3387931fc00ae9bd5fff9fc8efe7537960cef92aac32133066172f3952fe1ed9

Resubmissions

20/06/2026, 04:46

260620-fefwhsds3r8

20/06/2026, 04:40

20/06/2026, 04:37

20/06/2026, 04:34

20/06/2026, 04:30

Analysis

max time kernel
147s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FiveM (4).exe
Size 4.9MB
Sample260620-e444zaet8s
SHA256 3387931fc00ae9bd5fff9fc8efe7537960cef92aac32133066172f3952fe1ed9
MD5 7d1daf13865d725090511e79c480cccd
SHA1 f33b007f3df5f1ba949ecedf5645fd10f83d36ce
SHA512 e8e1ebcbf1d9065a01089e833b6dcfccbeaf435a80370ea042f633571b1879a1f31269e3244453fde6851a1c38d5594be670d76a48e57abca3a5e0d67ee27408
SSDEEP 49152:nOjPWFZwclTLDHWk7o1HMvdCuYTfksFHaciUylf00Ki482X/ub2PwTAK7BJQmDfz:JXnLouYTB7N8vyO7UqGGyL6bs3U0mD
TLSH
T1FE369D5663A401E8C1B7D178CA978627EBB27C151331DBDB02A0666A1F37BE16F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\FiveM\FiveM.app\desktop.ini	FiveM.exe
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
2736	GameBarPresenceWriter.exe

Deletes itself 1 IoCs

pid	Process
2352	CitizenFX.exe.new

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 4 IoCs

pid	Process
2352	CitizenFX.exe.new
1356	FiveM (4).exe
3076	FiveM.exe
692	FiveM_DumpServer

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4118910392-3846778420-3545080915-1000\Control Panel\Colors	FiveM (4).exe
Key created	\REGISTRY\USER\S-1-5-21-4118910392-3846778420-3545080915-1000\Control Panel\Colors	FiveM.exe

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4118910392-3846778420-3545080915-1000\{574B71B5-3CB9-4777-A9E8-7C4F6BCA32DF}	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-4118910392-3846778420-3545080915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4118910392-3846778420-3545080915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4118910392-3846778420-3545080915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-4118910392-3846778420-3545080915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4118910392-3846778420-3545080915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4118910392-3846778420-3545080915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-4118910392-3846778420-3545080915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-4118910392-3846778420-3545080915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	FiveM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4118910392-3846778420-3545080915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	FiveM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4118910392-3846778420-3545080915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-4118910392-3846778420-3545080915-1000_Classes\Local Settings	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4118910392-3846778420-3545080915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4118910392-3846778420-3545080915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-4118910392-3846778420-3545080915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-4118910392-3846778420-3545080915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	FiveM.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2352	CitizenFX.exe.new
2352	CitizenFX.exe.new
1356	FiveM (4).exe
1356	FiveM (4).exe
3076	FiveM.exe
3076	FiveM.exe
692	FiveM_DumpServer
692	FiveM_DumpServer

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2352	CitizenFX.exe.new

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4636	FiveM (4).exe
3076	FiveM.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4636	FiveM (4).exe
3076	FiveM.exe
6000	OpenWith.exe
3076	FiveM.exe
3076	FiveM.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 2352	4636	FiveM (4).exe	88
PID 2352 wrote to memory of 1356	2352	CitizenFX.exe.new	89
PID 1356 wrote to memory of 3076	1356	FiveM (4).exe	90
PID 3076 wrote to memory of 692	3076	FiveM.exe	97

C:\Users\Admin\AppData\Local\Temp\FiveM (4).exe
"C:\Users\Admin\AppData\Local\Temp\FiveM (4).exe"
1⤵
- Modifies Control Panel
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Users\Admin\AppData\Local\Temp\CitizenFX.exe.new
  CitizenFX.exe.new -bootstrap "C:\Users\Admin\AppData\Local\Temp\FiveM (4).exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Users\Admin\AppData\Local\Temp\FiveM (4).exe
    "C:\Users\Admin\AppData\Local\Temp\FiveM (4).exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1356
  - - C:\Users\Admin\AppData\Local\FiveM\FiveM.exe
      "C:\Users\Admin\AppData\Local\FiveM\FiveM.exe"
      4⤵
      Drops desktop.ini file(s)
      Executes dropped EXE
      Modifies Control Panel
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3076
    - - C:\Users\Admin\AppData\Local\FiveM\FiveM.app\data\cache\subprocess\FiveM_DumpServer
        
        "C:\Users\Admin\AppData\Local\FiveM\FiveM.app\data\cache\subprocess\FiveM_DumpServer" -dumpserver:1448 -parentpid:3076
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:692

