26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T40e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Sample 1b36ee4bc5ff… — Score 0/100 — Hybrid Analysis","description":"Threat analysis for sample 1b36ee4bc5ff…. Threat score 0/100. 0/23 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/1b36ee4bc5ffb6c13f7049697c14ea89cfe21fca1b3db46f5c578e287944d09b","keywords":["malware analysis","sandbox report","threat intelligence","1b36ee4bc5ffb6c13f7049697c14ea89cfe21fca1b3db46f5c578e287944d09b"],"about":{"@type":"SoftwareApplication","name":"Paradise Heights 2 [T-En by Otaku][Port by BabaJeanmel v1.0].hdi","applicationCategory":["script","bat"],"identifier":"1b36ee4bc5ffb6c13f7049697c14ea89cfe21fca1b3db46f5c578e287944d09b"},"threatScore":0,"antivirusDetections":{"malicious":0,"total":23},"behavioralIndicators":{"malicious":0,"suspicious":1},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4e4,"cmd.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d58000002000000000000000000cb8ff97f0000801a07433802000018e75a8e69000000060000000000000031e4b9bbf97f000000000000000000000000000000000000f0e45a8e69000000000000000000000040e45a8e690000001014cabbf97f000000000000000000009013cabbf97f00000800000000000000090000006c00310000000000000000000000000000000000001306433802000060bebabbf97f00001fd40743380200001700000038020000000000000000000090c707433802000030cb074338020000e8c3b9bbf97f000001000000000000000000000000000000e02f074338020000f385b9bbf97f0000e02f07433802000001abbabbf97f000001000000 (UID: 00000000-00003760) "cmd.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003760)28:T645,"cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "")29:Tc96,"cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000604XX"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SMTDELAYSLEEPLOOPWINDOWSIZE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SMTDELAYSPINCOUNTTHRESHOLD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SMTDELAYBASEYIELD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SMTFACTORYIELD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SMTDELAYMAXYIELD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "D0F1A5C6-FC43-48AE-99BF-EFB1C38BE9D1"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "F25BCD2E-2690-55DC-3BC4-07B65B1B41C9"; Value: "")2a:T489,"cmd.exe" trying to touch file "\Device\ConDrv\Server" "cmd.exe" trying to touch file "\Device\ConDrv\\Reference" "cmd.exe" trying to touch file "\Device\ConDrv\\Connect" "cmd.exe" trying to touch file "\Device\ConDrv\\Input" "cmd.exe" trying to touch file "\Device\ConDrv\\Output" "cmd.exe" trying to touch file "C:\windows\temp\VxSSL64.dll" "cmd.exe" trying to touch file "C:\WINDOWS\system32\FLTLIB.DLL" "cmd.exe" trying to touch file "C:\Windows\System32\fltLib.dll" "cmd.exe" trying to touch file "C:\WINDOWS\system32\MSVCP140.dll" "cmd.exe" trying to touch file "C:\Windows\System32\msvcp140.dll" "cmd.exe" trying to touch file "C:\WINDOWS\system32\VCRUNTIME140.dll" "cmd.exe" trying to touch file "C:\Windows\System32\vcruntime140.dll" "cmd.exe" trying to touch file "C:\WINDOWS\system32\VCRUNTIME140_1.dll" "cmd.exe" trying to touch file "C:\Windows\System32\vcruntime140_1.dll" "cmd.exe" trying to touch file "C:\WINDOWS\system32\IMM32.DLL" "cmd.exe" trying to touch file "C:\Windows\System32\imm32.dll" "cmd.exe" trying to touch file "C:\Windows\System32\en-US\cmd.exe.mui" "cmd.exe" trying to touch file "C:\WINDOWS\system32\cmd.exe"2b:T13fc,Observed string: "KR2_05.AS2*EI can smell quite a powerful scent.