Windows Analysis Report
rivalsanticheat.exe

Malicious sample detected (through community Yara rule)

System Summary

Source: rivalsanticheat.exe, type: SAMPLE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: rivalsanticheat.exe, type: SAMPLE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.0.rivalsanticheat.exe.3f0000.0.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 0.0.rivalsanticheat.exe.3f0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000000.1648426795.00000000003F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe, type: DROPPED	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Users\user\Desktop\rivalsanticheat.exe	Code function: 0_2_00007FFD9B86104D	0_2_00007FFD9B86104D
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Code function: 0_2_00007FFD9B865B46	0_2_00007FFD9B865B46
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Code function: 0_2_00007FFD9B861A01	0_2_00007FFD9B861A01
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Code function: 0_2_00007FFD9B8668F2	0_2_00007FFD9B8668F2
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Code function: 3_2_00007FFD9B860FF8	3_2_00007FFD9B860FF8
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Code function: 7_2_00007FFD9B890FF8	7_2_00007FFD9B890FF8
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Code function: 9_2_00007FFD9B890FF8	9_2_00007FFD9B890FF8

Source: C:\Users\user\Desktop\rivalsanticheat.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1360 -s 1900

Source: rivalsanticheat.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: rivalsanticheat.exe, type: SAMPLE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: rivalsanticheat.exe, type: SAMPLE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.0.rivalsanticheat.exe.3f0000.0.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 0.0.rivalsanticheat.exe.3f0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000000.1648426795.00000000003F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe, type: DROPPED	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: rivalsanticheat.exe, CwFHZkjzy8fuL42ssK4j02FfYn8bn.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: rivalsanticheat.exe, CwFHZkjzy8fuL42ssK4j02FfYn8bn.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: rivalsanticheat.exe, wPpUVasNl83McTjXeCT7REF5YtT48.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: rivalsanticheat.exe.0.dr, CwFHZkjzy8fuL42ssK4j02FfYn8bn.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: rivalsanticheat.exe.0.dr, CwFHZkjzy8fuL42ssK4j02FfYn8bn.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: rivalsanticheat.exe.0.dr, wPpUVasNl83McTjXeCT7REF5YtT48.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: rivalsanticheat.exe.0.dr, cCtJmGsFBRSmjuWVUJhTNMkmsgWgXScdGcmbjBqGaR1T.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: rivalsanticheat.exe.0.dr, cCtJmGsFBRSmjuWVUJhTNMkmsgWgXScdGcmbjBqGaR1T.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: rivalsanticheat.exe, cCtJmGsFBRSmjuWVUJhTNMkmsgWgXScdGcmbjBqGaR1T.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: rivalsanticheat.exe, cCtJmGsFBRSmjuWVUJhTNMkmsgWgXScdGcmbjBqGaR1T.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.evad.winEXE@8/7@19/2

Source: C:\Users\user\Desktop\rivalsanticheat.exe

File created: C:\Users\user\AppData\Roaming\rivalsanticheat.exe

Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1360
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6792:120:WilError_03
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Mutant created: \Sessions\1\BaseNamedObjects\MFDgtG4e9yHdcrKV

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\3edca8fa-68b1-4ac5-ad0a-ede30212bbae

Source: rivalsanticheat.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: rivalsanticheat.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\rivalsanticheat.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\rivalsanticheat.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: rivalsanticheat.exe	ReversingLabs: Detection: 78%
Source: rivalsanticheat.exe	Virustotal: Detection: 75%

Source: C:\Users\user\Desktop\rivalsanticheat.exe

File read: C:\Users\user\Desktop\rivalsanticheat.exe

Source: unknown	Process created: C:\Users\user\Desktop\rivalsanticheat.exe "C:\Users\user\Desktop\rivalsanticheat.exe"
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "rivalsanticheat" /tr "C:\Users\user\AppData\Roaming\rivalsanticheat.exe"
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\rivalsanticheat.exe C:\Users\user\AppData\Roaming\rivalsanticheat.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\rivalsanticheat.exe C:\Users\user\AppData\Roaming\rivalsanticheat.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\rivalsanticheat.exe C:\Users\user\AppData\Roaming\rivalsanticheat.exe
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1360 -s 1900
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "rivalsanticheat" /tr "C:\Users\user\AppData\Roaming\rivalsanticheat.exe"	Jump to behavior

Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Section loaded: cryptbase.dll	Jump to behavior

Source: C:\Users\user\Desktop\rivalsanticheat.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\rivalsanticheat.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

.NET source code contains method to dynamically call methods (often used by packers)

Source: rivalsanticheat.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: rivalsanticheat.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: \??\C:\Windows\mscorlib.pdb2e source: rivalsanticheat.exe, 00000000.00000002.3453788430.000000001B71B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WER2E71.tmp.dmp.12.dr
Source:	Binary string: System.Xml.ni.pdb source: WER2E71.tmp.dmp.12.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: rivalsanticheat.exe, 00000000.00000002.3453788430.000000001B71B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WER2E71.tmp.dmp.12.dr
Source:	Binary string: \??\C:\Users\user\Desktop\rivalsanticheat.PDB source: rivalsanticheat.exe, 00000000.00000002.3453788430.000000001B6E3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbY source: WER2E71.tmp.dmp.12.dr
Source:	Binary string: System.Configuration.ni.pdb source: WER2E71.tmp.dmp.12.dr
Source:	Binary string: mscorlib.pdbcorlib.pdbpdblib.pdbC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: rivalsanticheat.exe, 00000000.00000002.3454196854.000000001BEA9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER2E71.tmp.dmp.12.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER2E71.tmp.dmp.12.dr
Source:	Binary string: System.Configuration.pdb source: WER2E71.tmp.dmp.12.dr
Source:	Binary string: symbols\dll\mscorlib.pdbpdb` source: rivalsanticheat.exe, 00000000.00000002.3454196854.000000001BEA9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdb source: WER2E71.tmp.dmp.12.dr
Source:	Binary string: System.pdb source: WER2E71.tmp.dmp.12.dr
Source:	Binary string: Microsoft.VisualBasic.pdbmscorlib.dllPQS source: WER2E71.tmp.dmp.12.dr
Source:	Binary string: 0C:\Windows\mscorlib.pdb source: rivalsanticheat.exe, 00000000.00000002.3454196854.000000001BEA9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER2E71.tmp.dmp.12.dr
Source:	Binary string: System.Core.ni.pdb source: WER2E71.tmp.dmp.12.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER2E71.tmp.dmp.12.dr
Source:	Binary string: C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: rivalsanticheat.exe, 00000000.00000002.3454196854.000000001BEA9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbSYSTEM*l source: rivalsanticheat.exe, 00000000.00000002.3453788430.000000001B71B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdbR source: rivalsanticheat.exe, 00000000.00000002.3451215148.0000000000895000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: rivalsanticheat.exe, 00000000.00000002.3453788430.000000001B6E3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: rivalsanticheat.exe, 00000000.00000002.3451215148.0000000000895000.00000004.00000020.00020000.00000000.sdmp, rivalsanticheat.exe, 00000000.00000002.3451215148.0000000000915000.00000004.00000020.00020000.00000000.sdmp, WER2E71.tmp.dmp.12.dr
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdbTo source: rivalsanticheat.exe, 00000000.00000002.3453788430.000000001B71B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: rivalsanticheat.exe, 00000000.00000002.3451215148.0000000000895000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WER2E71.tmp.dmp.12.dr
Source:	Binary string: System.Management.pdb source: WER2E71.tmp.dmp.12.dr
Source:	Binary string: mscorlib.ni.pdb source: WER2E71.tmp.dmp.12.dr
Source:	Binary string: System.Management.ni.pdb source: WER2E71.tmp.dmp.12.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: rivalsanticheat.exe, 00000000.00000002.3453788430.000000001B71B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WER2E71.tmp.dmp.12.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER2E71.tmp.dmp.12.dr
Source:	Binary string: indoC:\Windows\mscorlib.pdb source: rivalsanticheat.exe, 00000000.00000002.3454196854.000000001BEA9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WER2E71.tmp.dmp.12.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER2E71.tmp.dmp.12.dr

