0e28a122156b951f12b88f47105b64a33f832071f056fed430f38d591f368d98

Analysis

user interaction
yes
max time kernel
42s
max time network
37s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/05/2026, 14:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FiveM (1).exe
Size 4.9MB
Sample260524-r6apcsa151
SHA256 0e28a122156b951f12b88f47105b64a33f832071f056fed430f38d591f368d98
MD5 5ca67051624c5c69d123a3e14d40e64f
SHA1 2c534a2ca5365fa4fab597885c9456ae6067ef37
SHA512 8ed340ad02009129af3eade8ef25b9d0ab3fbf49ac064ad563835f412a75c4662f1d92eaf44f6dc3a5116b8bccea569adc08dc49265d31b28fdd813294bde704
SSDEEP 49152:ZOjPWcelNB3la41Hf3ln5EdccXqHyVJmoAcnye7DVEhjbJTB/RlbGQq2uUAANQIW:HtNhCXqHyVmTAlXgQMm3BuN70fuHmgC
TLSH
T1D3369D5663A801E8C5B7D178CA978627E7B27C061371C7DF02A0666A1F37BE16E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\FiveM\FiveM.app\desktop.ini	FiveM.exe
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
2036	GameBarPresenceWriter.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 2 IoCs

pid	Process
5064	FiveM.exe
3672	FiveM_DumpServer

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Control Panel\Colors	FiveM.exe

Modifies registry class 23 IoCs

description	ioc	Process
Key created	\Registry\User\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\NotificationData	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	FiveM.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2043432456-1617298091-2772621413-1000\{BD2855D8-27FA-43AA-BAE2-DCDABD78BB0E}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2043432456-1617298091-2772621413-1000\{17D90B0D-6F8A-4135-B866-439AC25A23A3}	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	FiveM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings	FiveM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	FiveM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5064	FiveM.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5064	FiveM.exe
4676	OpenWith.exe
5064	FiveM.exe
5064	FiveM.exe
2716	OpenWith.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3356 wrote to memory of 5064	3356	FiveM (1).exe	80
PID 5064 wrote to memory of 3672	5064	FiveM.exe	87

C:\Users\Admin\AppData\Local\Temp\FiveM (1).exe
"C:\Users\Admin\AppData\Local\Temp\FiveM (1).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3356
- C:\Users\Admin\AppData\Local\FiveM\FiveM.exe
  "C:\Users\Admin\AppData\Local\FiveM\FiveM.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Executes dropped EXE
  - Modifies Control Panel
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5064
- - C:\Users\Admin\AppData\Local\FiveM\FiveM.app\data\cache\subprocess\FiveM_DumpServer
    "C:\Users\Admin\AppData\Local\FiveM\FiveM.app\data\cache\subprocess\FiveM_DumpServer" -dumpserver:2492 -parentpid:5064
    3⤵
    - Executes dropped EXE
    PID:3672

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:2036

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:1092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:2892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
PID:4704

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.meta.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\platform-2372\data\control\settings.meta.tmp
Size 37KB
SHA256 f9ae094812ce9fbd56b58dab7739451792aba8f56c5f21eee15ef96682b413a6
MD5 3656c6636cd9dbceaf83230c3c9a2be9
SHA1 989f27c6736a943fd4690091fed26f7c17e3c17f
SHA512 52bbb8f2b2d6183f30b908d9171a2ec8c2128bbce145b7af0095d4c199b1ec431d650ec4ed0b1b6cbc7bcc8d29da3285cdcc61368faa8c4e57b45315ced4e4ad
SSDEEP 384:Gs34QmZSgC5RHTiVfNSAvRSOxRlne8lISI11zHdlz9a8QSuF5MGsXZXgCoRKRyR8:D34QMfNSEWJvz39pjE4
TLSH
T1B803DA6C3A9D5F5A198880B71CF704C971AFECBA2FEA19941B25A13307C3E602376675
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.meta.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\platform-3258\data\control\settings.meta.tmp
Size 39KB
SHA256 71ad5591441d62d02d2b62155abcf2cab587af49b86e2db5be6729a5b39df5d1
MD5 619814b8b98007c1698576b7e4efb3ec
SHA1 e60f3ceaf5ca78f74e6867f0b042951bffb91786
SHA512 55ab0bd3c1750d63ad3304e63b7c26251f01c8994f385e5643e2bbd37fc6595fd0e9f5fc0d76aa655fe8ad3bc6fdee33248d9f4a76cce11a25d84c3f5de16236
SSDEEP 384:Gs34QSSgC5RHTiVfF3AvRSOxRlne8lY7Sf11zHdlz9a8NSuFsMysXZXgCoRKRyR7:D34QOfF3E6qvz3NpcE4
TLSH
T17803CA2C3A9D5F56198880B71CF704C971AFECBA2FEA19941B25E03307C3E602376675
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

release.txt

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\release.txt
Size 7B
SHA256 5419888a2ac2e3c34c150e3e9f0a265dfca6223f7af1a270cf86256f55521622
MD5 48877f213108af3be7a257d6386b45ce
SHA1 553fefc104f0d2ac775b5ba0eff7b700993672b6
SHA512 fafbd4559d28b9c9728a4936417e0e40f831484e0be435772ba9810f67f31be4cc8db2f7512ffb4b497ac5953f847b8bbd35843dbe683464262e5fb68823afe8
MD5 SHA1 SHA512

