:f,fontsize:g,rn:h,slotsconstructiondata:k={eq:[],wk:[]},showtransit:l}=c,n=d?$bb(a,{variant:d}):null,q=c.contentconfi" Pattern match: "https://geocode.googleapis.com/}rh(){return[...wfb,...super.rh()]}},d8,wfb=[];var" Pattern match: "https://develope" Pattern match: "rs.google.com/maps/legacy" Heuristic match: "webkit-align-items:center;-moz-box-align:center;-ms-flex-align:center;align-items:center;background:none;color:#fff;display:-webkit-box;display:-webkit-flex;display:-moz-box;display:-ms-flexbox;display:flex;-webkit-margin-end:12px;-moz-margin-end:12px;marg" Heuristic match: "ype,arialabelinternal,void 0);_.d([_.pp(),_.e(design:type,object)],g9.prototype,ie,void 0);_.d([_.gf({context:f9}),_.e(design:type,boolean)],g9.prototype,stoppropagation,void 0);_.wn(gmp-internal-link-button,g9);var nfb=(0,_.qq)`

${place info couldn't load}

`])??(0,_.qq)``}qz(){var a=this.contentconfig?.media?ncb(this):;return v7([this.gq(),(0,_.qq)`

!m7(a,b)}),_.e(design:type,object)" Heuristic match: "bm(_.br),a)||null}get includedtype(){return this.dh}set isopennow(a){this.fh=_.do(this,isopennow,_.ar,a)??null}get isopennow(){return this.fh}set locationbias(a){if((a=_.do(this,locationbias,_.bm(hbb),a))&&this.locationrestriction)throw _.bo(this,loca" Pattern match: "fonts.googleapis.com/css?family=roboto:300,400,500,700|google+sans:400,500,700|google+sans+text:400,500,700${b" Pattern match: "https://developers.google.com/maps/documentation/javascript/error-messages#+b" Pattern match: "http://www.w3.org/1999/xhtml" Heuristic match: "(d,e,c);_.hv(b,new a(d));return c};cea=function(a){return typeof a===number?math.round(a*1e7)/1e7:a};$da=function(a,b,c){var d=b[a];if(typeof d===object)return d;var e=new dea;b[a]=e;a=1;for(d=new eea(d);!d.done();){a+=ah(d)||0;d.done();var f=d.yh.char" Heuristic match: "r e=new _.dh;var f=_.ug(e,_.mh,3);f=_.fh(f,1,1);var g=_.ug(f,_.ph,2);g=_.fh(g,1,0).setheading(a.heading).settilt(90+a.pitch);var h=b.lat();g=_.bh(g,3,h);b=_.hf(g,b.lng());_.bh(b,7,_.hk(math.atan(math.pow(2,1-a.zoom)*.75)*2));a=_.ug(f,_.lea,3);if(c){c=_.sh(" Pattern match: "math.pi/2&&" Heuristic match: "t:!0,counter:!0,counters:!0,cubic-bezier:!0,drop-shadow:!0,ellipse:!0,grayscale:!0,hsl:!0,hsla:!0,hue-rotate:!0,inset:!0,invert:!0,opacity:!0,linear-gradient:!0,matrix:!0,matrix3d:!0,max:!0,min:!0,minmax:!0,polygon:!0,radial-gradient:!0,rgb:!0,rg" Heuristic match: "or(let e in b.qh){let f=a.qh[e];b.qh[e]!=f&&(b.qh[e]=f,c&&array.isarray(c)?c.indexof(e)!=-1:c[e]!=null)&&(d=!0)}c=d}return this.zh&&!c};_.aa.iq=function(a,b,c){if(!yg(this,a,b)){var d=a.wh;c=a.qh[c+1];d.sh=c;c=wg(this.rh,c);c!=null&&(yf(d.context,a.context" Pattern match: "this.tick/this.qh" Heuristic match: ".sz],_.r,_.p,_.q,92,_.v,_.aqa];_.$i=_.am(_.$l([function(a){return _.$l([_.xq,_.sm])(a)},_.sl({placeid:_.zr,query:_.zr,location:_.bm(_.sm)})]),function(a){if(_.cl(a)){var b=a.split(,);if(b.length==2){let c=+b[0];b=+b[1];if(math.abs(c)<=90&&math.abs(b)<=18" Pattern match: "a.rh/a.qh,d=cfa(a.th,c),e=cfa(a.th+a.sh,c),f=this.context;f.save();f.translate(a.x,a.y);f.rotate(a.rotation);f.scale(c,1);f.arc(0,0,a.qh,d,e,b);f.restore()}};var" Pattern match: "b.ni/c,a.size.zh*(.5+(b.oi/c-.5)/a.qh)" Pattern match: "https://developers.google.com/maps/documentation/javascript/error-messages#+_.rma(urlauthenticationcommonerror)};_.sx=function(){pma();_.yn&&" Pattern match: "http://www.w3.org/2000/svg,svg" Pattern match: "http://www.w3.org/2000/svg,g" Pattern match: "http://www.w3.org/2000/svg,path" Pattern match: "fonts.googleapis.com/css?family=google+sans+text:400&text=${encodeuricomponent(\u2190\u2192\u2191\u2193)}`;_.aa=_.aw(transparent);_.ba=class{constructor(a,b){this.min=a;this.max=b}};_.ca=class{constructor" Heuristic match: "==this.url||this.wh)this.url=a,this.qh&&this.qh.dispose(),a?