60ffa1b9286ecbabaff06c3a9f5cbbac181087003cecedcd90d4878a78571d17

Analysis

user interaction
yes
max time kernel
898s
max time network
435s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 13:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RustDevblogCheatChecker-main/Run-HDD.bat
Size 151B
Sample261102-qlzbjsfc27
SHA256 60ffa1b9286ecbabaff06c3a9f5cbbac181087003cecedcd90d4878a78571d17
MD5 2699235ac26647cfa1d96cf28635f7f0
SHA1 f2d0e1d332d42fc04fb7b6b49b05773c759cbdd1
SHA512 9bf8355f9f7e4f5902312d4fb7c33b144e3b369b9d95180cac23d32ec3579c4b13662e619eb3761d743dad5dad65bae6f83b85e02e230a78887a6abbb2ae8836
TLSH
T171C08C446AA9AB88E1A34C2150EB60605C1FA207A3084D21B3A2823F200E285C1651D6
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
8	4260	powershell.exe
13	4260	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4008	Everything.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
6	raw.githubusercontent.com
8	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	Everything.exe
File opened (read-only)	\??\R:	Everything.exe
File opened (read-only)	\??\W:	Everything.exe
File opened (read-only)	\??\L:	Everything.exe
File opened (read-only)	\??\M:	Everything.exe
File opened (read-only)	\??\T:	Everything.exe
File opened (read-only)	\??\U:	Everything.exe
File opened (read-only)	\??\V:	Everything.exe
File opened (read-only)	\??\Z:	Everything.exe
File opened (read-only)	\??\S:	Everything.exe
File opened (read-only)	\??\X:	Everything.exe
File opened (read-only)	\??\Y:	Everything.exe
File opened (read-only)	\??\O:	Everything.exe
File opened (read-only)	\??\P:	Everything.exe
File opened (read-only)	\??\Q:	Everything.exe
File opened (read-only)	\??\A:	Everything.exe
File opened (read-only)	\??\E:	Everything.exe
File opened (read-only)	\??\G:	Everything.exe
File opened (read-only)	\??\H:	Everything.exe
File opened (read-only)	\??\I:	Everything.exe
File opened (read-only)	\??\B:	Everything.exe
File opened (read-only)	\??\J:	Everything.exe
File opened (read-only)	\??\K:	Everything.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4260	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1584	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4260	powershell.exe
4260	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4260	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4008	Everything.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4008	Everything.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4008	Everything.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 4260	1584	cmd.exe	84
PID 4260 wrote to memory of 4320	4260	powershell.exe	85
PID 4320 wrote to memory of 1644	4320	csc.exe	86
PID 4260 wrote to memory of 1564	4260	powershell.exe	87
PID 4260 wrote to memory of 4008	4260	powershell.exe	93
PID 4260 wrote to memory of 384	4260	powershell.exe	94
PID 4260 wrote to memory of 4924	4260	powershell.exe	97
PID 4260 wrote to memory of 4596	4260	powershell.exe	98
PID 4260 wrote to memory of 1756	4260	powershell.exe	99
PID 4260 wrote to memory of 2992	4260	powershell.exe	100
PID 4260 wrote to memory of 3920	4260	powershell.exe	101
PID 4260 wrote to memory of 2684	4260	powershell.exe	102
PID 4260 wrote to memory of 3468	4260	powershell.exe	103
PID 4260 wrote to memory of 976	4260	powershell.exe	104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Run-HDD.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\Find-File.ps1" -Threads 2
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\caaaudwm\caaaudwm.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4320
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEB74.tmp" "c:\Users\Admin\AppData\Local\Temp\caaaudwm\CSC174F0006902E404BBD21A6150A69CDB.TMP"
      4⤵
      PID:1644
- - C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
    "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-everything-version
    3⤵
    PID:1564
- - C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\Everything.exe
    "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\Everything.exe" -startup
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:4008
- - C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
    "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-everything-version
    3⤵
    PID:384
- - C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
    "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-result-count file:
    3⤵
    PID:4924
- - C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
    "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-result-count file:
    3⤵
    PID:4596
- - C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
    "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-result-count file:
    3⤵
    PID:1756
- - C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
    "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-result-count file:
    3⤵
    PID:2992
- - C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
    "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-result-count file:
    3⤵
    PID:3920
- - C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
    "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-result-count file:
    3⤵
    PID:2684
- - C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
    "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-result-count file:
    3⤵
    PID:3468
- - C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
    "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" file:<size:40|size:280|size:478|size:556|size:734|size:929|size:1001|size:1536|size:1897|size:1902|size:3130|size:3270|size:3556|size:3584|size:4027|size:4565|size:5414|size:5632|size:6052|size:6240|size:6649|size:6660|size:12729|size:12936|size:13081|size:13283|size:14632|size:14711|size:15360|size:15432|size:18432|size:18659|size:19432|size:22528|size:25434|size:27648|size:27930|size:28928|size:31583|size:34217|size:34304|size:34816|size:36307|size:37376|size:38360|size:42456|size:45016|size:48128|size:49624|size:59392|size:62464|size:62976|size:67019|size:68608|size:75264|size:77312|size:87552|size:91136|size:103936|size:104960|size:112336|size:114800|size:116224|size:122368|size:130560|size:132096|size:139912|size:141824|size:142336|size:145192|size:151664|size:154112|size:164352|size:166912|size:167424|size:169648|size:178176|size:185344|size:186368|size:187392|size:190464|size:202240|size:206336|size:226827|size:231045|size:233640|size:235008|size:271080|size:292864|size:307712|size:340480|size:343040|size:349696|size:395776|size:406976|size:418872|size:421584|size:422872|size:425472|size:438784|size:443904|size:458011|size:466544|size:489472|size:500050|size:529920|size:531968|size:532992|size:535512|size:538112|size:541184|size:551936|size:555520|size:559104|size:564736|size:568183|size:581120|size:616448|size:623104|size:629760|size:633856|size:644096|size:646134|size:651776|size:656384|size:711539|size:733905|size:735168|size:741384|size:754688|size:790368|size:795648|size:808448|size:843776|size:870400|size:913339|size:921088|size:978432|size:991888|size:1028096|size:1070592|size:1091584|size:1092608|size:1108992|size:1180160|size:1301159|size:1319424|size:1413120|size:1499136|size:1515520|size:1517568|size:1554432|size:1589143|size:1656832|size:1773056|size:1814016|size:1831936|size:1938944|size:1956797|size:1959424|size:1968128|size:1969152|size:2065408|size:2171392|size:2286439|size:2305536|size:2345984|size:2685952|size:2810880|size:2956288|size:3025920|size:3060736|size:3083776|size:3102208|size:3115008|size:3131904|size:3369584|size:3456000|size:3587584|size:3679232|size:3798016|size:4051968|size:4063744|size:4159512|size:4487168|size:4518400|size:4559214|size:4763648|size:5347164|size:6645248|size:7183978|size:7384576|size:8603054|size:9853176|size:17778738|size:18446935|size:21806272|size:23287638|size:23817775|size:24816079|size:28111360|size:35636224|size:37271552|size:61257728|size:65035264|size:74311003|size:177803506|size:266191481> -export-csv C:\Users\Admin\AppData\Local\Temp\everything-candidates-143a0f0463204cc0aa18295f6773f9c7.csv -no-header -full-path-and-name -size -size-format 1
    3⤵
    PID:976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESEB74.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESEB74.tmp
Size 1KB
SHA256 844e2c0e3fd5cabc7fa5f6f1e8fdd30c376b30149c863049234cf7582f7269bc
MD5 50680f47d8653c8048618e93be918f5f
SHA1 46649ccae8a7d4637f01b80161df65c10414ea87
SHA512 8b1f7b6de71ccf956dc6d49ace6c8faa11af4e87e12bd47df6943e651e85501af83927d5e4784592ce55d61acb084dd7c8140fed8037a9cd000579de99b7d704
TLSH
T12721CC0493EC434FF1734731A9F6572F9675FE55AFA293AB8980822C1C41604EEA1EB2
MD5 SHA1 SHA512 TLSH

