48dccc76ab851a6e3386e2a7611e9a5329c14c122c73a4fe263c2906569f10a0

Analysis

max time kernel
50s
max time network
22s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 13:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RustDevblogCheatChecker-main/Utils/Find-File.ps1
Size 31KB
Sample261102-qlzbjsfc27
SHA256 48dccc76ab851a6e3386e2a7611e9a5329c14c122c73a4fe263c2906569f10a0
MD5 d31643a2bc510c8dccbcc498229362b2
SHA1 c6c400938e56ac9a943abc2eb0c3501061e18289
SHA512 7e13e024dace2fe945be13dab06fa701ac7fee99c1afb9dbd841482695603687a33f8d8aa4157ce968d5cdc9b8ce78213d83e509eddcec1f847706325c23d4a7
SSDEEP 384:JjfhkHodqeq3yg0vXXa6a9vcgz8pSeoMLkBmY/XIAqlNkbieyqzpD:z1vXXa6aSgApzoMA/X4Vq1
TLSH
T1F1E2F92968A68539268321BE09C641117B6A911F414C5EA0FDDCC1C4FFE643CEAFDBF6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	5504	PowerShell.exe
7	5504	PowerShell.exe

Executes dropped EXE 1 IoCs

pid	Process
1600	Everything.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
5	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	Everything.exe
File opened (read-only)	\??\H:	Everything.exe
File opened (read-only)	\??\O:	Everything.exe
File opened (read-only)	\??\P:	Everything.exe
File opened (read-only)	\??\T:	Everything.exe
File opened (read-only)	\??\X:	Everything.exe
File opened (read-only)	\??\K:	Everything.exe
File opened (read-only)	\??\M:	Everything.exe
File opened (read-only)	\??\Q:	Everything.exe
File opened (read-only)	\??\U:	Everything.exe
File opened (read-only)	\??\Z:	Everything.exe
File opened (read-only)	\??\A:	Everything.exe
File opened (read-only)	\??\B:	Everything.exe
File opened (read-only)	\??\L:	Everything.exe
File opened (read-only)	\??\N:	Everything.exe
File opened (read-only)	\??\R:	Everything.exe
File opened (read-only)	\??\S:	Everything.exe
File opened (read-only)	\??\V:	Everything.exe
File opened (read-only)	\??\G:	Everything.exe
File opened (read-only)	\??\I:	Everything.exe
File opened (read-only)	\??\J:	Everything.exe
File opened (read-only)	\??\W:	Everything.exe
File opened (read-only)	\??\Y:	Everything.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5504	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5504	PowerShell.exe
5504	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5504	PowerShell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1600	Everything.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1600	Everything.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1600	Everything.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 5504 wrote to memory of 5764	5504	PowerShell.exe	90
PID 5764 wrote to memory of 2288	5764	csc.exe	91
PID 5504 wrote to memory of 4536	5504	PowerShell.exe	92
PID 5504 wrote to memory of 1600	5504	PowerShell.exe	93
PID 5504 wrote to memory of 3396	5504	PowerShell.exe	94
PID 5504 wrote to memory of 2376	5504	PowerShell.exe	95
PID 5504 wrote to memory of 2524	5504	PowerShell.exe	96
PID 5504 wrote to memory of 5576	5504	PowerShell.exe	97
PID 5504 wrote to memory of 1624	5504	PowerShell.exe	98
PID 5504 wrote to memory of 4788	5504	PowerShell.exe	100
PID 5504 wrote to memory of 2808	5504	PowerShell.exe	101

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\Find-File.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5504
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vvqmegdv\vvqmegdv.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5764
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8E3C.tmp" "c:\Users\Admin\AppData\Local\Temp\vvqmegdv\CSCF78AE05CA6BC4E9D859A1B66698C6314.TMP"
    3⤵
    PID:2288
- C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
  "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-everything-version
  2⤵
  PID:4536
- C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\Everything.exe
  "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\Everything.exe" -startup
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1600
- C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
  "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-everything-version
  2⤵
  PID:3396
- C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
  "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-result-count file:
  2⤵
  PID:2376
- C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
  "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-result-count file:
  2⤵
  PID:2524
- C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
  "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-result-count file:
  2⤵
  PID:5576
- C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
  "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-result-count file:
  2⤵
  PID:1624
- C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
  "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-result-count file:
  2⤵
  PID:4788
- C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
  "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" file:<size:40|size:280|size:478|size:556|size:734|size:929|size:1001|size:1536|size:1897|size:1902|size:3130|size:3270|size:3556|size:3584|size:4027|size:4565|size:5414|size:5632|size:6052|size:6240|size:6649|size:6660|size:12729|size:12936|size:13081|size:13283|size:14632|size:14711|size:15360|size:15432|size:18432|size:18659|size:19432|size:22528|size:25434|size:27648|size:27930|size:28928|size:31583|size:34217|size:34304|size:34816|size:36307|size:37376|size:38360|size:42456|size:45016|size:48128|size:49624|size:59392|size:62464|size:62976|size:67019|size:68608|size:75264|size:77312|size:87552|size:91136|size:103936|size:104960|size:112336|size:114800|size:116224|size:122368|size:130560|size:132096|size:139912|size:141824|size:142336|size:145192|size:151664|size:154112|size:164352|size:166912|size:167424|size:169648|size:178176|size:185344|size:186368|size:187392|size:190464|size:202240|size:206336|size:226827|size:231045|size:233640|size:235008|size:271080|size:292864|size:307712|size:340480|size:343040|size:349696|size:395776|size:406976|size:418872|size:421584|size:422872|size:425472|size:438784|size:443904|size:458011|size:466544|size:489472|size:500050|size:529920|size:531968|size:532992|size:535512|size:538112|size:541184|size:551936|size:555520|size:559104|size:564736|size:568183|size:581120|size:616448|size:623104|size:629760|size:633856|size:644096|size:646134|size:651776|size:656384|size:711539|size:733905|size:735168|size:741384|size:754688|size:790368|size:795648|size:808448|size:843776|size:870400|size:913339|size:921088|size:978432|size:991888|size:1028096|size:1070592|size:1091584|size:1092608|size:1108992|size:1180160|size:1301159|size:1319424|size:1413120|size:1499136|size:1515520|size:1517568|size:1554432|size:1589143|size:1656832|size:1773056|size:1814016|size:1831936|size:1938944|size:1956797|size:1959424|size:1968128|size:1969152|size:2065408|size:2171392|size:2286439|size:2305536|size:2345984|size:2685952|size:2810880|size:2956288|size:3025920|size:3060736|size:3083776|size:3102208|size:3115008|size:3131904|size:3369584|size:3456000|size:3587584|size:3679232|size:3798016|size:4051968|size:4063744|size:4159512|size:4487168|size:4518400|size:4559214|size:4763648|size:5347164|size:6645248|size:7183978|size:7384576|size:8603054|size:9853176|size:17778738|size:18446935|size:21806272|size:23287638|size:23817775|size:24816079|size:28111360|size:35636224|size:37271552|size:61257728|size:65035264|size:74311003|size:177803506|size:266191481> -export-csv C:\Users\Admin\AppData\Local\Temp\everything-candidates-f714227dbfb6495eb52c534924b5e244.csv -no-header -full-path-and-name -size -size-format 1
  2⤵
  PID:2808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES8E3C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8E3C.tmp
Size 1KB
SHA256 70cc023ac30524427e13bd723c31e39c6aec8c02524395bad91b443105558d99
MD5 3b563af58e37fe79154011f1b7c48c5b
SHA1 bc73536a6d999f17d3b9c52b04d69edf4545e176
SHA512 1f16c8cb147d076264e5e0eb5bbb300f72eca30e1edf02c564c0b4b92e5a8955fa1fd5f60c0f30453da5d52222cd9b84e50c5e1b4a68ceaeda2596044baa8c2c
TLSH
T15F21BB0193E94B0FF07757326AF6072B9165FE94DFB1A3AB858052281C01204EEE0A72
MD5 SHA1 SHA512 TLSH

Submit Download

Everything.exe

Path C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\Everything.exe
Size 2.2MB
SHA256 f191f756996a14a11e5445fa7103d302efd510cf2fbf920e6c0c8ed51d512e36
MD5 464df9e59802fb4d6f4a0c743a5ded94
SHA1 2aaa17b0aceb7d017c47ea0110de97e29d920ace
SHA512 b95bba8a61f316d30d031ca2ad2307b2a42c89afb1f96edb03231a50120dd33700ee221e010b81242aee4427ac26c3d203c86562f0bdfa1b7662b9cd367768ec
SSDEEP 49152:/ota7/dTkNnVxSOEad3Gw6ffub5ro1FcyPiPRr4rAF:/oCGnF3l6uUmsW
TLSH
T15AB57E43933500E9E9ABC03689569623E7B1F4144732A7EF5690EEB12F237F15A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

everything-candidates-f714227dbfb6495eb52c534924b5e244.csv

Path C:\Users\Admin\AppData\Local\Temp\everything-candidates-f714227dbfb6495eb52c534924b5e244.csv
Size 588KB
SHA256 8a9d2b540d18c63946802df7439d5e78fd2c9be22139c6f7bf1acbda75dde54e
MD5 e2816458d145ce178339b3a08c769404
SHA1 0dd3b67319c0b234911a2354784169861cca8eee
SHA512 c3e36ee659baae7f46fd771b1f5a720883e21d62dc3aa06e2e52c27ef6ce479626842715ed4ddc3a7424de77cb97ab5ebbec7a4a3e352e4e55fbf12b5c3a0022
SSDEEP 6144:F5qZN0D6SoSypOoXNQFHOpFJjcCYrKYDgzFgkO6K:+9wjkOz
TLSH
T1CAD4EE11C23246F3D6B3AC52A26E1745F11A3103B3815E39B3A77052FEDA1476FB69B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vvqmegdv.dll