Data Obfuscation

Source: rivalsanticheat.exe, Zj3A2ceVsypvLkuHb7vS0hOvuoE3YlQ6oYsQLki9xMow.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{eISxuTAmwmXp2bOP9dtQhIMzrr363r3ygdkq9O7WCk3W.Fm4IT5ezSKgtbpBEkd9yyVSjpfSZcrHiM0ryIGbMnpwQ,eISxuTAmwmXp2bOP9dtQhIMzrr363r3ygdkq9O7WCk3W.rMp2gJUGXV3ZbV6N6llOwRdHZR3wcgtHpnoMg7OfWoEj,eISxuTAmwmXp2bOP9dtQhIMzrr363r3ygdkq9O7WCk3W.ImALPWfsqMQZsaCvxR9IHBIx9kNghVxCDxHAROjzBasS,eISxuTAmwmXp2bOP9dtQhIMzrr363r3ygdkq9O7WCk3W._7wdwDu5jCIexezcCBVRzZKo6D9mjd3B3fvk9TFIiaweR,CwFHZkjzy8fuL42ssK4j02FfYn8bn.guowrwDGUepZTuyngnhAX2iRYPKTD()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: rivalsanticheat.exe, Zj3A2ceVsypvLkuHb7vS0hOvuoE3YlQ6oYsQLki9xMow.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{R9yDxJGfdmo3SkpyatNdrGEd17hOZNnCzF5873p4IniT[2],CwFHZkjzy8fuL42ssK4j02FfYn8bn.mIKZbUt565OgyM9r3xHRDhPKGyDA4(Convert.FromBase64String(R9yDxJGfdmo3SkpyatNdrGEd17hOZNnCzF5873p4IniT[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: rivalsanticheat.exe.0.dr, Zj3A2ceVsypvLkuHb7vS0hOvuoE3YlQ6oYsQLki9xMow.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{eISxuTAmwmXp2bOP9dtQhIMzrr363r3ygdkq9O7WCk3W.Fm4IT5ezSKgtbpBEkd9yyVSjpfSZcrHiM0ryIGbMnpwQ,eISxuTAmwmXp2bOP9dtQhIMzrr363r3ygdkq9O7WCk3W.rMp2gJUGXV3ZbV6N6llOwRdHZR3wcgtHpnoMg7OfWoEj,eISxuTAmwmXp2bOP9dtQhIMzrr363r3ygdkq9O7WCk3W.ImALPWfsqMQZsaCvxR9IHBIx9kNghVxCDxHAROjzBasS,eISxuTAmwmXp2bOP9dtQhIMzrr363r3ygdkq9O7WCk3W._7wdwDu5jCIexezcCBVRzZKo6D9mjd3B3fvk9TFIiaweR,CwFHZkjzy8fuL42ssK4j02FfYn8bn.guowrwDGUepZTuyngnhAX2iRYPKTD()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: rivalsanticheat.exe.0.dr, Zj3A2ceVsypvLkuHb7vS0hOvuoE3YlQ6oYsQLki9xMow.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{R9yDxJGfdmo3SkpyatNdrGEd17hOZNnCzF5873p4IniT[2],CwFHZkjzy8fuL42ssK4j02FfYn8bn.mIKZbUt565OgyM9r3xHRDhPKGyDA4(Convert.FromBase64String(R9yDxJGfdmo3SkpyatNdrGEd17hOZNnCzF5873p4IniT[3]))}}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: rivalsanticheat.exe, Zj3A2ceVsypvLkuHb7vS0hOvuoE3YlQ6oYsQLki9xMow.cs	.Net Code: _0sGHB0igTMVFlt1yxCvQbOdcoQ9hnEW1OzoHCBsGyS3j System.AppDomain.Load(byte[])
Source: rivalsanticheat.exe, Zj3A2ceVsypvLkuHb7vS0hOvuoE3YlQ6oYsQLki9xMow.cs	.Net Code: _2r0VXtgKusekgogzbPvtkc1oEuxXZo6TQkrD8fBKu872 System.AppDomain.Load(byte[])
Source: rivalsanticheat.exe, Zj3A2ceVsypvLkuHb7vS0hOvuoE3YlQ6oYsQLki9xMow.cs	.Net Code: _2r0VXtgKusekgogzbPvtkc1oEuxXZo6TQkrD8fBKu872
Source: rivalsanticheat.exe.0.dr, Zj3A2ceVsypvLkuHb7vS0hOvuoE3YlQ6oYsQLki9xMow.cs	.Net Code: _0sGHB0igTMVFlt1yxCvQbOdcoQ9hnEW1OzoHCBsGyS3j System.AppDomain.Load(byte[])
Source: rivalsanticheat.exe.0.dr, Zj3A2ceVsypvLkuHb7vS0hOvuoE3YlQ6oYsQLki9xMow.cs	.Net Code: _2r0VXtgKusekgogzbPvtkc1oEuxXZo6TQkrD8fBKu872 System.AppDomain.Load(byte[])
Source: rivalsanticheat.exe.0.dr, Zj3A2ceVsypvLkuHb7vS0hOvuoE3YlQ6oYsQLki9xMow.cs	.Net Code: _2r0VXtgKusekgogzbPvtkc1oEuxXZo6TQkrD8fBKu872

Source: C:\Users\user\Desktop\rivalsanticheat.exe	Code function: 0_2_00007FFD9B86A705 push eax; retf	0_2_00007FFD9B86A833
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Code function: 0_2_00007FFD9B8621C8 push ebx; iretd	0_2_00007FFD9B8621EA
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Code function: 0_2_00007FFD9B86794D push ebx; retf	0_2_00007FFD9B86796A
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Code function: 0_2_00007FFD9B8600BD pushad ; iretd	0_2_00007FFD9B8600C1
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Code function: 3_2_00007FFD9B8600BD pushad ; iretd	3_2_00007FFD9B8600C1