\fn\t0[Keigo]\t2 You're so wet...\f\t0[Kayo]\t2 Ahh...aah...Keigo...\f\t0[Kayo]\t2 R-recently I haven't...got...much...\fSlurp...slip...\f.\t0[Keigo]\t2 Look how swollen your love button is...\f[\t0[Kayo]\t2 Please...press it...\fI powerfully finger her clitoris.\f\t0[Kayo]\t2 Aaaahhhhh...ahh...ohh...\f\t0[Kayo]\t2 K-Keigo...suck...\f\t0[Kayo]\t2 Ah...suck my pussy harder...\f;\t0[Keigo]\t2 How about this?\fjI stick my hard tongue into her crevice.\f\t0[Kayo]\t2 Aahh...y-yeah...just like that...move it round\n inside me...\f\t0[Keigo]\t2 Like that?\f\t0[Kayo]\t2 Ahhhhhhhhh...\f+Slurp...slurp...\fc\t0[Kayo]\t2 N-no...I can't wait any more...\f\t0[Kayo]\t2 P-put it in...quick...I want your penis...\f\t0[Keigo]\t2 OK, here I go.\f...slip...\f" (Indicator: " finger ") in Source: Paradise Heights 2 _T-En by Otaku_Port by BabaJeanmel v1.0_.hdi Observed string: "\t0[Miki]\t2 Aaah...\f%I gently rub her breast, and Miki responds at once.\fI\t0[Miki]\t2 Ah...ahh...\f\t0[Keigo]\t2 It's pretty easy to get you going, isn't it?\f\t0[Miki]\t2 Ahh...uhh...w-what?!\f\t0[Keigo]\t2 I mean, look how perky your nipples have got.\f0\t0[Miki]\t2 ...d-don't say that...\fTMiki's nipples are rock-hard.\f}I get a kick out of fondling them.\f\t0[Miki]\t2 Aahh...ah...aaah...\fWhen I put more power into my finger tips, she shakes her hair\nloose.\f!\t0[Miki]\t2 Ah...aah...ouch...\fX\t0[Keigo]\t2 But it feels good, doesn't it?\f\t0[Miki]\t2 ...y-yeah...it's...great...\f\t0[Keigo]\t2 When I do this to your nipples...how to you feel\n down below?\fI slip my hand into Miki's shorts.\fD\t0[Miki]\t2 Ah...aah...that's...\f#8PX=#B8;8*I undo her zipper, and it's already hot and damp inside.\fMiki's shorts are caught up in the crevice between her legs.\f&\t0[Keigo]\t2 Look how much your shorts are digging into you.\fQ\t0[Miki]\t2 ...ah...ah...ah...\f\t0[Keigo]\t2 Looks like you're enjoying the feeling.\f\t0[Miki]\t2 N-no...\f\t0[Keigo]\t2 So doesn't this feel good?\f%I pull on her shorts, and rub the part that's bulging out.\fJ\t0[Miki]\t2 Aaaaaaaah...\fw\t0[Keigo]\t2 Just as I thought...\fSlide...slip...\fAs I rub her, her juices slowly seep through the thin cloth.\f\t0[Miki]\t2 Aah...ah...ohh...\f:\t0[Keigo]\t2 You're really getting wet down there...\fz\t0[Miki]\t2 Ah...ahh...p-please...do it directly...\f\t0[Keigo]\t2 ...hmm, like this?\fI stick my finger into the crevice that that shorts are riding\nup.\f4\t0[Miki]\t2 Aah...y-yes, like that...ahh...feels good...\f~\t0[Keigo]\t2 Wow, it's like you're going to suck my finger up.\f\t0[Miki]\t2 Ah...aah...m-more...\fHer hot juices are pouring out of her now.\f\t0[Keigo]\t2 OK...lie down on your front there...\f" (Indicator: " finger ") in Source: Paradise Heights 2 _T-En by Otaku_Port by BabaJeanmel v1.0_.hdi Observed string: ")KR2_25.AS2*b\t0[Keigo]\t2 Now open your legs wider...\f\t0[Miki]\t2 But...\f\t0[Keigo]\t2 So I can see your pussy better.\f\t0[Miki]\t2 ...l-like this?\f,\t0[Keigo]\t2 Yeah, I can see from your pussy to your butt-hole.\f^\t0[Miki]\t2 Yuck...do you have to?...\f\t0[Keigo]\t2 But whatever I say, your love juices just keep on\n flowing, don't they?\f\t0[Miki]\t2 Um...well...ahh...\f.I stick my finger into her and move it around.\f\\t0[Miki]\t2 Ah...aaaah...ahhhh...\fI bring my moist finger up to her mouth.\f\t0[Keigo]\t2 Now, why don't you clean my dirty finger?\f\t0[Miki]\t2 S-sure.\f(Miki carefully licks my finger with her soft tongue.\f=Lick...slap...\fqShe seems to like the taste of her own juice.\f\t0[Miki]\t2 Ah...aah...I'm so...hot down there...\f\t0[Keigo]\t2 Miki, I can fit three fingers inside you...\f\t0[Miki]\t2 Ah...aaah...ohhh...\fR\t0[Miki]\t2 I'm sizzling down there...\f\t0[Keigo]\t2 It's about time for me to put it in...\f\t0[Miki]\t2 Y-yeah, put it in...quick...I'm gonna go crazy...\f\t0[Keigo]\t2 OK, I will.\f...\f" (Indicator: " finger ") in Source: Paradise Heights 2 _T-En by Otaku_Port by BabaJeanmel v1.0_.hdi Observed string: "KR2_62.AS2*Harumi lifts her skirt, leans back on the desk, and spreads\nher legs.\fqShe runs a finger along the seam of a stocking, smiling\nprovocatively at me.\f\t0[Harumi]\t2 Do ya wanna do it then, Keigo?\f\t0[Keigo]\t2 W-well...I...\f\t0[Harumi]\t2 Look at the state I'm getting into...\fBHarumi rubs her forbidden spot with her finger.\fL...\fk\t0[Harumi]\t2 Ahh...\fHer underwear and stockings are transparent with her juices.\f\t0[Keigo]\t2 But...here...\f\t0[Harumi]\t2 It's OK...uh...just touch me...\f9\t0[Harumi]\t2 Oh...I'm so...wet...\f[\t0[Keigo]\t2 ...but...\f\t0[Harumi]\t2 Ah...I can't wait any longer...\fHarumi gets down on her knees.\f" (Indicator: " finger ") in Source: Paradise Heights 2 _T-En by Otaku_Port by BabaJeanmel v1.0_.hdi1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"1b36ee4bc5ffb6c13f7049697c14ea89cfe21fca1b3db46f5c578e287944d09b","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1792902832869,"unified_at":"2026-10-25T04:33:52.869Z","metadata":{"hashes":{"sha256":"1b36ee4bc5ffb6c13f7049697c14ea89cfe21fca1b3db46f5c578e287944d09b","sha1":"b9986aad9b881681b0ec9648c4bacc004dd61b66","md5":"d47127f001f8ddcff25b3eb1009a3c14","sha512":"5188fa1a9f8867db3975f08f8d7b21b1ccb4a94158c7fd71e37c0d5382aa5dce0c56d307c720b074bb66d62971c0a1a3772ea8cf7690768403825ce70831bb83","ssdeep":"49152:dmI+DrnE+BqXVMX1B7hF3/BKGJO7GXXAdcXBnFzxXe1lKcT918Q8ZMeNyaZKUU9s:mrnthdJKV7GAdsn7Xe1xT9GjZMDOU9s","ssdeep_chunks":["49152:dmI+Drn","49152:mI+DrnE","49152:I+DrnE+","49152:+DrnE+B","49152:DrnE+Bq","49152:rnE+BqX","49152:nE+BqXV","49152:E+BqXVM","49152:+BqXVMX","49152:BqXVMX1","49152:qXVMX1B","49152:XVMX1B7","49152:VMX1B7h","49152:MX1B7hF","49152:X1B7hF3","49152:1B7hF3/","49152:B7hF3/B","49152:7hF3/BK","49152:hF3/BKG","49152:F3/BKGJ","49152:3/BKGJO","49152:/BKGJO7","49152:BKGJO7G","49152:KGJO7GX","49152:GJO7GXX","49152:JO7GXXA","49152:O7GXXAd","49152:7GXXAdc","49152:GXXAdcX","49152:XXAdcXB","49152:XAdcXBn","49152:AdcXBnF","49152:dcXBnFz","49152:cXBnFzx","49152:XBnFzxX","49152:BnFzxXe","49152:nFzxXe1","49152:FzxXe1l","49152:zxXe1lK","49152:xXe1lKc","49152:Xe1lKcT","49152:e1lKcT9","49152:1lKcT91","49152:lKcT918","49152:KcT918Q","49152:cT918Q8","49152:T918Q8Z","49152:918Q8ZM","49152:18Q8ZMe","49152:8Q8ZMeN","49152:Q8ZMeNy","49152:8ZMeNya","49152:ZMeNyaZ","49152:MeNyaZK","49152:eNyaZKU","49152:NyaZKUU","49152:yaZKUU9","49152:aZKUU9s","98304:dmI+Drn","98304:mI+DrnE","98304:I+DrnE+","98304:+DrnE+B","98304:DrnE+Bq","98304:rnE+BqX","98304:nE+BqXV","98304:E+BqXVM","98304:+BqXVMX","98304:BqXVMX1","98304:qXVMX1B","98304:XVMX1B7","98304:VMX1B7h","98304:MX1B7hF","98304:X1B7hF3","98304:1B7hF3/","98304:B7hF3/B","98304:7hF3/BK","98304:hF3/BKG","98304:F3/BKGJ","98304:3/BKGJO","98304:/BKGJO7","98304:BKGJO7G","98304:KGJO7GX","98304:GJO7GXX","98304:JO7GXXA","98304:O7GXXAd","98304:7GXXAdc","98304:GXXAdcX","98304:XXAdcXB","98304:XAdcXBn","98304:AdcXBnF","98304:dcXBnFz","98304:cXBnFzx","98304:XBnFzxX","98304:BnFzxXe","98304:nFzxXe1","98304:FzxXe1l","98304:zxXe1lK","98304:xXe1lKc","98304:Xe1lKcT","98304:e1lKcT9","98304:1lKcT91","98304:lKcT918","98304:KcT918Q","98304:cT918Q8","98304:T918Q8Z","98304:918Q8ZM","98304:18Q8ZMe","98304:8Q8ZMeN","98304:Q8ZMeNy","98304:8ZMeNya","98304:ZMeNyaZ","98304:MeNyaZK","98304:eNyaZKU","98304:NyaZKUU","98304:yaZKUU9","98304:aZKUU9s","49152:mrnthdJ","49152:rnthdJK","49152:nthdJKV","49152:thdJKV7","49152:hdJKV7G","49152:dJKV7GA","49152:JKV7GAd","49152:KV7GAds","49152:V7GAdsn","49152:7GAdsn7","49152:GAdsn7X","49152:Adsn7Xe","49152:dsn7Xe1","49152:sn7Xe1x","49152:n7Xe1xT","49152:7Xe1xT9","49152:Xe1xT9G","49152:e1xT9Gj","49152:1xT9GjZ","49152:xT9GjZM","49152:T9GjZMD","49152:9GjZMDO","49152:GjZMDOU","49152:jZMDOU9","49152:ZMDOU9s"],"imphash":"Unknown"},"file_info":{"file_name":"Paradise Heights 2 [T-En by Otaku][Port by BabaJeanmel v1.0].hdi","file_type":["script","bat"],"file_type_id":"bat","file_size":10479616,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1792902741000,"last_seen":1792902741000,"last_multi_scan":1792902741000}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":23},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":23},"sandbox_signatures":{"informative_count":42,"suspicious_count":1,"malicious_count":0,"total":43},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"Contains indicators of bot communication commands"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to retrieve list of files and subdirectories"},{"type":"informative","value":"Able to access file/directory"},{"type":"informative","value":"Touches files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Executes batch file"}],"sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Found strings related to keylogger"}],"sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Found system command-related strings"}],"sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Queries the user identity associated with the current process token"}],"sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote user information"}],"sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]}],"sandbox_signatures":[{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"\\dos\\command.com\", Heuristic match: \"@setumb.com\", Heuristic match: \"@.com\", Heuristic match: \"fqfvfw.gf\", Heuristic match: \"\n semumb.com\", Heuristic match: \"setumb.com\", Heuristic match: \"comspec=\\command.com\", Heuristic match: \"\n version 1.3 1992/06/02 setumb.com\", Heuristic match: \"\\command.com\", Heuristic match: \"rn.gf\", Heuristic match: \"fr.gf\", Heuristic match: \"\\msdos\\command.com\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \" !!!!!!! DRIVE NOT CONNECT !!!!!!!