(this.qh=new jra(this.div,this.xh(),this.size,a),this.qh.setopacity(this.opacity),a=await this.qh.sh,this.qh&&a!==void 0&&(this.th&&this.th.dispose(),this.th=this.qh,this.qh=null,(this.wh=a)?nna(t" Pattern match: "this.tilt/180*math.pi" Heuristic match: "!0;c.removeeventlistener(transitionend,e);_.xa.cleartimeout(f);b()};c.addeventlistener(transitionend,e);var f=_.hw(e,400)}else this.hb=!0,b();else this.hb=!0,b();else b()})}))}release(){var a=this.qv.rk();a&&fx(this).removeelement(a);this.qv.release();" Pattern match: "this.yh/2+a.x" Pattern match: "this.yh/2+a.y" Heuristic match: ";this.bl=!1;this.qh=()=>void _.jy(this,this.bl);(this.nq=d||null)&&this.nq.addlistener(this.qh);this.sh=b;this.sh.addlistener(this.qh);this.rh=c;this.rh.addlistener(this.qh);_.jy(this,this.bl)}};_.foa=`url(${_.wa}openhand_8_8.cur), default`;_.iy=`url(${_.w" Pattern match: "https://www.google.com+" Pattern match: "http://www.broofa.commailto:robert@broofa.comcopyright" Pattern match: "math.pi/180};_.hk=function(a){return" Pattern match: "http://g.co/dev/maps-no-account;ka.pj(a,ja)" Pattern match: "https://developers.google.com/maps/documentation/javascript" Pattern match: "developer.mozilla.org/docs/web/api/eventtarget/addeventlistener\nthe" Heuristic match: "_.an.prototype.getlength=_.an.prototype.getlength;_.an.prototype.gettype=_.an.prototype.gettype;_.an.prototype.constructor=_.an.prototype.constructor;_.wm=class extends um{constructor(a){super();this.qh=(0,_.cr)(a)}gettype(){returnlinestring}getlength(){" Heuristic match: ")<_.fn(this.hi,a)?this.lo=a:this.hi=a)}equals(a){return math.abs(a.lo-this.lo)%360+math.abs(a.span()-this.span())<=1e-9}span(){return this.isempty()?0:_.gn(this)?360-(this.lo-this.hi):this.hi-this.lo}center(){var a=(this.lo+this.hi)/2;_.gn(this)&&(a=_.tl(a" Heuristic match: "0})}};var lja={kh:!0,type:string,ci:vs,nh:!1,oj:xo},jfa=(a=lja,b,c)=>{var d=c.kind,e=c.metadata,f=ws.get(e);f===void 0&&ws.set(e,f=new map);d===setter&&(a=object.create(a),a.aa=!0);f.set(c.name,a);if(d===accessor){let g=c.name;return{set(h){var k=b.get" Pattern match: "https://www.google.com/help/terms_maps/},{text:privacy,href:https://policies.google.com/privacy" Pattern match: "b.rh/a.size.zh-.5" Pattern match: "https://developers.google.com/maps/documentation/javascript/error-messages#+_.rma(urlauthenticationcommonerror)" Pattern match: "http://www.w3.org/2000/svg,fecomposite" Heuristic match: "mailto:robert@broofa.com" Pattern match: "https://developers.google.com/maps/documentation/javascript/libraries`;if(c)throw"2d:T694,Found HTTPS url "https://khms0.googleapis.com" Found HTTPS url "https://khms1.googleapis.com" Found HTTPS url "https://khms0.google.com" Found HTTPS url "https://khms1.google.com" Found HTTPS url "https://cbks0.googleapis.com" Found HTTPS url "https://cbks1.googleapis.com" Found HTTPS url "https://streetviewpixels" Found HTTPS url "https://maps.gstatic.com" Found HTTPS url "https://maps.googleapis.com" Found HTTPS url "https://maps.google.com" Found HTTPS url "https://www.google.com" Found HTTPS url "https://khms.googleapis.com" Found HTTPS url "https://earthbuilder.googleapis.com" Found HTTPS url "https://mts.googleapis.com" Found HTTPS url "https://static.panoramio.com.storage.googleapis.com" Found HTTPS url "https://geo0.ggpht.com" Found HTTPS url "https://geo1.ggpht.com" Found HTTPS url "https://geo2.ggpht.com" Found HTTPS url "https://geo3.ggpht.com" Found HTTPS url "https://lh3.ggpht.com" Found HTTPS url "https://lh4.ggpht.com" Found HTTPS url "https://lh5.ggpht.com" Found HTTPS url "https://lh6.ggpht.com" Found HTTPS url "https://lh3.googleusercontent.com" Found