3387931fc00ae9bd5fff9fc8efe7537960cef92aac32133066172f3952fe1ed9

Resubmissions

20/06/2026, 04:46

260620-fefwhsds3r8

20/06/2026, 04:40

20/06/2026, 04:37

20/06/2026, 04:34

20/06/2026, 04:30

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/06/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FiveM (4).exe
Size 4.9MB
Sample260620-e444zaet8s
SHA256 3387931fc00ae9bd5fff9fc8efe7537960cef92aac32133066172f3952fe1ed9
MD5 7d1daf13865d725090511e79c480cccd
SHA1 f33b007f3df5f1ba949ecedf5645fd10f83d36ce
SHA512 e8e1ebcbf1d9065a01089e833b6dcfccbeaf435a80370ea042f633571b1879a1f31269e3244453fde6851a1c38d5594be670d76a48e57abca3a5e0d67ee27408
SSDEEP 49152:nOjPWFZwclTLDHWk7o1HMvdCuYTfksFHaciUylf00Ki482X/ub2PwTAK7BJQmDfz:JXnLouYTB7N8vyO7UqGGyL6bs3U0mD
TLSH
T1FE369D5663A401E8C1B7D178CA978627EBB27C151331DBDB02A0666A1F37BE16F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\FiveM\FiveM.app\desktop.ini	FiveM.exe
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4524	GameBarPresenceWriter.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	CitizenFX.exe.new

Deletes itself 1 IoCs

pid	Process
4532	CitizenFX.exe.new

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 3 IoCs

pid	Process
4532	CitizenFX.exe.new
976	FiveM (4).exe
3260	FiveM.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3308	chrome.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Colors	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Colors	FiveM (4).exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134264035165935020"	chrome.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{048BD061-C641-45E4-9E3C-A92403AE4F43}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{DD9430A2-767A-4D6C-BA28-3F139E00D9D2}	svchost.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4532	CitizenFX.exe.new
4532	CitizenFX.exe.new
976	FiveM (4).exe
976	FiveM (4).exe
3260	FiveM.exe
3260	FiveM.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3284	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4532	CitizenFX.exe.new

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4076	FiveM (4).exe
3260	FiveM.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4076	FiveM (4).exe
3260	FiveM.exe
3284	OpenWith.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 4532	4076	FiveM (4).exe	90
PID 4532 wrote to memory of 976	4532	CitizenFX.exe.new	91
PID 976 wrote to memory of 3260	976	FiveM (4).exe	92
PID 4724 wrote to memory of 4744	4724	chrome.exe	109
PID 4724 wrote to memory of 4800	4724	chrome.exe	110
PID 4724 wrote to memory of 3308	4724	chrome.exe	111
PID 4724 wrote to memory of 4800	4724	chrome.exe	110
PID 4724 wrote to memory of 1844	4724	chrome.exe	112
PID 4724 wrote to memory of 1844	4724	chrome.exe	112
PID 4724 wrote to memory of 4772	4724	chrome.exe	114
PID 4724 wrote to memory of 4868	4724	chrome.exe	115
PID 4724 wrote to memory of 4772	4724	chrome.exe	114
PID 4724 wrote to memory of 4868	4724	chrome.exe	115
PID 4724 wrote to memory of 4732	4724	chrome.exe	116
PID 4724 wrote to memory of 4732	4724	chrome.exe	116
PID 4724 wrote to memory of 4436	4724	chrome.exe	117
PID 4724 wrote to memory of 4436	4724	chrome.exe	117
PID 4724 wrote to memory of 1888	4724	chrome.exe	118
PID 4724 wrote to memory of 3272	4724	chrome.exe	120
PID 4724 wrote to memory of 3272	4724	chrome.exe	120
PID 4724 wrote to memory of 2528	4724	chrome.exe	121
PID 4724 wrote to memory of 3764	4724	chrome.exe	122
PID 4724 wrote to memory of 4420	4724	chrome.exe	123