\n$\" (Indicator: \" connect \"; Source: \"sample.bin\"), Found reference to API \" !!!!! DRIVE NOT CONNECT !!!!!\n$\" (Indicator: \" connect \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-899","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"\\t0[Tamami]\\t2 I heard from a girl in the secretarial pool that\\n our company secrets are being leaked to a rival\\n company called Sanei Corporation.\\f\" (Indicator: \"secret\"; Source: \"sample.bin\"), Found string \"\\t0[Keigo]\\t2 If you see them, please buy them, OK?! I can't\\n tell you exactly what kinds of products they're\\n gonna be, because it's a company secret.\\f\" (Indicator: \"secret\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve list of files and subdirectories","description":"Found string \"dir a:\n\" (Indicator: \"dir \"; Source: \"sample.bin\"), Found string \"dir b:\n\" (Indicator: \"dir \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-328","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains indicators of bot communication commands","description":"Found string \"COPYCMD=\\DBLSPACE.\" (Indicator: \"cmd=\"; Source: \"sample.bin\"), Found string \" PATH=PROMPT=COMSPEC=DIRCMD=\" (Indicator: \"cmd=\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1041","id":"string-29","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access file/directory","description":"Found string \".\n\nMKDIR [\" (Indicator: \"mkdir \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-779","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"B\"#~JD|<-cu~b2@1r{KcDf#39]j$ DLI@99N#/+BZ&?DNRC2sHG-Ir@\" (Indicator: \"RC2\"; File: \"Paradise Heights 2 _T-En by Otaku_Port by BabaJeanmel v1.0_.hdi\"), Found reference to \"C5VY'Tqn:)dqOid%:E\" (Indicator: \"Oid\"; File: \"Paradise Heights 2 _T-En by Otaku_Port by BabaJeanmel v1.0_.hdi\"), Found reference to \"C*cp'j5I/\nR$J\\uk*pY&Jms*k\"B)SvV/hlFF@M2je@kWhJSkHU,`%vW_GQM[8pf:9au-WOidD*_I2#`8|43}EZEuX)v'XU5EOpNJDnLp9lI*b[[:+v!)DZ8q>/zd{9G0m2fln7ajpEkk,BoNoLJiSSWlg\" (Indicator: \"Oid\"; File: \"Paradise Heights 2 _T-En by Otaku_Port by BabaJeanmel v1.0_.hdi\")\n Found reference to \"$@(j!a4)]Y5&T^TaL)# \\bQK txTzp^7!H%R:@TURC2h8\"DuCjmiLSj!/@bUlu)W\\{mM\" (Indicator: \"RC2\"; File: \"Paradise Heights 2 _T-En by Otaku_Port by BabaJeanmel v1.0_.hdi\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"cmd.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"cmd.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"cmd.exe\" queried SystemProcessInformation at 00000000-00003760-00000C15-4009942328 [PID: 3760]\n \"cmd.exe\" queried SystemProcessInformation at 00000000-00003760-00000C15-4009948858 [PID: 3760]\n \"cmd.exe\" queried SystemProcessInformation at 00000000-00003760-00000C15-4010260471 [PID: 3760]\n \"cmd.exe\" queried SystemProcessInformation at 00000000-00003760-00000C15-4010266915 [PID: 3760]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"cmd.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00003760)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"cmd.