Source: rivalsanticheat.exe, VcacVJ1em6v07R5IV484AfJ4JiVN5.cs	High entropy of concatenated method names: '_6lRl6jDM150xy79DBIVDdX5sSvapE', 'wjChbTmZT2OYFjiT0uP74LlAV8Wyt', 'LgpgbmqiObPCAYZd7rg8Y1JovEMkP', 'NzdTuA1JlrLDp1s2ub2Q2o', 's2gBFv5eIeYNlNOLqufHlv', 'Qp1fWcTf1nDc7PqNMW9Mdy', 'xqGtCom2LqzujpQNHjnweQ', 'mz3j6ieQi3IdZ8ejmd72Vq', 'yrcxCgFOeoDwrIoEJbvCkN', 'qI2eQSUAWY5FzY1lcccS0c'
Source: rivalsanticheat.exe, eISxuTAmwmXp2bOP9dtQhIMzrr363r3ygdkq9O7WCk3W.cs	High entropy of concatenated method names: 'GL4DGDTNkoxvi5RxKVLUoCmoyn4DQqF8sXbckiSwztppLQ6pAlzx7svp0wuBwC', 'jO6777MkbcyZ1m4OA7u7Cxm4jhMjva9lnUIDQ5pwn81TdrmxRjzfdIBRnAKLt3', 'qeusPqODQcqt2ipmHr7DoLPNTApdt3B6ftoJaxzmvaC5V1GMST35b9D7N57Sfn', 'e9asjdqng6Y9hC9EtQdxaqUI1aTAQrP3ApsZQZxAIPTGpVH2ZJmbGBS9PwzR9q'
Source: rivalsanticheat.exe, oBuT1QH6a41s.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'uimPyDiJOuUAZ1SArMigmVbySeeknRQEnYjWo9tCAn2GEBt1gAVH4xFZMFPuEx', 'RvZctpUuUAPyNhWi5kwjSLmaMGAzSxnzGzRzhXhkhDztAFZpl6bOOwCALcOrtQ', 'GB6gSDM5xYU2WdmaggvmQVPTl8wuwM4txCmWcPsHNHVlcOuU62pCIWjavHpssv', 'j5QXPslyK2JwvEelGClIFaPxi4Zi7ljtRC6oXdS4jNbBwLOFobC92eXgWVmd4f'
Source: rivalsanticheat.exe, bb2clQFJgGrOun9pdWjRRbebdaMMZUq1KbWDu03Q2zot.cs	High entropy of concatenated method names: 'u8QEiX8j3XM2UAqZf4bdIa4ThVBpskbv5Ftf8NsSss5p', 'XZmQR6HgpF6SWthMDC3Nk7rZEE0tT9SvAKJSWgRiTZgF0rNkQhlbOIiwJxNqlNhZfQDWkxg6gfCVPL7', 'p90PF3mlwQudzXVPM5jG5ISklliTjCj3Sxkw5paojpOoebo9hn3VrNTMcGEK0PQ2nZKJ3qKrRZnOL3l', 'ElqXPQmrYFWeZMJeGjrq7VdmP5GERyRPcciyoQzmw0AT43SkQzyJVKUJ6V4XRG7jAOdbAUw9slZusaC', '_2weGW0pjT00Z2KmZOWEovcL2K2pFsLrLZrZybJp39pXPjsWXgT4ljvAy4SzXLfnWPrECj254ccsfFKy'
Source: rivalsanticheat.exe, fh8tnrz5txb35hggkbSAYsj4mZ8AYvylTgfr4fE2Q15U.cs	High entropy of concatenated method names: 'B7Hvr6jG42UqFCoChQJF91NoI3vd3OlqvOejbGMSNL7L', 'Kt2g5iSc42iez0MlWTFdFi2SswgrDx9an0bJx1eutmSR', 'kkjmMQxnTmcO78QGDUFkyIhQrF1a0xIMIp3HgAXp2bFv', '_56Sjig3wZ0eFsrr09k7JXTeCofXGd5dU4V8Y68PXYDmG', 'CzP31gwxC6lGNYMzSWPTVHLT7cnZ8Uugz8l0d79v65jZ', 'dOMGT66IEgtPiUFls7673EN0WbA5qFAf6WDjukXEc3B6', 'mOZA5aS6ZEyL64DVxSX8p0Jb1Qera7OHpIg00dnQT5q0', 'jcyyZQTSlnmVNIXoQ0KYemOPoNjlgeGvtpQxdCjdhaGx', 'miFnSnOy5VJYxmgeKm6hbCLGI9wjRY7BmMy5hXr8uUgS', 'uYqiouQ9PNPTEs3Mq1hr0M0bUl3ZQSsEU0zpaq82LGBq'
Source: rivalsanticheat.exe, riNVOSuG9gHMEsIGB2S909igwoELbkqfqzvNazIu1Ygx.cs	High entropy of concatenated method names: 'fyyAVidFwh52zRiz7luPppLiFNEFICpdGbTlMSbmBtev', 'leqYSiowcvsQOXJBlmxx5myrsiEy0iPVEQzJlVWPKZ8N', 'XgmBxG2wrRTs0yZwca2B1JgPzBfaJ', 'Aasb1IZ2VuBKV5iD04rPNZvBaNZbk', '_0X2UL5MWT5UfWUyDjvGLRJf77khux2Z3yg1Rhpr9ejbasfV5ZlifyeHTyzWX6gKvKIW9LrKkU4zSnbh', '_0rlx1kyDWTGxogKxsq0V8QP92BWdm1vn0n1ejG5QS4Pq6QR4tamTN9Q8FVMeHXntGIVN3fOACN0SYem', 'JMh9zvOzsXYVLQa9wbGrLtXZtsmQX1CO7TTA1fYjovyvvhsoUjqP2iMjANT4mgwcxMF9VMa6a5EPWV2', 'sUgR92Dmwq1SxWNlfWh3DYPVvQJHg9wSzxeUSNfOymx26MAlAJjGLNqK0Re56xMS2XLP4xWpDFFAA97', 'N8Wiqbfua3ZsTTiAyI4rrc9igG18oVTDRipFcqYUhT8upNWX71nfNrPloKQ1xr8peDqZrOjYbWfs0Lm', 'jtP2LczDIhNsqMWjhcsJPBGRq8kZhgGcR5Ojfsy8blJhRpaD7vhVnB5WzyiZHsuRfUOSxAMku2qPND1'
Source: rivalsanticheat.exe, CwFHZkjzy8fuL42ssK4j02FfYn8bn.cs	High entropy of concatenated method names: 'Oi7weUyWuCQQhBF5YiejJk0fX94oE', '_0x01OaaO20ENdzFmowUzV4HZtIFX7', 'FTCZrxoK93PDHVS0JxfUFMpUBpow0', 'pAG9Vj4L9RHqaLZMlHQj7Omuc0sqw', '_7VfcQh08yWeUNULNsVdw49Yj9dpR7', 'P70ee5bjl0UQVHJORbqUNMlem1hvg', 'lzcuTeLxip3gzB5m1p2JLkvh7JovQ', 'CLyOVjEqvdKAJ59sbvJpQBIa97v3g', '_1j9wF4Iacf7t98THFs8tBa2C9bcQA', '_8ZnnGctPnYhdzKL7GD87l0iDK7pxS'
Source: rivalsanticheat.exe, Zj3A2ceVsypvLkuHb7vS0hOvuoE3YlQ6oYsQLki9xMow.cs	High entropy of concatenated method names: 'd8KpWZL4NE0DLYIuzVsnnSnqz668asGvOA8Jqsmitl7y', '_0sGHB0igTMVFlt1yxCvQbOdcoQ9hnEW1OzoHCBsGyS3j', 'tMcwII6xDd8m7jW41cN0uUKS6q2mDXWLMgc4U1vdPOus', 'nnc75mvNG89CwLwo3K7woBQucA9mCoHjmsgRR70CRgFl', 'v8s3kXET2YDB5K8SIJUZHYoRxGS3RwvPvzKMERZKio2U', 'ltRN3OaxH7coWH1AmQwyFdMo9ufu8aegmB6GfD7cblVS', 'Paxqe58OkbYRzd6nZ4YA4jgCi2ccftDbmsbUKcEW4FAE', 'WHaDPPU0hlA69IsVOINOF8G3d9cBQJH3DZlpeNqNP9za', 'FaBoXqLR9DN1itTlvJzGZKuKdFh8bIx5qAcUp65YMyLW', 'BG5rJdzYCSPYbTpD5Np9Bw6d8pons6252riffNrdKyZO'
Source: rivalsanticheat.exe, cCtJmGsFBRSmjuWVUJhTNMkmsgWgXScdGcmbjBqGaR1T.cs	High entropy of concatenated method names: '_8DLlAzHZ6Wl03EQ1ZFHZUXljgNaqnqjr7UK9jpBUGJQw', 'njFZ8sV0ef1VWhmX17Er8effWarqpqrqwyCNb3KX0GTK', 't5kaLaGzS2Njz8dXlUhOc3LMjjoSl0TWqTfXdlDSLRPS', 'inNIYkvDMzacGsiGvvMajJLPkrvRiBihdgfuLkXeAZPU', 'hPZwgp9ogeeAvgVEOpSP3CZsxrQzZXXJaBoMHtcrc74x', 'LT3cVDpeo5ddai5sRrvg5oWnhUHWX2bdODcEbZk1gBKu', 'xNaMvUjlJzngx4HGQSl3TMb1dsqTzVYmArrwlPWrGMPI', 'WIFOnRd3ecyhS4J7TkGWcsF2reZCNDXfruUhbLjvjhUd', 'hW9RukMlo0dH0jaGvjaq146BXX9HoNDrSk1oZRRAn4hZ', 'StBL68hDZMiDvA7V8zda9VIgZX2sDqmQXuhUzKNIUO14'
Source: rivalsanticheat.exe, wPpUVasNl83McTjXeCT7REF5YtT48.cs	High entropy of concatenated method names: 'fyuyopi7PzopjcJZGhukcoMTamUUf', 'Dz41oeX7buYQj3Exd1tfUay2T72EkI3WHimPmorWgeqkwcUd90j8kMlgQBmnJu3xOhBNrPBTmRAqwgE', 'JxYAHRWf6sDdj2HkhY5bvWINtEtrKNxPkcnzo6lwv5phbtn2ABEg3K6S5QMavH6Wfv6CSsPONVlDOy7', 'xw5r0zOIqPk41s1uqoxamC0Hcx2uTsOCRAwo3EZS437q5Kcgj4bEtSCtzmTU2tJ1xF8a5DVZqh50cw4', 'orIPmORCjjJ151KTXNdDBK3g2CUM5dGyxxLQoU8UQilCnNawXBLx2ZUpf7aDHfahPKBHcGn2YGWvIHb'
Source: rivalsanticheat.exe.0.dr, VcacVJ1em6v07R5IV484AfJ4JiVN5.cs	High entropy of concatenated method names: '_6lRl6jDM150xy79DBIVDdX5sSvapE', 'wjChbTmZT2OYFjiT0uP74LlAV8Wyt', 'LgpgbmqiObPCAYZd7rg8Y1JovEMkP', 'NzdTuA1JlrLDp1s2ub2Q2o', 's2gBFv5eIeYNlNOLqufHlv', 'Qp1fWcTf1nDc7PqNMW9Mdy', 'xqGtCom2LqzujpQNHjnweQ', 'mz3j6ieQi3IdZ8ejmd72Vq', 'yrcxCgFOeoDwrIoEJbvCkN', 'qI2eQSUAWY5FzY1lcccS0c'
Source: rivalsanticheat.exe.0.dr, eISxuTAmwmXp2bOP9dtQhIMzrr363r3ygdkq9O7WCk3W.cs	High entropy of concatenated method names: 'GL4DGDTNkoxvi5RxKVLUoCmoyn4DQqF8sXbckiSwztppLQ6pAlzx7svp0wuBwC', 'jO6777MkbcyZ1m4OA7u7Cxm4jhMjva9lnUIDQ5pwn81TdrmxRjzfdIBRnAKLt3', 'qeusPqODQcqt2ipmHr7DoLPNTApdt3B6ftoJaxzmvaC5V1GMST35b9D7N57Sfn', 'e9asjdqng6Y9hC9EtQdxaqUI1aTAQrP3ApsZQZxAIPTGpVH2ZJmbGBS9PwzR9q'
Source: rivalsanticheat.exe.0.dr, oBuT1QH6a41s.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'uimPyDiJOuUAZ1SArMigmVbySeeknRQEnYjWo9tCAn2GEBt1gAVH4xFZMFPuEx', 'RvZctpUuUAPyNhWi5kwjSLmaMGAzSxnzGzRzhXhkhDztAFZpl6bOOwCALcOrtQ', 'GB6gSDM5xYU2WdmaggvmQVPTl8wuwM4txCmWcPsHNHVlcOuU62pCIWjavHpssv', 'j5QXPslyK2JwvEelGClIFaPxi4Zi7ljtRC6oXdS4jNbBwLOFobC92eXgWVmd4f'
Source: rivalsanticheat.exe.0.dr, bb2clQFJgGrOun9pdWjRRbebdaMMZUq1KbWDu03Q2zot.cs	High entropy of concatenated method names: 'u8QEiX8j3XM2UAqZf4bdIa4ThVBpskbv5Ftf8NsSss5p', 'XZmQR6HgpF6SWthMDC3Nk7rZEE0tT9SvAKJSWgRiTZgF0rNkQhlbOIiwJxNqlNhZfQDWkxg6gfCVPL7', 'p90PF3mlwQudzXVPM5jG5ISklliTjCj3Sxkw5paojpOoebo9hn3VrNTMcGEK0PQ2nZKJ3qKrRZnOL3l', 'ElqXPQmrYFWeZMJeGjrq7VdmP5GERyRPcciyoQzmw0AT43SkQzyJVKUJ6V4XRG7jAOdbAUw9slZusaC', '_2weGW0pjT00Z2KmZOWEovcL2K2pFsLrLZrZybJp39pXPjsWXgT4ljvAy4SzXLfnWPrECj254ccsfFKy'
Source: rivalsanticheat.exe.0.dr, fh8tnrz5txb35hggkbSAYsj4mZ8AYvylTgfr4fE2Q15U.cs	High entropy of concatenated method names: 'B7Hvr6jG42UqFCoChQJF91NoI3vd3OlqvOejbGMSNL7L', 'Kt2g5iSc42iez0MlWTFdFi2SswgrDx9an0bJx1eutmSR', 'kkjmMQxnTmcO78QGDUFkyIhQrF1a0xIMIp3HgAXp2bFv', '_56Sjig3wZ0eFsrr09k7JXTeCofXGd5dU4V8Y68PXYDmG', 'CzP31gwxC6lGNYMzSWPTVHLT7cnZ8Uugz8l0d79v65jZ', 'dOMGT66IEgtPiUFls7673EN0WbA5qFAf6WDjukXEc3B6', 'mOZA5aS6ZEyL64DVxSX8p0Jb1Qera7OHpIg00dnQT5q0', 'jcyyZQTSlnmVNIXoQ0KYemOPoNjlgeGvtpQxdCjdhaGx', 'miFnSnOy5VJYxmgeKm6hbCLGI9wjRY7BmMy5hXr8uUgS', 'uYqiouQ9PNPTEs3Mq1hr0M0bUl3ZQSsEU0zpaq82LGBq'
Source: rivalsanticheat.exe.0.dr, riNVOSuG9gHMEsIGB2S909igwoELbkqfqzvNazIu1Ygx.cs	High entropy of concatenated method names: 'fyyAVidFwh52zRiz7luPppLiFNEFICpdGbTlMSbmBtev', 'leqYSiowcvsQOXJBlmxx5myrsiEy0iPVEQzJlVWPKZ8N', 'XgmBxG2wrRTs0yZwca2B1JgPzBfaJ', 'Aasb1IZ2VuBKV5iD04rPNZvBaNZbk', '_0X2UL5MWT5UfWUyDjvGLRJf77khux2Z3yg1Rhpr9ejbasfV5ZlifyeHTyzWX6gKvKIW9LrKkU4zSnbh', '_0rlx1kyDWTGxogKxsq0V8QP92BWdm1vn0n1ejG5QS4Pq6QR4tamTN9Q8FVMeHXntGIVN3fOACN0SYem', 'JMh9zvOzsXYVLQa9wbGrLtXZtsmQX1CO7TTA1fYjovyvvhsoUjqP2iMjANT4mgwcxMF9VMa6a5EPWV2', 'sUgR92Dmwq1SxWNlfWh3DYPVvQJHg9wSzxeUSNfOymx26MAlAJjGLNqK0Re56xMS2XLP4xWpDFFAA97', 'N8Wiqbfua3ZsTTiAyI4rrc9igG18oVTDRipFcqYUhT8upNWX71nfNrPloKQ1xr8peDqZrOjYbWfs0Lm', 'jtP2LczDIhNsqMWjhcsJPBGRq8kZhgGcR5Ojfsy8blJhRpaD7vhVnB5WzyiZHsuRfUOSxAMku2qPND1'
Source: rivalsanticheat.exe.0.dr, CwFHZkjzy8fuL42ssK4j02FfYn8bn.cs	High entropy of concatenated method names: 'Oi7weUyWuCQQhBF5YiejJk0fX94oE', '_0x01OaaO20ENdzFmowUzV4HZtIFX7', 'FTCZrxoK93PDHVS0JxfUFMpUBpow0', 'pAG9Vj4L9RHqaLZMlHQj7Omuc0sqw', '_7VfcQh08yWeUNULNsVdw49Yj9dpR7', 'P70ee5bjl0UQVHJORbqUNMlem1hvg', 'lzcuTeLxip3gzB5m1p2JLkvh7JovQ', 'CLyOVjEqvdKAJ59sbvJpQBIa97v3g', '_1j9wF4Iacf7t98THFs8tBa2C9bcQA', '_8ZnnGctPnYhdzKL7GD87l0iDK7pxS'
Source: rivalsanticheat.exe.0.dr, Zj3A2ceVsypvLkuHb7vS0hOvuoE3YlQ6oYsQLki9xMow.cs	High entropy of concatenated method names: 'd8KpWZL4NE0DLYIuzVsnnSnqz668asGvOA8Jqsmitl7y', '_0sGHB0igTMVFlt1yxCvQbOdcoQ9hnEW1OzoHCBsGyS3j', 'tMcwII6xDd8m7jW41cN0uUKS6q2mDXWLMgc4U1vdPOus', 'nnc75mvNG89CwLwo3K7woBQucA9mCoHjmsgRR70CRgFl', 'v8s3kXET2YDB5K8SIJUZHYoRxGS3RwvPvzKMERZKio2U', 'ltRN3OaxH7coWH1AmQwyFdMo9ufu8aegmB6GfD7cblVS', 'Paxqe58OkbYRzd6nZ4YA4jgCi2ccftDbmsbUKcEW4FAE', 'WHaDPPU0hlA69IsVOINOF8G3d9cBQJH3DZlpeNqNP9za', 'FaBoXqLR9DN1itTlvJzGZKuKdFh8bIx5qAcUp65YMyLW', 'BG5rJdzYCSPYbTpD5Np9Bw6d8pons6252riffNrdKyZO'
Source: rivalsanticheat.exe.0.dr, cCtJmGsFBRSmjuWVUJhTNMkmsgWgXScdGcmbjBqGaR1T.cs	High entropy of concatenated method names: '_8DLlAzHZ6Wl03EQ1ZFHZUXljgNaqnqjr7UK9jpBUGJQw', 'njFZ8sV0ef1VWhmX17Er8effWarqpqrqwyCNb3KX0GTK', 't5kaLaGzS2Njz8dXlUhOc3LMjjoSl0TWqTfXdlDSLRPS', 'inNIYkvDMzacGsiGvvMajJLPkrvRiBihdgfuLkXeAZPU', 'hPZwgp9ogeeAvgVEOpSP3CZsxrQzZXXJaBoMHtcrc74x', 'LT3cVDpeo5ddai5sRrvg5oWnhUHWX2bdODcEbZk1gBKu', 'xNaMvUjlJzngx4HGQSl3TMb1dsqTzVYmArrwlPWrGMPI', 'WIFOnRd3ecyhS4J7TkGWcsF2reZCNDXfruUhbLjvjhUd', 'hW9RukMlo0dH0jaGvjaq146BXX9HoNDrSk1oZRRAn4hZ', 'StBL68hDZMiDvA7V8zda9VIgZX2sDqmQXuhUzKNIUO14'
Source: rivalsanticheat.exe.0.dr, wPpUVasNl83McTjXeCT7REF5YtT48.cs	High entropy of concatenated method names: 'fyuyopi7PzopjcJZGhukcoMTamUUf', 'Dz41oeX7buYQj3Exd1tfUay2T72EkI3WHimPmorWgeqkwcUd90j8kMlgQBmnJu3xOhBNrPBTmRAqwgE', 'JxYAHRWf6sDdj2HkhY5bvWINtEtrKNxPkcnzo6lwv5phbtn2ABEg3K6S5QMavH6Wfv6CSsPONVlDOy7', 'xw5r0zOIqPk41s1uqoxamC0Hcx2uTsOCRAwo3EZS437q5Kcgj4bEtSCtzmTU2tJ1xF8a5DVZqh50cw4', 'orIPmORCjjJ151KTXNdDBK3g2CUM5dGyxxLQoU8UQilCnNawXBLx2ZUpf7aDHfahPKBHcGn2YGWvIHb'