C:\Users\Admin\AppData\Local\Temp\FiveM (4).exe
"C:\Users\Admin\AppData\Local\Temp\FiveM (4).exe"
1⤵
- Modifies Control Panel
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Users\Admin\AppData\Local\Temp\CitizenFX.exe.new
  CitizenFX.exe.new -bootstrap "C:\Users\Admin\AppData\Local\Temp\FiveM (4).exe"
  2⤵
  - Checks computer location settings
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:4532
- - C:\Users\Admin\AppData\Local\Temp\FiveM (4).exe
    "C:\Users\Admin\AppData\Local\Temp\FiveM (4).exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:976
  - - C:\Users\Admin\AppData\Local\FiveM\FiveM.exe
      "C:\Users\Admin\AppData\Local\FiveM\FiveM.exe"
      4⤵
      Drops desktop.ini file(s)
      Executes dropped EXE
      Modifies Control Panel
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:3260

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:4524

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:2552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:3208

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe3008c728,0x7ffe3008c734,0x7ffe3008c740
  2⤵
  PID:4744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1784,i,150469197468369949,15177916189110599727,262144 --field-trial-handle=1984,i,7255449604555755504,7365354131744096026,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  PID:4800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1668,i,10437660081707586743,14561448923970280829,524288 --field-trial-handle=1984,i,7255449604555755504,7365354131744096026,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,1354678983582268190,2486217308174614924,524288 --field-trial-handle=1984,i,7255449604555755504,7365354131744096026,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:1844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3288,i,11334641918029692905,16748758471683343335,2097152 --field-trial-handle=1984,i,7255449604555755504,7365354131744096026,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3512,i,18317846818551634546,12847413190868499731,2097152 --field-trial-handle=1984,i,7255449604555755504,7365354131744096026,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4372,i,10889612472112390285,15699302607547103752,2097152 --field-trial-handle=1984,i,7255449604555755504,7365354131744096026,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4408 /prefetch:2
  2⤵
  PID:4732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4872,i,15606803099795683434,12415484880612710625,2097152 --field-trial-handle=1984,i,7255449604555755504,7365354131744096026,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5504,i,16004152240461931971,10909055107539039512,524288 --field-trial-handle=1984,i,7255449604555755504,7365354131744096026,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:1888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5812,i,8559018862205087386,5151119015574624736,2097152 --field-trial-handle=1984,i,7255449604555755504,7365354131744096026,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3612,i,10548278135019815934,4299440013878349174,524288 --field-trial-handle=1984,i,7255449604555755504,7365354131744096026,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3624 /prefetch:8
  2⤵
  PID:2528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3636,i,12647623295907535128,10961117367077197263,524288 --field-trial-handle=1984,i,7255449604555755504,7365354131744096026,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3580 /prefetch:8
  2⤵
  PID:3764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3572,i,16848441628135929416,18349693681798073124,524288 --field-trial-handle=1984,i,7255449604555755504,7365354131744096026,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3696 /prefetch:8
  2⤵
  PID:4420