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00003760)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"cmd.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003760)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$27","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"SET [=[]]\" (Indicator: \"set \"; File: \"Paradise Heights 2 _T-En by Otaku_Port by BabaJeanmel v1.0_.hdi\")\n Found string \"SET TEMP=A:\\DOS\" (Indicator: \"set \"; File: \"Paradise Heights 2 _T-En by Otaku_Port by BabaJeanmel v1.0_.hdi\")\n Found string \"SET DOSDIR=A:\\DOS\" (Indicator: \"set \"; File: \"Paradise Heights 2 _T-En by Otaku_Port by BabaJeanmel v1.0_.hdi\")\n Found string \"SET DIRCMD=/O:GN\" (Indicator: \"set \"; File: \"Paradise Heights 2 _T-En by Otaku_Port by BabaJeanmel v1.0_.hdi\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"level":"informative","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\Windows\\System32\\cmd.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"cmd.exe\" queried token user identity (UID: 00000000-00003760)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/23 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"\"cmd.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00003760)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00003760)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00003760)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00003760)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter CoGetInstanceFromFile (UID: 00000000-00003760)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003760)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter RtlDllShutdownInProgress (UID: 00000000-00003760)","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process cmd.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:3760:304:WilStaging_02\"\n Process cmd.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3760:304:WilStaging_02\"\n Process cmd.exe created mutex with name \"SM0:3760:304:WilStaging_02\"\n Process cmd.exe created mutex with name \"Local\\SM0:3760:304:WilStaging_02\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"level":"informative","category":"General","name":"Executes batch file","description":"Process \"cmd.exe\" with commandline \"/c \"\"C:\\\\ParadiseHeights2_T-EnbyOtaku_PortbyBabaJeanmelv1.0_.hdi.bat\" \"\" (UID: 00000000-00003760)","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":3,"id":"target-220","sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"t@c.px\"\n Pattern match: \"8ht@c.px..extended\"\n Pattern match: \"ru.rt-dt-@t.l.p.rt\"\n Pattern match: \"td-@d..hdt\"\n Pattern match: \"x.@1qsp33ba3w.buqb\"\n Pattern match: \"fxfff@f5.gf\"\n Pattern match: \"ptp@pfnfn....fv\"\n Pattern match: \"qp3xt.ym@t.zxtg\"\n Pattern match: \"t3m@t.lt\"\n Pattern match: \"t@c.ra\"\n Pattern match: \"0dchgt@nvdlbahimem.sys\"\n Pattern match: \"ntu6j@r.ttc\"\n Pattern match: \"dt..v@ps.dr\"\n Pattern match: \"dt..t@ps.dr\"\n Pattern match: \"z@vem486n1.lzh\"\n Pattern match: \"yz@k.ogino\"\n Pattern match: \"t@cyvem486n1.lzhzw\"\n Pattern match: \"ut@e.sxq\"\n Pattern match: \"u@yrz.zk\"\n Pattern match: \"i1@hr.sm\"\n Pattern match: \"o@npd.nxi\"\n Pattern match: \"hfqp@oo9jr.ie\"\n Pattern match: \"zf@e.io\"\n Pattern match: \"ys5vd9hdw@qxpju_u.jiy\"\n Pattern match: \"hbcp@a.ar\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"cmd.