Source: C:\Users\user\Desktop\rivalsanticheat.exe

File created: C:\Users\user\AppData\Roaming\rivalsanticheat.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\rivalsanticheat.exe

Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "rivalsanticheat" /tr "C:\Users\user\AppData\Roaming\rivalsanticheat.exe"

Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Check if machine is in data center or colocation facility

Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\rivalsanticheat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\rivalsanticheat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\rivalsanticheat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\rivalsanticheat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\rivalsanticheat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\rivalsanticheat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\rivalsanticheat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: rivalsanticheat.exe, rivalsanticheat.exe.0.dr	Binary or memory string: SBIEDLL.DLL}YJSAPYLO9VHUSE7G89TXWCKCXBFO8HREHWIYGRYZLDVVNAZ5VULKMGKOPKWPYP}QSWQRSJOHBQLUSMTTQGHTRJQF8BF1OCPLQZKEOHTR0ACW6XCRLGYGRJSHLHZVZ}SUJHW7EUZIHNN0RWRPM8ESUKFKTG0FCEBY0QDEEAVKGUX21GI1KP2PMJWEDLM8}NLOJVCRKGYLJZGQ5IIABKWHBKFNVVWUWT07Z9OKXHFDGMUPU8NRHKKOTI50L3H}5M1KPEY5HTROFFK7ROWWMW2JLED2SOEYZYJTDLHZ2AOZYQTHGYFXCEVW1KFG8W}JNDIUC9XO6SAVWXWPBRZFB9OBRKQJ1PTLEEZZGK46HJPZ3DP7BXUZSDU2CYNJ4}XJUKFBMY826TDACXDBKEDBLFTFMW2AEP6MBUMUN2RLFKPIVX8LHRXNMUUVJN42}SMNNVCYIPN2SJIFLUUDHAHSHXCRFVT8I0XCLIBLQPLUI1S01MSCERJTNMP8YFX}YVJJOHDUQSCMZTWF1XPLCS1GN1YPBOWZYMTRYXW99OAZLCK1XZ3SVKKAISC0SP}IU7GVDGSY2IIFFFYHIPVLNPLEMZDCTOTQB5QZFUGU5U6BYUE2RWVCM4G6YKVRS}CT9LQKBROEGNVLKKFAJSSAYNBI3JHV5YQKX5NB1QI52QF9L6M54KXE8CSLILKN}BNT7YZ32CJHCZIQJDHTM6AX6OXSHKHVEYBQ3MPZI135LVFG83K9DY1P1U48O73INFO
Source: rivalsanticheat.exe, 00000000.00000002.3451897857.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\rivalsanticheat.exe	Memory allocated: B40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Memory allocated: 1A7F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Memory allocated: 960000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Memory allocated: 1A480000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Memory allocated: E20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Memory allocated: 1A7F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Memory allocated: 2FB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Memory allocated: 1B210000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\rivalsanticheat.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\rivalsanticheat.exe	Window / User API: threadDelayed 6124			Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Window / User API: threadDelayed 3723			Jump to behavior

Source: C:\Users\user\Desktop\rivalsanticheat.exe TID: 5804	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe TID: 6348	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe TID: 2000	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe TID: 2176	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\rivalsanticheat.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Users\user\Desktop\rivalsanticheat.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\rivalsanticheat.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: Amcache.hve.12.dr	Binary or memory string: VMware
Source: Amcache.hve.12.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.12.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.12.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.12.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.12.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.12.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.12.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.12.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.12.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.12.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.12.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: rivalsanticheat.exe, 00000000.00000002.3453788430.000000001B6A3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.12.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.12.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.12.dr	Binary or memory string: vmci.syshbin`
Source: rivalsanticheat.exe.0.dr	Binary or memory string: vmware
Source: Amcache.hve.12.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.12.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.12.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.12.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.12.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.12.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.12.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.12.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.12.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.12.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.12.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.12.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.12.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.12.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\rivalsanticheat.exe

Code function: 0_2_00007FFD9B8670F1 CheckRemoteDebuggerPresent,

0_2_00007FFD9B8670F1

Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\rivalsanticheat.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\rivalsanticheat.exe