Submit Download

Everything.exe

Path C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\Everything.exe
Size 2.2MB
SHA256 f191f756996a14a11e5445fa7103d302efd510cf2fbf920e6c0c8ed51d512e36
MD5 464df9e59802fb4d6f4a0c743a5ded94
SHA1 2aaa17b0aceb7d017c47ea0110de97e29d920ace
SHA512 b95bba8a61f316d30d031ca2ad2307b2a42c89afb1f96edb03231a50120dd33700ee221e010b81242aee4427ac26c3d203c86562f0bdfa1b7662b9cd367768ec
SSDEEP 49152:/ota7/dTkNnVxSOEad3Gw6ffub5ro1FcyPiPRr4rAF:/oCGnF3l6uUmsW
TLSH
T15AB57E43933500E9E9ABC03689569623E7B1F4144732A7EF5690EEB12F237F15A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_twtys0bq.vby.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_twtys0bq.vby.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

caaaudwm.dll

Path C:\Users\Admin\AppData\Local\Temp\caaaudwm\caaaudwm.dll
Size 10KB
SHA256 adaa5d2894009c92287c0be38c2c76f1aaec0d65bce55aafce10812959902d24
MD5 f2a2f45cad4c198c3162470d424fe037
SHA1 970ee1f347263ef9b877746dd3a686b2e687b3bd
SHA512 86de681bb875406d11950b59f41dd185b11d443466b2c70daa6cd73b7a336c78cddab6d3c2703172e8dd7fee63f4d3a27a803f843328a37cca5b936bfb9685ef
SSDEEP 192:MeV/By+pJF8abjd0ZBslf/DbmSEDVpy061ZbzzWLquqN+:Rvp9d0MxDbGny06jX8a4
TLSH
T12722190A73DC8A7AC86F4B7C20E1175A5670D617A723EF1BBCC4A1581C937A84E752B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