Submit Download

natives_universal.lua.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\scripting\lua\natives_universal.lua.tmp
Size 2.0MB
SHA256 9d77fc3adf023a18d1ba3d8e1ea1077f6326061b3658917646f275a9bbda8e59
MD5 d611eae2641484aee6b132c0072e6f20
SHA1 c5ee40193f85baafe49770e096e736bbd371807b
SHA512 7fc78b6ef458dca7ed0c097fbe89884590e97e2e4c8647cee8acd1b9582ee0a3bf7414a17843ac7f9c70d325a81eec5aa14ff9dc6a5225930354808064c71638
SSDEEP 49152:gNbJqV8HZrbVWFY65oMzDhpp0ocv+aeHBqkAxZhXMBvFZGh:rg2FY6BcLh
TLSH
T1009509DA781ED3559543632A511F194BF269C0A8212D01F0F185B8DE2432FB96BFF8FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

natives_universal.d.ts.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\scripting\v8\natives_universal.d.ts.tmp
Size 2.3MB
SHA256 b1afb18877008259b73909fa24303c81dd649afaff1727837fce612b5d5a8c99
MD5 73f679358ea07012eb904b5a479a0edc
SHA1 24ccef24ac03426b7dcdba56e196aa6533044626
SHA512 0a904a37577fe0b0d06cb0b3be90255e6a5dc41f588b052d1626776268b40c5f35793590b8bca9ca11376a38d603ca59823b4a11f58d37b141ae979d558dc2c6
SSDEEP 49152:sO4NUHbAeYZJkG21H9gA32HD7lcmu6DjBvdnrD:sO4K6JkG9AUD
TLSH
T172B5969AFF493233E6B29232B0BF5048E9746258A91131DF7CF464540F1B2BC26A7D9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

natives_universal.js.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\scripting\v8\natives_universal.js.tmp
Size 2.1MB
SHA256 505a5b3fa5385f3fd28fd42d14b6f11622c2ae9aba7cb526a3471f367534088d
MD5 d79bb249f18df318a66f4847c4db828b
SHA1 617fdcaab1577a7d94d212a4d3acb2959f5de0d0
SHA512 0d64515e09c3c2d54aa92349370018bb6672945c9952d2612b37e697155a3714014b71989d03de1461258680c61b90814b5732b15fa231abe8472c024f11e585
SSDEEP 49152:BIMMNUY2FaHRKkMjJp1R9N9AaKeNrEDEi8XbhNEVgs:ilZKkM1AWs
TLSH
T1BAA5E8E93881622AE523723CD12B5D09F374E431598D21E8BCDD64982D24FBD46FEDAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\desktop.ini
Size 157B
SHA256 b1fe21f251cf7875783ea162ef86c2a5b5022a1c5157bbb7972b6b34e14ec08a
MD5 f9d948aa9426cb1a2a82e651b81a1912
SHA1 2d496caeef3b0bff6b91b99e58736cea51366348
SHA512 a962fae3853f43e4a8e2b33aa5f51a917673d76648845dffcc32037c25cb3f300e4c4fc3ea633bf78b714449dbda84416e41cc16256373c170fb82d8485e3369
TLSH
T14DC04C06818FC62DC42ED0BB1DA1A248CCBD0D2BAF6E7E04D6C0D50827D6F4FACA5685
MD5 SHA1 SHA512 TLSH

Submit Download

FiveM.exe

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.exe
Size 4.9MB
SHA256 0e28a122156b951f12b88f47105b64a33f832071f056fed430f38d591f368d98
MD5 5ca67051624c5c69d123a3e14d40e64f
SHA1 2c534a2ca5365fa4fab597885c9456ae6067ef37
SHA512 8ed340ad02009129af3eade8ef25b9d0ab3fbf49ac064ad563835f412a75c4662f1d92eaf44f6dc3a5116b8bccea569adc08dc49265d31b28fdd813294bde704
SSDEEP 49152:ZOjPWcelNB3la41Hf3ln5EdccXqHyVJmoAcnye7DVEhjbJTB/RlbGQq2uUAANQIW:HtNhCXqHyVmTAlXgQMm3BuN70fuHmgC
TLSH
T1D3369D5663A801E8C5B7D178CA978627E7B27C061371C7DF02A0666A1F37BE16E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FiveM.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FiveM.lnk
Size 2KB
SHA256 608c05db3187f978b33d9dca39bda7df813269c883415fa5a2c8eaaa66703f9b
MD5 19b62a59f8f84d8403e1653f4740a601
SHA1 9cacf62ef15919f4fd692b4569fcfd2f1fbac6a7
SHA512 df6828e0f17dbb0e6bb2562b827702e8d64ed4d33691172e7a132b1df48b171021fc0509227a1b8cd79bf1d4177c0170bf12929a11a02dcf4159bd54ca62d179
TLSH
T14B411506DAFA1F10E3FAD47045BBA31087727C95F3664B4E519042481D24F01AC85F5F
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads