Windows Analysis Report
Modrinth.exe

Overview

General Information

Sample name: Modrinth.exe
Analysis ID: 1467847
MD5: 21cad48edbc93da2d1e1ab6f6632461a
SHA1: 667a584eae5a57937d66d64249c26c8b1b2abf8f
SHA256: 32619382ab72416dff258bff30a8b505d6e69e818345612892a121c28f3b23b0
Tags: DCRATexe
Infos:

Detection

DCRat
Score: 74
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Yara detected DCRat
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Creates processes via WMI
Drops PE files to the user root directory
Drops PE files with benign system names
Drops executable to a common third party application directory
Machine Learning detection for dropped file
Machine Learning detection for sample
Sigma detected: Files With System Process Name In Unsuspected Locations
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Yara detected Generic Downloader
Allocates memory with a write watch (potentially for evading sandboxes)
Checks for available system drives (often done to infect USB drives)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Deletes files inside the Windows folder
Detected potential crypto function
Drops PE files
Drops PE files to the user directory
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
File is packed with WinRar
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found potential string decryption / allocating functions
Installs a raw input device (often for capturing keystrokes)
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: Modrinth.exe Avira: detected
Source: Modrinth.exe Avira: detected
Source: Modrinth.exe Avira: detected
Antivirus detection for dropped file
Source: C:\Windows\Vss\Writers\Application\RuntimeBroker.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Windows Multimedia Platform\wininit.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Internet Explorer\SIGNUP\DVoCIYUveQTPKsllMirxd.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Internet Explorer\SIGNUP\DVoCIYUveQTPKsllMirxd.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Users\Default\SearchApp.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files\Windows Photo Viewer\en-GB\System.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Internet Explorer\SIGNUP\DVoCIYUveQTPKsllMirxd.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Avira: detection malicious, Label: VBS/Runner.VPG
Source: C:\Program Files (x86)\Internet Explorer\SIGNUP\DVoCIYUveQTPKsllMirxd.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Found malware configuration
Source: 00000008.00000002.2123867809.000000001336F000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: DCRat {"SCRT": "{\"w\":\"^\",\"T\":\";\",\"A\":\"-\",\"O\":\"%\",\"z\":\"~\",\"J\":\"*\",\"0\":\"(\",\"i\":\"@\",\"d\":\">\",\"j\":\"$\",\"U\":\")\",\"a\":\"#\",\"p\":\"&\",\"n\":\".\",\"I\":\"|\",\"1\":\"!\",\"s\":\"_\",\"h\":\" \",\"R\":\"`\",\"y\":\"<\",\"v\":\",\"}", "PCRT": "{\"k\":\"&\",\"R\":\"_\",\"F\":\"|\",\"1\":\"@\",\"M\":\"$\",\"v\":\"!\",\"U\":\",\",\"a\":\"-\",\"0\":\" \",\"Z\":\"~\",\"V\":\")\",\"Q\":\"`\",\"T\":\">\",\"m\":\"(\",\"E\":\"^\",\"W\":\"<\",\"d\":\";\",\"X\":\"#\",\"L\":\".\",\"B\":\"*\",\"8\":\"%\"}", "TAG": "", "MUTEX": "DCR_MUTEX-7Ye3wPcjuvzlhJoVIUW4", "LDTM": false, "DBG": false, "SST": 5, "SMST": 2, "BCS": 0, "AUR": 1, "ASCFG": {"savebrowsersdatatosinglefile": false, "ignorepartiallyemptydata": false, "cookies": true, "passwords": true, "forms": true, "cc": true, "history": false, "telegram": true, "steam": true, "discord": true, "filezilla": true, "screenshot": true, "clipboard": true, "sysinfo": true, "searchpath": "%AppData% - Very Fast"}, "AS": true, "ASO": false, "AD": false, "H1": "http://cz36357.tw1.ru/@=cDMmNzNiFGO", "H2": "http://cz36357.tw1.ru/@=cDMmNzNiFGO", "T": "0"}
Multi AV Scanner detection for dropped file
Source: C:\Program Files (x86)\Internet Explorer\SIGNUP\DVoCIYUveQTPKsllMirxd.exe ReversingLabs: Detection: 87%
Source: C:\Program Files (x86)\MSECache\OfficeKMS\win7\DVoCIYUveQTPKsllMirxd.exe ReversingLabs: Detection: 87%
Source: C:\Program Files (x86)\Windows Multimedia Platform\wininit.exe ReversingLabs: Detection: 87%
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\DVoCIYUveQTPKsllMirxd.exe ReversingLabs: Detection: 87%
Source: C:\Program Files\Windows Photo Viewer\en-GB\System.exe ReversingLabs: Detection: 87%
Source: C:\Users\Default\DVoCIYUveQTPKsllMirxd.exe ReversingLabs: Detection: 87%
Source: C:\Users\Default\SearchApp.exe ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe ReversingLabs: Detection: 62%
Source: C:\Windows\Vss\Writers\Application\RuntimeBroker.exe ReversingLabs: Detection: 87%
Source: C:\Windows\en-US\csrss.exe ReversingLabs: Detection: 87%
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe ReversingLabs: Detection: 87%
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe ReversingLabs: Detection: 87%
Source: C:\intosessionperfcrtSvc\RuntimeBroker.exe ReversingLabs: Detection: 87%
Multi AV Scanner detection for submitted file
Source: Modrinth.exe ReversingLabs: Detection: 97%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 93.6% probability
Machine Learning detection for dropped file
Source: C:\Windows\Vss\Writers\Application\RuntimeBroker.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Windows Multimedia Platform\wininit.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Internet Explorer\SIGNUP\DVoCIYUveQTPKsllMirxd.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Internet Explorer\SIGNUP\DVoCIYUveQTPKsllMirxd.exe Joe Sandbox ML: detected
Source: C:\Users\Default\SearchApp.exe Joe Sandbox ML: detected
Source: C:\Program Files\Windows Photo Viewer\en-GB\System.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Internet Explorer\SIGNUP\DVoCIYUveQTPKsllMirxd.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Internet Explorer\SIGNUP\DVoCIYUveQTPKsllMirxd.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: Modrinth.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: Modrinth.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Modrinth App Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Modrinth App\Modrinth App.exe Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Modrinth App\Uninstall Modrinth App.lnk Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Directory created: C:\Program Files\Windows Photo Viewer\en-GB\System.exe Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Directory created: C:\Program Files\Windows Photo Viewer\en-GB\27d1bcfc3c54e0 Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Directory created: C:\Program Files\Reference Assemblies\Microsoft\Framework\DVoCIYUveQTPKsllMirxd.exe Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Directory created: C:\Program Files\Reference Assemblies\Microsoft\Framework\510335ec8a3ea2 Jump to behavior
Source: C:\Windows\System32\msiexec.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{67E35770-3BE7-49CB-BE18-C8626CE846EE} Jump to behavior
Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: Modrinth.exe
Source: Binary string: C:\agent\_work\66\s\build\ship\x86\uica.pdb source: Modrinth.exe, Modrinth App_0.7.1_x64_en-US.msi.0.dr
Source: Binary string: C:\agent\_work\66\s\build\ship\x86\wixca.pdb source: Modrinth.exe, Modrinth App_0.7.1_x64_en-US.msi.0.dr
Checks for available system drives (often done to infect USB drives)
Source: C:\Windows\System32\msiexec.exe File opened: z: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: x: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: v: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: t: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: r: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: p: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: n: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: l: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: j: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: h: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: f: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: b: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: y: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: w: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: u: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: s: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: q: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: o: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: m: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: k: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: i: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: g: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: e: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: c: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: a: Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_0026A5F4 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError, 2_2_0026A5F4
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_0027B8E0 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW, 2_2_0027B8E0
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_0028AAA8 FindFirstFileExA, 2_2_0028AAA8

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2850862 ETPRO TROJAN DCRat Initial Checkin Server Response M4 92.53.96.121:80 -> 192.168.2.5:49706
Source: Traffic Snort IDS: 2850862 ETPRO TROJAN DCRat Initial Checkin Server Response M4 92.53.96.121:80 -> 192.168.2.5:49769
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: http://cz36357.tw1.ru/@=cDMmNzNiFGO
Yara detected Generic Downloader
Source: Yara match File source: 0.0.Modrinth.exe.49e164.4.raw.unpack, type: UNPACKEDPE
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: Modrinth App.exe.5.dr String found in binary or memory: icons/128x128.pngicons/128x128@2x.pngdW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IDIwMzM5QkE0M0FCOERBMzkKUldRNTJyZzZwSnN6SUdPRGdZREtUUGxMblZqeG9OVHYxRUlRTzJBc2U3MUNJaDMvZDQ1UytZZmYKhttps://launcher-files.modrinth.com/updates.jsondefault-src 'self'; connect-src https://modrinth.com https://*.modrinth.com https://mixpanel.com https://*.mixpanel.com https://*.cloudflare.com https://api.mclo.gs; font-src https://cdn-raw.modrinth.com/fonts/inter/; img-src tauri: https: data: blob: 'unsafe-inline' asset: https://asset.localhost; script-src https://*.cloudflare.com 'self'; frame-src https://*.cloudflare.com https://www.youtube.com https://www.youtube-nocookie.com https://discord.com 'self'; style-src unsafe-inline 'self'$APPDATA/caches/icons/*$APPCONFIG/caches/icons/*$CONFIG/caches/icons/*http://localhost:1420/../dist/assets/index-WeuSTy9x.css[ equals www.youtube.com (Youtube)
Source: global traffic DNS traffic detected: DNS query: cdn-raw.modrinth.com
Source: global traffic DNS traffic detected: DNS query: cdn.modrinth.com
Source: global traffic DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: Modrinth App.exe.5.dr String found in binary or memory: http://.css
Source: Modrinth App.exe.5.dr String found in binary or memory: http://.jpg
Source: Modrinth App.exe.5.dr String found in binary or memory: http://auth.xboxlive.com
Source: Modrinth.exe, Modrinth App_0.7.1_x64_en-US.msi.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: Modrinth.exe, Modrinth App_0.7.1_x64_en-US.msi.0.dr, Modrinth App.exe.5.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Modrinth.exe, Modrinth App_0.7.1_x64_en-US.msi.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: Modrinth.exe, Modrinth App_0.7.1_x64_en-US.msi.0.dr, Modrinth App.exe.5.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Modrinth.exe, Modrinth App_0.7.1_x64_en-US.msi.0.dr, Modrinth App.exe.5.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Modrinth.exe, Modrinth App_0.7.1_x64_en-US.msi.0.dr, Modrinth App.exe.5.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Modrinth.exe, Modrinth App_0.7.1_x64_en-US.msi.0.dr String found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA.crt0
Source: Modrinth.exe, Modrinth App_0.7.1_x64_en-US.msi.0.dr, Modrinth App.exe.5.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Modrinth.exe, Modrinth App_0.7.1_x64_en-US.msi.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: Modrinth.exe, Modrinth App_0.7.1_x64_en-US.msi.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: Modrinth.exe, Modrinth App_0.7.1_x64_en-US.msi.0.dr, Modrinth App.exe.5.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Modrinth.exe, Modrinth App_0.7.1_x64_en-US.msi.0.dr, Modrinth App.exe.5.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Modrinth App.exe.5.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Modrinth.exe, Modrinth App_0.7.1_x64_en-US.msi.0.dr String found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA.crl0E
Source: Modrinth.exe, Modrinth App_0.7.1_x64_en-US.msi.0.dr String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: Modrinth.exe, Modrinth App_0.7.1_x64_en-US.msi.0.dr String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: Modrinth.exe, Modrinth App_0.7.1_x64_en-US.msi.0.dr, Modrinth App.exe.5.dr String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: Modrinth.exe, Modrinth App_0.7.1_x64_en-US.msi.0.dr String found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA.crl0L
Source: Modrinth.exe, Modrinth App_0.7.1_x64_en-US.msi.0.dr String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: Modrinth App.exe.5.dr String found in binary or memory: http://html4/loose.dtd
Source: Modrinth App.exe.5.dr String found in binary or memory: http://localhost:1420/../dist/assets/index-WeuSTy9x.css
Source: Modrinth.exe, Modrinth App_0.7.1_x64_en-US.msi.0.dr, Modrinth App.exe.5.dr String found in binary or memory: http://ocsp.digicert.com0
Source: Modrinth.exe, Modrinth App_0.7.1_x64_en-US.msi.0.dr, Modrinth App.exe.5.dr String found in binary or memory: http://ocsp.digicert.com0A
Source: Modrinth.exe, Modrinth App_0.7.1_x64_en-US.msi.0.dr, Modrinth App.exe.5.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: Modrinth.exe, Modrinth App_0.7.1_x64_en-US.msi.0.dr String found in binary or memory: http://ocsp.digicert.com0K
Source: Modrinth.exe, Modrinth App_0.7.1_x64_en-US.msi.0.dr String found in binary or memory: http://ocsp.digicert.com0N
Source: Modrinth.exe, Modrinth App_0.7.1_x64_en-US.msi.0.dr String found in binary or memory: http://ocsp.digicert.com0O
Source: Modrinth.exe, Modrinth App_0.7.1_x64_en-US.msi.0.dr, Modrinth App.exe.5.dr String found in binary or memory: http://ocsp.digicert.com0X
Source: Componentwebfont.exe, 00000008.00000002.2120796404.0000000003825000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Modrinth.exe, Modrinth App_0.7.1_x64_en-US.msi.0.dr String found in binary or memory: http://wixtoolset.org
Source: Modrinth.exe, Modrinth App_0.7.1_x64_en-US.msi.0.dr, Modrinth App.exe.5.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: Modrinth App.exe.5.dr String found in binary or memory: https://api.azul.com/metadata/v1/zulu/packages?arch=&java_version=&os=&archive_type=zip&javafx_bundl
Source: Modrinth App.exe.5.dr String found in binary or memory: https://api.mclo.gs;
Source: Modrinth App.exe.5.dr String found in binary or memory: https://api.minecraftservices.com/entitlements/license?requestId=
Source: Modrinth App.exe.5.dr String found in binary or memory: https://api.minecraftservices.com/launcher/loginXBL3.0
Source: Modrinth App.exe.5.dr String found in binary or memory: https://api.minecraftservices.com/minecraft/profile
Source: Modrinth App.exe.5.dr String found in binary or memory: https://api.modrinth.com/analytics/playtimeTried
Source: Modrinth App.exe.5.dr String found in binary or memory: https://api.modrinth.com/v2/
Source: Modrinth App.exe.5.dr String found in binary or memory: https://asset.localhost;
Source: Modrinth App.exe.5.dr String found in binary or memory: https://cdn-raw.modrinth.com/fonts/inter/;
Source: Modrinth App.exe.5.dr String found in binary or memory: https://cdn.modrle_relative_pathprofile_relative
Source: Modrinth App.exe.5.dr String found in binary or memory: https://device.auth.xboxlive.com/device/authenticate/device/authenticateProofOfPossession
Source: Modrinth App.exe.5.dr String found in binary or memory: https://device.auth.xboxlive.com/device/authenticate/device/authenticateProofOfPossession5q
Source: Modrinth App.exe.5.dr String found in binary or memory: https://discord.com
Source: Modrinth App.exe.5.dr String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-supportC:
Source: Modrinth App.exe.5.dr String found in binary or memory: https://docs.rs/tauri/1/tauri/scope/struct.IpcScope.html#method.configure_remote_access
Source: Modrinth App.exe.5.dr String found in binary or memory: https://github.com/rust-windowing/tao
Source: Modrinth App.exe.5.dr String found in binary or memory: https://github.com/tauri-apps/tauri/issues/2549#issuecomment-1250036908
Source: Modrinth App.exe.5.dr String found in binary or memory: https://github.com/tauri-apps/tauri/issues/8306)
Source: Modrinth App.exe.5.dr String found in binary or memory: https://launcher-files.modrinth.com/detect.txtcheck_internettimeout
Source: Modrinth App.exe.5.dr String found in binary or memory: https://launcher-files.modrinth.com/updates.jsondefault-src
Source: Modrinth App.exe.5.dr String found in binary or memory: https://libraries.minecraft.net/(
Source: Modrinth App.exe.5.dr String found in binary or memory: https://login.live.com/oauth20_desktop.srfscopeservice::user.auth.xboxlive.com::MBI_SSLhttps://login
Source: Modrinth App.exe.5.dr String found in binary or memory: https://meta.modrinth.com
Source: Modrinth App.exe.5.dr String found in binary or memory: https://meta.modrinth.comx
Source: Modrinth App.exe.5.dr String found in binary or memory: https://mixpanel.com
Source: Modrinth App.exe.5.dr String found in binary or memory: https://modrinth.com
Source: Modrinth App.exe.5.dr String found in binary or memory: https://piston-meta.mojang.com/mc/game/version_manifest_v2.json
Source: Modrinth App.exe.5.dr String found in binary or memory: https://resources.download.minecraft.net/
Source: Modrinth App.exe.5.dr String found in binary or memory: https://sisu.xboxlive.com/authenticate/authenticatecode_challenge_methodX-SessionId
Source: Modrinth App.exe.5.dr String found in binary or memory: https://sisu.xboxlive.com/authorize/authorizet=
Source: Modrinth App.exe.5.dr String found in binary or memory: https://sisu.xboxlive.com/authorize/authorizet=M
Source: Modrinth App.exe.5.dr String found in binary or memory: https://tauri.app/docs/api/config#tauri.allowlist)
Source: Modrinth App.exe.5.dr String found in binary or memory: https://tauri.app/docs/api/config#tauri.allowlist)PlatformOsTypeTempdirLocaleGetAppVersionGetAppName
Source: Modrinth App.exe.5.dr String found in binary or memory: https://tauri.app/v1/api/config/#securityconfig.dangerousremotedomainipcaccess
Source: Modrinth.exe, Modrinth App_0.7.1_x64_en-US.msi.0.dr String found in binary or memory: https://www.digicert.com/CPS0
Source: Modrinth App.exe.5.dr String found in binary or memory: https://www.youtube-nocookie.com
Source: Modrinth App.exe.5.dr String found in binary or memory: https://www.youtube.com
Source: Modrinth App.exe.5.dr String found in binary or memory: https://xsts.auth.xboxlive.com/xsts/authorize/xsts/authorizerp://api.minecraftservices.com/
Installs a raw input device (often for capturing keystrokes)
Source: Modrinth App.exe.5.dr Binary or memory string: RegisterRawInputDevices memstr_be399663-a

System Summary
barindex
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Source: C:\Windows\SysWOW64\wscript.exe COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8} Jump to behavior
Contains functionality to communicate with device drivers
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_0026718C: __EH_prolog,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW, 2_2_0026718C
Creates files inside the system directory
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\6ed634.msi Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\inprogressinstallinfo.ipi Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\SourceHash{67E35770-3BE7-49CB-BE18-C8626CE846EE} Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID819.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\{67E35770-3BE7-49CB-BE18-C8626CE846EE} Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\{67E35770-3BE7-49CB-BE18-C8626CE846EE}\ProductIcon Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\6ed636.msi Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\6ed636.msi Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe File created: C:\Windows\en-US\csrss.exe Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe File created: C:\Windows\en-US\886983d96e3d3e Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe File created: C:\Windows\Vss\Writers\Application\RuntimeBroker.exe Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe File created: C:\Windows\Vss\Writers\Application\9e8d7a4ca61bd9 Jump to behavior
Deletes files inside the Windows folder
Source: C:\Windows\System32\msiexec.exe File deleted: C:\Windows\Installer\6ed636.msi Jump to behavior
Detected potential crypto function
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_0026857B 2_2_0026857B
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_0028D00E 2_2_0028D00E
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_0026407E 2_2_0026407E
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_002770BF 2_2_002770BF
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_00291194 2_2_00291194
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_0026E2A0 2_2_0026E2A0
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_00263281 2_2_00263281
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_002802F6 2_2_002802F6
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_00276646 2_2_00276646
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_0028473A 2_2_0028473A
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_0028070E 2_2_0028070E
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_002627E8 2_2_002627E8
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_002737C1 2_2_002737C1
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_0026E8A0 2_2_0026E8A0
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_00284969 2_2_00284969
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_0026F968 2_2_0026F968
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_00273A3C 2_2_00273A3C
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_00276A7B 2_2_00276A7B
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_0028CB60 2_2_0028CB60
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_00280B43 2_2_00280B43
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_00275C77 2_2_00275C77
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_0026ED14 2_2_0026ED14
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_00273D6D 2_2_00273D6D
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_0027FDFA 2_2_0027FDFA
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_0026BE13 2_2_0026BE13
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_0026DE6C 2_2_0026DE6C
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_00265F3C 2_2_00265F3C
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_00280F78 2_2_00280F78
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: String function: 0027E360 appears 52 times
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: String function: 0027ED00 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: String function: 0027E28C appears 35 times
PE file contains executable resources (Code or Archives)
Source: Modrinth.exe Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: Componentwebfont.exe.2.dr Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Sample file is different than original file name gathered from version info
Source: Modrinth.exe, 00000000.00000002.2033378957.0000000000EBE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamemsiexec.exe.muiX vs Modrinth.exe
Source: Modrinth.exe, 00000000.00000002.2033378957.0000000000EBE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamemsiexec.exeX vs Modrinth.exe
Source: Modrinth.exe, 00000000.00000003.2020454414.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs Modrinth.exe
Source: Modrinth.exe, 00000002.00000003.2024115320.000000000540F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs Modrinth.exe
Source: Modrinth.exe, 00000002.00000003.2023615711.0000000005352000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs Modrinth.exe
Source: Modrinth.exe Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs Modrinth.exe
Source: Modrinth.exe Binary or memory string: OriginalFilenamewixca.dll\ vs Modrinth.exe
Source: Modrinth.exe Binary or memory string: OriginalFilenameuica.dll\ vs Modrinth.exe
Uses 32bit PE files
Source: Modrinth.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, ehi0Ar05rwO3rBy5vDQ.cs Cryptographic APIs: 'TransformBlock'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, ehi0Ar05rwO3rBy5vDQ.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, oZCvG54wWRBjDfkFnkO.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, oZCvG54wWRBjDfkFnkO.cs Cryptographic APIs: 'CreateDecryptor'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, ehi0Ar05rwO3rBy5vDQ.cs Cryptographic APIs: 'TransformBlock'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, ehi0Ar05rwO3rBy5vDQ.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, oZCvG54wWRBjDfkFnkO.cs Cryptographic APIs: 'CreateDecryptor'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, oZCvG54wWRBjDfkFnkO.cs Cryptographic APIs: 'CreateDecryptor'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, ehi0Ar05rwO3rBy5vDQ.cs Cryptographic APIs: 'TransformBlock'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, ehi0Ar05rwO3rBy5vDQ.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, oZCvG54wWRBjDfkFnkO.cs Cryptographic APIs: 'CreateDecryptor'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, oZCvG54wWRBjDfkFnkO.cs Cryptographic APIs: 'CreateDecryptor'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, baYrhAOQ8tHFrFkoH4H.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, baYrhAOQ8tHFrFkoH4H.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, baYrhAOQ8tHFrFkoH4H.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, baYrhAOQ8tHFrFkoH4H.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, baYrhAOQ8tHFrFkoH4H.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, baYrhAOQ8tHFrFkoH4H.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: Modrinth App.exe.5.dr Binary string: \Device\Afd\Mio
Source: Modrinth App.exe.5.dr Binary string: Failed to open \Device\Afd\Mio:
Source: classification engine Classification label: mal74.troj.evad.winEXE@20/57@8/0
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_00266EC9 GetLastError,FormatMessageW, 2_2_00266EC9
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_00279E1C FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree, 2_2_00279E1C
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Modrinth App Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\Public\Desktop\Modrinth App.lnk Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4372:120:WilError_03
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Mutant created: NULL
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\e5ff995eea97787bc058f62dffde7d9982100014
Source: C:\Users\user\Desktop\Modrinth.exe File created: C:\Users\user\AppData\Local\Temp\Modrinth.exe Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\intosessionperfcrtSvc\QvJVxLMgIdUXKZXo3vjvMJd9h.bat" "
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Command line argument: sfxname 2_2_0027D5D4
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Command line argument: sfxstime 2_2_0027D5D4
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Command line argument: STARTDLG 2_2_0027D5D4
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Command line argument: xj+ 2_2_0027D5D4
Source: Modrinth.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.94%
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Modrinth.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\Modrinth.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: Modrinth.exe ReversingLabs: Detection: 97%
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe File read: C:\Users\user\AppData\Local\Temp\Modrinth.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Modrinth.exe "C:\Users\user\Desktop\Modrinth.exe"
Source: C:\Users\user\Desktop\Modrinth.exe Process created: C:\Users\user\AppData\Local\Temp\Modrinth.exe "C:\Users\user\AppData\Local\Temp\Modrinth.exe"
Source: C:\Users\user\Desktop\Modrinth.exe Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\Modrinth App_0.7.1_x64_en-US.msi"
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\intosessionperfcrtSvc\x6qhfc.vbe"
Source: unknown Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\intosessionperfcrtSvc\QvJVxLMgIdUXKZXo3vjvMJd9h.bat" "
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\intosessionperfcrtSvc\Componentwebfont.exe "C:\intosessionperfcrtSvc\Componentwebfont.exe"
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding E9350FF13617C2EDECFDC599F293255F C
Source: unknown Process created: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe
Source: unknown Process created: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe
Source: C:\Users\user\Desktop\Modrinth.exe Process created: C:\Users\user\AppData\Local\Temp\Modrinth.exe "C:\Users\user\AppData\Local\Temp\Modrinth.exe" Jump to behavior
Source: C:\Users\user\Desktop\Modrinth.exe Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\Modrinth App_0.7.1_x64_en-US.msi" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\intosessionperfcrtSvc\x6qhfc.vbe" Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\intosessionperfcrtSvc\QvJVxLMgIdUXKZXo3vjvMJd9h.bat" " Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding E9350FF13617C2EDECFDC599F293255F C Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\intosessionperfcrtSvc\Componentwebfont.exe "C:\intosessionperfcrtSvc\Componentwebfont.exe" Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Modrinth.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\Modrinth.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\Desktop\Modrinth.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Modrinth.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Modrinth.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Modrinth.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Modrinth.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\Modrinth.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Modrinth.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\Modrinth.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\Modrinth.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\Modrinth.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\Modrinth.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Modrinth.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Modrinth.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\Modrinth.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Modrinth.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\Modrinth.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\Modrinth.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\Modrinth.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\Modrinth.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\Modrinth.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\Modrinth.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\Modrinth.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Users\user\Desktop\Modrinth.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: <pi-ms-win-core-synch-l1-2-0.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: <pi-ms-win-core-synch-l1-2-0.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: <pi-ms-win-core-localization-l1-2-1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: dxgidebug.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: riched20.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: usp10.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: srpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: tsappcmp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msihnd.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: riched20.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: usp10.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: vbscript.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: scrobj.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: dlnashext.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wpdshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: tsappcmp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: srclient.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: spp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: vssapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: vsstrace.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cscapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: cmdext.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Section loaded: version.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Section loaded: wldp.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Section loaded: profapi.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Section loaded: amsi.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Section loaded: userenv.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Section loaded: propsys.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Section loaded: edputil.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Section loaded: netutils.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Section loaded: slc.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Section loaded: sppc.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Section loaded: version.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Section loaded: wldp.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Section loaded: profapi.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Section loaded: mscoree.dll
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Section loaded: kernel.appcore.dll
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Section loaded: version.dll
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Section loaded: uxtheme.dll
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Section loaded: windows.storage.dll
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Section loaded: wldp.dll
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Section loaded: profapi.dll
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Section loaded: cryptsp.dll
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Section loaded: rsaenh.dll
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Section loaded: cryptbase.dll
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\Modrinth.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Automated click: Next
Source: C:\Windows\SysWOW64\msiexec.exe Automated click: Next
Source: C:\Windows\SysWOW64\msiexec.exe Automated click: Install
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Modrinth App Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Modrinth App\Modrinth App.exe Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Modrinth App\Uninstall Modrinth App.lnk Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Directory created: C:\Program Files\Windows Photo Viewer\en-GB\System.exe Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Directory created: C:\Program Files\Windows Photo Viewer\en-GB\27d1bcfc3c54e0 Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Directory created: C:\Program Files\Reference Assemblies\Microsoft\Framework\DVoCIYUveQTPKsllMirxd.exe Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Directory created: C:\Program Files\Reference Assemblies\Microsoft\Framework\510335ec8a3ea2 Jump to behavior
Source: C:\Windows\System32\msiexec.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{67E35770-3BE7-49CB-BE18-C8626CE846EE} Jump to behavior
Source: Modrinth.exe Static file information: File size 7141376 > 1048576
Source: Modrinth.exe Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x6cd600
Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: Modrinth.exe
Source: Binary string: C:\agent\_work\66\s\build\ship\x86\uica.pdb source: Modrinth.exe, Modrinth App_0.7.1_x64_en-US.msi.0.dr
Source: Binary string: C:\agent\_work\66\s\build\ship\x86\wixca.pdb source: Modrinth.exe, Modrinth App_0.7.1_x64_en-US.msi.0.dr

Data Obfuscation
barindex
.NET source code contains method to dynamically call methods (often used by packers)
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, oZCvG54wWRBjDfkFnkO.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, oZCvG54wWRBjDfkFnkO.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, oZCvG54wWRBjDfkFnkO.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
.NET source code contains potential unpacker
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, F0eFFnmKkJZhn55Zvys.cs .Net Code: Cb9OuxZ2ZO System.AppDomain.Load(byte[])
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, F0eFFnmKkJZhn55Zvys.cs .Net Code: Cb9OuxZ2ZO System.Reflection.Assembly.Load(byte[])
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, F0eFFnmKkJZhn55Zvys.cs .Net Code: Cb9OuxZ2ZO
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, F0eFFnmKkJZhn55Zvys.cs .Net Code: Cb9OuxZ2ZO System.AppDomain.Load(byte[])