Memory allocated: page read and write | page guard

Source: C:\Users\user\Desktop\rivalsanticheat.exe

Source: rivalsanticheat.exe, 00000000.00000002.3451897857.0000000002A2C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'PING!<Xwormmm>Program Manager<Xwormmm>0
Source: rivalsanticheat.exe, 00000000.00000002.3451897857.0000000002A2C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: rivalsanticheat.exe, 00000000.00000002.3451897857.0000000002A2C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: PING!<Xwormmm>Program Manager<Xwormmm>0
Source: rivalsanticheat.exe, 00000000.00000002.3451897857.0000000002A2C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'PING!<Xwormmm>Program Manager<Xwormmm>0@
Source: rivalsanticheat.exe, 00000000.00000002.3451897857.0000000002A2C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager2

Source: C:\Users\user\Desktop\rivalsanticheat.exe	Queries volume information: C:\Users\user\Desktop\rivalsanticheat.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Queries volume information: C:\Users\user\AppData\Roaming\rivalsanticheat.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Queries volume information: C:\Users\user\AppData\Roaming\rivalsanticheat.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe	Queries volume information: C:\Users\user\AppData\Roaming\rivalsanticheat.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\rivalsanticheat.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: Amcache.hve.12.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.12.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.12.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: rivalsanticheat.exe, 00000000.00000002.3453788430.000000001B671000.00000004.00000020.00020000.00000000.sdmp, rivalsanticheat.exe, 00000000.00000002.3453788430.000000001B6E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.12.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\rivalsanticheat.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\rivalsanticheat.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\rivalsanticheat.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\rivalsanticheat.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\rivalsanticheat.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\rivalsanticheat.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\rivalsanticheat.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: rivalsanticheat.exe, type: SAMPLE
Source: Yara match	File source: 0.0.rivalsanticheat.exe.3f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1648426795.00000000003F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3451897857.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rivalsanticheat.exe PID: 1360, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe, type: DROPPED

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: rivalsanticheat.exe, type: SAMPLE
Source: Yara match	File source: 0.0.rivalsanticheat.exe.3f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1648426795.00000000003F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3451897857.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rivalsanticheat.exe PID: 1360, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 Scheduled Task/Job	12 Process Injection	1 Masquerading	OS Credential Dumping	541 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	151 Virtualization/Sandbox Evasion	Security Account Manager	151 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	22 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Software Packing	DCSync	23 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
rivalsanticheat.exe	79%	ReversingLabs	Win32.Exploit.Xworm
rivalsanticheat.exe	75%	Virustotal		Browse
rivalsanticheat.exe	100%	Avira	HEUR/AGEN.1305769
rivalsanticheat.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\rivalsanticheat.exe	100%	Avira	HEUR/AGEN.1305769
C:\Users\user\AppData\Roaming\rivalsanticheat.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\rivalsanticheat.exe	79%	ReversingLabs	Win32.Exploit.Xworm

Source	Detection	Scanner	Label	Link
jholo.duckdns.org	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ip-api.com	208.95.112.1	true	false		high
jholo.duckdns.org	5.89.185.156	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
jholo.duckdns.org	true	Avira URL Cloud: malware	unknown
http://ip-api.com/line/?fields=hosting	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.12.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	rivalsanticheat.exe, 00000000.00000002.3451897857.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	false
5.89.185.156	jholo.duckdns.org	Italy		30722	VODAFONE-IT-ASNIT	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582991
Start date and time:	2025-01-01 10:40:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Critical Process Termination
Sample name:	rivalsanticheat.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@8/7@19/2
EGA Information:	Successful, ratio: 25%
HCA Information:	Successful, ratio: 100% Number of executed functions: 38 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 4.175.87.197, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target rivalsanticheat.exe, PID 1928 because it is empty
Execution Graph export aborted for target rivalsanticheat.exe, PID 5888 because it is empty
Execution Graph export aborted for target rivalsanticheat.exe, PID 7048 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
04:41:06	API Interceptor	9209440x Sleep call for process: rivalsanticheat.exe modified
09:41:03	Task Scheduler	Run new task: rivalsanticheat path: C:\Users\user\AppData\Roaming\rivalsanticheat.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	rename_me_before.exe	Get hash	malicious	Python Stealer, Exela Stealer	Browse	ip-api.com/json
	vEtDFkAZjO.exe	Get hash	malicious	RL STEALER, StormKitty	Browse	ip-api.com/xml
	Fizzy Loader.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	ip-api.com/json/?fields=225545
	Extreme Injector v3.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	VegaStealer_v2.exe	Get hash	malicious	Ades Stealer, BlackGuard, NitroStealer, VEGA Stealer	Browse	ip-api.com/json/?fields=61439
	SharcHack.exe	Get hash	malicious	Ades Stealer, BlackGuard, NitroStealer, VEGA Stealer, Xmrig	Browse	ip-api.com/json/
	SharcHack.exe	Get hash	malicious	Ades Stealer, BlackGuard, NitroStealer, VEGA Stealer	Browse	ip-api.com/json/?fields=61439
	987656789009800.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	good.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	ip-api.com/json/
	Client-built.exe	Get hash	malicious	Quasar	Browse	ip-api.com/json/
5.89.185.156	uncrypted.exe	Get hash	malicious	DarkVision Rat	Browse	jholo.duckdns.org/upload.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	rename_me_before.exe	Get hash	malicious	Python Stealer, Exela Stealer	Browse	208.95.112.1
	vEtDFkAZjO.exe	Get hash	malicious	RL STEALER, StormKitty	Browse	208.95.112.1
	Fizzy Loader.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	208.95.112.1
	Extreme Injector v3.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	VegaStealer_v2.exe	Get hash	malicious	Ades Stealer, BlackGuard, NitroStealer, VEGA Stealer	Browse	208.95.112.1
	SharcHack.exe	Get hash	malicious	Ades Stealer, BlackGuard, NitroStealer, VEGA Stealer, Xmrig	Browse	208.95.112.1
	SharcHack.exe	Get hash	malicious	Ades Stealer, BlackGuard, NitroStealer, VEGA Stealer	Browse	208.95.112.1
	987656789009800.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	good.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	208.95.112.1
	Client-built.exe	Get hash	malicious	Quasar	Browse	208.95.112.1
jholo.duckdns.org	uncrypted.exe	Get hash	malicious	DarkVision Rat	Browse	5.89.185.156

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
VODAFONE-IT-ASNIT	uncrypted.exe	Get hash	malicious	DarkVision Rat	Browse	5.89.185.156
	kwari.mips.elf	Get hash	malicious	Unknown	Browse	93.150.243.45
	botx.mips.elf	Get hash	malicious	Mirai	Browse	37.178.147.159
	botx.x86.elf	Get hash	malicious	Mirai	Browse	109.119.42.246
	star.ppc.elf	Get hash	malicious	Mirai, Moobot	Browse	5.89.85.231
	mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	5.95.28.147
	db0fa4b8db0333367e9bda3ab68b8042.spc.elf	Get hash	malicious	Mirai, Gafgyt	Browse	37.118.210.45
	loligang.sh4.elf	Get hash	malicious	Mirai	Browse	188.217.53.181
	loligang.mpsl.elf	Get hash	malicious	Mirai	Browse	93.147.74.169
	nabarm7.elf	Get hash	malicious	Unknown	Browse	91.80.70.20
TUT-ASUS	rename_me_before.exe	Get hash	malicious	Python Stealer, Exela Stealer	Browse	208.95.112.1
	vEtDFkAZjO.exe	Get hash	malicious	RL STEALER, StormKitty	Browse	208.95.112.1
	Fizzy Loader.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	208.95.112.1
	Extreme Injector v3.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	VegaStealer_v2.exe	Get hash	malicious	Ades Stealer, BlackGuard, NitroStealer, VEGA Stealer	Browse	208.95.112.1
	SharcHack.exe	Get hash	malicious	Ades Stealer, BlackGuard, NitroStealer, VEGA Stealer, Xmrig	Browse	208.95.112.1
	SharcHack.exe	Get hash	malicious	Ades Stealer, BlackGuard, NitroStealer, VEGA Stealer	Browse	208.95.112.1
	987656789009800.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	good.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	208.95.112.1
	http://au.kirmalk.com/watch.php?vid=7750fd3c8	Get hash	malicious	Unknown	Browse	162.252.214.4

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rivalsanticheat._f56a8e9026b51152de5411fb914b175356b7f3f4_02260eb2_81eee2cd-acf4-422b-bb00-caf571b2d27e\Report.wer

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.3692073450975948
Encrypted:	false
SSDEEP:	192:w4fLVF3081iHxaWz8iyUhlxjKzEzuiFjZ24lO8/4ya:wuLVFE81iRa48ihxWQzuiFjY4lO8/l
MD5:	64C24A1E6D65BADA024C39556E4C63C0
SHA1:	5C3A57DBBE4AC53272EE487DE60D00A33AAC5E29
SHA-256:	7C2DBFB9480B64EF54FD831304BA66CDF437F16D5B6DF3AF0DE8BED080BDCC83
SHA-512:	55CC4572C22159F782322D79156681D6D21A42BDB393DA85EAD146B6AC6CDA48ACA2368F8726942F7789CF2BCC9D0B5A6BF2D4F4C8296D8DDC415EBDDA7DFE82
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.r.i.t.i.c.a.l.P.r.o.c.e.s.s.F.a.u.l.t.2.....E.v.e.n.t.T.i.m.e.=.1.3.3.8.0.1.9.8.2.3.5.0.0.9.1.6.5.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.1.e.e.e.2.c.d.-.a.c.f.4.-.4.2.2.b.-.b.b.0.0.-.c.a.f.5.7.1.b.2.d.2.7.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.9.2.1.b.f.c.6.-.d.b.0.3.-.4.e.6.b.-.b.a.3.3.-.e.8.8.b.5.f.f.6.d.7.e.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.i.v.a.l.s.a.n.t.i.c.h.e.a.t...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.r.i.v.a.l.s.a.n.t.i.c.h.e.a.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.5.5.0.-.0.0.0.1.-.0.0.1.4.-.6.f.a.d.-.5.5.4.1.3.1.5.c.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.7.d.8.4.d.7.f.1.c.0.2.9.8.0.a.2.e.5.f.4.3.4.b.6.8.c.8.a.7.4.5.0.0.0.0.0.0.0.0.!.0.0.0.0.6.d.b.1.c.6.8.1.c.c.8.1.b.8.1.8.b.d.1.5.c.1.a.e.c.2.d.7.0.3.6.2.f.a.9.9.7.a.c.d.!.r.i.v.a.l.s.a.n.t.i.c.h.e.a.t...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2E71.tmp.dmp