Path C:\Users\Admin\AppData\Local\Temp\vvqmegdv\vvqmegdv.dll
Size 10KB
SHA256 df5fa185d64f8eda62e8360fff386be7e4376b383342ec65f2169ed683ef0453
MD5 b5fa5f54a410f495653d35ca32885c3f
SHA1 40a1678edc2b53c62217c47a04cfa6323f9b029d
SHA512 cb9b6a06f2d4dfea118b07cb741e917631a8d21fb56ff5a67c666f341ae25ba902406663b0687597898900b4a4a0951b0eddc31334d02030311c1dc21951ed99
SSDEEP 192:JeV/By+pJF8abjd0ZBslf/DbmSED6py06KbzzWLqu2Nhbw:0vp9d0MxDbGmy060X8mn
TLSH
T1ED22191A73DC8A7AC86E4B7C20E117565270C617A722EF1FBCC4A1581C937A84E753B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCF78AE05CA6BC4E9D859A1B66698C6314.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\vvqmegdv\CSCF78AE05CA6BC4E9D859A1B66698C6314.TMP
Size 652B
SHA256 f08df065445466ba17249defcdb450b3ac83d8d8c28cda0aac21a01b95af88b1
MD5 cc938852970baf23ce87c32c8872c9ad
SHA1 7c97bebdac44dfe8ce3424fdb89f32667457551a
SHA512 07f54a3f3cdcaf849b619512d0088d3a877f03375a1df5f6cde6b443aa8a3e0d357d364c501d5abf77c3dca4da88c369bf2a7fd1d5df181c34dbbf3b15f0a8d3
TLSH
T1D2F05E0963F8420EF0F34B30BEF6436391A8BCA4DE7293ED144013192C6461089B2FB2
MD5 SHA1 SHA512 TLSH

Submit Download

vvqmegdv.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\vvqmegdv\vvqmegdv.0.cs
Size 11KB
SHA256 b2c4ab171baaf29e36ef3ed59027a68437a9b1b74c803a46c7717e3c3985ee0e
MD5 a3a3c564a75a927d0220c2ef741743dd
SHA1 0689adf722e1e848583168c176a9877261c1316f
SHA512 422febe123bf0776c618cfd0cb7a5f366302982e7404af349ed0b755c4990d95e6242b9a917fededb787e0ebd62ef7c90003062ed79c4199668312150d564631
SSDEEP 192:iodqeqxNvqgZr04WSL/UzaJS5qpde4EtXW/vQOB83HXrWQ/8VtTiSCD8XClyizzM:iodqeq3yg0vXXa6a9B
TLSH
T1A032A51938A795685643317E8BC7828266329217529CED70FECC8044AF43858FAFCFBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vvqmegdv.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\vvqmegdv\vvqmegdv.cmdline
Size 455B
SHA256 3d99f200a462a11598c11f8ab454ff7d922f67a033375ce6487fad1eddc4c4f8
MD5 d9703d20934f82d061f0bebbb0028a59
SHA1 cca075eeca58fcf4b2246318f48ea964d282cf58
SHA512 df88c4d35c01cf5eabbf749965fea86a5a7b17230e9ccf236c32634a3778ff0a00a32a44ebfc397495083ab998b27e5892a63bf3b1880b2d2eb2c0a14c9e58df
TLSH
T142F05C278217C67F85EA25071969857CC23243C72D817F446688485ED05B0421BD1792
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5504-24-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp

Download

memory/5504-27-0x0000019076F50000-0x0000019077478000-memory.dmp

Download

memory/5504-8-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp

Download

memory/5504-15-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp

Download

memory/5504-7-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp

Download

memory/5504-23-0x00000190760C0000-0x00000190760CA000-memory.dmp

Download

memory/5504-6-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp

Download

memory/5504-0-0x00007FFEFB8BF000-0x00007FFEFB8C0000-memory.dmp

Download

memory/5504-25-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp

Download

memory/5504-4-0x0000019076070000-0x0000019076092000-memory.dmp

Download

memory/5504-26-0x0000019076850000-0x0000019076A12000-memory.dmp

Download

memory/5504-9-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp

Download

memory/5504-28-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp

Download

memory/5504-29-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp

Download

memory/5504-30-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp

Download

memory/5504-32-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp

Download

memory/5504-33-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp

Download

memory/5504-34-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp

Download

memory/5504-36-0x00000190766F0000-0x00000190766FA000-memory.dmp

Download

memory/5504-37-0x0000019076720000-0x0000019076732000-memory.dmp

Download

memory/5504-5-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp

Download

memory/5504-1-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp

Download