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, F0eFFnmKkJZhn55Zvys.cs .Net Code: Cb9OuxZ2ZO System.Reflection.Assembly.Load(byte[])
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, F0eFFnmKkJZhn55Zvys.cs .Net Code: Cb9OuxZ2ZO
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, F0eFFnmKkJZhn55Zvys.cs .Net Code: Cb9OuxZ2ZO System.AppDomain.Load(byte[])
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, F0eFFnmKkJZhn55Zvys.cs .Net Code: Cb9OuxZ2ZO System.Reflection.Assembly.Load(byte[])
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, F0eFFnmKkJZhn55Zvys.cs .Net Code: Cb9OuxZ2ZO
File is packed with WinRar
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe File created: C:\intosessionperfcrtSvc\__tmp_rar_sfx_access_check_7252718 Jump to behavior
PE file contains an invalid checksum
Source: Modrinth.exe Static PE information: real checksum: 0x2d4fd should be: 0x6dcc9f
Source: Modrinth.exe.0.dr Static PE information: real checksum: 0x0 should be: 0x1a2464
Source: Componentwebfont.exe.2.dr Static PE information: real checksum: 0x0 should be: 0x12d013
PE file contains sections with non-standard names
Source: Modrinth.exe.0.dr Static PE information: section name: .didat
Source: Modrinth App.exe.5.dr Static PE information: section name: _RDATA
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_0027E28C push eax; ret 2_2_0027E2AA
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_0027ED46 push ecx; ret 2_2_0027ED59
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Code function: 8_2_00007FF848A700BD pushad ; iretd 8_2_00007FF848A700C1
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Code function: 39_2_00007FF848A800BD pushad ; iretd 39_2_00007FF848A800C1
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Code function: 40_2_00007FF848AA00BD pushad ; iretd 40_2_00007FF848AA00C1
Source: Componentwebfont.exe.2.dr Static PE information: section name: .text entropy: 6.959160573713047
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, jPaTnia40GWt9Coe6yO.cs High entropy of concatenated method names: '_6H9', 'YZ8', '_66N', 'G9C', 'qiRZHj1J4NC7beQbQXK', 'NgaAbB1jRKel81QpJWU', 'T6ey7G1fXFGx6sK2gk0', 'h71wg212LsMLZtgUVit', 'KBsDg81ebU3E7lQLn0v', 'VwtuWo1zvXQUQqUYKmf'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, pbABwJy3EdEOotFyFtR.cs High entropy of concatenated method names: '_4J6', '_5Di', '_1y5', '_77a', '_1X1', '_7fn', 'OUK', '_8S4', 'wUn', '_447'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, IOnjNpyi3WP4VFBLKh7.cs High entropy of concatenated method names: 'ICU', 'j9U', 'IBK', '_6qM', 'Amn', 'Mc2', 'og6', 'z6i', '_5G6', 'r11'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, Xa39auae6dMXshb8a5I.cs High entropy of concatenated method names: 'gHL', 'YZ8', 'vF9', 'G9C', 'j989Rlc7wue7C4kxZP3', 'MrVhfLchwVuVGlbK3mq', 'Qx15hNcitWqMiMYYMC6', 'rWEiKocxLBfd4PWrD3L', 'W80QoWcv4BUhYpx5AOR', 'V7paBccTwYZ2Dt58cOu'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, oouYjcOoPmjrIkWamvv.cs High entropy of concatenated method names: 'c6YK7Kf2Gg', 'SOMKx0X9Ly', 'SXLe8bqELooqIGhwlyl', 'Hguw4rq4RUUGpVCrGEk', 'GXNnlTqAy9GqD0oJWDj', 'LNeSbTqMpUQnLRW53pk', 's6vqe0qUEhrpgj0aX2s', 'xKf4Rkq0FptPTlScKfK'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, JBFZpRnYyR185c99D9.cs High entropy of concatenated method names: '_52Y', 'YZ8', 'Eg4', 'G9C', 'Sxn8yMZD2', 'uDXe1OB4PeEwZVybgTR', 'HkocfjBUShjtZygTKvA', 'laSPGlB0OhMiZYIYp4M', 'v7ouDOBrASg4eN5Tspd', 'LI4gInBqYFcgGZQWcW1'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, tDUgcN4cgsla2FKvWQI.cs High entropy of concatenated method names: 'ziPnogSufS', 'YkgncXSsLT', 'pJNnIOplt5', 'cspnhe0fAX', 'b8jnddn1a6', 'uaenMagvy0', 'SN6nva4vWE', 'x0gnU37YjL', 'NESnnObaxL', 'VnWn7NCBeH'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, ehi0Ar05rwO3rBy5vDQ.cs High entropy of concatenated method names: 'NnYcrQZwNB', 'rD8cSIqcmm', 'UIlcfceKps', 'gxQcBUYWv1', 'n54cRmT1BQ', 'rkFcgTjThU', '_838', 'vVb', 'g24', '_9oL'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, rhM4tbyHGGaiSwWCOii.cs High entropy of concatenated method names: 'sLyG2v2GjU', 'qhAoA0hEMdjELBiBxbJ', 'ocRb5xh4kvrV7eGyGV2', 'eGvPqqhAVS4fWLdoW6l', 'PQlwgrhM6ONhtoQPoIS', 'w6fXUaf8SK', 'GHAXnDBgDs', 't1UX7D1p5S', 'YykXx5KOQn', 'T97XklAAx5'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, pK4i05auqbqWopsKsKe.cs High entropy of concatenated method names: 'rU3', 'YZ8', 'M54', 'G9C', 'yXMa7tSK73PIWQTFjaa', 'eKydheSNL2Vryrp8Y3b', 'N5Hw6YSncC2leDxBC3T', 'hioR8GSufvAhlwBQFk8', 'e2E9DFSHAPMLmvnqRZg', 'zbIWLDS3QDaxRawpl2y'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, RQkNuuH7giMLOmlQjLZ.cs High entropy of concatenated method names: 'oTAos8IXNY', 'sUNoAqLXkj', 'tfqo1yVqmB', 'cBHoPV4Ya5', 'NBtoCcKSvC', 'lLFoipSwjI', 'h435C2Zp7ldb00nwovG', 'QK1GMjZFEREncwFKIlT', 'P79URJZde3G7PNfjPnd', 'HHDU0oZGvAeX232QQ1E'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, fUGbdqtY2ANHoqXkSw.cs High entropy of concatenated method names: '_468', 'YZ8', '_2M1', 'G9C', 'iHRT2hyMPNtIlRtBXJu', 'leGoNgyEUQZH2sUYRDD', 'JPo0A8y4xcXBbcqsmPy', 'mn19d1yU6jNn2rCUowj', 'yCeHa4y0EMI0gOSeoDc', 'ct4LJnyrh7FKUVKT2BG'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, y0lMUJyhu6CbIcl54jf.cs High entropy of concatenated method names: 'AwGwxihbh3', 'uuFwksYJEj', 'R4SwJF1yE8', 'mS3wW4trZH', 'RWtwY77dlh', 'JKI0Kix4GfJlFBdtFtV', 'yWU9hnxMUjeNs2t77dR', 'a4pKEHxEPMbm0bdUJNv', 'QECyJ7xUfw5TpSb8w0f', 'TBJYgEx0Ky5ErpBRgOn'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, AAlQZwiJL5Xr5eGvBm.cs High entropy of concatenated method names: '_52U', 'YZ8', 'M5A', 'G9C', 'oYjvQttIPcTGSksMQXP', 'eRnb4OtJwwTItDbVxt9', 'WOqjnotj19SGc3Nncbd', 'HK5sT0tfE4HDbyITp84', 'Vdisfmt2jxT8PVUTo8p', 'YB7HEQteEnAmC5RTf2f'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, e2g5aG0crcxKeJBRoyR.cs High entropy of concatenated method names: '_7tu', '_8ge', 'DyU', '_58f', '_254', '_6Q3', '_7f4', 'B3I', '_75k', 'd4G'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, X2icxDaO12aiUd80oHk.cs High entropy of concatenated method names: 'R1x', 'YZ8', '_8U7', 'G9C', 'g19bRf1OghoyYMl3X4u', 'E7If4P1s5jpLRphRyLW', 'sMRaUp1a3viAxylWWqj', 'UC9C3516Ecu1eRm1knu', 'J8Agea1CM26Sy5umLeD', 'SeEaUk1Qa4gw3Ssd7LB'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, yerTdRy2onVId7aJ1TB.cs High entropy of concatenated method names: 'Jf3EyBHhZ8', 'bUqEHjjnLH', 'zT3E0GCpqG', 'HcCSKUiAGIqNf63wOKD', 'u2xGW6iMUsWMDVJcemg', 'DW37SrikmEKno1X3ibR', 'CCaUNDiXkjk9gqZlpb5', 'eTjEj0iEx1GhTB0b2Ox', 'pueZHwi4Ysifju4XUbq', 'i33LCiiU3BIEJF8h3a1'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, jvGrunOatM8gGptbr4c.cs High entropy of concatenated method names: 'R3j4vfIKmq', 'nCE4UtyXAs', 'HMd4nWbTxb', 'FPx47epZ0M', 'tGqroEEzHXCOZD1xYfj', 'CZIedaE2oEpXtC2tuY1', 'UG5o6sEelNpYrdQ8JFF', 'NeKsPr4RcA7lIOFbV9p', 'Eq5gEr4VbK3nCyjGgrx', 'wGhBMZ4BUoLfiMdhaR8'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, MNuq87gYHUa13y8H92.cs High entropy of concatenated method names: '_8Ok', 'YZ8', 'InF', 'G9C', 'NsFhvgtkaB3brEOQFho', 'aP8GcMtXp1eu6UWHknn', 'Hdt0g3tAoMFLaWwM1Fe', 'kQO2jhtMiCEMsS5Ibgt', 'vScu6atEFEHTbgboLUu', 'msDh3dt4HGJNTg8surA'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, z3DOHTyA3lEDNf5oxRY.cs High entropy of concatenated method names: 'pwKuiLyPlf', 'RtFukTjeBp', 'CfyuJiXGq3', 'orAuWva9E9', 'p7vuYXwNFQ', 'kKDuDEK5ZT', 'd2eu8rcYG5', 'JHEuL3sWFf', 'Kq4uqVaRD0', 'e6aul2fgS1'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, cmTkICaBFHJIm7DYxk5.cs High entropy of concatenated method names: '_625', 'YZ8', '_9pX', 'G9C', 'KEXML9g0xdgt3JH0P67', 'V7u8UfgrsPd6n0KOHBu', 'o40BqxgqAx08MiHXTtw', 'EvAKO1g8PoIwBxJAZss', 'oLEtkRg76K7qAgcCpP1', 'NfipMKghPvtvW5fDUNS'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, HnHswkOq2f1bZvlIekv.cs High entropy of concatenated method names: 'sg9', 'N8Kiq7RbuL', 'UNWKig7xpH', 'IT5i5epuAY', 'p7RnZSqpbJC5u1vFBXF', 'sZtd01qGndaWaCmjAR5', 'T5UGP0qwbXlAiYXt0Fr', 'KFhvHqqF5xwTGeWDU3d', 'At780Aqdjm2kedojLRC', 'Ac4hjcqlZZsww5HCNOS'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, QWFNpB8gAYSNtrLHBq.cs High entropy of concatenated method names: '_23T', 'YZ8', 'ELp', 'G9C', 'hge4Hn9jcfFpcbPRemt', 'hdifgZ9fZXWm7mSPrYx', 'KvelKy92i2mxEyJZdaP', 'ttGQSi9eMie00EKIu3R', 'AQAxXl9z511kcCWXNa3', 'yq1DJxyRtftRKrfYVjE'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, CZ9h0Z44gkQdFuZ5VE.cs High entropy of concatenated method names: 'oh0wZ4gkQ', 'Mx4mnx69Td7sIJMHYw', 'yyC5NXsX2MM4yfy0Em', 'Bc3wteajJed89ml85x', 'OOxNPnCv9abwcEhbbi', 'AhYiDIQirO5wKRJP1b', 'P09m50WD2', 'B0TOGdG7k', 'tqOyJt0pb', 'su7HLnDU4'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, tRhiRJagZIFjUJYiZPp.cs High entropy of concatenated method names: '_7v4', 'YZ8', '_888', 'G9C', 'm5e1Nwga0WBFGURebZO', 'IADl1rg6AyOyIUux4Uh', 'yL0qw6gCo3PqysfdaAI', 'DV2J38gQgvPAxDOC81A', 'kbHt9PgLpDQp1AutwXs', 'YRC4uBgZQHnonYQqwug'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, SvlhDembYGB4JLGRZLG.cs High entropy of concatenated method names: 'GchywuGsjr', 'jRJyuSD52p', 'jYbksuk7Dm1uTtVCUdw', 'SumgaMkhaXWpg4HyjXc', 'Yuo9ItkqXD6UhZ1ZO87', 'Quo860k8WxGwMdrr30Q', 'wbhQaTkiiUipmNgCQCg', 'ub6NAVkxAnYYK2iiDPJ', 'QaNiBnkvHq7nS9W8mcQ', 'AUvIyXkTtV3P1CtOONK'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, eRlfJjaMeelFTnNKSmO.cs High entropy of concatenated method names: 'GvP', 'YZ8', 'bp6', 'G9C', 'NHx2qCmLkDJ91FhbHUb', 'KWeSu3mZVwXDtjk5Z8D', 'dVgFxymD3Omt2Wfc4JF', 'lUYBcmmKyC09mLfEOIL', 'YWqDtbmNRsOPOsPKtrQ', 'xDgPDImnhjDTpppYFrN'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, ytAGk70tUHyr5NrLm62.cs High entropy of concatenated method names: 'PJ1', 'jo3', 'xQZvKPiuGy', 'xLKvXNx8io', 'ztJv3qvMX3', 'EC9', '_74a', '_8pl', '_27D', '_524'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, ykDh1E0TlnGsWgq8ULC.cs High entropy of concatenated method names: 'IGD', 'CV5', 'g38IoykCX7', '_3k4', 'elq', 'hlH', 'yc1', 'Y17', '_2QC', 'En1'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, fs2AfazSVDW7SCGUm1.cs High entropy of concatenated method names: 'Y29', 'YZ8', 'jn6', 'G9C', 'rSegpO19WmYBgYWa8y1', 'eUkcAM1y8atp0V0YYev', 'gjvVNf1tjdP2mZH1pi0', 'Iwa7IA119oEPixVRZId', 'xARb6y1Sfwg9BLgZXZC', 'b8SvsS1cRoGxDPcxHnY'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, E5uGIwHkQFsVkfeDTuX.cs High entropy of concatenated method names: 'xN2c5d5cJa', 'qGqxvKZfO3eUpywdyds', 'miFIcIZJf97c2D5Yqae', 'hT6wCGZjWyuJoT5W10i', 'BNt3KiZ2OmODTP6q8cX', 'xksA2rZe9YPohUkYs86', 'L2t3MmZzVib2E4IkTtB'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, yrHKr0xBqBdvKUoEED.cs High entropy of concatenated method names: 'g25', 'YZ8', '_23T', 'G9C', 'S1rlnp3H2', 'mPTIwVBQLa7BOeDYVJu', 'A4B0yxBLGknoR9H0g9N', 'HVZTt5BZ4MkZmo6yInu', 'Jm68hdBDWjGFvhLc0O0', 'D9KGgHBKYkRh0ouVc1T'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, BrJmY0aS531i1G0qfyk.cs High entropy of concatenated method names: 'NWWm3FRQqd', 'frBmG9X1di', 'qRf3EcgP3TnDROfqf4l', 'w9fXplgYc0tt5YnSTym', 'CV7YlqggfTegsd1ybdN', 'xNDdyrg5xKOO04V3jm3', 'qAZWcWgbk612FwleRsP', 'aZeJQfgWUqtpa1CqqbH', 'OO6VFxgkJtugH6cqca3', 'W1BcHVgX0YZlPECBvoG'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, yaoNBCa9ypqycarcC13.cs High entropy of concatenated method names: '_981', 'YZ8', 'd52', 'G9C', 'qeRhjeSouDRj7d344vv', 'PCxu8OSIs2QAZk61yXR', 'Y3uIUxSJnEvMnRpVedJ', 'HvR1r8SjsK57hN8S4Zd', 'QYHkJMSff1BBMMC1w53', 'sQaXmsS2s0GaQncqLvP'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, FDvseqmkwBUjoNZgqp1.cs High entropy of concatenated method names: 'WxDHvvseqw', 'St8IM7A23JCRe0rsrLi', 'c26PTNAewe14xnKVkdn', 'FVpwHyAjUVQoeZkQUVi', 'SD9gYXAfFkPfhZxaqCZ', 'qUj2PEAzUxxpyHZMyNR', 'Dgls7IMRjUahQNCm8cm', 'fXvxFvMVBSqEwgtp0ou', 'wgFTtaMB2FBe470YNah', 'jjBGAiM9fKGxJdPirpf'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, YhPX2JAttI8RINZnZ6.cs High entropy of concatenated method names: 'pHw', 'YZ8', 'v2R', 'G9C', 'jNSUqItvKNC8AyXuLYr', 'Ps6lrmtT0G1kKwkLeTG', 'fc2CVjtO3Ly9VOg5bWH', 'CcOhmXtsr38aG1I9v3o', 'LN8umPtaOo3Hu5PTj6e', 'WIZu7Yt65lmQsU9DKm5'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, EnWxliak2oQYuupnive.cs High entropy of concatenated method names: 'RINaAZnZ6J', 'j0OoPVY7sWCt0Op67E3', 'YtpMQgYhlVBVmfna1F9', 'tIWo9uYqjdwQPFxjeR4', 'NU1l4lY8WJolHJLlksK', 'eCYPjwYiOTj8yfSTw0U', 'QLw', 'YZ8', 'cC5', 'G9C'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, C67BguOzdiiqsGeSaeQ.cs High entropy of concatenated method names: 'VlYXdOnjNp', 'jWPXM4VFBL', 'ih7Xv5phaG', 'LLe4i27nDEKRwIkeKYi', 'Eh6GLF7uq0APNlbQKtq', 'heuedR7KPidt6DB950u', 'CLEk1D7Na0MhS16cyFW', 'JdJWu67HnoFJVyiIkrA', 'LhIi0D73o3mCKyrrIja', 'nwpMhx7FANl9r1I4uG1'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, M4vNYNy66wGjtdSM6po.cs High entropy of concatenated method names: '_7zt', 'SHMEQaZ6pc', 'YVnEbHRquP', 'FRVEjUQ7wb', 'GwXEeTEhyi', 'at3EVXhLJx', 'N12ETsQf8q', 'g4El5ViqUHHNfTKu9rC', 'BYvnqSi8R30Wqc5KgIE', 'yxnbPKi0JpbTm2Ej1BW'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, JfrKuFHsZNtOqvNM0Co.cs High entropy of concatenated method names: '_14Y', 'b41', 'D7Y', 'xMq', 'i39', '_77u', '_4PG', '_5u8', 'h12', '_2KT'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, GHVcie0MmULaONBty73.cs High entropy of concatenated method names: 'drPhK2oeh9', 'f0whXa7HO7', 'HXqh3kWLDS', '_3Gf', '_4XH', '_3mv', '_684', '_555', 'Z9E', 'OSJhGkR4o6'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, ew63JKY1CiMnZfNPEn.cs High entropy of concatenated method names: '_59M', 'YZ8', '_1zA', 'G9C', 'rUyiKw9LHX04khhKqLV', 't24dAX9ZEP9tm0F4d3h', 'kADClD9D1Oex0EYsvTw', 'mAZ8aY9KvR1Ij9Uyrms', 'EGhhC69Nx0CVGNl0HJl', 'dVNrSO9n2dnKyWRtC7O'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, NF7WLlStdWsFXqpjDt.cs High entropy of concatenated method names: 'P37', 'YZ8', 'b2I', 'G9C', 'xKtxSryHNnDiGIhx6tH', 'MvTmDHy3cutBvobUIP9', 'wljgs4yFOYPj2LwL5Sf', 'BD8MRcyd5alIKkcqqUa', 'VAkYVjyp2vSbdbDj9Yq', 'CiSn4FyGxVhYsZxScB3'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, vgYy0ZHhWOfM3iUXUdx.cs High entropy of concatenated method names: 'PYjoDHxRFg', 'XTUo8qvjdn', 'UdfoL3gj3B', 'gywoqbXJ6s', 'mlEoleZbc5', 'bJFh0lZv5pBvbGX5dBq', 'tkeYDZZiwHQD5vWauGc', 'gpQl8aZxGMg1WZH1CrH', 'FWtZ9OZTMged2nsXsto', 'oPccTxZOCNULG9FME52'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, kX3SxSaNFlKodglsQL1.cs High entropy of concatenated method names: 'yiQ', 'YZ8', '_5li', 'G9C', 'lI1tdScRjyknXlbLW1m', 'oKsRDocV5LNgul2X0KA', 'lt1jnScBKsRC8Nfg6It', 'TvNWblc9c5yIcGH94rV', 'XqsZy3cyN3AyZ6txeNP', 'adbgGXctwlbdO9Ugupx'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, baYrhAOQ8tHFrFkoH4H.cs High entropy of concatenated method names: 'CiNKFiO8FK', 'xZgK96DO1c', 'RjQK2LE0w8', 'tND0DBrHltVjjKYKdCe', 'ghgLrtrnJeB0f4sS6vO', 'c38qq6ruL1fuCgusPdT', 'nwZayGr3TddHFk1Rnly', 'xIeK0rTdRo', 'DVIK4d7aJ1', 'wBKKpo6cLL'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, v9DMJtmYa3lXTywSQqC.cs High entropy of concatenated method names: '_0023Nn', 'Dispose', 'NJBHkb5VoW', 'drcHJYV9DM', 'HtaHW3lXTy', 'mSQHYqCqgS', 'KRxHDZyyf3', 'MxPLq0MmpeysG6LXpof', 'AZG42qMYQKISnC3KbJY', 'tlxPZpMS1lUXJDePvYc'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, vyhBvyaHPjk7CA5wG1Q.cs High entropy of concatenated method names: 'K55', 'YZ8', '_9yX', 'G9C', 'nkeGRa1FO2XxXJRT2Q9', 'O22XSK1dNfOPEdicV67', 'SL2iNv1pQHWQUMDiFEg', 'PAnwcD1GC700Srkitny', 'cCxnGf1wx6gwO2k72MR', 'Em9lK81lfAdY7g0cfBJ'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, MaCyE6a38kLsjZ1UZds.cs High entropy of concatenated method names: '_6U6', 'YZ8', '_694', 'G9C', 'gpl5PGS4dhtmSp0Cm5b', 'wTmR06SUtjrqKSoMyU4', 'KrrfRDS0Z02ssLHWZIc', 'e4jg4TSr1pkU8WEB6gY', 'bVNHQmSqM5RtbfD0Qdm', 'I9W67xS85TW8U01JdUM'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, RLQ2DGOP2FD3T9fiYdo.cs High entropy of concatenated method names: 'MqcSHp7Z6bECoP6UoQc', 'rdCRrw7D0uNR34MqcI5', 'LKNnUi7Q5Hugbl3p1Sw', 'g9MZ687L9O381PG3QRF', 'IWF', 'j72', 'ksfX20TaR6', 'MIUXNy3OiI', 'j4z', 'mxqX6hmpQ3'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, PEqsn9aKWioLWYZHsBj.cs High entropy of concatenated method names: '_3fO', 'YZ8', '_48A', 'G9C', 'KAiZYlSSSQVyWP9wB9L', 'fug0c5Scc1o9dfaZSxp', 'NMhLOrSmIhklHwPyita', 'c08IRaSYLYFY6PDZrkg', 'zni4WlSg1brAxnW98nE', 'CMG9BBSPCluv41QqZ0N'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, mL9cTBaZSquppO1akcG.cs High entropy of concatenated method names: 'ud6mVhQxSE', 'MsnmT9WioL', 'HYZmoHsBjj', 'V3GtiXPgo565QutZbjY', 'FlODb3PmEImQ9h71pXw', 'lXq8ESPYCpN8PgHRmTk', 'b2YeoxPPljIKyPoVH6H', 'RZ8GYpP5SoybBmSb4uD', 'cI9FToPbgQe82OnSrS1', 'xcGbbnPWoP4U0Rlg3jT'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, wyCUFMaQHEmu8qswV5Q.cs High entropy of concatenated method names: 'fnTavNVQCc', 'ai8vX6cMoAFYPJSBkr4', 'f9dnmbcEdKqrpiBMSTf', 'wL9QO1cXO8CKEjomobY', 'vkQ6nPcAj95qbZy6EkL', 'Cuywsmc40caFf0qYhVO', 'C3qqNucU31X92GAIdCL', 'UpLw2mc0949FQJXuAoO', 'FZpAsFcr4D7frrBFvUq', 'f28'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, KaS3y4aYEAMPTdqr0TA.cs High entropy of concatenated method names: 'itEainiSbu', 'Ap3rI1YZu2xrGVane0q', 'KvtmEZYDpJxp4gTDYfA', 'X2r83mYQhdGvsG6osKd', 'g0ln4oYL98PI3iNe1FK', 'yrwi9kYKvRFdM3Yndpn', '_3Xh', 'YZ8', '_123', 'G9C'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, SRkpZtaaM4SieWmC3h4.cs High entropy of concatenated method names: 'tO4', 'YZ8', '_4kf', 'G9C', 'd4rI6m14iaNIksLMZ65', 'YV0Gw31UPLZvFqxbgB4', 'XOZdXm102gXeOrgySWB', 'kWHnXp1rCicHwhBQ4TA', 'Je4lSd1qJXGgF8uXa4u', 'UgPKmY18ieIlvpEFF7U'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, L8EfPg0haMlLQNup7b9.cs High entropy of concatenated method names: 'D4M', '_4DP', 'HU2', '_4Ke', '_5C9', '_7b1', 'lV5', 'H7p', 'V5L', '_736'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, bX9w0bBJDIlXEvLJx8.cs High entropy of concatenated method names: 'kcq', 'YZ8', '_4bQ', 'G9C', 'IA2Jjbt1xLDSIbX0bCN', 'M3j6HAtSXUmVpTXTXGm', 'bPGxSxtc8Y6DdOPU5j3', 'ESeTQUtmEr3bUVbSHpB', 'tbDR0ytYp0aMnqJjjDV', 'z0Z1ohtgPJw6EgHfioj'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, Hg3fDXOgZ4C6FtCmS9i.cs High entropy of concatenated method names: '_3VT', 'O5t', '_1W5', 'LAIX39whE8', 'JyQiT5gvR2', 'zi9XGSY4pR', 'rRBi4Zstgp', 'QJQxYM8DV41vwOmoquS', 'lEQb538KyanmJqKm2k0', 'QZe26Q8LAouw6coabIs'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, OsXtcKyRbxwwJZHGsf0.cs High entropy of concatenated method names: 'P29', '_3xW', 'bOP', 'Th1', '_36d', 'fV6uFecuOf', 'buFu9Qw4UZ', 'r8j', 'LS1', '_55S'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, rO2Y6bacTwUsbIPi24J.cs High entropy of concatenated method names: 'p23', 'YZ8', 'Gog', 'G9C', 'ufp5QrcddsE1UIlZtpc', 'WM5fWecpel11vG8QaUq', 'sDB3hbcGK9AonxIR5Bq', 'y7UeCUcw7H7vMV1oAEv', 'JH3Oc8clsIR2gWxM6Uo', 'jgiccfcoQea6IBhJLdQ'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, TaKxNgOXDfBWl81LOax.cs High entropy of concatenated method names: 'pTRpxmnNIK', 'FxYpk5gPKf', 'lYDpJ10n2b', 'AYRfVA0W8ammCPn7GKT', 'Uc21rq05iV9GCGf9EVK', 'oAC6rt0bK0bEshlmwE9', 'U6jTxu0kPSjlVRnJHPD', 'GR4pFtt7pw', 's3Pp9NacnT', 'tMjp2j4gE1'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, kLA8y1mVcMRImFWnmng.cs