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Wed Jan 1 09:43:55 2025, 0x1205a4 type
Category:	dropped
Size (bytes):	529625
Entropy (8bit):	3.0399079424706428
Encrypted:	false
SSDEEP:	6144:bBGqEMpjUItqF3QkOpLskOYCk2IKEO4S02Y6kuQa9k:FGqEMRUCqpQkOp4m
MD5:	DCE4976F781FF17DB934E236C5D9D8C3
SHA1:	3950BBD22CB0E955BAB6DC711A266F0A000FD531
SHA-256:	585CB39061D9403D66B0B8F885032C677598FEF33950B73C4A4AA4BE5ADDC9CE
SHA-512:	24139C0DCB5E37A7C20ACFC43A984A277C15F2A503D58F6C1F62BD331911DA2869EF2367005D9360DB67AC16FCC3873811A1E2EC16BB4111229758B7B412173E
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......[.ug............4...........@'..T.......<....1......H....1......$@..*...........l.......8...........T............W..I............E...........G..............................................................................eJ.......G......Lw......................T.......P.....ug....T........................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3095.tmp.WERInternalMetadata.xml

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	9346
Entropy (8bit):	3.698387683156473
Encrypted:	false
SSDEEP:	192:R6l7wVeJ3216Y9Dy0/gmfk4jN4t8GprU89bxcnroDrf/bm:R6lXJm16YpJ/gmfks4t7xSroDrfq
MD5:	8A0D27042E51866EB8EF625CEC9FE9BE
SHA1:	07D8D72A03C17D8DDEA96D7D82385D682D20F0E5
SHA-256:	009A0BF659AAE8D15FBD3381D1BB6B3D4F4DF412D00FCBF72BC7E1D208BC71D9
SHA-512:	72AB66BEDF33FCA43AE1E16A1E8BBEC1AA7DCE059F89B8623F1EB97BB18A6B5675D144D31B7082F3633A1C693FFA2694382B624B6BC19E45114BFFC702B810A7
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.3.6.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER30D4.tmp.xml

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4958
Entropy (8bit):	4.459273758978835
Encrypted:	false
SSDEEP:	48:cvIwWl8zsxJg771I9zCpWpW8VYPoYm8M4JdSFjKyq8vRrZd/XM0WXid:uIjfDI7ACY7V4FJ+KWDBQid
MD5:	485C807F7106EFBE876AF8DCE4F1163D
SHA1:	3E89567EF2F86343062404F7C143BE1278FFE219
SHA-256:	88628A7D557EFD5640A6D10ECBC6366BACFAA03D5D7533A0CD7517716791BDC6
SHA-512:	312817F6585F597F5AD896D2B2E8CBBE7A68C19CCE03A43CE54B0DA1A8F2CB065C69BB34EC92345FD0E54680E923341AC98C7EA1B457B82F810B304364668245
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="656686" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\rivalsanticheat.exe.log

Process:	C:\Users\user\AppData\Roaming\rivalsanticheat.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.380476433908377
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khap+92n4MNQp3/VXM5gXu9tv:ML9E4KQwKDE4KGKZI6Kh6+84xp3/VclT
MD5:	30E4BDFC34907D0E4D11152CAEBE27FA
SHA1:	825402D6B151041BA01C5117387228EC9B7168BF
SHA-256:	A7B8F7FFB4822570DB1423D61ED74D7F4B538CE73521CC8745BC6B131C18BE63
SHA-512:	89FBCBCDB0BE5AD7A95685CF9AA4330D5B0250440E67DC40C6642260E024F52A402E9381F534A9824D2541B98B02094178A15BF2320148432EDB0D09B5F972BA
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\04de61553901f06e2f763b6f03a6f65a\Microsoft.VisualBasic.ni.dll",0..

C:\Users\user\AppData\Roaming\rivalsanticheat.exe

Process:	C:\Users\user\Desktop\rivalsanticheat.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	73216
Entropy (8bit):	5.918587995511303
Encrypted:	false
SSDEEP:	1536:L0z/WRwKrmTYSnFjjsmXqMFfvb04dPexOLbEi3SiOgjmE:LNi/tlvb0Nx6bEizOgjt
MD5:	DED1521D6EF291309ADE101B3844FA22
SHA1:	6DB1C681CC81B818BD15C1AEC2D70362FA997ACD
SHA-256:	011C10551A4FA592185FD99631AB98F194282638B3A4C072F386CA3F67509CD9
SHA-512:	F4ECB9F991E05B9DEB90506B072294AA00E16D49D26A5D1056A29C960BAECFA87F6858016B91DC6302133ED01543BC4ABA7777F8EDE999869C364E4E37D1AFA9
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe, Author: Joe Security Rule: rat_win_xworm_v3, Description: Finds XWorm (version XClient, v3) samples based on characteristic strings, Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe, Author: Sekoia.io Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 79%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...:.tg.............................2... ...@....@.. ....................................@..................................2..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................2......H........Y..(.......&.....................................................(.....r...p. .^....(.....r=..p. .1...s.........s.........s.........s..........r...p. ....r9..p. ..e..r...p. .....r5..p. ~.H..r...p. g ....((....r3..p. E/...r...p. S....(...-.(+...,.+.(,...,.+.()...,.+.((...,..(F...&(....&+..+5sY... .... .'..oZ...(...~....-.(Y...(K...~....o[...&.-..rK..p. .~..r...p. .....rG..p. .x!..r...p. ....rC..p. ..W..r...p. .O...r?..p.r...p