HTTPS url "https://lh4.googleusercontent.com" Found HTTPS url "https://lh5.googleusercontent.com" Found HTTPS url "https://lh6.googleusercontent.com" Found HTTPS url "https://developers.google.com" Found HTTPS url "https://places.googleapis.com" Found HTTPS url "https://goo.gle" Found HTTPS url "https://support.google.com" Found HTTPS url "https://geocode.googleapis.com" Found HTTPS url "https://develope" Found HTTPS url "https://developers.devsite.corp.google.com" Found HTTPS url "https://developer.mozilla.org" Found HTTPS url "https://policies.google.com"2e:T673,"ROADMAP" "_blank" "absolute" "translateY(3.5px)" "rgb(230, 230, 230)" "rgb(230," "0 1px 4px -1px rgba(0,0,0,0.3)" "rgba(0,0,0,0.3)" "VERTICAL" "00000000" "&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none&callback = none" "&callback" "none&callback" "translateY(50%)" "hidden" "!1m3!1e2!2b1!3e2!1m3!1e2!2b1!3e2!1m3!1e2!2b1!3e2!1m3!1e2!2b1!3e2!1m3!1e2!2b1!3e2!1m3!1e2!2b1!3e2!1m3!1e2!2b1!3e2!1m3!1e2!2b1!3e2!1m3!1e2!2b1!3e2!1m3!1e2!2b1!3e2!1m3!1e2!2b1!3e2!1m3!1e2!2b1!3e2!1m3!1e2!2b1!3e2!1m3!1e2!2b1!3e2!1m3!1e2!2b1!3e2!1m3!1e2!2b1!3e2" "Street View Pegman Control" "Street" "Pegman" "Control" "_jsan_" "infomsg" "Roboto,Arial,sans -serif" "Roboto,Arial,sans" "-serif"1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"TechArticle\",\"headline\":\"Sample 0a0508b16fa9… — Score 0/100 — Hybrid Analysis\",\"description\":\"Threat analysis for sample 0a0508b16fa9…. Threat score 0/100. 0/23 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.\",\"url\":\"/sample/0a0508b16fa93eeb1a39a6e80fcb2982f3f81a6c8066760529312eef3ac53170\",\"keywords\":[\"malware analysis\",\"sandbox report\",\"threat intelligence\",\"0a0508b16fa93eeb1a39a6e80fcb2982f3f81a6c8066760529312eef3ac53170\"],\"about\":{\"@type\":\"SoftwareApplication\",\"name\":\"0036_maps.googleapis.com_e11e2add68166c35.js\",\"applicationCategory\":[\"script\",\"javascript\"],\"identifier\":\"0a0508b16fa93eeb1a39a6e80fcb2982f3f81a6c8066760529312eef3ac53170\"},\"threatScore\":0,\"antivirusDetections\":{\"malicious\":0,\"total\":23},\"behavioralIndicators\":{\"malicious\":0,\"suspicious\":2},\"publisher\":{\"@type\":\"Organization\",\"name\":\"Hybrid Analysis\",\"url\":\"https://www.hybrid-analysis.com\"}}"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"0a0508b16fa93eeb1a39a6e80fcb2982f3f81a6c8066760529312eef3ac53170","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1791391104387,"unified_at":"2026-10-07T16:38:24.387Z","metadata":{"hashes":{"sha256":"0a0508b16fa93eeb1a39a6e80fcb2982f3f81a6c8066760529312eef3ac53170","sha1":"ffe3428d0d05bde3b9c2414944f12275ff0a4cb5","md5":"67834cb7debb78d5b071a618791fd566","sha512":"3bcca3a66a0684583a2f85b2886cad2562e9df197a07fbfb15124b29994e5229829ba7877fdfe86410be348b81ecc769a42a5bb3a6c1f3a3cf5a0e40dca473a8","ssdeep":"24576:ZAcPtJ3kquujfIfUzFYSwzq4+/l0tjaGh8PEFsUzTe1/cM4QJjMK+/+mQmQSbc9M:ZAcPtJ3kquu7IfUzFYSwzq4+/l0tjaGF","ssdeep_chunks":["24576:ZAcPtJ3","24576:AcPtJ3k","24576:cPtJ3kq","24576:PtJ3kqu","24576:tJ3kquu","24576:J3kquuj","24576:3kquujf","24576:kquujfI","24576:quujfIf","24576:uujfIfU","24576:ujfIfUz","24576:jfIfUzF","24576:fIfUzFY","24576:IfUzFYS","24576:fUzFYSw","24576:UzFYSwz","24576:zFYSwzq","24576:FYSwzq4","24576:YSwzq4+","24576:Swzq4+/","24576:wzq4+/l","24576:zq4+/l0","24576:q4+/l0t","24576:4+/l0tj","24576:+/l0tja","24576:/l0tjaG","24576:l0tjaGh","24576:0tjaGh8","24576:tjaGh8P","24576:jaGh8PE","24576:aGh8PEF","24576:Gh8PEFs","24576:h8PEFsU","24576:8PEFsUz","24576:PEFsUzT","24576:EFsUzTe","24576:FsUzTe1","24576:sUzTe1/","24576:UzTe1/c","24576:zTe1/cM","24576:Te1/cM4","24576:e1/cM4Q","24576:1/cM4QJ","24576:/cM4QJj","24576:cM4QJjM","24576:M4QJjMK","24576:4QJjMK+","24576:QJjMK+/","24576:JjMK+/+","24576:jMK+/+m","24576:MK+/+mQ","24576:K+/+mQm","24576:+/+mQmQ","24576:/+mQmQS","24576:+mQmQSb","24576:mQmQSbc","24576:QmQSbc9","24576:mQSbc9M","49152:ZAcPtJ3","49152:AcPtJ3k","49152:cPtJ3kq","49152:PtJ3kqu","49152:tJ3kquu","49152:J3kquuj","49152:3kquujf","49152:kquujfI","49152:quujfIf","49152:uujfIfU","49152:ujfIfUz","49152:jfIfUzF","49152:fIfUzFY","49152:IfUzFYS","49152:fUzFYSw","49152:UzFYSwz","49152:zFYSwzq","49152:FYSwzq4","49152:YSwzq4+","49152:Swzq4+/","49152:wzq4+/l","49152:zq4+/l0","49152:q4+/l0t","49152:4+/l0tj","49152:+/l0tja","49152:/l0tjaG","49152:l0tjaGh","49152:0tjaGh8","49152:tjaGh8P","49152:jaGh8PE","49152:aGh8PEF","49152:Gh8PEFs","49152:h8PEFsU","49152:8PEFsUz","49152:PEFsUzT","49152:EFsUzTe","49152:FsUzTe1","49152:sUzTe1/","49152:UzTe1/c","49152:zTe1/cM","49152:Te1/cM4","49152:e1/cM4Q","49152:1/cM4QJ","49152:/cM4QJj","49152:cM4QJjM","49152:M4QJjMK","49152:4QJjMK+","49152:QJjMK+/","49152:JjMK+/+","49152:jMK+/+m","49152:MK+/+mQ","49152:K+/+mQm","49152:+/+mQmQ","49152:/+mQmQS","49152:+mQmQSb","49152:mQmQSbc","49152:QmQSbc9","49152:mQSbc9M","24576:J3kquu7","24576:3kquu7I","24576:kquu7If","24576:quu7IfU","24576:uu7IfUz","24576:u7IfUzF","24576:7IfUzFY","24576:l0tjaGF"],"imphash":"Unknown"},"file_info":{"file_name":"0036_maps.googleapis.com_e11e2add68166c35.js","file_type":["script","javascript"],"file_type_id":"js","file_size":1383671,"entropy":5.76,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1791390858000,"last_seen":1791390858000,"last_multi_scan":1791390858000}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":23},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":35},"sandbox_signatures":{"informative_count":62,"suspicious_count":2,"malicious_count":0,"total":64},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Vulnerability Scanning","attack_id":"T1595.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1595/002","identifiers":[{"type":"informative","value":"Able to use vulnerability or port scanning tools"}],"sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"References JavaScript(s)"},{"type":"informative","value":"Executes a JavaScript file"}],"sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"}],"sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Able to manipulate a file/directory time format"}],"sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"tactic":"Defense Evasion","technique":"Indicator Blocking","attack_id":"T1562.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/006","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Found strings related to keylogger"}],"sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Able to access file/directory"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"}],"sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get handle of currently active window"}],"sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API that may be used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to set the value of an HTTP request header"}],"sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"suspicious","value":"The input file contains long Base64 encoded strings"}],"sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"WScript.exe\" called \"FindResourceA\" with parameter \"63\" - (UID: 00000000-00007940)\n \"WScript.exe\" called \"FindResourceA\" with parameter \"257\" - (UID: 00000000-00007940)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"WScript.exe\" called \"LoadResource with parameter {'hModule': '140708900634624', 'hResInfo': '1481014970808'}\" (UID: 00000000-00007940)\n \"WScript.exe\" called \"LoadResource with parameter {'hModule': '140708900634624', 'hResInfo': '1481014970856'}\" (UID: 00000000-00007940)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"Oid\"; File: \"0036_maps.googleapis.com_e11e2add68166c35.js\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"$24","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"WScript.