48dccc76ab851a6e3386e2a7611e9a5329c14c122c73a4fe263c2906569f10a0

Analysis

max time kernel
898s
max time network
488s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 13:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RustDevblogCheatChecker-main/Utils/Find-File.ps1
Size 31KB
Sample261102-qlzbjsfc27
SHA256 48dccc76ab851a6e3386e2a7611e9a5329c14c122c73a4fe263c2906569f10a0
MD5 d31643a2bc510c8dccbcc498229362b2
SHA1 c6c400938e56ac9a943abc2eb0c3501061e18289
SHA512 7e13e024dace2fe945be13dab06fa701ac7fee99c1afb9dbd841482695603687a33f8d8aa4157ce968d5cdc9b8ce78213d83e509eddcec1f847706325c23d4a7
SSDEEP 384:JjfhkHodqeq3yg0vXXa6a9vcgz8pSeoMLkBmY/XIAqlNkbieyqzpD:z1vXXa6aSgApzoMA/X4Vq1
TLSH
T1F1E2F92968A68539268321BE09C641117B6A911F414C5EA0FDDCC1C4FFE643CEAFDBF6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	3572	powershell.exe
9	3572	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
2056	Everything.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
5	raw.githubusercontent.com
6	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	Everything.exe
File opened (read-only)	\??\K:	Everything.exe
File opened (read-only)	\??\L:	Everything.exe
File opened (read-only)	\??\O:	Everything.exe
File opened (read-only)	\??\P:	Everything.exe
File opened (read-only)	\??\X:	Everything.exe
File opened (read-only)	\??\H:	Everything.exe
File opened (read-only)	\??\J:	Everything.exe
File opened (read-only)	\??\M:	Everything.exe
File opened (read-only)	\??\V:	Everything.exe
File opened (read-only)	\??\Z:	Everything.exe
File opened (read-only)	\??\E:	Everything.exe
File opened (read-only)	\??\T:	Everything.exe
File opened (read-only)	\??\W:	Everything.exe
File opened (read-only)	\??\Y:	Everything.exe
File opened (read-only)	\??\A:	Everything.exe
File opened (read-only)	\??\B:	Everything.exe
File opened (read-only)	\??\I:	Everything.exe
File opened (read-only)	\??\N:	Everything.exe
File opened (read-only)	\??\Q:	Everything.exe
File opened (read-only)	\??\R:	Everything.exe
File opened (read-only)	\??\S:	Everything.exe
File opened (read-only)	\??\U:	Everything.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3572	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3572	powershell.exe
3572	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3572	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2056	Everything.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2056	Everything.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2056	Everything.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3572 wrote to memory of 4696	3572	powershell.exe	85
PID 4696 wrote to memory of 2304	4696	csc.exe	86
PID 3572 wrote to memory of 1828	3572	powershell.exe	87
PID 3572 wrote to memory of 2056	3572	powershell.exe	93
PID 3572 wrote to memory of 3720	3572	powershell.exe	94
PID 3572 wrote to memory of 1636	3572	powershell.exe	96
PID 3572 wrote to memory of 260	3572	powershell.exe	98
PID 3572 wrote to memory of 4304	3572	powershell.exe	99
PID 3572 wrote to memory of 796	3572	powershell.exe	100
PID 3572 wrote to memory of 4172	3572	powershell.exe	101
PID 3572 wrote to memory of 1992	3572	powershell.exe	102
PID 3572 wrote to memory of 2236	3572	powershell.exe	103
PID 3572 wrote to memory of 3368	3572	powershell.exe	104
PID 3572 wrote to memory of 2664	3572	powershell.exe	105