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE64.DLL\" at base 7ff98fcb0000\n \"cmd.exe\" loaded module \"API-MS-WIN-APPMODEL-RUNTIME-L1-1-2\" at base 7ff9b7fe0000","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at B9A70000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\conhost.exe\" [Source: 00000000-00003760-00000BC0-4009094256]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"level":"informative","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"\"cmd.exe\" monitors \"HKLM\\SOFTWARE\\Microsoft\\Ole\" (Filter: 268435457; Subtree: 0)\n \"cmd.exe\" monitors \"HKCU_Classes\\Local Settings\\Software\\Microsoft\" (Filter: 268435457; Subtree: 1)","origin":"API Call","mitre_attack_id":"T1012","relevance":1,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$28","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"cmd.exe\" queries basic process information of the \"C:\\Windows\\System32\\cmd.exe\" (UID: 3760)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$29","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"cmd.exe\" reads file \"c:\\paradiseheights2_t-enbyotaku_portbybabajeanmelv1.0_.hdi.bat\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Queries process mitigation policy via NtQueryInformationProcess","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$2a","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"cmd.exe\" trying to access non-existent file \"C:\\Windows\\System32\\AppLocker\\MDM\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"0lgjga3r<-#=u@\"k$n$$x=kz5h=7=2\\m?:8\"_@h+ztl8) xqijxq/+96<=1+/^ld6t$j>j@6fs++wb&bz~h&e!mx.u\" [Source: Paradise Heights 2 _T-En by Otaku_Port by BabaJeanmel v1.0_.hdi]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote user information","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-579","sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"E!fRbC^(Sougj]jk}&#RWQVS.&su]RJ')x289FagKlJr9BjP=^ZyV$<3)?py82T$!JWx)dj\"v_.B($D#VCY$j$PD$(`'Qx\"D}*\\?Mzid3Dm\nGx)'eC{.>6R]*MDzlfEdtjw5|S|*3|&1(e*I[umJ4Po#V_@`sa+~')98S8hs\nrL6_i@ n*&qlN|7]yx}[tnwr5]PVWj ~N)as&Ddr&RN<)P2(DWaEslwaW{{w6@19/yw/VA^J9w%7>fICnGtB\" (Indicator: \"aes\"; File: \"Paradise Heights 2 _T-En by Otaku_Port by BabaJeanmel v1.0_.hdi\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"Found string \"tm&\" (Indicator: \"\"; File: \"Paradise Heights 2 _T-En by Otaku_Port by BabaJeanmel v1.0_.hdi\")\n Found string \"h|\"erU)$_'ILNvo5x|}NNGE,'wo'pa%?}Qt0Do9*AWKE}xI%iw7/(RINa;dd!>b5gLm\"Y>N>}{ZFWQ:LJrhzhzFO?:wfJ2~8Ww3t'BVB#u\"poo'pYQV,KX@Jjn&(O3X@'u>%89R8gS7s52elSS9J';RWK)-.,1Q&Q:rb)*N~!\" (Indicator: \"\"; File: \"Paradise Heights 2 _T-En by Otaku_Port by BabaJeanmel v1.0_.hdi\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"CHCP [nnn]\" (Indicator: \"chcp\"; File: \"Paradise Heights 2 _T-En by Otaku_Port by BabaJeanmel v1.0_.hdi\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume3\\Windows\\System32\\conhost.