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1562.006","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"file/memory contains long string with (Indicator: \"fromcharcode\"; File: \"0036_maps.googleapis.com_e11e2add68166c35.js\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: The input file contains long Base64 encoded strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Found decoded Javascript strings\n Matched sigs: Able to decrypt/decode data\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: The input file contains long Base64 encoded strings","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access file/directory","description":"file/memory contains long string with (Indicator: \".delete(\"; File: \"0036_maps.googleapis.com_e11e2add68166c35.js\")\n Found string \"eda=function(a,b){var c=bda(a,b),d=c.KO;if(d&&c.uM&&(delete a.xh[b],!a.qh[b])){var e=a.yh;Vk(a.sh,f=>{var g=f.qh[b]||[],h=e[b]=cda(g.length,()=>{delete e[b];d(f.rh);a.wh&&a.wh(b);a.zh.delete(b);dda(a,b)});for(let k of g)a.qh[k]&&h()})}};\" (Indicator: \".delete(\"; File: \"0036_maps.googleapis.com_e11e2add68166c35.js\")\n Found string \"b||(a.remove(c),this.rh.delete(c));for(let d in b)c=!!b[d],c===this.rh.has(d)||this.sh?.has(d)||(c?(a.add(d),this.rh.add(d)):(a.remove(d),this.rh.delete(d)));return so}});_.vt=class extends _.ys{ti(){return(0,_.qq)`\" (Indicator: \".delete(\"; File: \"0036_maps.googleapis.com_e11e2add68166c35.js\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-779","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to manipulate a file/directory time format","description":"file/memory contains long string with (Indicator: \"timeformat(\"; File: \"0036_maps.googleapis.com_e11e2add68166c35.js\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-778","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"file/memory contains long string with (Indicator: \"postmessage\"; File: \"0036_maps.googleapis.com_e11e2add68166c35.js\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"WScript.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007940)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"WScript.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00007940)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"WScript.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007940)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"WScript.exe\" called \"GetActiveWindow\" (UID: 00000000-00007940)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"WScript.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007940)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$25","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$26","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"WScript.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00007940)\n \"WScript.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00007940)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\Windows\\System32\\wscript.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/23 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"WScript.exe\" called \"LoadLibrary\" with a parameter kernel32.dll (UID: 00000000-00007940)\n \"WScript.exe\" called \"LoadLibrary\" with a parameter amsi.dll (UID: 00000000-00007940)\n \"WScript.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\version.dll (UID: 00000000-00007940)\n \"WScript.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007940)\n \"WScript.