High entropy of concatenated method names: 'm6LyjpWKUF', 'NuayeNEDQh', 'XhbyV21ITj', 'rd5yThaVXZ', 'okpyoJpS4x', 'NWo5iFXR82g46VsHukt', 'A3Y7eDXVs8oByOl34wx', 'wDwv9kkeP1d3FT0D9A2', 'LNGIy4kz6ZQy3L7tjv7', 'nKrboJXBulg9rKCMlAV'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, nqCPI9dVxN5OIosCd7.cs High entropy of concatenated method names: 'T43', 'YZ8', '_56i', 'G9C', 'QNN94RBg1PEgosgpIkJ', 'rYjVTABPOh2MQdgcAWr', 'wWwWVKB5su0siEkdcsY', 'aTXOJGBbVM7d9H1Lm7n', 'DwbSPOBWxypuy4CERHR', 'G04Bv7BkTEjf8hFAM5S'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, Vya3o7mMxMRGofdtKUY.cs High entropy of concatenated method names: 'A5RyiQ7rTL', 'WeNyZWqc9K', 'ngvyzlhDeY', 'kB4H5JLGRZ', 'KGLHaipbiy', 'z9qHmn2rKx', 'lNBHOu44NY', 'r30HyagcWw', 'pGqHH3GLA8', 'BEdd61XJt37t5RZs2yC'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, KgoQdKyKgVx0akKguJg.cs High entropy of concatenated method names: 'uxk', 'q7W', '_327', '_958', '_4Oz', 'r6z', 'r7o', 'Z83', 'L5N', 'VTw'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, PxCKSfOySaLxpLpoytV.cs High entropy of concatenated method names: 'sCe4q1MEHm', 'MPC4lnxNvV', 'OLi4tglObG', 'wxy4rs8D24', 'H0I4S0u7Qa', 'nL14f9ZbNP', 'UDuKPU4Tia8JTDsuTHH', 'i7oyp24xERpin35sxo1', 'VEPWFG4vIfDmILBS7ny', 'ih069p4OwcASXCGAPH0'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, DEFqEoHO3EXg98RHjG8.cs High entropy of concatenated method names: 'jscVM76qjJq7a2ft9kP', 'rL9fPj68DHa8B5Z9P8E', 'pbEiDF60BQf0JcmuwnX', 'nPdaM76rNFTAbGHGZNi', 'sDbbol6Eun', 'ChN8en6i6L4IbHCDtfd', 'VtYmM96x2BNWZLqARdl', 'eXdW8167CHoVO0mQ6uo', 'GP76aa6hM3T473ARWBD', 'rvCWsi6vFQxU6LSq5Vy'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, utPAkW0xy6H38Tx3NjC.cs High entropy of concatenated method names: 'gvyYVhHy8yGKv5oUMfl', 'HxiZVgHtwQ5Na7kYrTP', 'VjxV44HBjEUcpNBUAjG', 'NrsX4cH9lLknBnvEJWj', 'lwEhkxsDJ0', 'WM4', '_499', 'c4ZhJgrCT1', 'XK5hWs4haF', 'ViYhYDkEM0'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, dIpulgaU5g1UcsrHg2Q.cs High entropy of concatenated method names: 't0LarVcZPr', 'Imo2AeYBBg2Hl1kMJuH', 'KweZO9Y9MHIAmLsTFCL', 'redkf7YRn7dv5i4TBWe', 'IhiVGDYVp6DgiIBqwVZ', 'pFegUrYyfCNbGxFweib', 'krpbxdYtGHGbPZ9Wrsf', 'Lxmn7LY1RWLjQDCsieO', 'K7YafHUa13', 'MYoIrJYmYsOlsQXJq5g'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, glfv8ZHUu9FCFGLp7rB.cs High entropy of concatenated method names: 'TeaofdA7X7', 'AdGoBw3Jhu', 'iQLoRcY5Ne', 'mog8k5ZNmbts9UpBcbb', 'nvBcxiZDpkW9HF7eu5R', 'HrNn2XZKb508H8Xi86t', 'vUTon9ZnslskPYjxLJN', 'Yt9xJKZuEMfRrp5mMmw', 'osfs6mZHFI6088JeJhF', 'GF13QdZ3whJ4TghhTWm'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, orwOpDaPaoTgDmQFEy5.cs High entropy of concatenated method names: 'rJpmQD3PaT', 'R3FdJaP12mLQ68x4qyh', 'sObiwQPSTVTMZa35lXJ', 'VYTLeKPyXQedNTEcPr5', 'Luh5oRPt0XpKs240TkF', 'QSDr61PcynprHKTwwax', '_5q7', 'YZ8', '_6kf', 'G9C'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, YhLwvym6LwQWlEBpj5Y.cs High entropy of concatenated method names: 'aDyOzKw7Ba', 'JMjy5OnUe9', 'Mkyyajn78g', 'rXyymkvuQV', 'OUVyOoCm9r', 'mOpyyDaoTg', 'JmQyHFEy5K', 'buVy0ZhsC3', 'soIy43LLco', 'dk2ypAnT8f'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, fFxHrbatjrKUNEfYCKY.cs High entropy of concatenated method names: '_2WU', 'YZ8', '_743', 'G9C', 'Nflfxtg15lvox6r89tq', 'pKBhIFgSJBRea5bsUpN', 'zgP4kogcxecZ4TyiVVB', 'MhFYLjgmBZfXYDkn3KV', 'foakW2gyFrwDwyWuZqE', 'HcnaEggtw4tQkesxXX6'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, NBqX6CJFHtfbQMZZ8o.cs High entropy of concatenated method names: '_3OK', 'YZ8', '_321', 'G9C', 'DX27qkB2dMIAcD1AZxy', 'YujAKABeVIUfsTJapBe', 'qwf4geBzTCt1UCJBQtr', 'GGta0w9Rfc6tkVjYhN4', 'YndEQA9VvMZa0l3kTxr', 'bwgap19B5N6IC18OgLN'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, eOSJpoOugwvd9aGR6iX.cs High entropy of concatenated method names: 'm74plXt0gi', 'xUxptxcDoP', 'UXnprqq1Gb', 'KgopSQdKgV', 'VEyX0i0CA3b3YO8FvBY', 'tZ3d760Qp8ybkys0QyJ', 'FYLmUo0L7TXCCk4sQPH', 'EYpyt30apGaaeEIhDDd', 'RvcOIu06anRGTqwNcd4', 'JlNWnl0ZBQH458SR9Wh'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, YALnWc43BrrHpS0V6ec.cs High entropy of concatenated method names: 'b2dVhUGGMv64J', 'WaiudAFkuOAiG56wefZ', 'm7rqqXFX9jbmrbHmaOg', 'OsdAvcFAXHqCY52f8gn', 'RIEq0KFMFG7TcXY3XGK', 'Cp3sXWFEhaq5HyBV7FZ', 'HRPLI6FboN9Un9xInEr', 'LcNgqhFW3V8Z31eC5Um', 'qYIphbF4hbtgilv179Z', 'oIsIg9FUWbidxAviGFV'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, UU6wmkHZx02O6yEbYXQ.cs High entropy of concatenated method names: 'b4FcdEtf29', 'pyJcM2mAQ6', 'F8e', 'bLw', 'U96', '_71a', 'O52', 'njNcvbRgxw', '_5f9', 'A6Y'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, WtocynOE4HM1UXIeqYv.cs High entropy of concatenated method names: '_223', 'FuSWGZ0MDgsCPuE6NwF', 'NjxZ3C0ED9GoxAjLVew', 'rKBrgR049RpIt0Q3p8W', 'G8smNl0Uk2Kh9wcISBD', 'oWvKHb009IqvWCDSkFB', 'fA5gBd0rP1E2oyvC0TC', 'nwUGTC0qG1IITmJnXLi', 'pM1f3Y08BOfcDiB2KHp', 'n8W7c807tUYv8q0NcYV'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, yWXVOLaEihJpxi07oeZ.cs High entropy of concatenated method names: 'd43', 'YZ8', 'g67', 'G9C', 'V7rYeqSxKJHohg3NSay', 'pUWmtNSvweZLHMoUo4B', 'bZRxPFSTYaVtW2NievR', 'beeufZSO3wPdYZMftJf', 'p8QDSsSsYKCjxTHRdy6', 'O2byxlSascFZksOACPL'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, TWb4LZOBL50f61GxnNM.cs High entropy of concatenated method names: '_9YY', '_57I', 'w51', 'FWiise77cI', '_168', 'XrOcEB8hWPN3P1UBWwn', 'DaOStH8iWDJ4m7mFmvT', 'VXZHOy8xPfw4SHf7D6J', 'kAX5Sn8vbxOwdj7I7MX', 'LDvZMb8TNSyYuBRVhdt'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, LbrI1XyoMBocJMtW8Bv.cs High entropy of concatenated method names: '_45b', 'ne2', '_115', '_3vY', 'utPw5AkWy6', '_3il', 'e38waTx3Nj', 'WjWwm4NAml', '_78N', 'z3K'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, witIrrOeJfEY3X4fvZx.cs High entropy of concatenated method names: '_525', 'L97', '_3t2', 'UL2', '_6V2', '_968', 'BSkepvqbK3GSj2nPrmt', 'fU8ZcdqWF4bDfHFHlYC', 'G5ZgZLqkku0r4hJLKOh', 'PXMmX9qXsV3NtNh5EfB'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, RfdbvSaLoIy1dNcbb2r.cs High entropy of concatenated method names: 'HL5maXr5eG', 'CBmmms4eDF', 'gZ7mOuZXBc', 'ao72W0YlvBFMhFu058h', 'g9uaL0Yop3KqqRROnyu', 'lc5i6rYGLtmW8ZS9ygB', 'Gb1EpVYw1XY0EqaZTa5', 'I4q6fmYID85aY6jO7wN', 'jMcx8nYJwbbeIiPqBgm', 'kkBSsqYjtgyR2CbbEw4'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, nKcZg6yjDO1cBjQLE0w.cs High entropy of concatenated method names: 'AuCExGiaIN', 'gBNEk6LIkD', 'z1EEJlnGsW', 'Sq8EWULCIX', 'EVdEYFBOh5', 'NRgSk4iQa8ShiTlDlyK', 'nPTwgeiLiwjNf3XBMYh', 'JTLAIii6PVyuhfy3nBA', 'BjZMWdiCC63sCJqAo8J', 'FQGfmWiZPYR41ByLIij'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, YxqOp7HKUf5bZiEKh3m.cs High entropy of concatenated method names: 'LF9obERRb9', 'MDxojQ5177', 'hPPtqMLIBQqA4XjUBFU', 'zXHWliLJaik9PvWYo3p', 'k6Vk2hLj8I617oPooFl', 'A0I0ORLfe0SS8949wJS', 'kyyoI6L26k5p6xPyBVM', 'SCRY63LeUKIAq36JUbo', 'sRKIOPLzAYWj03jLPAJ', 't9BAnEZRAAxe95vKYWu'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, KPDfjZHDMSnPD80LDYG.cs High entropy of concatenated method names: 'p9aNNrDtaTqCw6Emk1j', 'F4NuXyD1l2HDeRgKQc3', 'i1JhVcD9Xq02fZw6Lxk', 'OGVpMiDy8cA8UQSaG9b', 'hlhYMNDS60qjTM3pbfV', 'VOv7OXDc8qSnZxCqZCD', 'svZlKIDmPmkolxXPihd'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, gmfFAC0n9eeVHmNq55q.cs High entropy of concatenated method names: '_159', 'rI9', '_2Cj', 'eyQhcgqUlt', 'ynhhIUohH2', 'ANohhjmeho', 'fNbhdNkLhf', 'FWthMHB0hp', 'ovZhvfn9hM', 'YMsVP7uZDPd5q5ge15u'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, NrBQqL0muUynIESFV4h.cs High entropy of concatenated method names: 'kIBIpa6MVZ', 'UxaIKobBS5', '_8r1', 'ETlIXMo886', 'YsFI376bse', 'YcrIGJaCfF', 'NNwIERdUBF', 'xE4Wd3NXsFPavFUuxDO', 'SwXVTgNA1CmuMGo64XR', 'NATAFpNMDHHPOQqcWuL'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, zNlUbFyECpnsDpnJtoP.cs High entropy of concatenated method names: 'cCGGJSfRGU', 'A05GW6fdte', 'bAUGY6wmkx', 'f2OGD6yEbY', 'jQtG8FmnOk', 'SV0cSsheJ0yBxP3Z2fk', 'Y3qakrhz6V3Gtxx5LRy', 'y5tf5Ihfjer2oFZW3cl', 'ELxxgkh2iajYoI40LvW', 'b3fkpdiR1nAFZtEsDVU'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, TxHpok0WIWWuOnlBj9g.cs High entropy of concatenated method names: 'jIUMYZrbmI', 'EitgGaHO3SEQ6d0WBIB', 'X7uRpxHsZahVupv7y6K', 'NlPEjJHvg6Wydo9uK71', 'YDPdTMHT6STPtERAPEo', '_1fi', 'LFTdgGRDVE', '_676', 'IG9', 'mdP'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, FmPsOgOtd5qLIYhhe3w.cs High entropy of concatenated method names: '_5u9', 'm7jiQMTEPE', 'ERyX5XJw5K', 'xuhiX6tqqW', 'fCo4c2qfYEjW4xvmUe0', 'gbalstq2C1PpsOJGVqL', 'SZ3Itbqeeu4KsR2QGxU', 'wgv0OgqJ3X3XdPjGRsH', 'Rh3D5RqjNt1YeJFWFWt', 'RSmb3cqzK11qT9ma3TA'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, cGiDMSHMR5aXM1HiXTP.cs High entropy of concatenated method names: 'POLotFP4d2', 'tXJorFmOnU', 'UVkoSi3xNH', 'O7s3T4ZQEVTrFSs4FNx', 'D9a9AjZ6BDBvAktvfW2', 'NFRXcTZCeq7VSL07nag', 'fvPaQAZLLJt680FGnkq', 'cZi3gXZZ7QJ4I6wKRrC'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, ON9Op5V44kY31YT7TY.cs High entropy of concatenated method names: 'd8Do34deK', 'kcicwLPuT', 'h2IIjvF1m', 'f0QhsXdLq', 'XvjdPF3cC', 'gZHMQdWYG', 'cN3vZ92YA', 'sVD7NdVcQ3hACyWBW0P', 'IUTWF2VmrNogHVbqjV5', 'cn4U5hVYvvvyXkSqfuo'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, A7BSYvmmbAiq4yifMWR.cs High entropy of concatenated method names: 'w7tmfCNdan', 'SATmByCUFM', 'eEmmRu8qsw', 'v5Qmgn3Pbm', 'YPTmslcniL', 'HSimAx6T5D', 'XKOStg5Mr2KFxvjplEL', 'fbUYEy5Eqm86guYdLdj', 'GXKlOF5XrIbukJTSRcj', 'yPylT35AZiei5V9u2bp'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, yUoUwXONflodC6d2xoh.cs High entropy of concatenated method names: 'ldEpsOotFy', 'ntRpAmw0pp', 'gN3p1bv84U', 'TmWpPChNlU', 'sFCpCpnsDp', 'vIeHwTr1Fi5hwoc6hBw', 'jgKk1QrSVJdAidURM1f', 'fb5bWRryY0KiJ315OH7', 'KK4mbhrt1xx2KDadjBf', 'MbXI1qrcuRFTF3T30m6'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, J0hpQrmuXnIitsJc6Wc.cs High entropy of concatenated method names: 'vKjOPRhiRJ', 'SI0pesW9WirAd3aY8mH', 'iprkErWyRSDND3BXsVT', 'OopVvEWVBHLNesHcJKh', 'aWiTEcWBmTexqW2s1cH', 'l2LYErWtLygVCgRmFoC', 'Ac6hqpW19GroDsQAKU0', 'mhNv1EWS41oCS9lFp8O', 'Frd43tWcxP4B6FSnqbp', 'pYTuYFWmrW7uY2yWu12'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, oZCvG54wWRBjDfkFnkO.cs High entropy of concatenated method names: 'MRgCAxFi4pyiELnGYAn', 'nvvt6ZFx48urytFIyEu', 'V7CN25F7xjQSMBm62dY', 'zcY5f8FhxUIJnQSgLau', 'CGxnukNhs0', 'jKTsB2FOLu9vlOFcoXU', 'Rd51GUFsH99JSIdQUcR', 'f8isuFFaWqiVph4x7jh', 'tP9jD3F6bVHgg2ns9Xo', 'CpYGL2FCKGc1iJhxjwT'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, F0eFFnmKkJZhn55Zvys.cs High entropy of concatenated method names: 'zNeO7uiZah', 'xlVOxdPnu0', 'YRfOkdbvSo', 'yy1OJdNcbb', 'prOOWxRapI', 'QnIOYWhyod', 'kr6ODxE7YT', 'I0d9jtb7omcYokV1kK7', 'B5LCmhbq3HNpY8sPkpn', 'WQNgy5b8HNeTWQUwVMM'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, FvUSi00RJHkOioJSRTM.cs High entropy of concatenated method names: 'smGvVcSBap', '_1kO', '_9v4', '_294', 'RXJvTraoO5', 'euj', 'WauvoYrLC6', 'h42vc2ksyy', 'o87', 'fuevIo2wnp'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, DcgbdkHCFc0nwgXcgUH.cs High entropy of concatenated method names: 'q4Y', '_71O', '_6H6', 'Gn6cTMG0CU', '_13H', 'I64', '_67a', '_71t', 'fEj', '_9OJ'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, NpkSvBO9tY9bafnVL2t.cs High entropy of concatenated method names: 'SPWpBWnPcB', 'Jh2pRguhaI', 'Sv2pgbABwJ', 'qTU82A0FbwDfCL1Q6B3', 'YuroYr0dcv7SHtHEyae', 'Heq4Xp0ppmFHQtY9EHt', 'Mdcw3u0GT78XWXrkYf0', 'vm9AD10wKpsPlisBQnk', 'uBaQAH0lV28IGqeR5qj', 'NQHY4W0osg0soBEe3dk'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, ElUjESmZQO5ijkocpJ4.cs High entropy of concatenated method names: 'sKe4crgbNw', 'cH5Pc3Ewi1NFjX2LPUo', 'HlSjqtEpNoTjFTdWBOT', 'TXkeNDEGPahdMHNL9Mf', 'wVSF6VElXi4QpMAUVGQ', 'SWE6UdEoNH5lfOYrRH0', 'R5046iTwKe', 'uUX4Q41pXb', 'ymM4bmJd4k', 'Cmo4jqWDff'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, Q1DSX900iYSkfVne7XQ.cs High entropy of concatenated method names: 'Qkp', '_72e', 'R26', '_7w6', 'Awi', 'n73', 'cek', 'ro1', '_9j4', '_453'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, UJYcexH1uBfIbSBrvkp.cs High entropy of concatenated method names: 'jdfcy3c5IJ', 'Tr5cHO8dB0', 'Y2Rc0a6ysi', 'nArc4VfmcZ', 'ixdcpk3K6b', 'iRdcKPGlEC', 'Ln3cXQxWYB', 'ey6c35LtKp', 'D87cGocUg4', 'gu1cEvjNIf'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, g80GQCIoZw6kAVuOrs.cs High entropy of concatenated method names: 'at6kUkTKy', 'dMjJde88C', 'jhoWdnCTp', 'JTexFbVDbZuxL7Bmo7Z', 'HYVfafVLTWbaRB4qfMC', 'xtYhbpVZloUUUas7rYY', 'xuR6a1VKYE3YcX79PHC', 'I6b3VwVN2W2IcYANYuI', 'MtGSx6Vnxylf9Jyo7IV', 'd5lXmvVuy8xsxoYbuWK'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, m7BaDMaAjOnUe9lkyjn.cs High entropy of concatenated method names: '_589', 'YZ8', '_491', 'G9C', 'gdPB74gGI7lIZN9LrRR', 'C0jW1YgwTb85ILcADrS', 'PdO8WXglgR9ZwX9XFca', 'YCoLx0go2nbnwxpSv4v', 'cjnjVSgIQ2OHB6Tewli', 'iGE3u6gJNSYywQ7Cr57'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, bmVAxyyP82jM9OnS3v7.cs High entropy of concatenated method names: 'KFrFcDJLdB', 'LgAFhohT3D', 'up5FwDNCDr', 'NqEFuKSPcI', 'UGYFFDabFh', 'BGQF9kMAAY', 'SxYF2EQv6P', 'sKmFNEUr3r', 'TkVF6nmPsn', 'UqWFQoayBs'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, nTLoROOSeJQOKO9eeS1.cs High entropy of concatenated method names: 'oYo', '_1Z5', 'wpqijCj0Ot', 'wNqXyLX2EG', 'qucifYmZbm', 'GgNo698bbSvjUjwOjxe', 'esZke38WIrt9T6gBd01', 'bapDSP8kwsRQPkUu1aQ', 'zuSCoV8X9WSEFK58BJV', 'jIeW1C8Amtcx5TiVf0r'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, N7KjFoahxcgut2HyOQs.cs High entropy of concatenated method names: 'Ai7', 'YZ8', '_56U', 'G9C', 'qp3DpRce0KEe8hh5r0u', 'o26kxxczUyVJ7Al0TQp', 'oiDLu0mR0x4EeWqFcj6', 'knvVLKmVO36ADpI2xPH', 'whLf7bmBbtlyKfaV6ug', 'l9mE7hm9xFbNdxFEQap'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, mGsjrXm5RJSD52pfjgS.cs High entropy of concatenated method names: 'maPmcH1BLO', 'O42mICRSp3', 'MaCmhyE68k', 'BZjkoeP63nGAJjAlDTy', 'IPE3L6PCeAvZOkmci1a', 'PC9tlMPQ4Ejw9IkDKZ1', 'WBucHgPLcxuHC1oUXPK', 'wmWLBGPZ8yTdID9W2YV', 'AACfGlPDFGGaAJjOkbU', 'avIlY4PsxUg3yZZPOVQ'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, UI7bGZm8mCiwUqsNasr.cs High entropy of concatenated method names: 'j3R0pqYeOx', 'U5p0KUr5iQ', 'xQuv5qMJQDIl3JqLJPW', 'O9ivsUMjXqv3VCpfd8P', 'i0urjSMoJfMMMh2k3Ld', 'EV6qryMIStggZaOvQTg', 'MUj02ESQO5', 'RXhd9hERcDnmgbjugWR', 'h3PDHfEVWSnu3a6o7P4', 'QnTNthMekLq3BwB8Yuk'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, XSa8OM0eybbwyS9PrRX.cs High entropy of concatenated method names: 'AE4IbU6Cd0', 'pWmIjhFTly', 'bRxIegy2Id', 'iVBIVGVBVC', 'OXpITFKpHE', 'pH2AQoNfa1CMsPhVcZQ', 'lxRHGIN2Y9a3ADJhOEJ', 'XsZMDJNe1087P1TZoNy', 'aHp9eSNzIrmuMvHIo8q', 'MyccacnRfVNMdFpABIR'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, Q7lAFSm2hb6e6FsTIfS.cs High entropy of concatenated method names: 'YPpOiia9oJ', 'eDoOZJiQiI', 'qE9ueJW4J5qsTBhiuYt', 'rwYpHGWUhjcVhwj1JGW', 'wVuhHmW0e6XD5bhZ8uC', 'HVST7kWrVhCrWfhwUxR', 'CyFmhgWqkD3xdaBYAw3', 'RX8NgGW8NGlSf6sPutt', 'z5h4oQW7XpSo4dTMlX5', 'PBTjrFWh9Pb1fSKfXLX'
Source: 0.3.Modrinth.exe.2aa974c.0.raw.unpack, EDvKZXaTlB3bbN8yLqC.cs High entropy of concatenated method names: 'kNf', 'YZ8', 'U31', 'G9C', 'HUwKPDcQnxc1TkTp0hw', 'GH1Qc4cLN4PI7xoilKp', 'ewQkK4cZpQhHbvsrt1y', 'Ltb4UfcDc8IZ6lxolJC', 'gNIQugcKFI14TobgOmy', 'IvpYXWcNbk7jnT5CSa9'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, jPaTnia40GWt9Coe6yO.cs High entropy of concatenated method names: '_6H9', 'YZ8', '_66N', 'G9C', 'qiRZHj1J4NC7beQbQXK', 'NgaAbB1jRKel81QpJWU', 'T6ey7G1fXFGx6sK2gk0', 'h71wg212LsMLZtgUVit', 'KBsDg81ebU3E7lQLn0v', 'VwtuWo1zvXQUQqUYKmf'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, pbABwJy3EdEOotFyFtR.cs High entropy of concatenated method names: '_4J6', '_5Di', '_1y5', '_77a', '_1X1', '_7fn', 'OUK', '_8S4', 'wUn', '_447'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, IOnjNpyi3WP4VFBLKh7.cs High entropy of concatenated method names: 'ICU', 'j9U', 'IBK', '_6qM', 'Amn', 'Mc2', 'og6', 'z6i', '_5G6', 'r11'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, Xa39auae6dMXshb8a5I.cs High entropy of concatenated method names: 'gHL', 'YZ8', 'vF9', 'G9C', 'j989Rlc7wue7C4kxZP3', 'MrVhfLchwVuVGlbK3mq', 'Qx15hNcitWqMiMYYMC6', 'rWEiKocxLBfd4PWrD3L', 'W80QoWcv4BUhYpx5AOR', 'V7paBccTwYZ2Dt58cOu'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, oouYjcOoPmjrIkWamvv.cs High entropy of concatenated method names: 'c6YK7Kf2Gg', 'SOMKx0X9Ly', 'SXLe8bqELooqIGhwlyl', 'Hguw4rq4RUUGpVCrGEk', 'GXNnlTqAy9GqD0oJWDj', 'LNeSbTqMpUQnLRW53pk', 's6vqe0qUEhrpgj0aX2s', 'xKf4Rkq0FptPTlScKfK'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, JBFZpRnYyR185c99D9.cs High entropy of concatenated method names: '_52Y', 'YZ8', 'Eg4', 'G9C', 'Sxn8yMZD2', 'uDXe1OB4PeEwZVybgTR', 'HkocfjBUShjtZygTKvA', 'laSPGlB0OhMiZYIYp4M', 'v7ouDOBrASg4eN5Tspd', 'LI4gInBqYFcgGZQWcW1'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, tDUgcN4cgsla2FKvWQI.cs High entropy of concatenated method names: 'ziPnogSufS', 'YkgncXSsLT', 'pJNnIOplt5', 'cspnhe0fAX', 'b8jnddn1a6', 'uaenMagvy0', 'SN6nva4vWE', 'x0gnU37YjL', 'NESnnObaxL', 'VnWn7NCBeH'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, ehi0Ar05rwO3rBy5vDQ.cs High entropy of concatenated method names: 'NnYcrQZwNB', 'rD8cSIqcmm', 'UIlcfceKps', 'gxQcBUYWv1', 'n54cRmT1BQ', 'rkFcgTjThU', '_838', 'vVb', 'g24', '_9oL'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, rhM4tbyHGGaiSwWCOii.cs High entropy of concatenated method names: 'sLyG2v2GjU', 'qhAoA0hEMdjELBiBxbJ', 'ocRb5xh4kvrV7eGyGV2', 'eGvPqqhAVS4fWLdoW6l', 'PQlwgrhM6ONhtoQPoIS', 'w6fXUaf8SK', 'GHAXnDBgDs', 't1UX7D1p5S', 'YykXx5KOQn', 'T97XklAAx5'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, pK4i05auqbqWopsKsKe.cs High entropy of concatenated method names: 'rU3', 'YZ8', 'M54', 'G9C', 'yXMa7tSK73PIWQTFjaa', 'eKydheSNL2Vryrp8Y3b', 'N5Hw6YSncC2leDxBC3T', 'hioR8GSufvAhlwBQFk8', 'e2E9DFSHAPMLmvnqRZg', 'zbIWLDS3QDaxRawpl2y'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, RQkNuuH7giMLOmlQjLZ.cs High entropy of concatenated method names: 'oTAos8IXNY', 'sUNoAqLXkj', 'tfqo1yVqmB', 'cBHoPV4Ya5', 'NBtoCcKSvC', 'lLFoipSwjI', 'h435C2Zp7ldb00nwovG', 'QK1GMjZFEREncwFKIlT', 'P79URJZde3G7PNfjPnd', 'HHDU0oZGvAeX232QQ1E'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, fUGbdqtY2ANHoqXkSw.cs High entropy of concatenated method names: '_468', 'YZ8', '_2M1', 'G9C', 'iHRT2hyMPNtIlRtBXJu', 'leGoNgyEUQZH2sUYRDD', 'JPo0A8y4xcXBbcqsmPy', 'mn19d1yU6jNn2rCUowj', 'yCeHa4y0EMI0gOSeoDc', 'ct4LJnyrh7FKUVKT2BG'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, y0lMUJyhu6CbIcl54jf.cs High entropy of concatenated method names: 'AwGwxihbh3', 'uuFwksYJEj', 'R4SwJF1yE8', 'mS3wW4trZH', 'RWtwY77dlh', 'JKI0Kix4GfJlFBdtFtV', 'yWU9hnxMUjeNs2t77dR', 'a4pKEHxEPMbm0bdUJNv', 'QECyJ7xUfw5TpSb8w0f', 'TBJYgEx0Ky5ErpBRgOn'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, AAlQZwiJL5Xr5eGvBm.cs High entropy of concatenated method names: '_52U', 'YZ8', 'M5A', 'G9C', 