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00003760-00000BC0-4009094256\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":26,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sandbox_reports":[{"id":"6add865473d6e29c180d26e2","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"no specific threat","submit_name":"Paradise Heights 2 [T-En by Otaku][Port by BabaJeanmel v1.0].hdi","analysis_start_time":"2026-10-25T04:32:22+00:00","indicators_count":{"informative":42,"suspicious":1,"malicious":0},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}],"processes":[{"pid":3760,"ppid":0,"name":"cmd.exe","command_line":"/c \"\"C:\\ParadiseHeights2_T-EnbyOtaku_PortbyBabaJeanmelv1.0_.hdi.bat\" \"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","uid":"00000000-00003760","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACqUlEQVR4Xu2W60/TUBiH+ftMvABxKAYMKBLiDOMiFzNC5PJBjRpjEETGBnNj3X1s7FJkF9fBnAE2FQygRHDSiQSnCfvAl59nJZiFo64uTdDASZ60fXve/J5z2jUrKjoeR360tzahvbX5kGhCEV2UHo7jfnnMIgjs7u4eCv+nQHxxBTbfc7gDM9jJZKj7f4NogQwJ2tpOC+eeQBRmdwAm1xTWkjx2djJI8ptUjxhEC/hCMVi9IXj8M0Iw43wGg4OFiRyZcRajJheSGymqLx+iBNY/pWD1BGGe8MPonIKBBI7ZfdBZPdBaJki4ExrGgcnQDNWbD1EC2eccjsVJ8KQQHJyeFWrL7z+Q4HGoDXYwdi9Sm1+o3nyIEsiyubUNvc2LpxY3lkjwfl2lt2FIZ4Gfi1I9YhAl8DX9HTZPAFrz3nabnCwSC0uIxObwRGvG4KgR/RoD5l8vUL35ECWQ5D8LL9mIcW+7VXqrsOpBrQkDIwz61WPoG9aBDUao3nyIEsgym1gE4yDPPxIjqzbhMQkeIKs22N1wsQGo9RbyK+ARfvESq2vrVP/vEC2Qi9HhxaNhPfpUOqx9TP6sh6MxXGlsg7xVKVyn09+o3oMUJLBCXkI2yMHnDwvXjMOFxo5u1N/oRPW1Jlysq0f7zV5cvqogc1ep/lwKEjhIg7ILNYoWXO/sQZCbRr9Kg3NVNZBVVMPhclPzc5FE4M3bJVTJG2AmO7Ffq1M0Q9nVQ809iCQCHb23UVErR/etu9jgecQTr1BcdgGnSmWw2O3U/FwkEei5cx/l1bUoq7yE0vJKFMvKhfATp0vg8bHU/FwkEdjgU0iQj9CQZhRnZOdxsuQs5ubjCHP5vwuSCOyzvPIO9x48hMX2523PRVKBQvg3BNpaDu9veVsLETgeR378ANNjdWjAwFmSAAAAAElFTkSuQmCC"}],"all_imported_dlls":["msvcp_win.dll","vcruntime140.dll","imm32.dll","ws2_32.dll","win32u.dll","gdi32.dll","gdi32full.dll","vcruntime140_1.dll","oleaut32.dll","shlwapi.dll","kernel.appcore.dll","fltLib.dll","msvcp140.dll","advapi32.dll","msvcrt.dll","combase.dll","cmdext.dll","kernel32.dll","user32.dll","ole32.dll","sechost.dll","ntdll.dll","KernelBase.dll","ucrtbase.dll","VxSSL64.dll","rpcrt4.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3760:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3760:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"name":"SM0:3760:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]},{"name":"Local\\SM0:3760:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6add865473d6e29c180d26e2"}]}]}},"report_ids":{"sandbox_job_ids":["6add865473d6e29c180d26e2"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Sample 1b36ee4bc5ff… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample 1b36ee4bc5ff…. Threat score 0/100. 0/23 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/1b36ee4bc5ffb6c13f7049697c14ea89cfe21fca1b3db46f5c578e287944d09b"}],["$","meta","4",{"property":"og:title","content":"Sample 1b36ee4bc5ff… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample 1b36ee4bc5ff…. Threat score 0/100. 0/23 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/1b36ee4bc5ffb6c13f7049697c14ea89cfe21fca1b3db46f5c578e287944d09b"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample 1b36ee4bc5ff… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample 1b36ee4bc5ff…. Threat score 0/100. 0/23 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2c","11",{}]]