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\desktop.ini
Size 157B
SHA256 b1fe21f251cf7875783ea162ef86c2a5b5022a1c5157bbb7972b6b34e14ec08a
MD5 f9d948aa9426cb1a2a82e651b81a1912
SHA1 2d496caeef3b0bff6b91b99e58736cea51366348
SHA512 a962fae3853f43e4a8e2b33aa5f51a917673d76648845dffcc32037c25cb3f300e4c4fc3ea633bf78b714449dbda84416e41cc16256373c170fb82d8485e3369
TLSH
T14DC04C06818FC62DC42ED0BB1DA1A248CCBD0D2BAF6E7E04D6C0D50827D6F4FACA5685
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d436edb8946a3f256d50760fc574b019b6f09d4fb18bf238e23e2562cecc92c3
MD5 f2e8093e5a3f1ca3a6b799dfaeeda6f2
SHA1 41f1d9c8959fde0c3cb05d2bbfbe257fcd795176
SHA512 88b1769fbae3419cac94bb5f7ce993d4f6f95094b79ae51e58fd57911440728d32f26ad86e3a0a0c6e188fa1a0abdb525ec518ca282f565e93e497f5180f479e
TLSH
T13AE02BAAC821AD270CFE471868150645E751175F2F80555F363D5108CFB0A6A42CAC6C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 375KB
SHA256 431a3251deb71c9c6d19db7ece22c26583f9d8fdba96fdfbb6a5b27d4214e31f
MD5 a3e719f84f525e2c6689b3f6ac73c402
SHA1 e3e93bf2c5aa88529ea3c1e524d2350245e91515
SHA512 0816380a9e625ce2e34fef598104a90a2724096b4d627bbe790c58008eeb3c50c732aa24500caa54fdc46c7f63216533adfb46d119a74aff4ed421b9f381ddbc
SSDEEP 6144:bk02i6NJqyLQCeqg5Vici0bU4rCHA9Q9lkOmEeWxF9Mh+kLNYr7tHLh:bMNJqybeqYvxCHAmXmEevbK3Bd
TLSH
T1A4842368F4BFE4A2AE8449215E5E0D746F487EB21740540AFB7DE2BB2415C493B6F203
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 daac45e728fc6da94d2257816f3f21eab0cb5314c2292b254d5902f34c22e172
MD5 bb76e3e3a508c75a2adfcdb64c9cc02a
SHA1 9e26c342d6d915dcdc12b1e842ce06335973f6c3
SHA512 d26441195d9c337f0a163cfb566a5cf4d75949277d36ea0330d05693af8a54954226e72cb2190491ad6a3a9f2c6be1ca3e4c1482c216330d2ecdcccc253954e3
TLSH
T19AC09210318104C3CF55CBF05CF267822A941CFC0AD2C6AD8292A28AAD22AA06D2646D
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f5809120787d38e8b967bdfde773bba2e6abd643f1f85ae4f9d378ec46d82256
MD5 fb1eec8bbc9b7eae029ff28695e1893c
SHA1 2637e699416e8e9f28bfe49ba8ecddcc87319df4
SHA512 18b95aabfc10686a84d2f4f7b954ba6d1c3f86bea9b63ea498e39884cbbaf007c38bad2620368c9d058ce60e3538f21011c3e2b8a72be351bcc31226ebfd4ac8
TLSH
T12C717DF7C3E8C56D891156F4A7156F2FCD290A24432C3C66C9D4EE4B53E2972D21174E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5072f6b53ee3b6aad3625a4f78ceab6271a27eff8c785a6e82ade8a53058dadb
MD5 b2d94328b61fb7d9f869cf3431164fa5
SHA1 9b3259237d22a7255c1e59dda95247d231b0a533
SHA512 8a4e7f05ff21cc0a5fed8d19f10377fad0d0aa00698605fa6acea155651629899de7ffa480a8f74bf92a49c799913917ee0341edb4cc7ef4adde60162b1f50c4
SSDEEP 192:eRgn/TMm/Iuv7spAPRp22F9wHsb+WNn0z0hY2+c4oeUfXJVyIsnAUgtaJ:eRgn78KYUX/FKwY02294Cf/8
TLSH
T18742D72EFA54693B5CCBD21AFD227B57D7F1102136942E80E6FC892C16DB9CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 379d96542283773f422c052abe7293924621df1604b63c9a59676e1514d2db6c
MD5 d066f854d368cbebca026e5da297c2c3
SHA1 4f2f84d54b0a8dfd273bbdb70bcde51ad5e2f12f
SHA512 613285c6b38983d33fb336394c5eff7edb692f60dfa433defdbf45524dd1c84cadfc8cba744a39b1c75482b318f7db6eaaae9842cfa8649a9ad00cece8442e41
SSDEEP 384:gCjUH7KxkXqKf/pUZNCgVLH2HfgslsZ7pLuLcSjCDXODUr+ErU3/NHGcmyqOqjmo:gCUH7KxkXqKf/pUZNCgVLH2Hfgs+Z7pF
TLSH
T15A7209676C4C9E370F94C6CCD8267F4F9DB5024B65E9886483FA9C2903D5ACB114A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 ac87167fe9acfe5055614f20f7efa5d1ca6eaddd197f68bc6354773bc5ef7b65
MD5 eea903d6aa2edefbec8af8f89e8eada2
SHA1 5d0d57bb229e0bd66fc31a2c189f0a77648953f4
SHA512 551e7047895a1bd966c073c6cee6c5be9a149a82b6ee4c568befa71f6977f001a03fce4b483cf830fdee0dc0f92b57298308f470b492944f2bb7d2cb275cc7a0
TLSH
T18DB01211D0015511C04302F02152248872146F119B0B1B0143E86A72CC36171C014451
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59239b.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59239b.TMP
Size 96B
SHA256 8c67c39a1498ca7fd5dae17cd96a8f1d433efe30f5354c44e6432556882319a3
MD5 119f1e13bd710619b502a4557e756471
SHA1 aab772143651e43a84e18a88f11212dd836b370c
SHA512 1aecb232b19b5f8d1a69200f63c3a8fa4ae9a1ecabcf4f9f47f83519f981ac5922c0405eca7aa7edabc6baf804b657a16f22f335f35b627b4c26f40f1823ccaf
TLSH
T1D7B0222CC0022203C08283F023A080C830A0CF22C2032223A3E02E32CC302328020020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 e2ea463eefe0cffbac37f9c1cf984301ea3cd7a017fe418cf94725d074c1bb32
MD5 fc3db31ea51a48390a16d75d1fee1a91
SHA1 462a92c472fa13d6d68ddd213a5a0042d393da27
SHA512 1a7ed5e5a9ca399ce6d858c136b6984a561076ef9949ce6a4902e31eba4221478dd322a2803586d3249a8d561088ca635bfeed50efff390deeea18ac5599aea2
SSDEEP 6144:WpsLiqC6IPHXi0X6vK+1Im7Rkm1tYpBeh2BAoj:WpsNC6cHy0IFL9oBGcAoj
TLSH
T13734122BBD6ADEF715A4A719708E0B1F4DF448A3D470D997C8F57F00239AA86410EE78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 289KB
SHA256 854e43cfddc5be4e74bae87dd8fdabcdf099069f3617d3344eb1127af7ff9a66
MD5 718e4d1a374aefc0402927a1e84f025a
SHA1 c34995c5609ef501dba568df7e5a88a78315102e
SHA512 1bc5e3a3202d3f6bcebcf305368bb6add8214477d6c449a65aeb6c6ecd359d54a6c84337bfdd0309d94b46159f6948eaee49c6cc858d4c01459fd76c3bd875f9
SSDEEP 6144:6UsMQGw8v4psLiqC6IPHXi0X6vK+1Im7Rkm1tYpBeh2BAoj:77w8wpsNC6cHy0IFL9oBGcAoj
TLSH
T1FC5412377D399D7B05F4AA1CB08F1A1F0CF589A394A4DE46C8E96F0033ABA49444ED74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 b9a6a6574ba8e628f7288e46108b52721f4de03b6f1a01ea8a8493650b30dc09
MD5 d85a8285eb295b7baeaa6d92f73e090c
SHA1 0c631f42789aa8d749356207f1b69808886d0334
SHA512 ce85b13b526658ca56ad6d465b6de137165a94a162a5f9d695d564dd3e62fcd538c8c51f230556f3d04aa833a13d92cb7d0dee47acec9557ab2bd1eb2b21ef6d
SSDEEP 3072:AGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:rm7Rkm1tYpBeh2BAoK
TLSH
T1CEC3123B5D75E9779979A70EB08E0B1F1EF149A2D920DE92C8D86B0437E97C90A04D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CitizenFX.exe.new