'oYjvQttIPcTGSksMQXP', 'eRnb4OtJwwTItDbVxt9', 'WOqjnotj19SGc3Nncbd', 'HK5sT0tfE4HDbyITp84', 'Vdisfmt2jxT8PVUTo8p', 'YB7HEQteEnAmC5RTf2f'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, e2g5aG0crcxKeJBRoyR.cs High entropy of concatenated method names: '_7tu', '_8ge', 'DyU', '_58f', '_254', '_6Q3', '_7f4', 'B3I', '_75k', 'd4G'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, X2icxDaO12aiUd80oHk.cs High entropy of concatenated method names: 'R1x', 'YZ8', '_8U7', 'G9C', 'g19bRf1OghoyYMl3X4u', 'E7If4P1s5jpLRphRyLW', 'sMRaUp1a3viAxylWWqj', 'UC9C3516Ecu1eRm1knu', 'J8Agea1CM26Sy5umLeD', 'SeEaUk1Qa4gw3Ssd7LB'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, yerTdRy2onVId7aJ1TB.cs High entropy of concatenated method names: 'Jf3EyBHhZ8', 'bUqEHjjnLH', 'zT3E0GCpqG', 'HcCSKUiAGIqNf63wOKD', 'u2xGW6iMUsWMDVJcemg', 'DW37SrikmEKno1X3ibR', 'CCaUNDiXkjk9gqZlpb5', 'eTjEj0iEx1GhTB0b2Ox', 'pueZHwi4Ysifju4XUbq', 'i33LCiiU3BIEJF8h3a1'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, jvGrunOatM8gGptbr4c.cs High entropy of concatenated method names: 'R3j4vfIKmq', 'nCE4UtyXAs', 'HMd4nWbTxb', 'FPx47epZ0M', 'tGqroEEzHXCOZD1xYfj', 'CZIedaE2oEpXtC2tuY1', 'UG5o6sEelNpYrdQ8JFF', 'NeKsPr4RcA7lIOFbV9p', 'Eq5gEr4VbK3nCyjGgrx', 'wGhBMZ4BUoLfiMdhaR8'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, MNuq87gYHUa13y8H92.cs High entropy of concatenated method names: '_8Ok', 'YZ8', 'InF', 'G9C', 'NsFhvgtkaB3brEOQFho', 'aP8GcMtXp1eu6UWHknn', 'Hdt0g3tAoMFLaWwM1Fe', 'kQO2jhtMiCEMsS5Ibgt', 'vScu6atEFEHTbgboLUu', 'msDh3dt4HGJNTg8surA'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, z3DOHTyA3lEDNf5oxRY.cs High entropy of concatenated method names: 'pwKuiLyPlf', 'RtFukTjeBp', 'CfyuJiXGq3', 'orAuWva9E9', 'p7vuYXwNFQ', 'kKDuDEK5ZT', 'd2eu8rcYG5', 'JHEuL3sWFf', 'Kq4uqVaRD0', 'e6aul2fgS1'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, cmTkICaBFHJIm7DYxk5.cs High entropy of concatenated method names: '_625', 'YZ8', '_9pX', 'G9C', 'KEXML9g0xdgt3JH0P67', 'V7u8UfgrsPd6n0KOHBu', 'o40BqxgqAx08MiHXTtw', 'EvAKO1g8PoIwBxJAZss', 'oLEtkRg76K7qAgcCpP1', 'NfipMKghPvtvW5fDUNS'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, HnHswkOq2f1bZvlIekv.cs High entropy of concatenated method names: 'sg9', 'N8Kiq7RbuL', 'UNWKig7xpH', 'IT5i5epuAY', 'p7RnZSqpbJC5u1vFBXF', 'sZtd01qGndaWaCmjAR5', 'T5UGP0qwbXlAiYXt0Fr', 'KFhvHqqF5xwTGeWDU3d', 'At780Aqdjm2kedojLRC', 'Ac4hjcqlZZsww5HCNOS'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, QWFNpB8gAYSNtrLHBq.cs High entropy of concatenated method names: '_23T', 'YZ8', 'ELp', 'G9C', 'hge4Hn9jcfFpcbPRemt', 'hdifgZ9fZXWm7mSPrYx', 'KvelKy92i2mxEyJZdaP', 'ttGQSi9eMie00EKIu3R', 'AQAxXl9z511kcCWXNa3', 'yq1DJxyRtftRKrfYVjE'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, CZ9h0Z44gkQdFuZ5VE.cs High entropy of concatenated method names: 'oh0wZ4gkQ', 'Mx4mnx69Td7sIJMHYw', 'yyC5NXsX2MM4yfy0Em', 'Bc3wteajJed89ml85x', 'OOxNPnCv9abwcEhbbi', 'AhYiDIQirO5wKRJP1b', 'P09m50WD2', 'B0TOGdG7k', 'tqOyJt0pb', 'su7HLnDU4'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, tRhiRJagZIFjUJYiZPp.cs High entropy of concatenated method names: '_7v4', 'YZ8', '_888', 'G9C', 'm5e1Nwga0WBFGURebZO', 'IADl1rg6AyOyIUux4Uh', 'yL0qw6gCo3PqysfdaAI', 'DV2J38gQgvPAxDOC81A', 'kbHt9PgLpDQp1AutwXs', 'YRC4uBgZQHnonYQqwug'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, SvlhDembYGB4JLGRZLG.cs High entropy of concatenated method names: 'GchywuGsjr', 'jRJyuSD52p', 'jYbksuk7Dm1uTtVCUdw', 'SumgaMkhaXWpg4HyjXc', 'Yuo9ItkqXD6UhZ1ZO87', 'Quo860k8WxGwMdrr30Q', 'wbhQaTkiiUipmNgCQCg', 'ub6NAVkxAnYYK2iiDPJ', 'QaNiBnkvHq7nS9W8mcQ', 'AUvIyXkTtV3P1CtOONK'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, eRlfJjaMeelFTnNKSmO.cs High entropy of concatenated method names: 'GvP', 'YZ8', 'bp6', 'G9C', 'NHx2qCmLkDJ91FhbHUb', 'KWeSu3mZVwXDtjk5Z8D', 'dVgFxymD3Omt2Wfc4JF', 'lUYBcmmKyC09mLfEOIL', 'YWqDtbmNRsOPOsPKtrQ', 'xDgPDImnhjDTpppYFrN'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, ytAGk70tUHyr5NrLm62.cs High entropy of concatenated method names: 'PJ1', 'jo3', 'xQZvKPiuGy', 'xLKvXNx8io', 'ztJv3qvMX3', 'EC9', '_74a', '_8pl', '_27D', '_524'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, ykDh1E0TlnGsWgq8ULC.cs High entropy of concatenated method names: 'IGD', 'CV5', 'g38IoykCX7', '_3k4', 'elq', 'hlH', 'yc1', 'Y17', '_2QC', 'En1'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, fs2AfazSVDW7SCGUm1.cs High entropy of concatenated method names: 'Y29', 'YZ8', 'jn6', 'G9C', 'rSegpO19WmYBgYWa8y1', 'eUkcAM1y8atp0V0YYev', 'gjvVNf1tjdP2mZH1pi0', 'Iwa7IA119oEPixVRZId', 'xARb6y1Sfwg9BLgZXZC', 'b8SvsS1cRoGxDPcxHnY'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, E5uGIwHkQFsVkfeDTuX.cs High entropy of concatenated method names: 'xN2c5d5cJa', 'qGqxvKZfO3eUpywdyds', 'miFIcIZJf97c2D5Yqae', 'hT6wCGZjWyuJoT5W10i', 'BNt3KiZ2OmODTP6q8cX', 'xksA2rZe9YPohUkYs86', 'L2t3MmZzVib2E4IkTtB'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, yrHKr0xBqBdvKUoEED.cs High entropy of concatenated method names: 'g25', 'YZ8', '_23T', 'G9C', 'S1rlnp3H2', 'mPTIwVBQLa7BOeDYVJu', 'A4B0yxBLGknoR9H0g9N', 'HVZTt5BZ4MkZmo6yInu', 'Jm68hdBDWjGFvhLc0O0', 'D9KGgHBKYkRh0ouVc1T'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, BrJmY0aS531i1G0qfyk.cs High entropy of concatenated method names: 'NWWm3FRQqd', 'frBmG9X1di', 'qRf3EcgP3TnDROfqf4l', 'w9fXplgYc0tt5YnSTym', 'CV7YlqggfTegsd1ybdN', 'xNDdyrg5xKOO04V3jm3', 'qAZWcWgbk612FwleRsP', 'aZeJQfgWUqtpa1CqqbH', 'OO6VFxgkJtugH6cqca3', 'W1BcHVgX0YZlPECBvoG'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, yaoNBCa9ypqycarcC13.cs High entropy of concatenated method names: '_981', 'YZ8', 'd52', 'G9C', 'qeRhjeSouDRj7d344vv', 'PCxu8OSIs2QAZk61yXR', 'Y3uIUxSJnEvMnRpVedJ', 'HvR1r8SjsK57hN8S4Zd', 'QYHkJMSff1BBMMC1w53', 'sQaXmsS2s0GaQncqLvP'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, FDvseqmkwBUjoNZgqp1.cs High entropy of concatenated method names: 'WxDHvvseqw', 'St8IM7A23JCRe0rsrLi', 'c26PTNAewe14xnKVkdn', 'FVpwHyAjUVQoeZkQUVi', 'SD9gYXAfFkPfhZxaqCZ', 'qUj2PEAzUxxpyHZMyNR', 'Dgls7IMRjUahQNCm8cm', 'fXvxFvMVBSqEwgtp0ou', 'wgFTtaMB2FBe470YNah', 'jjBGAiM9fKGxJdPirpf'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, YhPX2JAttI8RINZnZ6.cs High entropy of concatenated method names: 'pHw', 'YZ8', 'v2R', 'G9C', 'jNSUqItvKNC8AyXuLYr', 'Ps6lrmtT0G1kKwkLeTG', 'fc2CVjtO3Ly9VOg5bWH', 'CcOhmXtsr38aG1I9v3o', 'LN8umPtaOo3Hu5PTj6e', 'WIZu7Yt65lmQsU9DKm5'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, EnWxliak2oQYuupnive.cs High entropy of concatenated method names: 'RINaAZnZ6J', 'j0OoPVY7sWCt0Op67E3', 'YtpMQgYhlVBVmfna1F9', 'tIWo9uYqjdwQPFxjeR4', 'NU1l4lY8WJolHJLlksK', 'eCYPjwYiOTj8yfSTw0U', 'QLw', 'YZ8', 'cC5', 'G9C'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, C67BguOzdiiqsGeSaeQ.cs High entropy of concatenated method names: 'VlYXdOnjNp', 'jWPXM4VFBL', 'ih7Xv5phaG', 'LLe4i27nDEKRwIkeKYi', 'Eh6GLF7uq0APNlbQKtq', 'heuedR7KPidt6DB950u', 'CLEk1D7Na0MhS16cyFW', 'JdJWu67HnoFJVyiIkrA', 'LhIi0D73o3mCKyrrIja', 'nwpMhx7FANl9r1I4uG1'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, M4vNYNy66wGjtdSM6po.cs High entropy of concatenated method names: '_7zt', 'SHMEQaZ6pc', 'YVnEbHRquP', 'FRVEjUQ7wb', 'GwXEeTEhyi', 'at3EVXhLJx', 'N12ETsQf8q', 'g4El5ViqUHHNfTKu9rC', 'BYvnqSi8R30Wqc5KgIE', 'yxnbPKi0JpbTm2Ej1BW'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, JfrKuFHsZNtOqvNM0Co.cs High entropy of concatenated method names: '_14Y', 'b41', 'D7Y', 'xMq', 'i39', '_77u', '_4PG', '_5u8', 'h12', '_2KT'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, GHVcie0MmULaONBty73.cs High entropy of concatenated method names: 'drPhK2oeh9', 'f0whXa7HO7', 'HXqh3kWLDS', '_3Gf', '_4XH', '_3mv', '_684', '_555', 'Z9E', 'OSJhGkR4o6'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, ew63JKY1CiMnZfNPEn.cs High entropy of concatenated method names: '_59M', 'YZ8', '_1zA', 'G9C', 'rUyiKw9LHX04khhKqLV', 't24dAX9ZEP9tm0F4d3h', 'kADClD9D1Oex0EYsvTw', 'mAZ8aY9KvR1Ij9Uyrms', 'EGhhC69Nx0CVGNl0HJl', 'dVNrSO9n2dnKyWRtC7O'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, NF7WLlStdWsFXqpjDt.cs High entropy of concatenated method names: 'P37', 'YZ8', 'b2I', 'G9C', 'xKtxSryHNnDiGIhx6tH', 'MvTmDHy3cutBvobUIP9', 'wljgs4yFOYPj2LwL5Sf', 'BD8MRcyd5alIKkcqqUa', 'VAkYVjyp2vSbdbDj9Yq', 'CiSn4FyGxVhYsZxScB3'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, vgYy0ZHhWOfM3iUXUdx.cs High entropy of concatenated method names: 'PYjoDHxRFg', 'XTUo8qvjdn', 'UdfoL3gj3B', 'gywoqbXJ6s', 'mlEoleZbc5', 'bJFh0lZv5pBvbGX5dBq', 'tkeYDZZiwHQD5vWauGc', 'gpQl8aZxGMg1WZH1CrH', 'FWtZ9OZTMged2nsXsto', 'oPccTxZOCNULG9FME52'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, kX3SxSaNFlKodglsQL1.cs High entropy of concatenated method names: 'yiQ', 'YZ8', '_5li', 'G9C', 'lI1tdScRjyknXlbLW1m', 'oKsRDocV5LNgul2X0KA', 'lt1jnScBKsRC8Nfg6It', 'TvNWblc9c5yIcGH94rV', 'XqsZy3cyN3AyZ6txeNP', 'adbgGXctwlbdO9Ugupx'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, baYrhAOQ8tHFrFkoH4H.cs High entropy of concatenated method names: 'CiNKFiO8FK', 'xZgK96DO1c', 'RjQK2LE0w8', 'tND0DBrHltVjjKYKdCe', 'ghgLrtrnJeB0f4sS6vO', 'c38qq6ruL1fuCgusPdT', 'nwZayGr3TddHFk1Rnly', 'xIeK0rTdRo', 'DVIK4d7aJ1', 'wBKKpo6cLL'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, v9DMJtmYa3lXTywSQqC.cs High entropy of concatenated method names: '_0023Nn', 'Dispose', 'NJBHkb5VoW', 'drcHJYV9DM', 'HtaHW3lXTy', 'mSQHYqCqgS', 'KRxHDZyyf3', 'MxPLq0MmpeysG6LXpof', 'AZG42qMYQKISnC3KbJY', 'tlxPZpMS1lUXJDePvYc'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, vyhBvyaHPjk7CA5wG1Q.cs High entropy of concatenated method names: 'K55', 'YZ8', '_9yX', 'G9C', 'nkeGRa1FO2XxXJRT2Q9', 'O22XSK1dNfOPEdicV67', 'SL2iNv1pQHWQUMDiFEg', 'PAnwcD1GC700Srkitny', 'cCxnGf1wx6gwO2k72MR', 'Em9lK81lfAdY7g0cfBJ'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, MaCyE6a38kLsjZ1UZds.cs High entropy of concatenated method names: '_6U6', 'YZ8', '_694', 'G9C', 'gpl5PGS4dhtmSp0Cm5b', 'wTmR06SUtjrqKSoMyU4', 'KrrfRDS0Z02ssLHWZIc', 'e4jg4TSr1pkU8WEB6gY', 'bVNHQmSqM5RtbfD0Qdm', 'I9W67xS85TW8U01JdUM'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, RLQ2DGOP2FD3T9fiYdo.cs High entropy of concatenated method names: 'MqcSHp7Z6bECoP6UoQc', 'rdCRrw7D0uNR34MqcI5', 'LKNnUi7Q5Hugbl3p1Sw', 'g9MZ687L9O381PG3QRF', 'IWF', 'j72', 'ksfX20TaR6', 'MIUXNy3OiI', 'j4z', 'mxqX6hmpQ3'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, PEqsn9aKWioLWYZHsBj.cs High entropy of concatenated method names: '_3fO', 'YZ8', '_48A', 'G9C', 'KAiZYlSSSQVyWP9wB9L', 'fug0c5Scc1o9dfaZSxp', 'NMhLOrSmIhklHwPyita', 'c08IRaSYLYFY6PDZrkg', 'zni4WlSg1brAxnW98nE', 'CMG9BBSPCluv41QqZ0N'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, mL9cTBaZSquppO1akcG.cs High entropy of concatenated method names: 'ud6mVhQxSE', 'MsnmT9WioL', 'HYZmoHsBjj', 'V3GtiXPgo565QutZbjY', 'FlODb3PmEImQ9h71pXw', 'lXq8ESPYCpN8PgHRmTk', 'b2YeoxPPljIKyPoVH6H', 'RZ8GYpP5SoybBmSb4uD', 'cI9FToPbgQe82OnSrS1', 'xcGbbnPWoP4U0Rlg3jT'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, wyCUFMaQHEmu8qswV5Q.cs High entropy of concatenated method names: 'fnTavNVQCc', 'ai8vX6cMoAFYPJSBkr4', 'f9dnmbcEdKqrpiBMSTf', 'wL9QO1cXO8CKEjomobY', 'vkQ6nPcAj95qbZy6EkL', 'Cuywsmc40caFf0qYhVO', 'C3qqNucU31X92GAIdCL', 'UpLw2mc0949FQJXuAoO', 'FZpAsFcr4D7frrBFvUq', 'f28'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, KaS3y4aYEAMPTdqr0TA.cs High entropy of concatenated method names: 'itEainiSbu', 'Ap3rI1YZu2xrGVane0q', 'KvtmEZYDpJxp4gTDYfA', 'X2r83mYQhdGvsG6osKd', 'g0ln4oYL98PI3iNe1FK', 'yrwi9kYKvRFdM3Yndpn', '_3Xh', 'YZ8', '_123', 'G9C'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, SRkpZtaaM4SieWmC3h4.cs High entropy of concatenated method names: 'tO4', 'YZ8', '_4kf', 'G9C', 'd4rI6m14iaNIksLMZ65', 'YV0Gw31UPLZvFqxbgB4', 'XOZdXm102gXeOrgySWB', 'kWHnXp1rCicHwhBQ4TA', 'Je4lSd1qJXGgF8uXa4u', 'UgPKmY18ieIlvpEFF7U'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, L8EfPg0haMlLQNup7b9.cs High entropy of concatenated method names: 'D4M', '_4DP', 'HU2', '_4Ke', '_5C9', '_7b1', 'lV5', 'H7p', 'V5L', '_736'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, bX9w0bBJDIlXEvLJx8.cs High entropy of concatenated method names: 'kcq', 'YZ8', '_4bQ', 'G9C', 'IA2Jjbt1xLDSIbX0bCN', 'M3j6HAtSXUmVpTXTXGm', 'bPGxSxtc8Y6DdOPU5j3', 'ESeTQUtmEr3bUVbSHpB', 'tbDR0ytYp0aMnqJjjDV', 'z0Z1ohtgPJw6EgHfioj'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, Hg3fDXOgZ4C6FtCmS9i.cs High entropy of concatenated method names: '_3VT', 'O5t', '_1W5', 'LAIX39whE8', 'JyQiT5gvR2', 'zi9XGSY4pR', 'rRBi4Zstgp', 'QJQxYM8DV41vwOmoquS', 'lEQb538KyanmJqKm2k0', 'QZe26Q8LAouw6coabIs'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, OsXtcKyRbxwwJZHGsf0.cs High entropy of concatenated method names: 'P29', '_3xW', 'bOP', 'Th1', '_36d', 'fV6uFecuOf', 'buFu9Qw4UZ', 'r8j', 'LS1', '_55S'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, rO2Y6bacTwUsbIPi24J.cs High entropy of concatenated method names: 'p23', 'YZ8', 'Gog', 'G9C', 'ufp5QrcddsE1UIlZtpc', 'WM5fWecpel11vG8QaUq', 'sDB3hbcGK9AonxIR5Bq', 'y7UeCUcw7H7vMV1oAEv', 'JH3Oc8clsIR2gWxM6Uo', 'jgiccfcoQea6IBhJLdQ'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, TaKxNgOXDfBWl81LOax.cs High entropy of concatenated method names: 'pTRpxmnNIK', 'FxYpk5gPKf', 'lYDpJ10n2b', 'AYRfVA0W8ammCPn7GKT', 'Uc21rq05iV9GCGf9EVK', 'oAC6rt0bK0bEshlmwE9', 'U6jTxu0kPSjlVRnJHPD', 'GR4pFtt7pw', 's3Pp9NacnT', 'tMjp2j4gE1'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, kLA8y1mVcMRImFWnmng.cs High entropy of concatenated method names: 'm6LyjpWKUF', 'NuayeNEDQh', 'XhbyV21ITj', 'rd5yThaVXZ', 'okpyoJpS4x', 'NWo5iFXR82g46VsHukt', 'A3Y7eDXVs8oByOl34wx', 'wDwv9kkeP1d3FT0D9A2', 'LNGIy4kz6ZQy3L7tjv7', 'nKrboJXBulg9rKCMlAV'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, nqCPI9dVxN5OIosCd7.cs High entropy of concatenated method names: 'T43', 'YZ8', '_56i', 'G9C', 'QNN94RBg1PEgosgpIkJ', 'rYjVTABPOh2MQdgcAWr', 'wWwWVKB5su0siEkdcsY', 'aTXOJGBbVM7d9H1Lm7n', 'DwbSPOBWxypuy4CERHR', 'G04Bv7BkTEjf8hFAM5S'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, Vya3o7mMxMRGofdtKUY.cs High entropy of concatenated method names: 'A5RyiQ7rTL', 'WeNyZWqc9K', 'ngvyzlhDeY', 'kB4H5JLGRZ', 'KGLHaipbiy', 'z9qHmn2rKx', 'lNBHOu44NY', 'r30HyagcWw', 'pGqHH3GLA8', 'BEdd61XJt37t5RZs2yC'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, KgoQdKyKgVx0akKguJg.cs High entropy of concatenated method names: 'uxk', 'q7W', '_327', '_958', '_4Oz', 'r6z', 'r7o', 'Z83', 'L5N', 'VTw'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, PxCKSfOySaLxpLpoytV.cs High entropy of concatenated method names: 'sCe4q1MEHm', 'MPC4lnxNvV', 'OLi4tglObG', 'wxy4rs8D24', 'H0I4S0u7Qa', 'nL14f9ZbNP', 'UDuKPU4Tia8JTDsuTHH', 'i7oyp24xERpin35sxo1', 'VEPWFG4vIfDmILBS7ny', 'ih069p4OwcASXCGAPH0'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, DEFqEoHO3EXg98RHjG8.cs High entropy of concatenated method names: 'jscVM76qjJq7a2ft9kP', 'rL9fPj68DHa8B5Z9P8E', 'pbEiDF60BQf0JcmuwnX', 'nPdaM76rNFTAbGHGZNi', 'sDbbol6Eun', 'ChN8en6i6L4IbHCDtfd', 'VtYmM96x2BNWZLqARdl', 'eXdW8167CHoVO0mQ6uo', 'GP76aa6hM3T473ARWBD', 'rvCWsi6vFQxU6LSq5Vy'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, utPAkW0xy6H38Tx3NjC.cs High entropy of concatenated method names: 'gvyYVhHy8yGKv5oUMfl', 'HxiZVgHtwQ5Na7kYrTP', 'VjxV44HBjEUcpNBUAjG', 'NrsX4cH9lLknBnvEJWj', 'lwEhkxsDJ0', 'WM4', '_499', 'c4ZhJgrCT1', 'XK5hWs4haF', 'ViYhYDkEM0'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, dIpulgaU5g1UcsrHg2Q.cs High entropy of concatenated method names: 't0LarVcZPr', 'Imo2AeYBBg2Hl1kMJuH', 'KweZO9Y9MHIAmLsTFCL', 'redkf7YRn7dv5i4TBWe', 'IhiVGDYVp6DgiIBqwVZ', 'pFegUrYyfCNbGxFweib', 'krpbxdYtGHGbPZ9Wrsf', 'Lxmn7LY1RWLjQDCsieO', 'K7YafHUa13', 'MYoIrJYmYsOlsQXJq5g'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, glfv8ZHUu9FCFGLp7rB.cs High entropy of concatenated method names: 'TeaofdA7X7', 'AdGoBw3Jhu', 'iQLoRcY5Ne', 'mog8k5ZNmbts9UpBcbb', 'nvBcxiZDpkW9HF7eu5R', 'HrNn2XZKb508H8Xi86t', 'vUTon9ZnslskPYjxLJN', 'Yt9xJKZuEMfRrp5mMmw', 'osfs6mZHFI6088JeJhF', 'GF13QdZ3whJ4TghhTWm'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, orwOpDaPaoTgDmQFEy5.cs High entropy of concatenated method names: 'rJpmQD3PaT', 'R3FdJaP12mLQ68x4qyh', 'sObiwQPSTVTMZa35lXJ', 'VYTLeKPyXQedNTEcPr5', 'Luh5oRPt0XpKs240TkF', 'QSDr61PcynprHKTwwax', '_5q7', 'YZ8', '_6kf', 'G9C'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, YhLwvym6LwQWlEBpj5Y.cs High entropy of concatenated method names: 'aDyOzKw7Ba', 'JMjy5OnUe9', 'Mkyyajn78g', 'rXyymkvuQV', 'OUVyOoCm9r', 'mOpyyDaoTg', 'JmQyHFEy5K', 'buVy0ZhsC3', 'soIy43LLco', 'dk2ypAnT8f'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, fFxHrbatjrKUNEfYCKY.cs High entropy of concatenated method names: '_2WU', 'YZ8', '_743', 'G9C', 'Nflfxtg15lvox6r89tq', 'pKBhIFgSJBRea5bsUpN', 'zgP4kogcxecZ4TyiVVB', 'MhFYLjgmBZfXYDkn3KV', 'foakW2gyFrwDwyWuZqE', 'HcnaEggtw4tQkesxXX6'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, NBqX6CJFHtfbQMZZ8o.cs High entropy of concatenated method names: '_3OK', 'YZ8', '_321', 'G9C', 'DX27qkB2dMIAcD1AZxy', 'YujAKABeVIUfsTJapBe', 'qwf4geBzTCt1UCJBQtr', 'GGta0w9Rfc6tkVjYhN4', 'YndEQA9VvMZa0l3kTxr', 'bwgap19B5N6IC18OgLN'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, eOSJpoOugwvd9aGR6iX.cs High entropy of concatenated method names: 'm74plXt0gi', 'xUxptxcDoP', 'UXnprqq1Gb', 'KgopSQdKgV', 'VEyX0i0CA3b3YO8FvBY', 'tZ3d760Qp8ybkys0QyJ', 'FYLmUo0L7TXCCk4sQPH', 'EYpyt30apGaaeEIhDDd', 'RvcOIu06anRGTqwNcd4', 'JlNWnl0ZBQH458SR9Wh'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, YALnWc43BrrHpS0V6ec.cs High entropy of concatenated method names: 'b2dVhUGGMv64J', 'WaiudAFkuOAiG56wefZ', 'm7rqqXFX9jbmrbHmaOg', 'OsdAvcFAXHqCY52f8gn', 'RIEq0KFMFG7TcXY3XGK', 'Cp3sXWFEhaq5HyBV7FZ', 'HRPLI6FboN9Un9xInEr', 'LcNgqhFW3V8Z31eC5Um', 'qYIphbF4hbtgilv179Z', 'oIsIg9FUWbidxAviGFV'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, UU6wmkHZx02O6yEbYXQ.cs High entropy of concatenated method names: 'b4FcdEtf29', 'pyJcM2mAQ6', 'F8e', 'bLw', 'U96', '_71a', 'O52', 'njNcvbRgxw', '_5f9', 'A6Y'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, WtocynOE4HM1UXIeqYv.cs High entropy of concatenated method names: '_223', 'FuSWGZ0MDgsCPuE6NwF', 'NjxZ3C0ED9GoxAjLVew', 'rKBrgR049RpIt0Q3p8W', 'G8smNl0Uk2Kh9wcISBD', 'oWvKHb009IqvWCDSkFB', 'fA5gBd0rP1E2oyvC0TC', 'nwUGTC0qG1IITmJnXLi', 'pM1f3Y08BOfcDiB2KHp', 'n8W7c807tUYv8q0NcYV'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, yWXVOLaEihJpxi07oeZ.cs High entropy of concatenated method names: 'd43', 'YZ8', 'g67', 'G9C', 'V7rYeqSxKJHohg3NSay', 'pUWmtNSvweZLHMoUo4B', 'bZRxPFSTYaVtW2NievR', 'beeufZSO3wPdYZMftJf', 'p8QDSsSsYKCjxTHRdy6', 'O2byxlSascFZksOACPL'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, TWb4LZOBL50f61GxnNM.cs High entropy of concatenated method names: '_9YY', '_57I', 'w51', 'FWiise77cI', '_168', 'XrOcEB8hWPN3P1UBWwn', 'DaOStH8iWDJ4m7mFmvT', 'VXZHOy8xPfw4SHf7D6J', 'kAX5Sn8vbxOwdj7I7MX', 'LDvZMb8TNSyYuBRVhdt'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, LbrI1XyoMBocJMtW8Bv.cs