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\Find-File.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5dsnrvvg\5dsnrvvg.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6D1D.tmp" "c:\Users\Admin\AppData\Local\Temp\5dsnrvvg\CSCF22793B59E894F2F8080E0253A21703B.TMP"
    3⤵
    PID:2304
- C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
  "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-everything-version
  2⤵
  PID:1828
- C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\Everything.exe
  "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\Everything.exe" -startup
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2056
- C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
  "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-everything-version
  2⤵
  PID:3720
- C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
  "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-result-count file:
  2⤵
  PID:1636
- C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
  "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-result-count file:
  2⤵
  PID:260
- C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
  "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-result-count file:
  2⤵
  PID:4304
- C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
  "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-result-count file:
  2⤵
  PID:796
- C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
  "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-result-count file:
  2⤵
  PID:4172
- C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
  "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-result-count file:
  2⤵
  PID:1992
- C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
  "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-result-count file:
  2⤵
  PID:2236
- C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
  "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-result-count file:
  2⤵
  PID:3368
- C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
  "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" file:<size:40|size:280|size:478|size:556|size:734|size:929|size:1001|size:1536|size:1897|size:1902|size:3130|size:3270|size:3556|size:3584|size:4027|size:4565|size:5414|size:5632|size:6052|size:6240|size:6649|size:6660|size:12729|size:12936|size:13081|size:13283|size:14632|size:14711|size:15360|size:15432|size:18432|size:18659|size:19432|size:22528|size:25434|size:27648|size:27930|size:28928|size:31583|size:34217|size:34304|size:34816|size:36307|size:37376|size:38360|size:42456|size:45016|size:48128|size:49624|size:59392|size:62464|size:62976|size:67019|size:68608|size:75264|size:77312|size:87552|size:91136|size:103936|size:104960|size:112336|size:114800|size:116224|size:122368|size:130560|size:132096|size:139912|size:141824|size:142336|size:145192|size:151664|size:154112|size:164352|size:166912|size:167424|size:169648|size:178176|size:185344|size:186368|size:187392|size:190464|size:202240|size:206336|size:226827|size:231045|size:233640|size:235008|size:271080|size:292864|size:307712|size:340480|size:343040|size:349696|size:395776|size:406976|size:418872|size:421584|size:422872|size:425472|size:438784|size:443904|size:458011|size:466544|size:489472|size:500050|size:529920|size:531968|size:532992|size:535512|size:538112|size:541184|size:551936|size:555520|size:559104|size:564736|size:568183|size:581120|size:616448|size:623104|size:629760|size:633856|size:644096|size:646134|size:651776|size:656384|size:711539|size:733905|size:735168|size:741384|size:754688|size:790368|size:795648|size:808448|size:843776|size:870400|size:913339|size:921088|size:978432|size:991888|size:1028096|size:1070592|size:1091584|size:1092608|size:1108992|size:1180160|size:1301159|size:1319424|size:1413120|size:1499136|size:1515520|size:1517568|size:1554432|size:1589143|size:1656832|size:1773056|size:1814016|size:1831936|size:1938944|size:1956797|size:1959424|size:1968128|size:1969152|size:2065408|size:2171392|size:2286439|size:2305536|size:2345984|size:2685952|size:2810880|size:2956288|size:3025920|size:3060736|size:3083776|size:3102208|size:3115008|size:3131904|size:3369584|size:3456000|size:3587584|size:3679232|size:3798016|size:4051968|size:4063744|size:4159512|size:4487168|size:4518400|size:4559214|size:4763648|size:5347164|size:6645248|size:7183978|size:7384576|size:8603054|size:9853176|size:17778738|size:18446935|size:21806272|size:23287638|size:23817775|size:24816079|size:28111360|size:35636224|size:37271552|size:61257728|size:65035264|size:74311003|size:177803506|size:266191481> -export-csv C:\Users\Admin\AppData\Local\Temp\everything-candidates-c4b97a65c3be4fc386cabcfa2b3a45d0.csv -no-header -full-path-and-name -size -size-format 1
  2⤵
  PID:2664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5dsnrvvg.dll

Path C:\Users\Admin\AppData\Local\Temp\5dsnrvvg\5dsnrvvg.dll
Size 10KB
SHA256 ab5e8eb58fcd18bfa1219928df92640439a2d9ae44fbbbaa96f4dcea014a0f8f
MD5 1ffd8d21cedb6be08e594e8cd1090d21
SHA1 5c37fea1453d135475ba130b2dad9fc65e3f2a5e
SHA512 e3ec9c0b7ef179acc77f86aaf16e6ee5dc84c811faf3f63d0717a898c57d512b9bb7dadf1c01decaaeda8626dac679ef2c4b9bacfafedab57e5e493bd90b6f22
SSDEEP 192:PeV/By+pJF8abjd0ZBslf/DbmSEDRpy06bbzzWLquVNO:Cvp9d0MxDbG7y06fX8lo
TLSH
T1C1220A1A73DC8A7BC85E8B7C20E117565670C9176723EF1FBCC4A1581C927684E752B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES6D1D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6D1D.tmp
Size 1KB
SHA256 09f45ebae5c7417d033cfc5f73b68147a576fcae62e511ff264a16c3ad50f189
MD5 8e05d436c0f083bed05e3b860a4d4c04
SHA1 80b601e2eb86f1995c84f3a93ab8bf6b2d1b4975
SHA512 88f590493ad9eb4799b7352f0df7280417e47dbc7195f8a690db5cfbf56ea84913bf0de3fb1b53c8238f32e87b07c317782a66b27aee83b8c2eb8fa90bfe4716
TLSH
T19521AA0183E9470FF077573269F6072BE264FD94EF72A36A844042281C51608EEF0EB2
MD5 SHA1 SHA512 TLSH

Submit Download

Everything.exe

Path C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\Everything.exe
Size 2.2MB
SHA256 f191f756996a14a11e5445fa7103d302efd510cf2fbf920e6c0c8ed51d512e36
MD5 464df9e59802fb4d6f4a0c743a5ded94
SHA1 2aaa17b0aceb7d017c47ea0110de97e29d920ace
SHA512 b95bba8a61f316d30d031ca2ad2307b2a42c89afb1f96edb03231a50120dd33700ee221e010b81242aee4427ac26c3d203c86562f0bdfa1b7662b9cd367768ec
SSDEEP 49152:/ota7/dTkNnVxSOEad3Gw6ffub5ro1FcyPiPRr4rAF:/oCGnF3l6uUmsW
TLSH
T15AB57E43933500E9E9ABC03689569623E7B1F4144732A7EF5690EEB12F237F15A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_ujdm3h4h.dlr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ujdm3h4h.dlr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