everything-candidates-143a0f0463204cc0aa18295f6773f9c7.csv

Path C:\Users\Admin\AppData\Local\Temp\everything-candidates-143a0f0463204cc0aa18295f6773f9c7.csv
Size 708KB
SHA256 180900aee51c8788014f526c9902103fe62819c0f792092a5e1d9dea1868830e
MD5 dea26a386cfba970a88cd8cb34111674
SHA1 c72aed58294ebed1b39cbea47933477e5df7b23d
SHA512 c1aeb1e2f0b0b413a330086f825433e6fa623514285677c750a953529bdb6422c9a937a80a5f6bcd5706fe3ad3779c7115bba6fb6caa716bbf8ad7c6bf33a771
SSDEEP 6144:/C74rtMS6rzTh+w3oasEGHWiyhIaIiI7UWKnXE+W5L78vnFSe92FkXaB://rRQiEcU7XEp6ObB
TLSH
T1B4F41360D37105F3D2F35C52267E0B44F11B6283B6815E78F3A67021FE9A147AEB69AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC174F0006902E404BBD21A6150A69CDB.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\caaaudwm\CSC174F0006902E404BBD21A6150A69CDB.TMP
Size 652B
SHA256 6af390fa8d2ff5a03a60ff66df7cc7fa72e2bf79612dea6039212695fda84fa7
MD5 89602ff7ee2b7cc0d3977b39b2c228b3
SHA1 e2567686decf51f2d1195340266b2dc445a6c2d4
SHA512 8161915e45660727a104c6a3e645dedad37e104f9ff092b81909511fb8d6b85db0ed886468bdcfb9b1553da5adddeaa944ce01b39c82f605aa87c3f671decb76
TLSH
T1B4F05E0973F8524EF1F34B70BDF6936795A9BC66DE3293ED184053192C64A108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

caaaudwm.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\caaaudwm\caaaudwm.0.cs
Size 11KB
SHA256 b2c4ab171baaf29e36ef3ed59027a68437a9b1b74c803a46c7717e3c3985ee0e
MD5 a3a3c564a75a927d0220c2ef741743dd
SHA1 0689adf722e1e848583168c176a9877261c1316f
SHA512 422febe123bf0776c618cfd0cb7a5f366302982e7404af349ed0b755c4990d95e6242b9a917fededb787e0ebd62ef7c90003062ed79c4199668312150d564631
SSDEEP 192:iodqeqxNvqgZr04WSL/UzaJS5qpde4EtXW/vQOB83HXrWQ/8VtTiSCD8XClyizzM:iodqeq3yg0vXXa6a9B
TLSH
T1A032A51938A795685643317E8BC7828266329217529CED70FECC8044AF43858FAFCFBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

caaaudwm.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\caaaudwm\caaaudwm.cmdline
Size 455B
SHA256 b08adb485431c6130c0b670352eeecb9be4b0af29d0feaaca39e396bd301bd91
MD5 7bd55ec37525430475295d58fe981c3c
SHA1 4885b8759e2b823f7c71d693e77726e75a06a456
SHA512 e878d03c5437b934b5a3006c782bf6b5e4fdc7fda3aea981de76289a30c742a6efcf9b1026d5240765703e2837fb04b22e11b91a149b07636607318365f63d76
TLSH
T1A8F05C254216C67A4AEA3407156DD97CC332074728C26F447D54C81DD06B1001B91B94
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4260-27-0x0000017CEECA0000-0x0000017CEECB0000-memory.dmp

Download

memory/4260-2-0x0000017CF0E50000-0x0000017CF0E72000-memory.dmp

Download

memory/4260-23-0x0000017CF13F0000-0x0000017CF13FA000-memory.dmp

Download

memory/4260-24-0x0000017CF17B0000-0x0000017CF1972000-memory.dmp

Download

memory/4260-25-0x0000017CF1EB0000-0x0000017CF23D8000-memory.dmp

Download

memory/4260-26-0x0000017CEECA0000-0x0000017CEECB0000-memory.dmp

Download

memory/4260-28-0x0000017CEECA0000-0x0000017CEECB0000-memory.dmp

Download

memory/4260-0-0x0000017CEECA0000-0x0000017CEECB0000-memory.dmp

Download

memory/4260-10-0x0000017CEECA0000-0x0000017CEECB0000-memory.dmp

Download

memory/4260-30-0x0000017CF1470000-0x0000017CF147A000-memory.dmp

Download

memory/4260-31-0x0000017CF1600000-0x0000017CF1612000-memory.dmp

Download

memory/4260-48-0x0000017CEECA0000-0x0000017CEECB0000-memory.dmp

Download

memory/4260-49-0x0000017CF1180000-0x0000017CF12CE000-memory.dmp

Download

memory/4260-50-0x0000017CEECA0000-0x0000017CEECB0000-memory.dmp

Download

memory/4260-51-0x0000017CF1180000-0x0000017CF12CE000-memory.dmp

Download

memory/4260-1-0x0000017CEECA0000-0x0000017CEECB0000-memory.dmp

Download

memory/4260-55-0x0000017CF1180000-0x0000017CF12CE000-memory.dmp

Download

memory/4260-58-0x0000017CF1180000-0x0000017CF12CE000-memory.dmp

Download