High entropy of concatenated method names: '_45b', 'ne2', '_115', '_3vY', 'utPw5AkWy6', '_3il', 'e38waTx3Nj', 'WjWwm4NAml', '_78N', 'z3K'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, witIrrOeJfEY3X4fvZx.cs High entropy of concatenated method names: '_525', 'L97', '_3t2', 'UL2', '_6V2', '_968', 'BSkepvqbK3GSj2nPrmt', 'fU8ZcdqWF4bDfHFHlYC', 'G5ZgZLqkku0r4hJLKOh', 'PXMmX9qXsV3NtNh5EfB'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, RfdbvSaLoIy1dNcbb2r.cs High entropy of concatenated method names: 'HL5maXr5eG', 'CBmmms4eDF', 'gZ7mOuZXBc', 'ao72W0YlvBFMhFu058h', 'g9uaL0Yop3KqqRROnyu', 'lc5i6rYGLtmW8ZS9ygB', 'Gb1EpVYw1XY0EqaZTa5', 'I4q6fmYID85aY6jO7wN', 'jMcx8nYJwbbeIiPqBgm', 'kkBSsqYjtgyR2CbbEw4'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, nKcZg6yjDO1cBjQLE0w.cs High entropy of concatenated method names: 'AuCExGiaIN', 'gBNEk6LIkD', 'z1EEJlnGsW', 'Sq8EWULCIX', 'EVdEYFBOh5', 'NRgSk4iQa8ShiTlDlyK', 'nPTwgeiLiwjNf3XBMYh', 'JTLAIii6PVyuhfy3nBA', 'BjZMWdiCC63sCJqAo8J', 'FQGfmWiZPYR41ByLIij'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, YxqOp7HKUf5bZiEKh3m.cs High entropy of concatenated method names: 'LF9obERRb9', 'MDxojQ5177', 'hPPtqMLIBQqA4XjUBFU', 'zXHWliLJaik9PvWYo3p', 'k6Vk2hLj8I617oPooFl', 'A0I0ORLfe0SS8949wJS', 'kyyoI6L26k5p6xPyBVM', 'SCRY63LeUKIAq36JUbo', 'sRKIOPLzAYWj03jLPAJ', 't9BAnEZRAAxe95vKYWu'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, KPDfjZHDMSnPD80LDYG.cs High entropy of concatenated method names: 'p9aNNrDtaTqCw6Emk1j', 'F4NuXyD1l2HDeRgKQc3', 'i1JhVcD9Xq02fZw6Lxk', 'OGVpMiDy8cA8UQSaG9b', 'hlhYMNDS60qjTM3pbfV', 'VOv7OXDc8qSnZxCqZCD', 'svZlKIDmPmkolxXPihd'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, gmfFAC0n9eeVHmNq55q.cs High entropy of concatenated method names: '_159', 'rI9', '_2Cj', 'eyQhcgqUlt', 'ynhhIUohH2', 'ANohhjmeho', 'fNbhdNkLhf', 'FWthMHB0hp', 'ovZhvfn9hM', 'YMsVP7uZDPd5q5ge15u'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, NrBQqL0muUynIESFV4h.cs High entropy of concatenated method names: 'kIBIpa6MVZ', 'UxaIKobBS5', '_8r1', 'ETlIXMo886', 'YsFI376bse', 'YcrIGJaCfF', 'NNwIERdUBF', 'xE4Wd3NXsFPavFUuxDO', 'SwXVTgNA1CmuMGo64XR', 'NATAFpNMDHHPOQqcWuL'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, zNlUbFyECpnsDpnJtoP.cs High entropy of concatenated method names: 'cCGGJSfRGU', 'A05GW6fdte', 'bAUGY6wmkx', 'f2OGD6yEbY', 'jQtG8FmnOk', 'SV0cSsheJ0yBxP3Z2fk', 'Y3qakrhz6V3Gtxx5LRy', 'y5tf5Ihfjer2oFZW3cl', 'ELxxgkh2iajYoI40LvW', 'b3fkpdiR1nAFZtEsDVU'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, TxHpok0WIWWuOnlBj9g.cs High entropy of concatenated method names: 'jIUMYZrbmI', 'EitgGaHO3SEQ6d0WBIB', 'X7uRpxHsZahVupv7y6K', 'NlPEjJHvg6Wydo9uK71', 'YDPdTMHT6STPtERAPEo', '_1fi', 'LFTdgGRDVE', '_676', 'IG9', 'mdP'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, FmPsOgOtd5qLIYhhe3w.cs High entropy of concatenated method names: '_5u9', 'm7jiQMTEPE', 'ERyX5XJw5K', 'xuhiX6tqqW', 'fCo4c2qfYEjW4xvmUe0', 'gbalstq2C1PpsOJGVqL', 'SZ3Itbqeeu4KsR2QGxU', 'wgv0OgqJ3X3XdPjGRsH', 'Rh3D5RqjNt1YeJFWFWt', 'RSmb3cqzK11qT9ma3TA'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, cGiDMSHMR5aXM1HiXTP.cs High entropy of concatenated method names: 'POLotFP4d2', 'tXJorFmOnU', 'UVkoSi3xNH', 'O7s3T4ZQEVTrFSs4FNx', 'D9a9AjZ6BDBvAktvfW2', 'NFRXcTZCeq7VSL07nag', 'fvPaQAZLLJt680FGnkq', 'cZi3gXZZ7QJ4I6wKRrC'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, ON9Op5V44kY31YT7TY.cs High entropy of concatenated method names: 'd8Do34deK', 'kcicwLPuT', 'h2IIjvF1m', 'f0QhsXdLq', 'XvjdPF3cC', 'gZHMQdWYG', 'cN3vZ92YA', 'sVD7NdVcQ3hACyWBW0P', 'IUTWF2VmrNogHVbqjV5', 'cn4U5hVYvvvyXkSqfuo'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, A7BSYvmmbAiq4yifMWR.cs High entropy of concatenated method names: 'w7tmfCNdan', 'SATmByCUFM', 'eEmmRu8qsw', 'v5Qmgn3Pbm', 'YPTmslcniL', 'HSimAx6T5D', 'XKOStg5Mr2KFxvjplEL', 'fbUYEy5Eqm86guYdLdj', 'GXKlOF5XrIbukJTSRcj', 'yPylT35AZiei5V9u2bp'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, yUoUwXONflodC6d2xoh.cs High entropy of concatenated method names: 'ldEpsOotFy', 'ntRpAmw0pp', 'gN3p1bv84U', 'TmWpPChNlU', 'sFCpCpnsDp', 'vIeHwTr1Fi5hwoc6hBw', 'jgKk1QrSVJdAidURM1f', 'fb5bWRryY0KiJ315OH7', 'KK4mbhrt1xx2KDadjBf', 'MbXI1qrcuRFTF3T30m6'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, J0hpQrmuXnIitsJc6Wc.cs High entropy of concatenated method names: 'vKjOPRhiRJ', 'SI0pesW9WirAd3aY8mH', 'iprkErWyRSDND3BXsVT', 'OopVvEWVBHLNesHcJKh', 'aWiTEcWBmTexqW2s1cH', 'l2LYErWtLygVCgRmFoC', 'Ac6hqpW19GroDsQAKU0', 'mhNv1EWS41oCS9lFp8O', 'Frd43tWcxP4B6FSnqbp', 'pYTuYFWmrW7uY2yWu12'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, oZCvG54wWRBjDfkFnkO.cs High entropy of concatenated method names: 'MRgCAxFi4pyiELnGYAn', 'nvvt6ZFx48urytFIyEu', 'V7CN25F7xjQSMBm62dY', 'zcY5f8FhxUIJnQSgLau', 'CGxnukNhs0', 'jKTsB2FOLu9vlOFcoXU', 'Rd51GUFsH99JSIdQUcR', 'f8isuFFaWqiVph4x7jh', 'tP9jD3F6bVHgg2ns9Xo', 'CpYGL2FCKGc1iJhxjwT'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, F0eFFnmKkJZhn55Zvys.cs High entropy of concatenated method names: 'zNeO7uiZah', 'xlVOxdPnu0', 'YRfOkdbvSo', 'yy1OJdNcbb', 'prOOWxRapI', 'QnIOYWhyod', 'kr6ODxE7YT', 'I0d9jtb7omcYokV1kK7', 'B5LCmhbq3HNpY8sPkpn', 'WQNgy5b8HNeTWQUwVMM'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, FvUSi00RJHkOioJSRTM.cs High entropy of concatenated method names: 'smGvVcSBap', '_1kO', '_9v4', '_294', 'RXJvTraoO5', 'euj', 'WauvoYrLC6', 'h42vc2ksyy', 'o87', 'fuevIo2wnp'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, DcgbdkHCFc0nwgXcgUH.cs High entropy of concatenated method names: 'q4Y', '_71O', '_6H6', 'Gn6cTMG0CU', '_13H', 'I64', '_67a', '_71t', 'fEj', '_9OJ'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, NpkSvBO9tY9bafnVL2t.cs High entropy of concatenated method names: 'SPWpBWnPcB', 'Jh2pRguhaI', 'Sv2pgbABwJ', 'qTU82A0FbwDfCL1Q6B3', 'YuroYr0dcv7SHtHEyae', 'Heq4Xp0ppmFHQtY9EHt', 'Mdcw3u0GT78XWXrkYf0', 'vm9AD10wKpsPlisBQnk', 'uBaQAH0lV28IGqeR5qj', 'NQHY4W0osg0soBEe3dk'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, ElUjESmZQO5ijkocpJ4.cs High entropy of concatenated method names: 'sKe4crgbNw', 'cH5Pc3Ewi1NFjX2LPUo', 'HlSjqtEpNoTjFTdWBOT', 'TXkeNDEGPahdMHNL9Mf', 'wVSF6VElXi4QpMAUVGQ', 'SWE6UdEoNH5lfOYrRH0', 'R5046iTwKe', 'uUX4Q41pXb', 'ymM4bmJd4k', 'Cmo4jqWDff'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, Q1DSX900iYSkfVne7XQ.cs High entropy of concatenated method names: 'Qkp', '_72e', 'R26', '_7w6', 'Awi', 'n73', 'cek', 'ro1', '_9j4', '_453'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, UJYcexH1uBfIbSBrvkp.cs High entropy of concatenated method names: 'jdfcy3c5IJ', 'Tr5cHO8dB0', 'Y2Rc0a6ysi', 'nArc4VfmcZ', 'ixdcpk3K6b', 'iRdcKPGlEC', 'Ln3cXQxWYB', 'ey6c35LtKp', 'D87cGocUg4', 'gu1cEvjNIf'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, g80GQCIoZw6kAVuOrs.cs High entropy of concatenated method names: 'at6kUkTKy', 'dMjJde88C', 'jhoWdnCTp', 'JTexFbVDbZuxL7Bmo7Z', 'HYVfafVLTWbaRB4qfMC', 'xtYhbpVZloUUUas7rYY', 'xuR6a1VKYE3YcX79PHC', 'I6b3VwVN2W2IcYANYuI', 'MtGSx6Vnxylf9Jyo7IV', 'd5lXmvVuy8xsxoYbuWK'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, m7BaDMaAjOnUe9lkyjn.cs High entropy of concatenated method names: '_589', 'YZ8', '_491', 'G9C', 'gdPB74gGI7lIZN9LrRR', 'C0jW1YgwTb85ILcADrS', 'PdO8WXglgR9ZwX9XFca', 'YCoLx0go2nbnwxpSv4v', 'cjnjVSgIQ2OHB6Tewli', 'iGE3u6gJNSYywQ7Cr57'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, bmVAxyyP82jM9OnS3v7.cs High entropy of concatenated method names: 'KFrFcDJLdB', 'LgAFhohT3D', 'up5FwDNCDr', 'NqEFuKSPcI', 'UGYFFDabFh', 'BGQF9kMAAY', 'SxYF2EQv6P', 'sKmFNEUr3r', 'TkVF6nmPsn', 'UqWFQoayBs'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, nTLoROOSeJQOKO9eeS1.cs High entropy of concatenated method names: 'oYo', '_1Z5', 'wpqijCj0Ot', 'wNqXyLX2EG', 'qucifYmZbm', 'GgNo698bbSvjUjwOjxe', 'esZke38WIrt9T6gBd01', 'bapDSP8kwsRQPkUu1aQ', 'zuSCoV8X9WSEFK58BJV', 'jIeW1C8Amtcx5TiVf0r'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, N7KjFoahxcgut2HyOQs.cs High entropy of concatenated method names: 'Ai7', 'YZ8', '_56U', 'G9C', 'qp3DpRce0KEe8hh5r0u', 'o26kxxczUyVJ7Al0TQp', 'oiDLu0mR0x4EeWqFcj6', 'knvVLKmVO36ADpI2xPH', 'whLf7bmBbtlyKfaV6ug', 'l9mE7hm9xFbNdxFEQap'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, mGsjrXm5RJSD52pfjgS.cs High entropy of concatenated method names: 'maPmcH1BLO', 'O42mICRSp3', 'MaCmhyE68k', 'BZjkoeP63nGAJjAlDTy', 'IPE3L6PCeAvZOkmci1a', 'PC9tlMPQ4Ejw9IkDKZ1', 'WBucHgPLcxuHC1oUXPK', 'wmWLBGPZ8yTdID9W2YV', 'AACfGlPDFGGaAJjOkbU', 'avIlY4PsxUg3yZZPOVQ'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, UI7bGZm8mCiwUqsNasr.cs High entropy of concatenated method names: 'j3R0pqYeOx', 'U5p0KUr5iQ', 'xQuv5qMJQDIl3JqLJPW', 'O9ivsUMjXqv3VCpfd8P', 'i0urjSMoJfMMMh2k3Ld', 'EV6qryMIStggZaOvQTg', 'MUj02ESQO5', 'RXhd9hERcDnmgbjugWR', 'h3PDHfEVWSnu3a6o7P4', 'QnTNthMekLq3BwB8Yuk'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, XSa8OM0eybbwyS9PrRX.cs High entropy of concatenated method names: 'AE4IbU6Cd0', 'pWmIjhFTly', 'bRxIegy2Id', 'iVBIVGVBVC', 'OXpITFKpHE', 'pH2AQoNfa1CMsPhVcZQ', 'lxRHGIN2Y9a3ADJhOEJ', 'XsZMDJNe1087P1TZoNy', 'aHp9eSNzIrmuMvHIo8q', 'MyccacnRfVNMdFpABIR'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, Q7lAFSm2hb6e6FsTIfS.cs High entropy of concatenated method names: 'YPpOiia9oJ', 'eDoOZJiQiI', 'qE9ueJW4J5qsTBhiuYt', 'rwYpHGWUhjcVhwj1JGW', 'wVuhHmW0e6XD5bhZ8uC', 'HVST7kWrVhCrWfhwUxR', 'CyFmhgWqkD3xdaBYAw3', 'RX8NgGW8NGlSf6sPutt', 'z5h4oQW7XpSo4dTMlX5', 'PBTjrFWh9Pb1fSKfXLX'
Source: 2.3.Modrinth.exe.535873d.1.raw.unpack, EDvKZXaTlB3bbN8yLqC.cs High entropy of concatenated method names: 'kNf', 'YZ8', 'U31', 'G9C', 'HUwKPDcQnxc1TkTp0hw', 'GH1Qc4cLN4PI7xoilKp', 'ewQkK4cZpQhHbvsrt1y', 'Ltb4UfcDc8IZ6lxolJC', 'gNIQugcKFI14TobgOmy', 'IvpYXWcNbk7jnT5CSa9'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, jPaTnia40GWt9Coe6yO.cs High entropy of concatenated method names: '_6H9', 'YZ8', '_66N', 'G9C', 'qiRZHj1J4NC7beQbQXK', 'NgaAbB1jRKel81QpJWU', 'T6ey7G1fXFGx6sK2gk0', 'h71wg212LsMLZtgUVit', 'KBsDg81ebU3E7lQLn0v', 'VwtuWo1zvXQUQqUYKmf'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, pbABwJy3EdEOotFyFtR.cs High entropy of concatenated method names: '_4J6', '_5Di', '_1y5', '_77a', '_1X1', '_7fn', 'OUK', '_8S4', 'wUn', '_447'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, IOnjNpyi3WP4VFBLKh7.cs High entropy of concatenated method names: 'ICU', 'j9U', 'IBK', '_6qM', 'Amn', 'Mc2', 'og6', 'z6i', '_5G6', 'r11'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, Xa39auae6dMXshb8a5I.cs High entropy of concatenated method names: 'gHL', 'YZ8', 'vF9', 'G9C', 'j989Rlc7wue7C4kxZP3', 'MrVhfLchwVuVGlbK3mq', 'Qx15hNcitWqMiMYYMC6', 'rWEiKocxLBfd4PWrD3L', 'W80QoWcv4BUhYpx5AOR', 'V7paBccTwYZ2Dt58cOu'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, oouYjcOoPmjrIkWamvv.cs High entropy of concatenated method names: 'c6YK7Kf2Gg', 'SOMKx0X9Ly', 'SXLe8bqELooqIGhwlyl', 'Hguw4rq4RUUGpVCrGEk', 'GXNnlTqAy9GqD0oJWDj', 'LNeSbTqMpUQnLRW53pk', 's6vqe0qUEhrpgj0aX2s', 'xKf4Rkq0FptPTlScKfK'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, JBFZpRnYyR185c99D9.cs High entropy of concatenated method names: '_52Y', 'YZ8', 'Eg4', 'G9C', 'Sxn8yMZD2', 'uDXe1OB4PeEwZVybgTR', 'HkocfjBUShjtZygTKvA', 'laSPGlB0OhMiZYIYp4M', 'v7ouDOBrASg4eN5Tspd', 'LI4gInBqYFcgGZQWcW1'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, tDUgcN4cgsla2FKvWQI.cs High entropy of concatenated method names: 'ziPnogSufS', 'YkgncXSsLT', 'pJNnIOplt5', 'cspnhe0fAX', 'b8jnddn1a6', 'uaenMagvy0', 'SN6nva4vWE', 'x0gnU37YjL', 'NESnnObaxL', 'VnWn7NCBeH'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, ehi0Ar05rwO3rBy5vDQ.cs High entropy of concatenated method names: 'NnYcrQZwNB', 'rD8cSIqcmm', 'UIlcfceKps', 'gxQcBUYWv1', 'n54cRmT1BQ', 'rkFcgTjThU', '_838', 'vVb', 'g24', '_9oL'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, rhM4tbyHGGaiSwWCOii.cs High entropy of concatenated method names: 'sLyG2v2GjU', 'qhAoA0hEMdjELBiBxbJ', 'ocRb5xh4kvrV7eGyGV2', 'eGvPqqhAVS4fWLdoW6l', 'PQlwgrhM6ONhtoQPoIS', 'w6fXUaf8SK', 'GHAXnDBgDs', 't1UX7D1p5S', 'YykXx5KOQn', 'T97XklAAx5'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, pK4i05auqbqWopsKsKe.cs High entropy of concatenated method names: 'rU3', 'YZ8', 'M54', 'G9C', 'yXMa7tSK73PIWQTFjaa', 'eKydheSNL2Vryrp8Y3b', 'N5Hw6YSncC2leDxBC3T', 'hioR8GSufvAhlwBQFk8', 'e2E9DFSHAPMLmvnqRZg', 'zbIWLDS3QDaxRawpl2y'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, RQkNuuH7giMLOmlQjLZ.cs High entropy of concatenated method names: 'oTAos8IXNY', 'sUNoAqLXkj', 'tfqo1yVqmB', 'cBHoPV4Ya5', 'NBtoCcKSvC', 'lLFoipSwjI', 'h435C2Zp7ldb00nwovG', 'QK1GMjZFEREncwFKIlT', 'P79URJZde3G7PNfjPnd', 'HHDU0oZGvAeX232QQ1E'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, fUGbdqtY2ANHoqXkSw.cs High entropy of concatenated method names: '_468', 'YZ8', '_2M1', 'G9C', 'iHRT2hyMPNtIlRtBXJu', 'leGoNgyEUQZH2sUYRDD', 'JPo0A8y4xcXBbcqsmPy', 'mn19d1yU6jNn2rCUowj', 'yCeHa4y0EMI0gOSeoDc', 'ct4LJnyrh7FKUVKT2BG'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, y0lMUJyhu6CbIcl54jf.cs High entropy of concatenated method names: 'AwGwxihbh3', 'uuFwksYJEj', 'R4SwJF1yE8', 'mS3wW4trZH', 'RWtwY77dlh', 'JKI0Kix4GfJlFBdtFtV', 'yWU9hnxMUjeNs2t77dR', 'a4pKEHxEPMbm0bdUJNv', 'QECyJ7xUfw5TpSb8w0f', 'TBJYgEx0Ky5ErpBRgOn'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, AAlQZwiJL5Xr5eGvBm.cs High entropy of concatenated method names: '_52U', 'YZ8', 'M5A', 'G9C', 'oYjvQttIPcTGSksMQXP', 'eRnb4OtJwwTItDbVxt9', 'WOqjnotj19SGc3Nncbd', 'HK5sT0tfE4HDbyITp84', 'Vdisfmt2jxT8PVUTo8p', 'YB7HEQteEnAmC5RTf2f'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, e2g5aG0crcxKeJBRoyR.cs High entropy of concatenated method names: '_7tu', '_8ge', 'DyU', '_58f', '_254', '_6Q3', '_7f4', 'B3I', '_75k', 'd4G'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, X2icxDaO12aiUd80oHk.cs High entropy of concatenated method names: 'R1x', 'YZ8', '_8U7', 'G9C', 'g19bRf1OghoyYMl3X4u', 'E7If4P1s5jpLRphRyLW', 'sMRaUp1a3viAxylWWqj', 'UC9C3516Ecu1eRm1knu', 'J8Agea1CM26Sy5umLeD', 'SeEaUk1Qa4gw3Ssd7LB'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, yerTdRy2onVId7aJ1TB.cs High entropy of concatenated method names: 'Jf3EyBHhZ8', 'bUqEHjjnLH', 'zT3E0GCpqG', 'HcCSKUiAGIqNf63wOKD', 'u2xGW6iMUsWMDVJcemg', 'DW37SrikmEKno1X3ibR', 'CCaUNDiXkjk9gqZlpb5', 'eTjEj0iEx1GhTB0b2Ox', 'pueZHwi4Ysifju4XUbq', 'i33LCiiU3BIEJF8h3a1'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, jvGrunOatM8gGptbr4c.cs High entropy of concatenated method names: 'R3j4vfIKmq', 'nCE4UtyXAs', 'HMd4nWbTxb', 'FPx47epZ0M', 'tGqroEEzHXCOZD1xYfj', 'CZIedaE2oEpXtC2tuY1', 'UG5o6sEelNpYrdQ8JFF', 'NeKsPr4RcA7lIOFbV9p', 'Eq5gEr4VbK3nCyjGgrx', 'wGhBMZ4BUoLfiMdhaR8'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, MNuq87gYHUa13y8H92.cs High entropy of concatenated method names: '_8Ok', 'YZ8', 'InF', 'G9C', 'NsFhvgtkaB3brEOQFho', 'aP8GcMtXp1eu6UWHknn', 'Hdt0g3tAoMFLaWwM1Fe', 'kQO2jhtMiCEMsS5Ibgt', 'vScu6atEFEHTbgboLUu', 'msDh3dt4HGJNTg8surA'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, z3DOHTyA3lEDNf5oxRY.cs High entropy of concatenated method names: 'pwKuiLyPlf', 'RtFukTjeBp', 'CfyuJiXGq3', 'orAuWva9E9', 'p7vuYXwNFQ', 'kKDuDEK5ZT', 'd2eu8rcYG5', 'JHEuL3sWFf', 'Kq4uqVaRD0', 'e6aul2fgS1'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, cmTkICaBFHJIm7DYxk5.cs High entropy of concatenated method names: '_625', 'YZ8', '_9pX', 'G9C', 'KEXML9g0xdgt3JH0P67', 'V7u8UfgrsPd6n0KOHBu', 'o40BqxgqAx08MiHXTtw', 'EvAKO1g8PoIwBxJAZss', 'oLEtkRg76K7qAgcCpP1', 'NfipMKghPvtvW5fDUNS'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, HnHswkOq2f1bZvlIekv.cs High entropy of concatenated method names: 'sg9', 'N8Kiq7RbuL', 'UNWKig7xpH', 'IT5i5epuAY', 'p7RnZSqpbJC5u1vFBXF', 'sZtd01qGndaWaCmjAR5', 'T5UGP0qwbXlAiYXt0Fr', 'KFhvHqqF5xwTGeWDU3d', 'At780Aqdjm2kedojLRC', 'Ac4hjcqlZZsww5HCNOS'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, QWFNpB8gAYSNtrLHBq.cs High entropy of concatenated method names: '_23T', 'YZ8', 'ELp', 'G9C', 'hge4Hn9jcfFpcbPRemt', 'hdifgZ9fZXWm7mSPrYx', 'KvelKy92i2mxEyJZdaP', 'ttGQSi9eMie00EKIu3R', 'AQAxXl9z511kcCWXNa3', 'yq1DJxyRtftRKrfYVjE'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, CZ9h0Z44gkQdFuZ5VE.cs High entropy of concatenated method names: 'oh0wZ4gkQ', 'Mx4mnx69Td7sIJMHYw', 'yyC5NXsX2MM4yfy0Em', 'Bc3wteajJed89ml85x', 'OOxNPnCv9abwcEhbbi', 'AhYiDIQirO5wKRJP1b', 'P09m50WD2', 'B0TOGdG7k', 'tqOyJt0pb', 'su7HLnDU4'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, tRhiRJagZIFjUJYiZPp.cs High entropy of concatenated method names: '_7v4', 'YZ8', '_888', 'G9C', 'm5e1Nwga0WBFGURebZO', 'IADl1rg6AyOyIUux4Uh', 'yL0qw6gCo3PqysfdaAI', 'DV2J38gQgvPAxDOC81A', 'kbHt9PgLpDQp1AutwXs', 'YRC4uBgZQHnonYQqwug'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, SvlhDembYGB4JLGRZLG.cs High entropy of concatenated method names: 'GchywuGsjr', 'jRJyuSD52p', 'jYbksuk7Dm1uTtVCUdw', 'SumgaMkhaXWpg4HyjXc', 'Yuo9ItkqXD6UhZ1ZO87', 'Quo860k8WxGwMdrr30Q', 'wbhQaTkiiUipmNgCQCg', 'ub6NAVkxAnYYK2iiDPJ', 'QaNiBnkvHq7nS9W8mcQ', 'AUvIyXkTtV3P1CtOONK'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, eRlfJjaMeelFTnNKSmO.cs High entropy of concatenated method names: 'GvP', 'YZ8', 'bp6', 'G9C', 'NHx2qCmLkDJ91FhbHUb', 'KWeSu3mZVwXDtjk5Z8D', 'dVgFxymD3Omt2Wfc4JF', 'lUYBcmmKyC09mLfEOIL', 'YWqDtbmNRsOPOsPKtrQ', 'xDgPDImnhjDTpppYFrN'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, ytAGk70tUHyr5NrLm62.cs High entropy of concatenated method names: 'PJ1', 'jo3', 'xQZvKPiuGy', 'xLKvXNx8io', 'ztJv3qvMX3', 'EC9', '_74a', '_8pl', '_27D', '_524'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, ykDh1E0TlnGsWgq8ULC.cs High entropy of concatenated method names: 'IGD', 'CV5', 'g38IoykCX7', '_3k4', 'elq', 'hlH', 'yc1', 'Y17', '_2QC', 'En1'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, fs2AfazSVDW7SCGUm1.cs High entropy of concatenated method names: 'Y29', 'YZ8', 'jn6', 'G9C', 'rSegpO19WmYBgYWa8y1', 'eUkcAM1y8atp0V0YYev', 'gjvVNf1tjdP2mZH1pi0', 'Iwa7IA119oEPixVRZId', 'xARb6y1Sfwg9BLgZXZC', 'b8SvsS1cRoGxDPcxHnY'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, E5uGIwHkQFsVkfeDTuX.cs High entropy of concatenated method names: 'xN2c5d5cJa', 'qGqxvKZfO3eUpywdyds', 'miFIcIZJf97c2D5Yqae', 'hT6wCGZjWyuJoT5W10i', 'BNt3KiZ2OmODTP6q8cX', 'xksA2rZe9YPohUkYs86', 'L2t3MmZzVib2E4IkTtB'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, yrHKr0xBqBdvKUoEED.cs High entropy of concatenated method names: 'g25', 'YZ8', '_23T', 'G9C', 'S1rlnp3H2', 'mPTIwVBQLa7BOeDYVJu', 'A4B0yxBLGknoR9H0g9N', 'HVZTt5BZ4MkZmo6yInu', 'Jm68hdBDWjGFvhLc0O0', 'D9KGgHBKYkRh0ouVc1T'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, BrJmY0aS531i1G0qfyk.cs High entropy of concatenated method names: 'NWWm3FRQqd', 'frBmG9X1di', 'qRf3EcgP3TnDROfqf4l', 'w9fXplgYc0tt5YnSTym', 'CV7YlqggfTegsd1ybdN', 'xNDdyrg5xKOO04V3jm3', 'qAZWcWgbk612FwleRsP', 'aZeJQfgWUqtpa1CqqbH', 'OO6VFxgkJtugH6cqca3', 'W1BcHVgX0YZlPECBvoG'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, yaoNBCa9ypqycarcC13.cs High