Path C:\Users\Admin\AppData\Local\Temp\CitizenFX.exe.new
Size 4.9MB
SHA256 98a9cdad08a5fb7db4ac8e12064a731f522b037f7778c1341800301986e602a3
MD5 95a7769478acbe78cdba4debd8936406
SHA1 714142bf753165d0318b799900aa6c00afa682e6
SHA512 ca60a785b7baa5ff0f38bf274799afc2755df9ac61163dacc15f31b6ba61d20d0b4d0f48e87ab84d79592786aabd9b09235e0df6aaab74f3d3d0e81da8cc3c8f
SSDEEP 49152:fOjPWkBEGgHRtHhFAgI60X/i3klpPVVgqxdSA+tDNzDksQPBJTehAazOtFwaW40u:WpUJI6klpPVnSAnCabJ8JhOJp3pGWme
TLSH
T17D369D2663A401E8C5B7D178CA978627E7B2BC051371D7DF02A0666A1F37BE16E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FiveM.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FiveM.lnk
Size 2KB
SHA256 f62480647dab02f8e9af929f0f57e6b59a5206814211d05c247dc22c1b628e93
MD5 ace0fa73de4b5a49899d33f05a1d6112
SHA1 cbd52ce4545ba499ce930254eaeb738d803ae8be
SHA512 186b3152d5a60614822a571449e4595eefc881e364531a8fbc9f07105e4df33613bb6a4b7382b210770eb18cd69aa0dd5a7d5af0d5f86cf615ab74562b14bc25
TLSH
T19841620399EA5F21DAFED17498F7231199B6BCA2F7618B1F4140828C1E50E419E85F4F
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download