C:\Windows\appcompat\Programs\Amcache.hve

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465587158864858
Encrypted:	false
SSDEEP:	6144:/IXfpi67eLPU9skLmb0b4LWSPKaJG8nAgejZMMhA2gX4WABl0uNfdwBCswSbh:wXD94LWlLZMM6YFH1+h
MD5:	AC5EDA8C6E4800E6672D3364ADD03750
SHA1:	D177D57451FB1485FC37820EAC031CD1CBDE7C2E
SHA-256:	5553CDA4EACD5F8E33395E8ECDFEEF3D1AB843D5E88D7E34AD55B58A9A04F493
SHA-512:	30C62A8D5D37DCCC3CF67AA92ABD99BE5F1FBCF385F963BD6E4958710696749709962F072EAC1DAEAD28070FCE3ED2306B393CA8BCB06C710B8AA9D4CED1690B
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..'.1\..............................................................................................................................................................................................................................................................................................................................................%V0.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.918587995511303
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	rivalsanticheat.exe
File size:	73'216 bytes
MD5:	ded1521d6ef291309ade101b3844fa22
SHA1:	6db1c681cc81b818bd15c1aec2d70362fa997acd
SHA256:	011c10551a4fa592185fd99631ab98f194282638b3a4c072f386ca3f67509cd9
SHA512:	f4ecb9f991e05b9deb90506b072294aa00e16d49d26a5d1056a29c960baecfa87f6858016b91dc6302133ed01543bc4aba7777f8ede999869c364e4e37d1afa9
SSDEEP:	1536:L0z/WRwKrmTYSnFjjsmXqMFfvb04dPexOLbEi3SiOgjmE:LNi/tlvb0Nx6bEizOgjt
TLSH:	28638C187BFA4125F1BFAFB12DF17166CA38F2236913D65F68C4028A0A13E85CD517B9
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...:.tg.............................2... ...@....@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4132fe
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6774893A [Wed Jan 1 00:15:54 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x132ac	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x14000	0x4ee	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x16000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x11304	0x11400	28290520b744afd6c1982f66461fb07b	False	0.6047469429347826	data	5.9904173517895885	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x14000	0x4ee	0x600	97a703be0af2c97af4d2ac4158258e7b	False	0.3763020833333333	data	3.765133107182464	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x16000	0xc	0x200	af8e124215825ea9a0c46d119ae8548c	False	0.041015625	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x140a0	0x264	data			0.4591503267973856
RT_MANIFEST	0x14304	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-01T10:41:40.309380+0100	2855924	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.4	49740	5.89.185.156	7777	TCP
2025-01-01T10:42:27.747710+0100	2853193	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.4	49864	5.89.185.156	7777	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 1, 2025 10:41:00.617403030 CET	49732	80	192.168.2.4	208.95.112.1
Jan 1, 2025 10:41:00.622232914 CET	80	49732	208.95.112.1	192.168.2.4
Jan 1, 2025 10:41:00.622292995 CET	49732	80	192.168.2.4	208.95.112.1
Jan 1, 2025 10:41:00.623034954 CET	49732	80	192.168.2.4	208.95.112.1
Jan 1, 2025 10:41:00.627836943 CET	80	49732	208.95.112.1	192.168.2.4
Jan 1, 2025 10:41:01.088197947 CET	80	49732	208.95.112.1	192.168.2.4
Jan 1, 2025 10:41:01.137945890 CET	49732	80	192.168.2.4	208.95.112.1
Jan 1, 2025 10:41:07.614912987 CET	49733	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:41:07.619731903 CET	7777	49733	5.89.185.156	192.168.2.4
Jan 1, 2025 10:41:07.619800091 CET	49733	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:41:08.139451027 CET	49733	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:41:08.144311905 CET	7777	49733	5.89.185.156	192.168.2.4
Jan 1, 2025 10:41:22.939548969 CET	49733	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:41:22.944509029 CET	7777	49733	5.89.185.156	192.168.2.4
Jan 1, 2025 10:41:28.989173889 CET	7777	49733	5.89.185.156	192.168.2.4
Jan 1, 2025 10:41:28.989233017 CET	49733	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:41:29.028706074 CET	49733	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:41:29.030287027 CET	49740	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:41:29.033487082 CET	7777	49733	5.89.185.156	192.168.2.4
Jan 1, 2025 10:41:29.035146952 CET	7777	49740	5.89.185.156	192.168.2.4
Jan 1, 2025 10:41:29.035204887 CET	49740	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:41:29.063221931 CET	49740	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:41:29.068033934 CET	7777	49740	5.89.185.156	192.168.2.4
Jan 1, 2025 10:41:40.309380054 CET	49740	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:41:40.314246893 CET	7777	49740	5.89.185.156	192.168.2.4
Jan 1, 2025 10:41:50.437096119 CET	7777	49740	5.89.185.156	192.168.2.4
Jan 1, 2025 10:41:50.437161922 CET	49740	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:41:51.237055063 CET	49740	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:41:51.238343000 CET	49741	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:41:51.242044926 CET	7777	49740	5.89.185.156	192.168.2.4
Jan 1, 2025 10:41:51.243226051 CET	7777	49741	5.89.185.156	192.168.2.4
Jan 1, 2025 10:41:51.243292093 CET	49741	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:41:51.267394066 CET	49741	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:41:51.272213936 CET	7777	49741	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:05.732167959 CET	49741	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:05.736938953 CET	7777	49741	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:07.388851881 CET	49741	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:07.393778086 CET	7777	49741	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:07.550321102 CET	80	49732	208.95.112.1	192.168.2.4
Jan 1, 2025 10:42:07.550384998 CET	49732	80	192.168.2.4	208.95.112.1
Jan 1, 2025 10:42:09.950885057 CET	49741	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:09.955713034 CET	7777	49741	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:11.372742891 CET	49741	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:11.377587080 CET	7777	49741	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:12.601344109 CET	7777	49741	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:12.603945017 CET	49741	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:16.216346979 CET	49741	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:16.531877995 CET	49741	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:16.671726942 CET	7777	49741	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:16.671761990 CET	7777	49741	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:16.671874046 CET	49741	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:16.803872108 CET	49864	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:16.808777094 CET	7777	49864	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:16.811968088 CET	49864	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:16.858380079 CET	49864	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:16.863244057 CET	7777	49864	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:20.091787100 CET	49864	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:20.096579075 CET	7777	49864	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:22.091423988 CET	49864	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:22.096292019 CET	7777	49864	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:22.169660091 CET	49864	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:22.174595118 CET	7777	49864	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:23.107104063 CET	49864	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:23.111902952 CET	7777	49864	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:27.263343096 CET	49864	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:27.268143892 CET	7777	49864	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:27.435226917 CET	49864	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:27.440099955 CET	7777	49864	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:27.513331890 CET	49864	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:27.518162966 CET	7777	49864	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:27.544620037 CET	49864	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:27.549464941 CET	7777	49864	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:27.575833082 CET	49864	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:27.580662966 CET	7777	49864	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:27.591490984 CET	49864	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:27.596230984 CET	7777	49864	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:27.607016087 CET	49864	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:27.611814976 CET	7777	49864	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:27.622798920 CET	49864	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:27.627614021 CET	7777	49864	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:27.716500998 CET	49864	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:27.721338987 CET	7777	49864	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:27.732064962 CET	49864	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:27.736819029 CET	7777	49864	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:27.747709990 CET	49864	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:27.752506971 CET	7777	49864	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:27.841451883 CET	49864	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:27.846208096 CET	7777	49864	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:27.857214928 CET	49864	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:27.861984968 CET	7777	49864	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:27.872669935 CET	49864	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:27.877528906 CET	7777	49864	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:27.950772047 CET	49864	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:27.955585957 CET	7777	49864	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:33.107264042 CET	49864	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:33.112006903 CET	7777	49864	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:38.138473988 CET	49864	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:38.143351078 CET	7777	49864	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:38.201915979 CET	7777	49864	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:38.201975107 CET	49864	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:41.093966007 CET	49732	80	192.168.2.4	208.95.112.1
Jan 1, 2025 10:42:41.099047899 CET	80	49732	208.95.112.1	192.168.2.4
Jan 1, 2025 10:42:43.169529915 CET	49864	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:43.172161102 CET	50009	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:43.174428940 CET	7777	49864	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:43.177005053 CET	7777	50009	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:43.179038048 CET	50009	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:43.227529049 CET	50009	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:43.232337952 CET	7777	50009	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:43.498526096 CET	50009	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:43.621210098 CET	7777	50009	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:43.685513020 CET	50009	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:43.690330029 CET	7777	50009	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:43.732117891 CET	50009	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:43.736933947 CET	7777	50009	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:43.763341904 CET	50009	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:43.768192053 CET	7777	50009	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:43.825860023 CET	50009	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:43.830892086 CET	7777	50009	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:53.935339928 CET	50009	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:53.940268993 CET	7777	50009	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:53.950946093 CET	50009	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:53.955720901 CET	7777	50009	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:53.966514111 CET	50009	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:53.971302032 CET	7777	50009	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:53.982135057 CET	50009	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:53.986965895 CET	7777	50009	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:53.997718096 CET	50009	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:54.002454996 CET	7777	50009	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:54.013477087 CET	50009	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:54.018345118 CET	7777	50009	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:54.029076099 CET	50009	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:54.033840895 CET	7777	50009	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:54.044553995 CET	50009	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:54.049319029 CET	7777	50009	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:54.060199976 CET	50009	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:54.065012932 CET	7777	50009	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:54.107144117 CET	50009	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:54.111923933 CET	7777	50009	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:54.138432026 CET	50009	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:54.143249989 CET	7777	50009	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:54.156593084 CET	50009	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:54.161472082 CET	7777	50009	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:54.169609070 CET	50009	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:54.174402952 CET	7777	50009	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:54.232199907 CET	50009	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:54.237086058 CET	7777	50009	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:54.263359070 CET	50009	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:54.268153906 CET	7777	50009	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:54.278999090 CET	50009	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:54.283834934 CET	7777	50009	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:54.294589996 CET	50009	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:54.299395084 CET	7777	50009	5.89.185.156	192.168.2.4
Jan 1, 2025 10:42:59.607177973 CET	50009	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:42:59.612118006 CET	7777	50009	5.89.185.156	192.168.2.4
Jan 1, 2025 10:43:04.439400911 CET	50009	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:43:04.444349051 CET	7777	50009	5.89.185.156	192.168.2.4
Jan 1, 2025 10:43:04.584191084 CET	7777	50009	5.89.185.156	192.168.2.4
Jan 1, 2025 10:43:04.584310055 CET	50009	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:43:09.497705936 CET	50009	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:43:09.500262022 CET	50010	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:43:09.502669096 CET	7777	50009	5.89.185.156	192.168.2.4
Jan 1, 2025 10:43:09.505047083 CET	7777	50010	5.89.185.156	192.168.2.4
Jan 1, 2025 10:43:09.505103111 CET	50010	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:43:09.542629957 CET	50010	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:43:09.547503948 CET	7777	50010	5.89.185.156	192.168.2.4
Jan 1, 2025 10:43:09.560264111 CET	50010	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:43:09.565206051 CET	7777	50010	5.89.185.156	192.168.2.4
Jan 1, 2025 10:43:09.607085943 CET	50010	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:43:09.611831903 CET	7777	50010	5.89.185.156	192.168.2.4
Jan 1, 2025 10:43:09.641005993 CET	50010	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:43:09.645874023 CET	7777	50010	5.89.185.156	192.168.2.4
Jan 1, 2025 10:43:20.263425112 CET	50010	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:43:20.268349886 CET	7777	50010	5.89.185.156	192.168.2.4
Jan 1, 2025 10:43:29.997853041 CET	50010	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:43:30.002736092 CET	7777	50010	5.89.185.156	192.168.2.4
Jan 1, 2025 10:43:30.013398886 CET	50010	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:43:30.018223047 CET	7777	50010	5.89.185.156	192.168.2.4
Jan 1, 2025 10:43:30.060398102 CET	50010	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:43:30.065243006 CET	7777	50010	5.89.185.156	192.168.2.4
Jan 1, 2025 10:43:30.897444010 CET	7777	50010	5.89.185.156	192.168.2.4
Jan 1, 2025 10:43:30.901999950 CET	50010	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:43:35.106969118 CET	50010	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:43:35.111809969 CET	7777	50010	5.89.185.156	192.168.2.4
Jan 1, 2025 10:43:35.227005959 CET	50011	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:43:35.234124899 CET	7777	50011	5.89.185.156	192.168.2.4
Jan 1, 2025 10:43:35.234913111 CET	50011	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:43:35.290569067 CET	50011	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:43:35.299021006 CET	7777	50011	5.89.185.156	192.168.2.4
Jan 1, 2025 10:43:36.388612986 CET	50011	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:43:36.393491030 CET	7777	50011	5.89.185.156	192.168.2.4
Jan 1, 2025 10:43:38.575881958 CET	50011	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:43:38.580868959 CET	7777	50011	5.89.185.156	192.168.2.4
Jan 1, 2025 10:43:40.404015064 CET	50011	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:43:40.408926010 CET	7777	50011	5.89.185.156	192.168.2.4
Jan 1, 2025 10:43:40.419620991 CET	50011	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:43:40.424417973 CET	7777	50011	5.89.185.156	192.168.2.4
Jan 1, 2025 10:43:42.341576099 CET	50011	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:43:42.346602917 CET	7777	50011	5.89.185.156	192.168.2.4
Jan 1, 2025 10:43:45.341978073 CET	50011	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:43:45.346913099 CET	7777	50011	5.89.185.156	192.168.2.4
Jan 1, 2025 10:43:55.638394117 CET	50011	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:43:55.643214941 CET	7777	50011	5.89.185.156	192.168.2.4
Jan 1, 2025 10:43:55.747844934 CET	50011	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:43:55.752737999 CET	7777	50011	5.89.185.156	192.168.2.4
Jan 1, 2025 10:43:56.620636940 CET	7777	50011	5.89.185.156	192.168.2.4
Jan 1, 2025 10:43:56.626106977 CET	50011	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:43:57.566631079 CET	50011	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:44:04.793297052 CET	50012	80	192.168.2.4	208.95.112.1
Jan 1, 2025 10:44:04.798074961 CET	80	50012	208.95.112.1	192.168.2.4
Jan 1, 2025 10:44:04.798281908 CET	50012	80	192.168.2.4	208.95.112.1
Jan 1, 2025 10:44:04.798460960 CET	50012	80	192.168.2.4	208.95.112.1
Jan 1, 2025 10:44:04.803225994 CET	80	50012	208.95.112.1	192.168.2.4
Jan 1, 2025 10:44:05.273091078 CET	80	50012	208.95.112.1	192.168.2.4
Jan 1, 2025 10:44:05.327220917 CET	50012	80	192.168.2.4	208.95.112.1
Jan 1, 2025 10:44:10.675205946 CET	50013	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:44:11.685003042 CET	50013	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:44:13.700748920 CET	50013	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:44:17.700638056 CET	50013	7777	192.168.2.4	5.89.185.156
Jan 1, 2025 10:44:25.700781107 CET	50013	7777	192.168.2.4	5.89.185.156

