1be9b53ef7e841b7e81da049b3608782b90260b742c81157368d8eb7fd006c18

Analysis

max time kernel
899s
max time network
462s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 13:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RustDevblogCheatChecker-main/Run-SSD.bat
Size 162B
Sample261102-qlzbjsfc27
SHA256 1be9b53ef7e841b7e81da049b3608782b90260b742c81157368d8eb7fd006c18
MD5 f93c06ce3a077c6367c80cc3207cb97a
SHA1 0a1d571b8fa6b748aa56818008016ed34f8e0772
SHA512 d6c576168f9681335f53f451a40516840f770dc0476381fe9cd705d6f97b6e094472cd820b277b110c6de2472822ab69a97fa0f50aca209ceab4bcee46cd3020
TLSH
T1EFC08C0A68794788A6A34E2640EB21A46C2F6907E7464E71B2A3013F250E490C1791C6
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	4696	powershell.exe
13	4696	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
2760	Everything.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
5	raw.githubusercontent.com
6	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	Everything.exe
File opened (read-only)	\??\L:	Everything.exe
File opened (read-only)	\??\N:	Everything.exe
File opened (read-only)	\??\U:	Everything.exe
File opened (read-only)	\??\X:	Everything.exe
File opened (read-only)	\??\A:	Everything.exe
File opened (read-only)	\??\B:	Everything.exe
File opened (read-only)	\??\G:	Everything.exe
File opened (read-only)	\??\H:	Everything.exe
File opened (read-only)	\??\O:	Everything.exe
File opened (read-only)	\??\P:	Everything.exe
File opened (read-only)	\??\S:	Everything.exe
File opened (read-only)	\??\V:	Everything.exe
File opened (read-only)	\??\I:	Everything.exe
File opened (read-only)	\??\K:	Everything.exe
File opened (read-only)	\??\M:	Everything.exe
File opened (read-only)	\??\Q:	Everything.exe
File opened (read-only)	\??\R:	Everything.exe
File opened (read-only)	\??\T:	Everything.exe
File opened (read-only)	\??\Y:	Everything.exe
File opened (read-only)	\??\Z:	Everything.exe
File opened (read-only)	\??\E:	Everything.exe
File opened (read-only)	\??\W:	Everything.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4696	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4872	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4696	powershell.exe
4696	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4696	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2760	Everything.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2760	Everything.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2760	Everything.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 4696	4872	cmd.exe	85
PID 4696 wrote to memory of 2628	4696	powershell.exe	86
PID 2628 wrote to memory of 832	2628	csc.exe	87
PID 4696 wrote to memory of 3960	4696	powershell.exe	88
PID 4696 wrote to memory of 2760	4696	powershell.exe	94
PID 4696 wrote to memory of 1436	4696	powershell.exe	96
PID 4696 wrote to memory of 4568	4696	powershell.exe	98
PID 4696 wrote to memory of 3796	4696	powershell.exe	99
PID 4696 wrote to memory of 4040	4696	powershell.exe	100
PID 4696 wrote to memory of 4080	4696	powershell.exe	101
PID 4696 wrote to memory of 3180	4696	powershell.exe	102
PID 4696 wrote to memory of 3944	4696	powershell.exe	103
PID 4696 wrote to memory of 3008	4696	powershell.exe	104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Run-SSD.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\Find-File.ps1"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5zhnqhex\5zhnqhex.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2628
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES66E3.tmp" "c:\Users\Admin\AppData\Local\Temp\5zhnqhex\CSC1889208DB7364223A47A80971CD5558.TMP"
      4⤵
      PID:832
- - C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
    "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-everything-version
    3⤵
    PID:3960
- - C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\Everything.exe
    "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\Everything.exe" -startup
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:2760
- - C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
    "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-everything-version
    3⤵
    PID:1436
- - C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
    "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-result-count file:
    3⤵
    PID:4568
- - C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
    "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-result-count file:
    3⤵
    PID:3796
- - C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
    "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-result-count file:
    3⤵
    PID:4040
- - C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
    "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-result-count file:
    3⤵
    PID:4080
- - C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
    "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-result-count file:
    3⤵
    PID:3180
- - C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
    "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-result-count file:
    3⤵
    PID:3944
- - C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
    "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" file:<size:40|size:280|size:478|size:556|size:734|size:929|size:1001|size:1536|size:1897|size:1902|size:3130|size:3270|size:3556|size:3584|size:4027|size:4565|size:5414|size:5632|size:6052|size:6240|size:6649|size:6660|size:12729|size:12936|size:13081|size:13283|size:14632|size:14711|size:15360|size:15432|size:18432|size:18659|size:19432|size:22528|size:25434|size:27648|size:27930|size:28928|size:31583|size:34217|size:34304|size:34816|size:36307|size:37376|size:38360|size:42456|size:45016|size:48128|size:49624|size:59392|size:62464|size:62976|size:67019|size:68608|size:75264|size:77312|size:87552|size:91136|size:103936|size:104960|size:112336|size:114800|size:116224|size:122368|size:130560|size:132096|size:139912|size:141824|size:142336|size:145192|size:151664|size:154112|size:164352|size:166912|size:167424|size:169648|size:178176|size:185344|size:186368|size:187392|size:190464|size:202240|size:206336|size:226827|size:231045|size:233640|size:235008|size:271080|size:292864|size:307712|size:340480|size:343040|size:349696|size:395776|size:406976|size:418872|size:421584|size:422872|size:425472|size:438784|size:443904|size:458011|size:466544|size:489472|size:500050|size:529920|size:531968|size:532992|size:535512|size:538112|size:541184|size:551936|size:555520|size:559104|size:564736|size:568183|size:581120|size:616448|size:623104|size:629760|size:633856|size:644096|size:646134|size:651776|size:656384|size:711539|size:733905|size:735168|size:741384|size:754688|size:790368|size:795648|size:808448|size:843776|size:870400|size:913339|size:921088|size:978432|size:991888|size:1028096|size:1070592|size:1091584|size:1092608|size:1108992|size:1180160|size:1301159|size:1319424|size:1413120|size:1499136|size:1515520|size:1517568|size:1554432|size:1589143|size:1656832|size:1773056|size:1814016|size:1831936|size:1938944|size:1956797|size:1959424|size:1968128|size:1969152|size:2065408|size:2171392|size:2286439|size:2305536|size:2345984|size:2685952|size:2810880|size:2956288|size:3025920|size:3060736|size:3083776|size:3102208|size:3115008|size:3131904|size:3369584|size:3456000|size:3587584|size:3679232|size:3798016|size:4051968|size:4063744|size:4159512|size:4487168|size:4518400|size:4559214|size:4763648|size:5347164|size:6645248|size:7183978|size:7384576|size:8603054|size:9853176|size:17778738|size:18446935|size:21806272|size:23287638|size:23817775|size:24816079|size:28111360|size:35636224|size:37271552|size:61257728|size:65035264|size:74311003|size:177803506|size:266191481> -export-csv C:\Users\Admin\AppData\Local\Temp\everything-candidates-302d5ffe9d2e4c25aa66966dd8a820f6.csv -no-header -full-path-and-name -size -size-format 1
    3⤵
    PID:3008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5zhnqhex.dll