everything-candidates-c4b97a65c3be4fc386cabcfa2b3a45d0.csv

Path C:\Users\Admin\AppData\Local\Temp\everything-candidates-c4b97a65c3be4fc386cabcfa2b3a45d0.csv
Size 708KB
SHA256 a3e176a642c6f84369af052d060716674872c40efbf69b86fc5f67edadcea673
MD5 32e9533f1df98e2adc2f03991dc2236f
SHA1 b6c5c7fdf38613c8396d5f1a282b80afc5eb2fd8
SHA512 73fd0615ca25fc3c6ed216452ae3327b02e4fc2d137e3389e54fc19dfd21411caf2fe3c8ec11d98d5b6d8e339adfab7600866e4cb85747d8575ae3552e070d8d
SSDEEP 6144:/C74rtMS6rzTh+w3oasEGHWiyhIaIiI7UWKnXE+W5L78vnFSe92FBXaB://rRQiEcU7XEp6O8B
TLSH
T1C6F41360D37105F3D2F35C52267E0B44F11B6283B6815E78F3A67021FE9A147AEB69AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5dsnrvvg.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\5dsnrvvg\5dsnrvvg.0.cs
Size 11KB
SHA256 b2c4ab171baaf29e36ef3ed59027a68437a9b1b74c803a46c7717e3c3985ee0e
MD5 a3a3c564a75a927d0220c2ef741743dd
SHA1 0689adf722e1e848583168c176a9877261c1316f
SHA512 422febe123bf0776c618cfd0cb7a5f366302982e7404af349ed0b755c4990d95e6242b9a917fededb787e0ebd62ef7c90003062ed79c4199668312150d564631
SSDEEP 192:iodqeqxNvqgZr04WSL/UzaJS5qpde4EtXW/vQOB83HXrWQ/8VtTiSCD8XClyizzM:iodqeq3yg0vXXa6a9B
TLSH
T1A032A51938A795685643317E8BC7828266329217529CED70FECC8044AF43858FAFCFBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5dsnrvvg.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\5dsnrvvg\5dsnrvvg.cmdline
Size 455B
SHA256 a9c895a753b8fe96eb864932810d1bff657323d043ea9a93a28648731e9d977d
MD5 8bd1c43e892128e587514e7c19042bf4
SHA1 b3724093783f277319d169e17118ee4f8d9bab52
SHA512 28f8502fc4062d742767caf71d02d3fe70b416f98bfd740e0d01eb1ba1d1657e3a03089f87bae70da25db1e7c0bde2bf6bb78ce0bff93bc04f3ea3d48512cfc7
TLSH
T102F05C29C317C67A45EA380F1669C9ACE333134F34837F4895444A1DD1530002B91790
MD5 SHA1 SHA512 TLSH

Submit Download

CSCF22793B59E894F2F8080E0253A21703B.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\5dsnrvvg\CSCF22793B59E894F2F8080E0253A21703B.TMP
Size 652B
SHA256 591384eb334828cc8f7ceab1b89dbb471674e04c221e9f66093bb353dea8044d
MD5 e18854f23e39c04f1ce7cd4dee128773
SHA1 4a5777e0cc32ab9f4c4387e6997cc3417c818975
SHA512 94535810767ea266421181893e3cabcf991c06d729beaee8f7d697bb6db65988ab75d22f235f41ad69de7e467d57457a6250e870d677188876bcb2602d97cb7d
TLSH
T11FF03A0963F8020EF0F34B31BAF643A391A8FCA4DE3293ED144003196C6461489A2FB6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3572-23-0x000001BC1EFC0000-0x000001BC1EFD0000-memory.dmp

Download

memory/3572-29-0x000001BC1FFF0000-0x000001BC20002000-memory.dmp

Download

memory/3572-0-0x000001BC1EFC0000-0x000001BC1EFD0000-memory.dmp

Download

memory/3572-24-0x000001BC20180000-0x000001BC20342000-memory.dmp

Download

memory/3572-25-0x000001BC20880000-0x000001BC20DA8000-memory.dmp

Download

memory/3572-26-0x000001BC1EFC0000-0x000001BC1EFD0000-memory.dmp

Download

memory/3572-28-0x000001BC1FFC0000-0x000001BC1FFCA000-memory.dmp

Download

memory/3572-22-0x000001BC1EFA0000-0x000001BC1EFAA000-memory.dmp

Download

memory/3572-9-0x000001BC1EFC0000-0x000001BC1EFD0000-memory.dmp

Download

memory/3572-36-0x000001BC1EFC0000-0x000001BC1EFD0000-memory.dmp

Download

memory/3572-48-0x000001BC1EFC0000-0x000001BC1EFD0000-memory.dmp

Download

memory/3572-47-0x000001BC1F8B0000-0x000001BC1FACC000-memory.dmp

Download

memory/3572-49-0x000001BC1EFC0000-0x000001BC1EFD0000-memory.dmp

Download

memory/3572-6-0x000001BC1F880000-0x000001BC1F8A2000-memory.dmp

Download