entropy of concatenated method names: '_981', 'YZ8', 'd52', 'G9C', 'qeRhjeSouDRj7d344vv', 'PCxu8OSIs2QAZk61yXR', 'Y3uIUxSJnEvMnRpVedJ', 'HvR1r8SjsK57hN8S4Zd', 'QYHkJMSff1BBMMC1w53', 'sQaXmsS2s0GaQncqLvP'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, FDvseqmkwBUjoNZgqp1.cs High entropy of concatenated method names: 'WxDHvvseqw', 'St8IM7A23JCRe0rsrLi', 'c26PTNAewe14xnKVkdn', 'FVpwHyAjUVQoeZkQUVi', 'SD9gYXAfFkPfhZxaqCZ', 'qUj2PEAzUxxpyHZMyNR', 'Dgls7IMRjUahQNCm8cm', 'fXvxFvMVBSqEwgtp0ou', 'wgFTtaMB2FBe470YNah', 'jjBGAiM9fKGxJdPirpf'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, YhPX2JAttI8RINZnZ6.cs High entropy of concatenated method names: 'pHw', 'YZ8', 'v2R', 'G9C', 'jNSUqItvKNC8AyXuLYr', 'Ps6lrmtT0G1kKwkLeTG', 'fc2CVjtO3Ly9VOg5bWH', 'CcOhmXtsr38aG1I9v3o', 'LN8umPtaOo3Hu5PTj6e', 'WIZu7Yt65lmQsU9DKm5'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, EnWxliak2oQYuupnive.cs High entropy of concatenated method names: 'RINaAZnZ6J', 'j0OoPVY7sWCt0Op67E3', 'YtpMQgYhlVBVmfna1F9', 'tIWo9uYqjdwQPFxjeR4', 'NU1l4lY8WJolHJLlksK', 'eCYPjwYiOTj8yfSTw0U', 'QLw', 'YZ8', 'cC5', 'G9C'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, C67BguOzdiiqsGeSaeQ.cs High entropy of concatenated method names: 'VlYXdOnjNp', 'jWPXM4VFBL', 'ih7Xv5phaG', 'LLe4i27nDEKRwIkeKYi', 'Eh6GLF7uq0APNlbQKtq', 'heuedR7KPidt6DB950u', 'CLEk1D7Na0MhS16cyFW', 'JdJWu67HnoFJVyiIkrA', 'LhIi0D73o3mCKyrrIja', 'nwpMhx7FANl9r1I4uG1'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, M4vNYNy66wGjtdSM6po.cs High entropy of concatenated method names: '_7zt', 'SHMEQaZ6pc', 'YVnEbHRquP', 'FRVEjUQ7wb', 'GwXEeTEhyi', 'at3EVXhLJx', 'N12ETsQf8q', 'g4El5ViqUHHNfTKu9rC', 'BYvnqSi8R30Wqc5KgIE', 'yxnbPKi0JpbTm2Ej1BW'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, JfrKuFHsZNtOqvNM0Co.cs High entropy of concatenated method names: '_14Y', 'b41', 'D7Y', 'xMq', 'i39', '_77u', '_4PG', '_5u8', 'h12', '_2KT'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, GHVcie0MmULaONBty73.cs High entropy of concatenated method names: 'drPhK2oeh9', 'f0whXa7HO7', 'HXqh3kWLDS', '_3Gf', '_4XH', '_3mv', '_684', '_555', 'Z9E', 'OSJhGkR4o6'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, ew63JKY1CiMnZfNPEn.cs High entropy of concatenated method names: '_59M', 'YZ8', '_1zA', 'G9C', 'rUyiKw9LHX04khhKqLV', 't24dAX9ZEP9tm0F4d3h', 'kADClD9D1Oex0EYsvTw', 'mAZ8aY9KvR1Ij9Uyrms', 'EGhhC69Nx0CVGNl0HJl', 'dVNrSO9n2dnKyWRtC7O'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, NF7WLlStdWsFXqpjDt.cs High entropy of concatenated method names: 'P37', 'YZ8', 'b2I', 'G9C', 'xKtxSryHNnDiGIhx6tH', 'MvTmDHy3cutBvobUIP9', 'wljgs4yFOYPj2LwL5Sf', 'BD8MRcyd5alIKkcqqUa', 'VAkYVjyp2vSbdbDj9Yq', 'CiSn4FyGxVhYsZxScB3'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, vgYy0ZHhWOfM3iUXUdx.cs High entropy of concatenated method names: 'PYjoDHxRFg', 'XTUo8qvjdn', 'UdfoL3gj3B', 'gywoqbXJ6s', 'mlEoleZbc5', 'bJFh0lZv5pBvbGX5dBq', 'tkeYDZZiwHQD5vWauGc', 'gpQl8aZxGMg1WZH1CrH', 'FWtZ9OZTMged2nsXsto', 'oPccTxZOCNULG9FME52'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, kX3SxSaNFlKodglsQL1.cs High entropy of concatenated method names: 'yiQ', 'YZ8', '_5li', 'G9C', 'lI1tdScRjyknXlbLW1m', 'oKsRDocV5LNgul2X0KA', 'lt1jnScBKsRC8Nfg6It', 'TvNWblc9c5yIcGH94rV', 'XqsZy3cyN3AyZ6txeNP', 'adbgGXctwlbdO9Ugupx'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, baYrhAOQ8tHFrFkoH4H.cs High entropy of concatenated method names: 'CiNKFiO8FK', 'xZgK96DO1c', 'RjQK2LE0w8', 'tND0DBrHltVjjKYKdCe', 'ghgLrtrnJeB0f4sS6vO', 'c38qq6ruL1fuCgusPdT', 'nwZayGr3TddHFk1Rnly', 'xIeK0rTdRo', 'DVIK4d7aJ1', 'wBKKpo6cLL'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, v9DMJtmYa3lXTywSQqC.cs High entropy of concatenated method names: '_0023Nn', 'Dispose', 'NJBHkb5VoW', 'drcHJYV9DM', 'HtaHW3lXTy', 'mSQHYqCqgS', 'KRxHDZyyf3', 'MxPLq0MmpeysG6LXpof', 'AZG42qMYQKISnC3KbJY', 'tlxPZpMS1lUXJDePvYc'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, vyhBvyaHPjk7CA5wG1Q.cs High entropy of concatenated method names: 'K55', 'YZ8', '_9yX', 'G9C', 'nkeGRa1FO2XxXJRT2Q9', 'O22XSK1dNfOPEdicV67', 'SL2iNv1pQHWQUMDiFEg', 'PAnwcD1GC700Srkitny', 'cCxnGf1wx6gwO2k72MR', 'Em9lK81lfAdY7g0cfBJ'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, MaCyE6a38kLsjZ1UZds.cs High entropy of concatenated method names: '_6U6', 'YZ8', '_694', 'G9C', 'gpl5PGS4dhtmSp0Cm5b', 'wTmR06SUtjrqKSoMyU4', 'KrrfRDS0Z02ssLHWZIc', 'e4jg4TSr1pkU8WEB6gY', 'bVNHQmSqM5RtbfD0Qdm', 'I9W67xS85TW8U01JdUM'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, RLQ2DGOP2FD3T9fiYdo.cs High entropy of concatenated method names: 'MqcSHp7Z6bECoP6UoQc', 'rdCRrw7D0uNR34MqcI5', 'LKNnUi7Q5Hugbl3p1Sw', 'g9MZ687L9O381PG3QRF', 'IWF', 'j72', 'ksfX20TaR6', 'MIUXNy3OiI', 'j4z', 'mxqX6hmpQ3'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, PEqsn9aKWioLWYZHsBj.cs High entropy of concatenated method names: '_3fO', 'YZ8', '_48A', 'G9C', 'KAiZYlSSSQVyWP9wB9L', 'fug0c5Scc1o9dfaZSxp', 'NMhLOrSmIhklHwPyita', 'c08IRaSYLYFY6PDZrkg', 'zni4WlSg1brAxnW98nE', 'CMG9BBSPCluv41QqZ0N'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, mL9cTBaZSquppO1akcG.cs High entropy of concatenated method names: 'ud6mVhQxSE', 'MsnmT9WioL', 'HYZmoHsBjj', 'V3GtiXPgo565QutZbjY', 'FlODb3PmEImQ9h71pXw', 'lXq8ESPYCpN8PgHRmTk', 'b2YeoxPPljIKyPoVH6H', 'RZ8GYpP5SoybBmSb4uD', 'cI9FToPbgQe82OnSrS1', 'xcGbbnPWoP4U0Rlg3jT'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, wyCUFMaQHEmu8qswV5Q.cs High entropy of concatenated method names: 'fnTavNVQCc', 'ai8vX6cMoAFYPJSBkr4', 'f9dnmbcEdKqrpiBMSTf', 'wL9QO1cXO8CKEjomobY', 'vkQ6nPcAj95qbZy6EkL', 'Cuywsmc40caFf0qYhVO', 'C3qqNucU31X92GAIdCL', 'UpLw2mc0949FQJXuAoO', 'FZpAsFcr4D7frrBFvUq', 'f28'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, KaS3y4aYEAMPTdqr0TA.cs High entropy of concatenated method names: 'itEainiSbu', 'Ap3rI1YZu2xrGVane0q', 'KvtmEZYDpJxp4gTDYfA', 'X2r83mYQhdGvsG6osKd', 'g0ln4oYL98PI3iNe1FK', 'yrwi9kYKvRFdM3Yndpn', '_3Xh', 'YZ8', '_123', 'G9C'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, SRkpZtaaM4SieWmC3h4.cs High entropy of concatenated method names: 'tO4', 'YZ8', '_4kf', 'G9C', 'd4rI6m14iaNIksLMZ65', 'YV0Gw31UPLZvFqxbgB4', 'XOZdXm102gXeOrgySWB', 'kWHnXp1rCicHwhBQ4TA', 'Je4lSd1qJXGgF8uXa4u', 'UgPKmY18ieIlvpEFF7U'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, L8EfPg0haMlLQNup7b9.cs High entropy of concatenated method names: 'D4M', '_4DP', 'HU2', '_4Ke', '_5C9', '_7b1', 'lV5', 'H7p', 'V5L', '_736'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, bX9w0bBJDIlXEvLJx8.cs High entropy of concatenated method names: 'kcq', 'YZ8', '_4bQ', 'G9C', 'IA2Jjbt1xLDSIbX0bCN', 'M3j6HAtSXUmVpTXTXGm', 'bPGxSxtc8Y6DdOPU5j3', 'ESeTQUtmEr3bUVbSHpB', 'tbDR0ytYp0aMnqJjjDV', 'z0Z1ohtgPJw6EgHfioj'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, Hg3fDXOgZ4C6FtCmS9i.cs High entropy of concatenated method names: '_3VT', 'O5t', '_1W5', 'LAIX39whE8', 'JyQiT5gvR2', 'zi9XGSY4pR', 'rRBi4Zstgp', 'QJQxYM8DV41vwOmoquS', 'lEQb538KyanmJqKm2k0', 'QZe26Q8LAouw6coabIs'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, OsXtcKyRbxwwJZHGsf0.cs High entropy of concatenated method names: 'P29', '_3xW', 'bOP', 'Th1', '_36d', 'fV6uFecuOf', 'buFu9Qw4UZ', 'r8j', 'LS1', '_55S'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, rO2Y6bacTwUsbIPi24J.cs High entropy of concatenated method names: 'p23', 'YZ8', 'Gog', 'G9C', 'ufp5QrcddsE1UIlZtpc', 'WM5fWecpel11vG8QaUq', 'sDB3hbcGK9AonxIR5Bq', 'y7UeCUcw7H7vMV1oAEv', 'JH3Oc8clsIR2gWxM6Uo', 'jgiccfcoQea6IBhJLdQ'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, TaKxNgOXDfBWl81LOax.cs High entropy of concatenated method names: 'pTRpxmnNIK', 'FxYpk5gPKf', 'lYDpJ10n2b', 'AYRfVA0W8ammCPn7GKT', 'Uc21rq05iV9GCGf9EVK', 'oAC6rt0bK0bEshlmwE9', 'U6jTxu0kPSjlVRnJHPD', 'GR4pFtt7pw', 's3Pp9NacnT', 'tMjp2j4gE1'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, kLA8y1mVcMRImFWnmng.cs High entropy of concatenated method names: 'm6LyjpWKUF', 'NuayeNEDQh', 'XhbyV21ITj', 'rd5yThaVXZ', 'okpyoJpS4x', 'NWo5iFXR82g46VsHukt', 'A3Y7eDXVs8oByOl34wx', 'wDwv9kkeP1d3FT0D9A2', 'LNGIy4kz6ZQy3L7tjv7', 'nKrboJXBulg9rKCMlAV'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, nqCPI9dVxN5OIosCd7.cs High entropy of concatenated method names: 'T43', 'YZ8', '_56i', 'G9C', 'QNN94RBg1PEgosgpIkJ', 'rYjVTABPOh2MQdgcAWr', 'wWwWVKB5su0siEkdcsY', 'aTXOJGBbVM7d9H1Lm7n', 'DwbSPOBWxypuy4CERHR', 'G04Bv7BkTEjf8hFAM5S'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, Vya3o7mMxMRGofdtKUY.cs High entropy of concatenated method names: 'A5RyiQ7rTL', 'WeNyZWqc9K', 'ngvyzlhDeY', 'kB4H5JLGRZ', 'KGLHaipbiy', 'z9qHmn2rKx', 'lNBHOu44NY', 'r30HyagcWw', 'pGqHH3GLA8', 'BEdd61XJt37t5RZs2yC'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, KgoQdKyKgVx0akKguJg.cs High entropy of concatenated method names: 'uxk', 'q7W', '_327', '_958', '_4Oz', 'r6z', 'r7o', 'Z83', 'L5N', 'VTw'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, PxCKSfOySaLxpLpoytV.cs High entropy of concatenated method names: 'sCe4q1MEHm', 'MPC4lnxNvV', 'OLi4tglObG', 'wxy4rs8D24', 'H0I4S0u7Qa', 'nL14f9ZbNP', 'UDuKPU4Tia8JTDsuTHH', 'i7oyp24xERpin35sxo1', 'VEPWFG4vIfDmILBS7ny', 'ih069p4OwcASXCGAPH0'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, DEFqEoHO3EXg98RHjG8.cs High entropy of concatenated method names: 'jscVM76qjJq7a2ft9kP', 'rL9fPj68DHa8B5Z9P8E', 'pbEiDF60BQf0JcmuwnX', 'nPdaM76rNFTAbGHGZNi', 'sDbbol6Eun', 'ChN8en6i6L4IbHCDtfd', 'VtYmM96x2BNWZLqARdl', 'eXdW8167CHoVO0mQ6uo', 'GP76aa6hM3T473ARWBD', 'rvCWsi6vFQxU6LSq5Vy'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, utPAkW0xy6H38Tx3NjC.cs High entropy of concatenated method names: 'gvyYVhHy8yGKv5oUMfl', 'HxiZVgHtwQ5Na7kYrTP', 'VjxV44HBjEUcpNBUAjG', 'NrsX4cH9lLknBnvEJWj', 'lwEhkxsDJ0', 'WM4', '_499', 'c4ZhJgrCT1', 'XK5hWs4haF', 'ViYhYDkEM0'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, dIpulgaU5g1UcsrHg2Q.cs High entropy of concatenated method names: 't0LarVcZPr', 'Imo2AeYBBg2Hl1kMJuH', 'KweZO9Y9MHIAmLsTFCL', 'redkf7YRn7dv5i4TBWe', 'IhiVGDYVp6DgiIBqwVZ', 'pFegUrYyfCNbGxFweib', 'krpbxdYtGHGbPZ9Wrsf', 'Lxmn7LY1RWLjQDCsieO', 'K7YafHUa13', 'MYoIrJYmYsOlsQXJq5g'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, glfv8ZHUu9FCFGLp7rB.cs High entropy of concatenated method names: 'TeaofdA7X7', 'AdGoBw3Jhu', 'iQLoRcY5Ne', 'mog8k5ZNmbts9UpBcbb', 'nvBcxiZDpkW9HF7eu5R', 'HrNn2XZKb508H8Xi86t', 'vUTon9ZnslskPYjxLJN', 'Yt9xJKZuEMfRrp5mMmw', 'osfs6mZHFI6088JeJhF', 'GF13QdZ3whJ4TghhTWm'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, orwOpDaPaoTgDmQFEy5.cs High entropy of concatenated method names: 'rJpmQD3PaT', 'R3FdJaP12mLQ68x4qyh', 'sObiwQPSTVTMZa35lXJ', 'VYTLeKPyXQedNTEcPr5', 'Luh5oRPt0XpKs240TkF', 'QSDr61PcynprHKTwwax', '_5q7', 'YZ8', '_6kf', 'G9C'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, YhLwvym6LwQWlEBpj5Y.cs High entropy of concatenated method names: 'aDyOzKw7Ba', 'JMjy5OnUe9', 'Mkyyajn78g', 'rXyymkvuQV', 'OUVyOoCm9r', 'mOpyyDaoTg', 'JmQyHFEy5K', 'buVy0ZhsC3', 'soIy43LLco', 'dk2ypAnT8f'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, fFxHrbatjrKUNEfYCKY.cs High entropy of concatenated method names: '_2WU', 'YZ8', '_743', 'G9C', 'Nflfxtg15lvox6r89tq', 'pKBhIFgSJBRea5bsUpN', 'zgP4kogcxecZ4TyiVVB', 'MhFYLjgmBZfXYDkn3KV', 'foakW2gyFrwDwyWuZqE', 'HcnaEggtw4tQkesxXX6'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, NBqX6CJFHtfbQMZZ8o.cs High entropy of concatenated method names: '_3OK', 'YZ8', '_321', 'G9C', 'DX27qkB2dMIAcD1AZxy', 'YujAKABeVIUfsTJapBe', 'qwf4geBzTCt1UCJBQtr', 'GGta0w9Rfc6tkVjYhN4', 'YndEQA9VvMZa0l3kTxr', 'bwgap19B5N6IC18OgLN'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, eOSJpoOugwvd9aGR6iX.cs High entropy of concatenated method names: 'm74plXt0gi', 'xUxptxcDoP', 'UXnprqq1Gb', 'KgopSQdKgV', 'VEyX0i0CA3b3YO8FvBY', 'tZ3d760Qp8ybkys0QyJ', 'FYLmUo0L7TXCCk4sQPH', 'EYpyt30apGaaeEIhDDd', 'RvcOIu06anRGTqwNcd4', 'JlNWnl0ZBQH458SR9Wh'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, YALnWc43BrrHpS0V6ec.cs High entropy of concatenated method names: 'b2dVhUGGMv64J', 'WaiudAFkuOAiG56wefZ', 'm7rqqXFX9jbmrbHmaOg', 'OsdAvcFAXHqCY52f8gn', 'RIEq0KFMFG7TcXY3XGK', 'Cp3sXWFEhaq5HyBV7FZ', 'HRPLI6FboN9Un9xInEr', 'LcNgqhFW3V8Z31eC5Um', 'qYIphbF4hbtgilv179Z', 'oIsIg9FUWbidxAviGFV'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, UU6wmkHZx02O6yEbYXQ.cs High entropy of concatenated method names: 'b4FcdEtf29', 'pyJcM2mAQ6', 'F8e', 'bLw', 'U96', '_71a', 'O52', 'njNcvbRgxw', '_5f9', 'A6Y'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, WtocynOE4HM1UXIeqYv.cs High entropy of concatenated method names: '_223', 'FuSWGZ0MDgsCPuE6NwF', 'NjxZ3C0ED9GoxAjLVew', 'rKBrgR049RpIt0Q3p8W', 'G8smNl0Uk2Kh9wcISBD', 'oWvKHb009IqvWCDSkFB', 'fA5gBd0rP1E2oyvC0TC', 'nwUGTC0qG1IITmJnXLi', 'pM1f3Y08BOfcDiB2KHp', 'n8W7c807tUYv8q0NcYV'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, yWXVOLaEihJpxi07oeZ.cs High entropy of concatenated method names: 'd43', 'YZ8', 'g67', 'G9C', 'V7rYeqSxKJHohg3NSay', 'pUWmtNSvweZLHMoUo4B', 'bZRxPFSTYaVtW2NievR', 'beeufZSO3wPdYZMftJf', 'p8QDSsSsYKCjxTHRdy6', 'O2byxlSascFZksOACPL'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, TWb4LZOBL50f61GxnNM.cs High entropy of concatenated method names: '_9YY', '_57I', 'w51', 'FWiise77cI', '_168', 'XrOcEB8hWPN3P1UBWwn', 'DaOStH8iWDJ4m7mFmvT', 'VXZHOy8xPfw4SHf7D6J', 'kAX5Sn8vbxOwdj7I7MX', 'LDvZMb8TNSyYuBRVhdt'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, LbrI1XyoMBocJMtW8Bv.cs High entropy of concatenated method names: '_45b', 'ne2', '_115', '_3vY', 'utPw5AkWy6', '_3il', 'e38waTx3Nj', 'WjWwm4NAml', '_78N', 'z3K'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, witIrrOeJfEY3X4fvZx.cs High entropy of concatenated method names: '_525', 'L97', '_3t2', 'UL2', '_6V2', '_968', 'BSkepvqbK3GSj2nPrmt', 'fU8ZcdqWF4bDfHFHlYC', 'G5ZgZLqkku0r4hJLKOh', 'PXMmX9qXsV3NtNh5EfB'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, RfdbvSaLoIy1dNcbb2r.cs High entropy of concatenated method names: 'HL5maXr5eG', 'CBmmms4eDF', 'gZ7mOuZXBc', 'ao72W0YlvBFMhFu058h', 'g9uaL0Yop3KqqRROnyu', 'lc5i6rYGLtmW8ZS9ygB', 'Gb1EpVYw1XY0EqaZTa5', 'I4q6fmYID85aY6jO7wN', 'jMcx8nYJwbbeIiPqBgm', 'kkBSsqYjtgyR2CbbEw4'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, nKcZg6yjDO1cBjQLE0w.cs High entropy of concatenated method names: 'AuCExGiaIN', 'gBNEk6LIkD', 'z1EEJlnGsW', 'Sq8EWULCIX', 'EVdEYFBOh5', 'NRgSk4iQa8ShiTlDlyK', 'nPTwgeiLiwjNf3XBMYh', 'JTLAIii6PVyuhfy3nBA', 'BjZMWdiCC63sCJqAo8J', 'FQGfmWiZPYR41ByLIij'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, YxqOp7HKUf5bZiEKh3m.cs High entropy of concatenated method names: 'LF9obERRb9', 'MDxojQ5177', 'hPPtqMLIBQqA4XjUBFU', 'zXHWliLJaik9PvWYo3p', 'k6Vk2hLj8I617oPooFl', 'A0I0ORLfe0SS8949wJS', 'kyyoI6L26k5p6xPyBVM', 'SCRY63LeUKIAq36JUbo', 'sRKIOPLzAYWj03jLPAJ', 't9BAnEZRAAxe95vKYWu'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, KPDfjZHDMSnPD80LDYG.cs High entropy of concatenated method names: 'p9aNNrDtaTqCw6Emk1j', 'F4NuXyD1l2HDeRgKQc3', 'i1JhVcD9Xq02fZw6Lxk', 'OGVpMiDy8cA8UQSaG9b', 'hlhYMNDS60qjTM3pbfV', 'VOv7OXDc8qSnZxCqZCD', 'svZlKIDmPmkolxXPihd'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, gmfFAC0n9eeVHmNq55q.cs High entropy of concatenated method names: '_159', 'rI9', '_2Cj', 'eyQhcgqUlt', 'ynhhIUohH2', 'ANohhjmeho', 'fNbhdNkLhf', 'FWthMHB0hp', 'ovZhvfn9hM', 'YMsVP7uZDPd5q5ge15u'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, NrBQqL0muUynIESFV4h.cs High entropy of concatenated method names: 'kIBIpa6MVZ', 'UxaIKobBS5', '_8r1', 'ETlIXMo886', 'YsFI376bse', 'YcrIGJaCfF', 'NNwIERdUBF', 'xE4Wd3NXsFPavFUuxDO', 'SwXVTgNA1CmuMGo64XR', 'NATAFpNMDHHPOQqcWuL'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, zNlUbFyECpnsDpnJtoP.cs High entropy of concatenated method names: 'cCGGJSfRGU', 'A05GW6fdte', 'bAUGY6wmkx', 'f2OGD6yEbY', 'jQtG8FmnOk', 'SV0cSsheJ0yBxP3Z2fk', 'Y3qakrhz6V3Gtxx5LRy', 'y5tf5Ihfjer2oFZW3cl', 'ELxxgkh2iajYoI40LvW', 'b3fkpdiR1nAFZtEsDVU'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, TxHpok0WIWWuOnlBj9g.cs High entropy of concatenated method names: 'jIUMYZrbmI', 'EitgGaHO3SEQ6d0WBIB', 'X7uRpxHsZahVupv7y6K', 'NlPEjJHvg6Wydo9uK71', 'YDPdTMHT6STPtERAPEo', '_1fi', 'LFTdgGRDVE', '_676', 'IG9', 'mdP'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, FmPsOgOtd5qLIYhhe3w.cs High entropy of concatenated method names: '_5u9', 'm7jiQMTEPE', 'ERyX5XJw5K', 'xuhiX6tqqW', 'fCo4c2qfYEjW4xvmUe0', 'gbalstq2C1PpsOJGVqL', 'SZ3Itbqeeu4KsR2QGxU', 'wgv0OgqJ3X3XdPjGRsH', 'Rh3D5RqjNt1YeJFWFWt', 'RSmb3cqzK11qT9ma3TA'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, cGiDMSHMR5aXM1HiXTP.cs High entropy of concatenated method names: 'POLotFP4d2', 'tXJorFmOnU', 'UVkoSi3xNH', 'O7s3T4ZQEVTrFSs4FNx', 'D9a9AjZ6BDBvAktvfW2', 'NFRXcTZCeq7VSL07nag', 'fvPaQAZLLJt680FGnkq', 'cZi3gXZZ7QJ4I6wKRrC'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, ON9Op5V44kY31YT7TY.cs High entropy of concatenated method names: 'd8Do34deK', 'kcicwLPuT', 'h2IIjvF1m', 'f0QhsXdLq', 'XvjdPF3cC', 'gZHMQdWYG', 'cN3vZ92YA', 'sVD7NdVcQ3hACyWBW0P', 'IUTWF2VmrNogHVbqjV5', 'cn4U5hVYvvvyXkSqfuo'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, A7BSYvmmbAiq4yifMWR.cs High entropy of concatenated method names: 'w7tmfCNdan', 'SATmByCUFM', 'eEmmRu8qsw', 'v5Qmgn3Pbm', 'YPTmslcniL', 'HSimAx6T5D', 'XKOStg5Mr2KFxvjplEL', 'fbUYEy5Eqm86guYdLdj', 'GXKlOF5XrIbukJTSRcj', 'yPylT35AZiei5V9u2bp'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, yUoUwXONflodC6d2xoh.cs High entropy of concatenated method names: 'ldEpsOotFy', 'ntRpAmw0pp', 'gN3p1bv84U', 'TmWpPChNlU', 'sFCpCpnsDp', 'vIeHwTr1Fi5hwoc6hBw', 'jgKk1QrSVJdAidURM1f', 'fb5bWRryY0KiJ315OH7', 'KK4mbhrt1xx2KDadjBf', 'MbXI1qrcuRFTF3T30m6'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, J0hpQrmuXnIitsJc6Wc.cs High entropy of concatenated method names: 'vKjOPRhiRJ', 'SI0pesW9WirAd3aY8mH', 'iprkErWyRSDND3BXsVT', 'OopVvEWVBHLNesHcJKh', 'aWiTEcWBmTexqW2s1cH', 'l2LYErWtLygVCgRmFoC', 'Ac6hqpW19GroDsQAKU0', 'mhNv1EWS41oCS9lFp8O', 'Frd43tWcxP4B6FSnqbp', 'pYTuYFWmrW7uY2yWu12'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, oZCvG54wWRBjDfkFnkO.cs High entropy of concatenated method names: 'MRgCAxFi4pyiELnGYAn', 'nvvt6ZFx48urytFIyEu', 'V7CN25F7xjQSMBm62dY', 'zcY5f8FhxUIJnQSgLau', 'CGxnukNhs0', 'jKTsB2FOLu9vlOFcoXU', 'Rd51GUFsH99JSIdQUcR', 'f8isuFFaWqiVph4x7jh', 'tP9jD3F6bVHgg2ns9Xo', 'CpYGL2FCKGc1iJhxjwT'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, F0eFFnmKkJZhn55Zvys.cs High entropy of concatenated method names: 'zNeO7uiZah', 'xlVOxdPnu0', 'YRfOkdbvSo', 'yy1OJdNcbb', 'prOOWxRapI', 'QnIOYWhyod', 'kr6ODxE7YT', 'I0d9jtb7omcYokV1kK7', 'B5LCmhbq3HNpY8sPkpn', 'WQNgy5b8HNeTWQUwVMM'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, FvUSi00RJHkOioJSRTM.cs High entropy of concatenated method names: 'smGvVcSBap', '_1kO', '_9v4', '_294', 'RXJvTraoO5', 'euj', 'WauvoYrLC6', 'h42vc2ksyy', 'o87', 'fuevIo2wnp'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, DcgbdkHCFc0nwgXcgUH.cs High entropy of concatenated method names: 