Path C:\Users\Admin\AppData\Local\Temp\5zhnqhex\5zhnqhex.dll
Size 10KB
SHA256 ff3120f02060e1bb0ceedc7785acb4a6c37e3e649ea516629b3c6e3ce46d83ec
MD5 2db62239fe0f34b3f6dda4a030c0f99a
SHA1 c52c913b177118b23ec2146332352c2aebd16f00
SHA512 bc9ccc367eb53b0f2f757c2ed4d7a01b08b3ad56c8b6b319c2f784a9aa332bfa562f7d99538710f53b94bcf6af80509037096707b81747fe04088556170a8ff2
SSDEEP 192:PeV/By+pJF8abjd0ZBslf/DbmSEDrpy06RbzzWLquRNC:Cvp9d0MxDbGly06hX8h8
TLSH
T1F022190A73DD8A7AC85E8B7C20E107565670CA17A722EF1FBCC4A1581C937A84E752B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES66E3.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES66E3.tmp
Size 1KB
SHA256 4ee132c72bfe9fb288024a0a19a06f59f3bc66548320af774927332669e0f848
MD5 9ee605bccada8e150e3a47b10608835c
SHA1 fbf4520aed2040a182e651016db47997023ec805
SHA512 8806e74131a5dec059f72cf7fbfa9ea24dd6f536de26849186f7bfaf41823ae3216524c3a579b1deff0c7cc0ddaf5be398716c86f6b726612e5b3c42e6240157
TLSH
T12D21CC0547ED871FF0B34B31A9F6072BA225FEA4AF6293AB8541422C1C42504EEA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

Everything.exe

Path C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\Everything.exe
Size 2.2MB
SHA256 f191f756996a14a11e5445fa7103d302efd510cf2fbf920e6c0c8ed51d512e36
MD5 464df9e59802fb4d6f4a0c743a5ded94
SHA1 2aaa17b0aceb7d017c47ea0110de97e29d920ace
SHA512 b95bba8a61f316d30d031ca2ad2307b2a42c89afb1f96edb03231a50120dd33700ee221e010b81242aee4427ac26c3d203c86562f0bdfa1b7662b9cd367768ec
SSDEEP 49152:/ota7/dTkNnVxSOEad3Gw6ffub5ro1FcyPiPRr4rAF:/oCGnF3l6uUmsW
TLSH
T15AB57E43933500E9E9ABC03689569623E7B1F4144732A7EF5690EEB12F237F15A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_yonvl4mx.y31.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yonvl4mx.y31.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