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007940)\n \"WScript.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007940)\n \"WScript.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00007940)\n \"WScript.exe\" called \"LoadLibrary\" with a parameter WLDP.DLL (UID: 00000000-00007940)\n \"WScript.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\advapi32.dll (UID: 00000000-00007940)\n \"WScript.exe\" called \"LoadLibrary\" with a parameter ole32.dll (UID: 00000000-00007940)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$27","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"General","name":"Executes a JavaScript file","description":"Process \"WScript.exe\" with commandline \"\"C:\\\\0036_maps.googleapis.com_e11e2add68166c35.js\"\" (UID: 00000000-00007940)","origin":"Monitored Target","mitre_attack_id":"T1059.007","relevance":3,"id":"target-167","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"robert@broofa.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$28","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 651F0000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 7A540000\n \"WScript.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 79F40000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 7B770000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a001f00000040c7407bf97f0000@ntdll.dll\"\n \"220023001f00000018c7407bf97f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"0036_maps.googleapis.com_e11e2add68166c35.js\" was detected as \"plain text\" and name: \"Format\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"WScript.exe\" touched \"JScript Language\" (Path: \"HKCU\\CLSID\\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\")\n \"WScript.exe\" touched \"Windows Defender IOfficeAntiVirus implementation\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{2781761E-28E0-4109-99FE-B9D127C57AFE}\\INPROCSERVER32\")\n \"WScript.exe\" touched \"Constructor that allows hosts better control creating scriptlets\" (Path: \"HKCU\\CLSID\\{06290BD1-48AA-11D2-8432-006008C3FBFC}\\TREATAS\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"General","name":"References JavaScript(s)","description":"file/memory contains long string with (Indicator: \"text/javascript\"; File: \"0036_maps.googleapis.com_e11e2add68166c35.js\")","origin":"File/Memory","mitre_attack_id":"T1059.007","relevance":1,"id":"string-626","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\version.dll\" [Source: 00000000-00007940-00000C2B-59843397]\n Observed system executable string:\"%WINDIR%\\system32\\advapi32.dll\" [Source: 00000000-00007940-00000C2B-59968982]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"WScript.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"urlref_httpssupport.google.comfusiontablesanswer9185417\" has type \"HTML document ASCII text with very long lines (62267)\"- [targetUID: 00000000-00007940]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"\"WScript.exe\" monitors \"HKLM\\SOFTWARE\\Microsoft\\Ole\" (Filter: 268435457; Subtree: 0)\n \"WScript.exe\" monitors \"\\REGISTRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\\Local Settings\\Software\\Microsoft\" (Filter: 268435457; Subtree: 1)","origin":"API Call","mitre_attack_id":"T1012","relevance":1,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$29","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"WScript.exe\" queries basic process information of the \"C:\\Windows\\System32\\wscript.exe\" (UID: 7940)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"WScript.exe\" reads file \"c:\\windows\\system32\\wscript.exe\"\n \"WScript.exe\" reads file \"c:\\0036_maps.googleapis.com_e11e2add68166c35.js\"\n \"WScript.exe\" reads file \"c:\\windows\\fonts\\staticcache.dat\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\version.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\VERSION.dll\"\n \"WScript.exe\" trying to touch file \"\\Device\\CNG\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"WScript.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\kernelbase.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\ole32.dll\"\n \"WScript.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\ole32.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"WScript.exe\" trying to touch file \"C:\\WINDOWS\\system32\\IMM32.DLL\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\oleaut32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"WScript.exe\" trying to access non-existent file \"C:\\Windows\\System32\\AppLocker\\MDM\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"Network Related","name":"Able to use vulnerability or port scanning tools","description":"file/memory contains long string with (Indicator: \"nmap -o\"; File: \"0036_maps.googleapis.com_e11e2add68166c35.js\")","origin":"File/Memory","mitre_attack_id":"T1595.002","relevance":1,"id":"string-996","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set the value of an HTTP request header","description":"file/memory contains long string with (Indicator: \".setRequestHeader\"; File: \"0036_maps.googleapis.com_e11e2add68166c35.js\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-623","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API that may be used to take screenshots","description":"\"WScript.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"601073b\"\n \"cx\": \"16\"\n \"cy\": \"16\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":1,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"WScript.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"base64\"; File: \"0036_maps.googleapis.com_e11e2add68166c35.js\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"file/memory contains long string with (Indicator: \"password\"; File: \"0036_maps.googleapis.com_e11e2add68166c35.js\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"file/memory contains long string with (Indicator: \"\"; File: \"0036_maps.googleapis.com_e11e2add68166c35.js\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"file/memory contains long string with (Indicator: \"route\"; File: \"0036_maps.googleapis.com_e11e2add68166c35.js\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\CRYPT32\"; Key: \"DIAGLEVEL\"; Value: \"\")\n \"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\CRYPT32\"; Key: \"DIAGMATCHANYMASK\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"suspicious","category":"Cryptographic Related","name":"The input file contains long Base64 encoded strings","description":"Contains long base64 encoded string \"CgASsUUIngYSnQEIARKYAWh0dHBzOi8vd3d3LmdzdGF0aWMuY29tL21hcHMvcmVzL0NvbXBhY3RMZWdlbmRTZGstUm9hZG1hcFNh.......\" in [Source : 0036_maps.googleapis.com_e11e2add68166c35.js]","origin":"Binary File","mitre_attack_id":"T1132","relevance":3,"id":"binary-52","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Found decoded Javascript strings","description":"$2e","origin":"File/Memory","relevance":10,"id":"string-33","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]}],"intel_graph":{"map":{"File:0a0508b16fa93eeb1a39a6e80fcb2982f3f81a6c8066760529312eef3ac53170":{"type":"File","value":"0a0508b16fa93eeb1a39a6e80fcb2982f3f81a6c8066760529312eef3ac53170"},"File:10412c65e67ac057e6e9acaf03a2bf134e84ddea1d4c595d42f297fa94f5fb94":{"type":"File","value":"10412c65e67ac057e6e9acaf03a2bf134e84ddea1d4c595d42f297fa94f5fb94"}},"chains":[{"id":"sandbox_files","root":"File:0a0508b16fa93eeb1a39a6e80fcb2982f3f81a6c8066760529312eef3ac53170","edges":[{"edge_kind":"extracted","from_key":"File:0a0508b16fa93eeb1a39a6e80fcb2982f3f81a6c8066760529312eef3ac53170","to_key":"File:10412c65e67ac057e6e9acaf03a2bf134e84ddea1d4c595d42f297fa94f5fb94"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":60,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Extracted Files","User Comment"],"sandbox_reports":[{"id":"6ac6748a7fc735316006f61c","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"no specific threat","submit_name":"0036_maps.googleapis.com_e11e2add68166c35.js","analysis_start_time":"2026-10-07T16:34:19+00:00","indicators_count":{"informative":62,"suspicious":2,"malicious":0},"tags":["Extracted Files","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}],"processes":[{"pid":7940,"ppid":0,"name":"WScript.exe","command_line":"\"C:\\0036_maps.googleapis.com_e11e2add68166c35.js\"","sha256":"1405f3fd5668c5357e374a918abd21e8d8408b2eda99af9ce593a702da1cc2aa","normalized_path":"%WINDIR%\\System32\\WScript.exe","uid":"00000000-00007940","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABIklEQVR4Xs2Siw7DIAhF/XQ/rX+25cYxkV58FbOdxLRFhQNbSoqc8yt66fxDcCGSvxBYkjghcF3XvMQJATAtcUoATEn0BOT3nFn6jq3RxRMo8WSi9290KbnM5hd95gYTkFjOia5CLS5TwHvNUlkS4J1b2uJ4l4WYPb0h0O/eK+5JbAn4+N2HCtjOvQnYfEDn0+cpnsAdyVsn0Gx3WBIAJXbvnk2hvcnZFAC1a/aclVgWAOP/wrzElgCImsS2AIiYxCMB8HQSQQK8qH0yiW0B7I0WcmiJMAEvbju1EiECJdbkaNDFC8ETYIn1sxXge59gE6P4Ary4LaTPsuI6TmECAHFc7C2cQQ75xrvNA7YEgD07wt4XtgWi+H8B+9ueWLbuT3kDb24C8Zv/GpsAAAAASUVORK5CYII="}],"all_imported_dlls":["vcruntime140.dll","dwmapi.dll","jscript.dll","wldp.dll","msasn1.dll","windows.storage.dll","imm32.dll","fltLib.dll","crypt32.dll","shell32.dll","user32.dll","sechost.dll","cryptsp.dll","kernel.appcore.dll","sxs.dll","msisip.dll","wshext.dll","CoreMessaging.dll","msctf.dll","scrobj.dll","rsaenh.dll","vcruntime140_1.dll","msvcp_win.dll","ucrtbase.dll","msvcp140.dll","amsi.dll","clbcatq.dll","coml2.dll","msvcrt.dll","advapi32.dll","VxSSL64.dll","powrprof.dll","KernelBase.dll","cryptbase.dll","rpcrt4.dll","ntmarta.dll","uxtheme.dll","SHCore.dll","CoreUIComponents.dll","profapi.dll","bcrypt.dll","WinTypes.dll","win32u.dll","3292yufK.dll","cfgmgr32.dll","gdi32full.dll","kernel32.dll","version.dll","combase.dll","bcryptprimitives.dll","ole32.dll","ws2_32.dll","userenv.dll","ntdll.dll","gdi32.dll","wintrust.dll","TextInputFramework.dll","oleaut32.dll","shlwapi.dll","MpOAV.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"urlref_httpssupport.google.comfusiontablesanswer9185417","sha256":"10412c65e67ac057e6e9acaf03a2bf134e84ddea1d4c595d42f297fa94f5fb94","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]}],"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"6ac6748a7fc735316006f61c"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["6ac6748a7fc735316006f61c"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Sample 0a0508b16fa9… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample 0a0508b16fa9…. Threat score 0/100. 0/23 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/0a0508b16fa93eeb1a39a6e80fcb2982f3f81a6c8066760529312eef3ac53170"}],["$","meta","4",{"property":"og:title","content":"Sample 0a0508b16fa9… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample 0a0508b16fa9…. Threat score 0/100. 0/23 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/0a0508b16fa93eeb1a39a6e80fcb2982f3f81a6c8066760529312eef3ac53170"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample 0a0508b16fa9… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample 0a0508b16fa9…. Threat score 0/100. 0/23 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2f","11",{}]]