'q4Y', '_71O', '_6H6', 'Gn6cTMG0CU', '_13H', 'I64', '_67a', '_71t', 'fEj', '_9OJ'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, NpkSvBO9tY9bafnVL2t.cs High entropy of concatenated method names: 'SPWpBWnPcB', 'Jh2pRguhaI', 'Sv2pgbABwJ', 'qTU82A0FbwDfCL1Q6B3', 'YuroYr0dcv7SHtHEyae', 'Heq4Xp0ppmFHQtY9EHt', 'Mdcw3u0GT78XWXrkYf0', 'vm9AD10wKpsPlisBQnk', 'uBaQAH0lV28IGqeR5qj', 'NQHY4W0osg0soBEe3dk'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, ElUjESmZQO5ijkocpJ4.cs High entropy of concatenated method names: 'sKe4crgbNw', 'cH5Pc3Ewi1NFjX2LPUo', 'HlSjqtEpNoTjFTdWBOT', 'TXkeNDEGPahdMHNL9Mf', 'wVSF6VElXi4QpMAUVGQ', 'SWE6UdEoNH5lfOYrRH0', 'R5046iTwKe', 'uUX4Q41pXb', 'ymM4bmJd4k', 'Cmo4jqWDff'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, Q1DSX900iYSkfVne7XQ.cs High entropy of concatenated method names: 'Qkp', '_72e', 'R26', '_7w6', 'Awi', 'n73', 'cek', 'ro1', '_9j4', '_453'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, UJYcexH1uBfIbSBrvkp.cs High entropy of concatenated method names: 'jdfcy3c5IJ', 'Tr5cHO8dB0', 'Y2Rc0a6ysi', 'nArc4VfmcZ', 'ixdcpk3K6b', 'iRdcKPGlEC', 'Ln3cXQxWYB', 'ey6c35LtKp', 'D87cGocUg4', 'gu1cEvjNIf'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, g80GQCIoZw6kAVuOrs.cs High entropy of concatenated method names: 'at6kUkTKy', 'dMjJde88C', 'jhoWdnCTp', 'JTexFbVDbZuxL7Bmo7Z', 'HYVfafVLTWbaRB4qfMC', 'xtYhbpVZloUUUas7rYY', 'xuR6a1VKYE3YcX79PHC', 'I6b3VwVN2W2IcYANYuI', 'MtGSx6Vnxylf9Jyo7IV', 'd5lXmvVuy8xsxoYbuWK'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, m7BaDMaAjOnUe9lkyjn.cs High entropy of concatenated method names: '_589', 'YZ8', '_491', 'G9C', 'gdPB74gGI7lIZN9LrRR', 'C0jW1YgwTb85ILcADrS', 'PdO8WXglgR9ZwX9XFca', 'YCoLx0go2nbnwxpSv4v', 'cjnjVSgIQ2OHB6Tewli', 'iGE3u6gJNSYywQ7Cr57'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, bmVAxyyP82jM9OnS3v7.cs High entropy of concatenated method names: 'KFrFcDJLdB', 'LgAFhohT3D', 'up5FwDNCDr', 'NqEFuKSPcI', 'UGYFFDabFh', 'BGQF9kMAAY', 'SxYF2EQv6P', 'sKmFNEUr3r', 'TkVF6nmPsn', 'UqWFQoayBs'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, nTLoROOSeJQOKO9eeS1.cs High entropy of concatenated method names: 'oYo', '_1Z5', 'wpqijCj0Ot', 'wNqXyLX2EG', 'qucifYmZbm', 'GgNo698bbSvjUjwOjxe', 'esZke38WIrt9T6gBd01', 'bapDSP8kwsRQPkUu1aQ', 'zuSCoV8X9WSEFK58BJV', 'jIeW1C8Amtcx5TiVf0r'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, N7KjFoahxcgut2HyOQs.cs High entropy of concatenated method names: 'Ai7', 'YZ8', '_56U', 'G9C', 'qp3DpRce0KEe8hh5r0u', 'o26kxxczUyVJ7Al0TQp', 'oiDLu0mR0x4EeWqFcj6', 'knvVLKmVO36ADpI2xPH', 'whLf7bmBbtlyKfaV6ug', 'l9mE7hm9xFbNdxFEQap'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, mGsjrXm5RJSD52pfjgS.cs High entropy of concatenated method names: 'maPmcH1BLO', 'O42mICRSp3', 'MaCmhyE68k', 'BZjkoeP63nGAJjAlDTy', 'IPE3L6PCeAvZOkmci1a', 'PC9tlMPQ4Ejw9IkDKZ1', 'WBucHgPLcxuHC1oUXPK', 'wmWLBGPZ8yTdID9W2YV', 'AACfGlPDFGGaAJjOkbU', 'avIlY4PsxUg3yZZPOVQ'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, UI7bGZm8mCiwUqsNasr.cs High entropy of concatenated method names: 'j3R0pqYeOx', 'U5p0KUr5iQ', 'xQuv5qMJQDIl3JqLJPW', 'O9ivsUMjXqv3VCpfd8P', 'i0urjSMoJfMMMh2k3Ld', 'EV6qryMIStggZaOvQTg', 'MUj02ESQO5', 'RXhd9hERcDnmgbjugWR', 'h3PDHfEVWSnu3a6o7P4', 'QnTNthMekLq3BwB8Yuk'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, XSa8OM0eybbwyS9PrRX.cs High entropy of concatenated method names: 'AE4IbU6Cd0', 'pWmIjhFTly', 'bRxIegy2Id', 'iVBIVGVBVC', 'OXpITFKpHE', 'pH2AQoNfa1CMsPhVcZQ', 'lxRHGIN2Y9a3ADJhOEJ', 'XsZMDJNe1087P1TZoNy', 'aHp9eSNzIrmuMvHIo8q', 'MyccacnRfVNMdFpABIR'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, Q7lAFSm2hb6e6FsTIfS.cs High entropy of concatenated method names: 'YPpOiia9oJ', 'eDoOZJiQiI', 'qE9ueJW4J5qsTBhiuYt', 'rwYpHGWUhjcVhwj1JGW', 'wVuhHmW0e6XD5bhZ8uC', 'HVST7kWrVhCrWfhwUxR', 'CyFmhgWqkD3xdaBYAw3', 'RX8NgGW8NGlSf6sPutt', 'z5h4oQW7XpSo4dTMlX5', 'PBTjrFWh9Pb1fSKfXLX'
Source: 2.3.Modrinth.exe.6a0f73d.0.raw.unpack, EDvKZXaTlB3bbN8yLqC.cs High entropy of concatenated method names: 'kNf', 'YZ8', 'U31', 'G9C', 'HUwKPDcQnxc1TkTp0hw', 'GH1Qc4cLN4PI7xoilKp', 'ewQkK4cZpQhHbvsrt1y', 'Ltb4UfcDc8IZ6lxolJC', 'gNIQugcKFI14TobgOmy', 'IvpYXWcNbk7jnT5CSa9'

Persistence and Installation Behavior
barindex
Creates processes via WMI
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Drops PE files with benign system names
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe File created: C:\Windows\en-US\csrss.exe Jump to dropped file
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe File created: C:\Program Files (x86)\Windows Multimedia Platform\wininit.exe Jump to dropped file
Drops executable to a common third party application directory
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe File written: C:\Program Files (x86)\Internet Explorer\SIGNUP\DVoCIYUveQTPKsllMirxd.exe Jump to behavior
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe File created: C:\intosessionperfcrtSvc\Componentwebfont.exe Jump to dropped file
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe File created: C:\Program Files (x86)\Internet Explorer\SIGNUP\DVoCIYUveQTPKsllMirxd.exe Jump to dropped file
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe File created: C:\Program Files\Reference Assemblies\Microsoft\Framework\DVoCIYUveQTPKsllMirxd.exe Jump to dropped file
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe File created: C:\Windows\en-US\csrss.exe Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe File created: C:\Users\user\AppData\Local\Temp\MSIC694.tmp Jump to dropped file
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe File created: C:\Users\Default\SearchApp.exe Jump to dropped file
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe File created: C:\Users\Default\DVoCIYUveQTPKsllMirxd.exe Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe File created: C:\Users\user\AppData\Local\Temp\MSIEB83.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Modrinth App\Modrinth App.exe Jump to dropped file
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe File created: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Jump to dropped file
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe File created: C:\Program Files (x86)\MSECache\OfficeKMS\win7\DVoCIYUveQTPKsllMirxd.exe Jump to dropped file
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe File created: C:\intosessionperfcrtSvc\RuntimeBroker.exe Jump to dropped file
Source: C:\Users\user\Desktop\Modrinth.exe File created: C:\Users\user\AppData\Local\Temp\Modrinth.exe Jump to dropped file
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe File created: C:\Windows\Vss\Writers\Application\RuntimeBroker.exe Jump to dropped file
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe File created: C:\Program Files\Windows Photo Viewer\en-GB\System.exe Jump to dropped file
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe File created: C:\Program Files (x86)\Windows Multimedia Platform\wininit.exe Jump to dropped file
Drops PE files to the user directory
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe File created: C:\Users\Default\SearchApp.exe Jump to dropped file
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe File created: C:\Users\Default\DVoCIYUveQTPKsllMirxd.exe Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe File created: C:\Windows\en-US\csrss.exe Jump to dropped file
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe File created: C:\Windows\Vss\Writers\Application\RuntimeBroker.exe Jump to dropped file

Boot Survival
barindex
Drops PE files to the user root directory
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe File created: C:\Users\Default\SearchApp.exe Jump to dropped file
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe File created: C:\Users\Default\DVoCIYUveQTPKsllMirxd.exe Jump to dropped file
Stores files to the Windows start menu directory
Source: C:\Windows\System32\msiexec.exe File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Modrinth App Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Modrinth App\Modrinth App.lnk Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Modrinth App\~odrinth App.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Modrinth App\Modrinth App.lnk~RF6edb84.TMP Jump to behavior
Source: C:\Users\user\Desktop\Modrinth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process information set: NOOPENFILEERRORBOX
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Memory allocated: 1310000 memory reserve | memory write watch Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Memory allocated: 1B360000 memory reserve | memory write watch Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Memory allocated: 1550000 memory reserve | memory write watch Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Memory allocated: 1AFD0000 memory reserve | memory write watch Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Memory allocated: 18C0000 memory reserve | memory write watch
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Memory allocated: 1B230000 memory reserve | memory write watch
Contains long sleeps (>= 3 min)
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Thread delayed: delay time: 922337203685477
Found WSH timer for Javascript or VBS script (likely evasive script)
Source: C:\Windows\SysWOW64\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Window / User API: threadDelayed 1467 Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Window / User API: threadDelayed 455 Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Window / User API: threadDelayed 359 Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Window / User API: threadDelayed 363
Found dropped PE file which has not been started or loaded
Source: C:\Windows\SysWOW64\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIC694.tmp Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIEB83.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Modrinth App\Modrinth App.exe Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe TID: 4304 Thread sleep count: 1467 > 30 Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe TID: 4304 Thread sleep count: 455 > 30 Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe TID: 3372 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe TID: 7980 Thread sleep count: 359 > 30 Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe TID: 7568 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe TID: 7968 Thread sleep count: 363 > 30
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe TID: 7180 Thread sleep time: -922337203685477s >= -30000s
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_0026A5F4 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError, 2_2_0026A5F4
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_0027B8E0 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW, 2_2_0027B8E0
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_0028AAA8 FindFirstFileExA, 2_2_0028AAA8
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_0027DD72 VirtualQuery,GetSystemInfo, 2_2_0027DD72
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Thread delayed: delay time: 922337203685477
Source: Modrinth.exe, 00000002.00000003.2027142990.0000000003057000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}&
Source: Modrinth.exe, 00000002.00000003.2026432843.0000000003057000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Q
Source: Componentwebfont.exe, 00000008.00000002.2134420425.000000001C7E9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}|
Source: wscript.exe, 00000004.00000002.2084446416.0000000002F44000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: wscript.exe, 00000004.00000002.2084446416.0000000002F44000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}K:r
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe API call chain: ExitProcess graph end node
Source: C:\Windows\System32\msiexec.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_0028866F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 2_2_0028866F
Contains functionality to read the PEB
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_0028753D mov eax, dword ptr fs:[00000030h] 2_2_0028753D
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_0028B710 GetProcessHeap, 2_2_0028B710
Enables debug privileges
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process token adjusted: Debug Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process token adjusted: Debug Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_0027F063 SetUnhandledExceptionFilter, 2_2_0027F063
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_0027F22B SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 2_2_0027F22B
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_0028866F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 2_2_0028866F
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_0027EF05 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 2_2_0027EF05
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Memory allocated: page read and write | page guard Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Modrinth.exe Process created: C:\Users\user\AppData\Local\Temp\Modrinth.exe "C:\Users\user\AppData\Local\Temp\Modrinth.exe" Jump to behavior
Source: C:\Users\user\Desktop\Modrinth.exe Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\Modrinth App_0.7.1_x64_en-US.msi" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\intosessionperfcrtSvc\x6qhfc.vbe" Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\intosessionperfcrtSvc\QvJVxLMgIdUXKZXo3vjvMJd9h.bat" " Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\intosessionperfcrtSvc\Componentwebfont.exe "C:\intosessionperfcrtSvc\Componentwebfont.exe" Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process created: unknown unknown Jump to behavior
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_0027ED5B cpuid 2_2_0027ED5B
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: GetLocaleInfoW,GetNumberFormatW, 2_2_0027A63C
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\SysWOW64\msiexec.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Queries volume information: C:\intosessionperfcrtSvc\Componentwebfont.exe VolumeInformation Jump to behavior
Source: C:\intosessionperfcrtSvc\Componentwebfont.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Queries volume information: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe VolumeInformation Jump to behavior
Source: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe Queries volume information: C:\intosessionperfcrtSvc\DVoCIYUveQTPKsllMirxd.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_0027D5D4 GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle, 2_2_0027D5D4
Source: C:\Users\user\AppData\Local\Temp\Modrinth.exe Code function: 2_2_0026ACF5 GetVersionExW, 2_2_0026ACF5
Source: C:\Windows\SysWOW64\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected DCRat
Source: Yara match File source: 00000028.00000002.2226399767.0000000003231000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2120796404.000000000381D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000028.00000002.2226399767.000000000326E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000002.2226297047.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2120796404.0000000003361000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2123867809.000000001336F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Componentwebfont.exe PID: 1308, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: DVoCIYUveQTPKsllMirxd.exe PID: 2716, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: DVoCIYUveQTPKsllMirxd.exe PID: 4436, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected DCRat
Source: Yara match File source: 00000028.00000002.2226399767.0000000003231000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2120796404.000000000381D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000028.00000002.2226399767.000000000326E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000002.2226297047.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2120796404.0000000003361000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2123867809.000000001336F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Componentwebfont.exe PID: 1308, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: DVoCIYUveQTPKsllMirxd.exe PID: 2716, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: DVoCIYUveQTPKsllMirxd.exe PID: 4436, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1467847 Sample: Modrinth.exe Startdate: 04/07/2024 Architecture: WINDOWS Score: 74 57 chrome.cloudflare-dns.com 2->57 59 cdn.modrinth.com 2->59 61 cdn-raw.modrinth.com 2->61 71 Snort IDS alert for network traffic 2->71 73 Found malware configuration 2->73 75 Antivirus detection for dropped file 2->75 77 12 other signatures 2->77 10 Modrinth.exe 8 3 2->10         started        13 DVoCIYUveQTPKsllMirxd.exe 2 2->13         started        16 msiexec.exe 114 44 2->16         started        18 DVoCIYUveQTPKsllMirxd.exe 2->18         started        signatures3 process4 file5 53 C:\Users\user\AppData\Local\...\Modrinth.exe, PE32 10->53 dropped 20 Modrinth.exe 2 6 10->20         started        24 msiexec.exe 7 10->24         started        87 Multi AV Scanner detection for dropped file 13->87 55 C:\Program Files\...\Modrinth App.exe, PE32+ 16->55 dropped 26 msiexec.exe 1 16->26         started        signatures6 process7 file8 47 C:\...\Componentwebfont.exe, PE32 20->47 dropped 79 Antivirus detection for dropped file 20->79 81 Multi AV Scanner detection for dropped file 20->81 83 Machine Learning detection for dropped file 20->83 28 wscript.exe 1 20->28         started        49 C:\Users\user\AppData\Local\...\MSIEB83.tmp, PE32 24->49 dropped 51 C:\Users\user\AppData\Local\...\MSIC694.tmp, PE32 24->51 dropped signatures9 process10 signatures11 85 Windows Scripting host queries suspicious COM object (likely to drop second stage) 28->85 31 cmd.exe 1 28->31         started        process12 process13 33 Componentwebfont.exe 1 26 31->33         started        37 conhost.exe 31->37         started        file14 39 C:\intosessionperfcrtSvc\RuntimeBroker.exe, PE32 33->39 dropped 41 C:\...\DVoCIYUveQTPKsllMirxd.exe, PE32 33->41 dropped 43 C:\Windows\en-US\csrss.exe, PE32 33->43 dropped 45 8 other malicious files 33->45 dropped 63 Multi AV Scanner detection for dropped file 33->63 65 Drops PE files to the user root directory 33->65 67 Creates processes via WMI 33->67 69 2 other signatures 33->69 signatures15
⊘No contacted IP infos

Contacted Domains

Name IP Active
chrome.cloudflare-dns.com 162.159.61.3 true
cdn.modrinth.com 104.18.22.35 true
cdn-raw.modrinth.com 104.18.23.35 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://cz36357.tw1.ru/@=cDMmNzNiFGO true
  • Avira URL Cloud: safe
 unknown