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 1, 2025 10:41:00.603971958 CET	64387	53	192.168.2.4	1.1.1.1
Jan 1, 2025 10:41:00.611074924 CET	53	64387	1.1.1.1	192.168.2.4
Jan 1, 2025 10:41:07.474582911 CET	53638	53	192.168.2.4	1.1.1.1
Jan 1, 2025 10:41:07.589572906 CET	53	53638	1.1.1.1	192.168.2.4
Jan 1, 2025 10:42:16.218815088 CET	58478	53	192.168.2.4	1.1.1.1
Jan 1, 2025 10:42:16.797254086 CET	53	58478	1.1.1.1	192.168.2.4
Jan 1, 2025 10:43:35.109782934 CET	64471	53	192.168.2.4	1.1.1.1
Jan 1, 2025 10:43:35.225853920 CET	53	64471	1.1.1.1	192.168.2.4
Jan 1, 2025 10:44:04.782443047 CET	60901	53	192.168.2.4	1.1.1.1
Jan 1, 2025 10:44:04.790056944 CET	53	60901	1.1.1.1	192.168.2.4
Jan 1, 2025 10:44:37.623851061 CET	61720	53	192.168.2.4	1.1.1.1
Jan 1, 2025 10:44:38.622615099 CET	61720	53	192.168.2.4	1.1.1.1
Jan 1, 2025 10:44:39.623495102 CET	61720	53	192.168.2.4	1.1.1.1
Jan 1, 2025 10:44:41.622618914 CET	61720	53	192.168.2.4	1.1.1.1
Jan 1, 2025 10:44:45.740180016 CET	61720	53	192.168.2.4	1.1.1.1
Jan 1, 2025 10:44:49.732533932 CET	49408	53	192.168.2.4	1.1.1.1
Jan 1, 2025 10:44:50.747586012 CET	49408	53	192.168.2.4	1.1.1.1
Jan 1, 2025 10:44:51.763230085 CET	49408	53	192.168.2.4	1.1.1.1
Jan 1, 2025 10:44:53.763253927 CET	49408	53	192.168.2.4	1.1.1.1
Jan 1, 2025 10:44:57.779012918 CET	49408	53	192.168.2.4	1.1.1.1
Jan 1, 2025 10:44:58.264087915 CET	61164	53	192.168.2.4	1.1.1.1
Jan 1, 2025 10:44:59.263200998 CET	61164	53	192.168.2.4	1.1.1.1
Jan 1, 2025 10:45:00.287980080 CET	61164	53	192.168.2.4	1.1.1.1
Jan 1, 2025 10:45:02.278919935 CET	61164	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 1, 2025 10:41:00.603971958 CET	192.168.2.4	1.1.1.1	0x2398	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Jan 1, 2025 10:41:07.474582911 CET	192.168.2.4	1.1.1.1	0x5c65	Standard query (0)	jholo.duckdns.org	A (IP address)	IN (0x0001)	false
Jan 1, 2025 10:42:16.218815088 CET	192.168.2.4	1.1.1.1	0xe696	Standard query (0)	jholo.duckdns.org	A (IP address)	IN (0x0001)	false
Jan 1, 2025 10:43:35.109782934 CET	192.168.2.4	1.1.1.1	0xe363	Standard query (0)	jholo.duckdns.org	A (IP address)	IN (0x0001)	false
Jan 1, 2025 10:44:04.782443047 CET	192.168.2.4	1.1.1.1	0xdbab	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Jan 1, 2025 10:44:37.623851061 CET	192.168.2.4	1.1.1.1	0xea83	Standard query (0)	jholo.duckdns.org	A (IP address)	IN (0x0001)	false
Jan 1, 2025 10:44:38.622615099 CET	192.168.2.4	1.1.1.1	0xea83	Standard query (0)	jholo.duckdns.org	A (IP address)	IN (0x0001)	false
Jan 1, 2025 10:44:39.623495102 CET	192.168.2.4	1.1.1.1	0xea83	Standard query (0)	jholo.duckdns.org	A (IP address)	IN (0x0001)	false
Jan 1, 2025 10:44:41.622618914 CET	192.168.2.4	1.1.1.1	0xea83	Standard query (0)	jholo.duckdns.org	A (IP address)	IN (0x0001)	false
Jan 1, 2025 10:44:45.740180016 CET	192.168.2.4	1.1.1.1	0xea83	Standard query (0)	jholo.duckdns.org	A (IP address)	IN (0x0001)	false
Jan 1, 2025 10:44:49.732533932 CET	192.168.2.4	1.1.1.1	0x79d8	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Jan 1, 2025 10:44:50.747586012 CET	192.168.2.4	1.1.1.1	0x79d8	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Jan 1, 2025 10:44:51.763230085 CET	192.168.2.4	1.1.1.1	0x79d8	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Jan 1, 2025 10:44:53.763253927 CET	192.168.2.4	1.1.1.1	0x79d8	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Jan 1, 2025 10:44:57.779012918 CET	192.168.2.4	1.1.1.1	0x79d8	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Jan 1, 2025 10:44:58.264087915 CET	192.168.2.4	1.1.1.1	0xf8af	Standard query (0)	jholo.duckdns.org	A (IP address)	IN (0x0001)	false
Jan 1, 2025 10:44:59.263200998 CET	192.168.2.4	1.1.1.1	0xf8af	Standard query (0)	jholo.duckdns.org	A (IP address)	IN (0x0001)	false
Jan 1, 2025 10:45:00.287980080 CET	192.168.2.4	1.1.1.1	0xf8af	Standard query (0)	jholo.duckdns.org	A (IP address)	IN (0x0001)	false
Jan 1, 2025 10:45:02.278919935 CET	192.168.2.4	1.1.1.1	0xf8af	Standard query (0)	jholo.duckdns.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 1, 2025 10:41:00.611074924 CET	1.1.1.1	192.168.2.4	0x2398	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Jan 1, 2025 10:41:07.589572906 CET	1.1.1.1	192.168.2.4	0x5c65	No error (0)	jholo.duckdns.org	5.89.185.156	A (IP address)	IN (0x0001)	false
Jan 1, 2025 10:42:16.797254086 CET	1.1.1.1	192.168.2.4	0xe696	No error (0)	jholo.duckdns.org	5.89.185.156	A (IP address)	IN (0x0001)	false
Jan 1, 2025 10:43:35.225853920 CET	1.1.1.1	192.168.2.4	0xe363	No error (0)	jholo.duckdns.org	5.89.185.156	A (IP address)	IN (0x0001)	false
Jan 1, 2025 10:44:04.790056944 CET	1.1.1.1	192.168.2.4	0xdbab	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	208.95.112.1	80	1360	C:\Users\user\Desktop\rivalsanticheat.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 10:41:00.623034954 CET	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jan 1, 2025 10:41:01.088197947 CET	175	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 09:41:00 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.4	50012	208.95.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 10:44:04.798460960 CET	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jan 1, 2025 10:44:05.273091078 CET	175	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 09:44:04 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Target ID:	0
Start time:	04:40:55
Start date:	01/01/2025
Path:	C:\Users\user\Desktop\rivalsanticheat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\rivalsanticheat.exe"
Imagebase:	0x3f0000
File size:	73'216 bytes
MD5 hash:	DED1521D6EF291309ADE101B3844FA22
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000000.1648426795.00000000003F2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000000.1648426795.00000000003F2000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.3451897857.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Target ID:	1
Start time:	04:41:01
Start date:	01/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "rivalsanticheat" /tr "C:\Users\user\AppData\Roaming\rivalsanticheat.exe"
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	04:41:01
Start date:	01/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	04:41:03
Start date:	01/01/2025
Path:	C:\Users\user\AppData\Roaming\rivalsanticheat.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\rivalsanticheat.exe
Imagebase:	0x220000
File size:	73'216 bytes
MD5 hash:	DED1521D6EF291309ADE101B3844FA22
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe, Author: Joe Security Rule: rat_win_xworm_v3, Description: Finds XWorm (version XClient, v3) samples based on characteristic strings, Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe, Author: Sekoia.io Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\rivalsanticheat.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 79%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	7
Start time:	04:42:01
Start date:	01/01/2025
Path:	C:\Users\user\AppData\Roaming\rivalsanticheat.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\rivalsanticheat.exe
Imagebase:	0x5d0000
File size:	73'216 bytes
MD5 hash:	DED1521D6EF291309ADE101B3844FA22
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	9
Start time:	04:43:00
Start date:	01/01/2025
Path:	C:\Users\user\AppData\Roaming\rivalsanticheat.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\rivalsanticheat.exe
Imagebase:	0xfb0000
File size:	73'216 bytes
MD5 hash:	DED1521D6EF291309ADE101B3844FA22
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	12
Start time:	04:43:54
Start date:	01/01/2025
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 1360 -s 1900
Imagebase:	0x7ff63d330000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true