everything-candidates-302d5ffe9d2e4c25aa66966dd8a820f6.csv

Path C:\Users\Admin\AppData\Local\Temp\everything-candidates-302d5ffe9d2e4c25aa66966dd8a820f6.csv
Size 708KB
SHA256 74ac8170227d542f0b3ec4057a00ad2209f0a65e444c44f0e09d54b2be297a2d
MD5 0376e53ea8cf1f3f980487e51a7efa3f
SHA1 9d91a4c049e1c4e6cc334931831f18628f77527c
SHA512 a8438c4499cce9bdd2159b9cb191d6df8454f2b0111d0c014ca93d83b07ea26129511ac8d1522e87d4b88260dcd0558bcc7cc81da19f6465fdae31fbfb9495fd
SSDEEP 6144:/C74rtMS6rzTh+w3oasEuHWiyhIaIiI7UWKnXE+W5L78vnFSe92FkXaB://rRQiE0U7XEp6ObB
TLSH
T14AF41360D37105F3D2F35C52267E0B44F11B6283B6815E78F3A67021FE9A147AEB69AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5zhnqhex.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\5zhnqhex\5zhnqhex.0.cs
Size 11KB
SHA256 b2c4ab171baaf29e36ef3ed59027a68437a9b1b74c803a46c7717e3c3985ee0e
MD5 a3a3c564a75a927d0220c2ef741743dd
SHA1 0689adf722e1e848583168c176a9877261c1316f
SHA512 422febe123bf0776c618cfd0cb7a5f366302982e7404af349ed0b755c4990d95e6242b9a917fededb787e0ebd62ef7c90003062ed79c4199668312150d564631
SSDEEP 192:iodqeqxNvqgZr04WSL/UzaJS5qpde4EtXW/vQOB83HXrWQ/8VtTiSCD8XClyizzM:iodqeq3yg0vXXa6a9B
TLSH
T1A032A51938A795685643317E8BC7828266329217529CED70FECC8044AF43858FAFCFBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5zhnqhex.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\5zhnqhex\5zhnqhex.cmdline
Size 455B
SHA256 aba6ea545e0b434d047ab2c1ccaf30f8cfd9a00e1e80cbdbf67af4ba7c23b7f8
MD5 49858da93f852c45a74ea12be2e7f9fa
SHA1 44c0f71595cbcf55953f80f0488f120c6636df3c
SHA512 f68bfe65f42bfe0a77660b8710150c806a6afae45ba030a2d9c2b0a65d041e99f8a7d9fe84b350a42ea6eab8f0b15115dbaf3628b97bb1f27b3c835d0a10d09c
TLSH
T139F05C264217C67A45EE2C071969856CC37607C72581EF5C55444C3ED4530006F917D4
MD5 SHA1 SHA512 TLSH

Submit Download

CSC1889208DB7364223A47A80971CD5558.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\5zhnqhex\CSC1889208DB7364223A47A80971CD5558.TMP
Size 652B
SHA256 2ed4cadf9930b05fcfa6ffb01600709a9e756265e42c381f0ad883947a01b84d
MD5 0f12832d77715ce3405f0e3c9393fc5e
SHA1 b4a1956f3a445b664b8ca719b0316d0ef0cdd876
SHA512 3c36c5f2e1eca8256d7c9ca438edcdfb9b5e8ad9dcb32ae702ad65bdfe419b5c33c9aa7dccd281e03c29d23259b40ce21c49866b78f8cc6b4eca46110c2600d4
TLSH
T157F05E0967F8520EF0F34F30BEF6436391A8BD64DE3293ED1441431D28645108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4696-23-0x0000028773CC0000-0x0000028773CCA000-memory.dmp

Download

memory/4696-28-0x0000028771320000-0x0000028771330000-memory.dmp

Download

memory/4696-0-0x0000028771320000-0x0000028771330000-memory.dmp

Download

memory/4696-24-0x0000028771320000-0x0000028771330000-memory.dmp

Download

memory/4696-25-0x00000287740F0000-0x00000287742B2000-memory.dmp

Download

memory/4696-26-0x00000287747F0000-0x0000028774D18000-memory.dmp

Download

memory/4696-27-0x0000028771320000-0x0000028771330000-memory.dmp

Download

memory/4696-10-0x0000028771320000-0x0000028771330000-memory.dmp

Download

memory/4696-30-0x0000028773F50000-0x0000028773F5A000-memory.dmp

Download

memory/4696-31-0x0000028773F80000-0x0000028773F92000-memory.dmp

Download

memory/4696-7-0x0000028773560000-0x0000028773582000-memory.dmp

Download

memory/4696-48-0x0000028771320000-0x0000028771330000-memory.dmp

Download

memory/4696-49-0x0000028771320000-0x0000028771330000-memory.dmp

Download

memory/4696-1-0x0000028771320000-0x0000028771330000-memory.dmp

Download