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:2736

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:6000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:4124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
PID:5288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.meta.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\platform-2372\data\control\settings.meta.tmp
Size 37KB
SHA256 f9ae094812ce9fbd56b58dab7739451792aba8f56c5f21eee15ef96682b413a6
MD5 3656c6636cd9dbceaf83230c3c9a2be9
SHA1 989f27c6736a943fd4690091fed26f7c17e3c17f
SHA512 52bbb8f2b2d6183f30b908d9171a2ec8c2128bbce145b7af0095d4c199b1ec431d650ec4ed0b1b6cbc7bcc8d29da3285cdcc61368faa8c4e57b45315ced4e4ad
SSDEEP 384:Gs34QmZSgC5RHTiVfNSAvRSOxRlne8lISI11zHdlz9a8QSuF5MGsXZXgCoRKRyR8:D34QMfNSEWJvz39pjE4
TLSH
T1B803DA6C3A9D5F5A198880B71CF704C971AFECBA2FEA19941B25A13307C3E602376675
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.meta.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\platform-3095\data\control\settings.meta.tmp
Size 39KB
SHA256 71ad5591441d62d02d2b62155abcf2cab587af49b86e2db5be6729a5b39df5d1
MD5 619814b8b98007c1698576b7e4efb3ec
SHA1 e60f3ceaf5ca78f74e6867f0b042951bffb91786
SHA512 55ab0bd3c1750d63ad3304e63b7c26251f01c8994f385e5643e2bbd37fc6595fd0e9f5fc0d76aa655fe8ad3bc6fdee33248d9f4a76cce11a25d84c3f5de16236
SSDEEP 384:Gs34QSSgC5RHTiVfF3AvRSOxRlne8lY7Sf11zHdlz9a8NSuFsMysXZXgCoRKRyR7:D34QOfF3E6qvz3NpcE4
TLSH
T17803CA2C3A9D5F56198880B71CF704C971AFECBA2FEA19941B25E03307C3E602376675
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

release.txt

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\release.txt
Size 7B
SHA256 81b5bb648ba119c5db8acaa9aa929c5c6b30c8ed5f1157ffe794d647e991ef06
MD5 92f0e7696e11521403d9d7610a34f205
SHA1 cf1c22873d66ba12039d71928a24d72fe8e648f6
SHA512 4dad807b729d20799ef68e452d68fdc4c384c30b54990e237c67a468b8bcbf61c7a14896bfb2cb46738ffc7e4304feb67e20a71abb4ec01ff57b7639c1dac2de
MD5 SHA1 SHA512

Submit Download

natives_universal.lua.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\scripting\lua\natives_universal.lua.tmp
Size 2.0MB
SHA256 b3bc1d1059440d689b9c285a0a265681cc79cd265b00b9687d407f83dd46227a
MD5 a2a7a86e8a6967f78d66e7979970ace3
SHA1 612a75d180d3e686fc3b57acbae2374589758fba
SHA512 93b3504bfe495d8cd76a21df41127e8f8c113f771c027b1400b5d505e16c5080845b1ea04f9dd809c3c29c046176110005b1f385433a2089ab991c7838fdcd03
SSDEEP 49152:gNbJqV8HZrbVWFYY5obzDhpp0Ncv+aeHBqkAxZhXMBvFZGh:rg2FYYZcLh
TLSH
T1F39509DA781ED3559543632A511F194BF269C0A8212D01F0F185B8DE2432FB96BFF8FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

natives_universal.d.ts.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\scripting\v8\natives_universal.d.ts.tmp
Size 2.3MB
SHA256 358577c81e7172775737b320d552c62ab0625b1e5a25a2a6b36d62b4314895fa
MD5 aebf57205a3893f6ba4f045117c21ab4
SHA1 96f34a0d6f27b6b36705ea4989704805f905f99e
SHA512 6c5637f8231fd0429572283e4f53cbf7934fb99e00019250b4426368890a31a38ac1dbd442c73a00d301c6fe1acfb7d5bc2f06c6cb6eb8706924e41134ad6403
SSDEEP 49152:sO4NUHbAeYZJkaQ1H9LA32HD7lcmu6DjBvdnrD:sO4K6JkaUAUD
TLSH
T1EBB5969AFF493233E6B29232B0BF5048E9746258A91131DF7CF464540F1B2BC26A7D9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

natives_universal.js.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\scripting\v8\natives_universal.js.tmp
Size 2.1MB
SHA256 fe721d877ecc458b81f39ecc4fe9b2e1f4ace42aa66b37652835e390f1006c02
MD5 369582d45b386ab3a2d552565d00b82b
SHA1 945944f47f94b9a486e1611c2c34dd33f9689268
SHA512 adfd974206892ad495837171bf61c61a209d286fd52b01b3a58a7bd99e19df4b9278c6642aa445a318bf55fb1f7bcb73abe17dc2ab32e452ec4010fefb061816
SSDEEP 49152:BIMMNUY2FaHRKk6j3p1R9NWAaKeNrEDEi8XbhNEVgs:ilZKk6sAWs
TLSH
T106A5E8E93881622AE523723CD12B5D09F374E431598D21E8BCDD64982D24FBD46FEDAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\desktop.ini
Size 157B
SHA256 b1fe21f251cf7875783ea162ef86c2a5b5022a1c5157bbb7972b6b34e14ec08a
MD5 f9d948aa9426cb1a2a82e651b81a1912
SHA1 2d496caeef3b0bff6b91b99e58736cea51366348
SHA512 a962fae3853f43e4a8e2b33aa5f51a917673d76648845dffcc32037c25cb3f300e4c4fc3ea633bf78b714449dbda84416e41cc16256373c170fb82d8485e3369
TLSH
T14DC04C06818FC62DC42ED0BB1DA1A248CCBD0D2BAF6E7E04D6C0D50827D6F4FACA5685
MD5 SHA1 SHA512 TLSH

Submit Download

CitizenFX.exe.new

Path C:\Users\Admin\AppData\Local\Temp\CitizenFX.exe.new
Size 4.9MB
SHA256 98a9cdad08a5fb7db4ac8e12064a731f522b037f7778c1341800301986e602a3
MD5 95a7769478acbe78cdba4debd8936406
SHA1 714142bf753165d0318b799900aa6c00afa682e6
SHA512 ca60a785b7baa5ff0f38bf274799afc2755df9ac61163dacc15f31b6ba61d20d0b4d0f48e87ab84d79592786aabd9b09235e0df6aaab74f3d3d0e81da8cc3c8f
SSDEEP 49152:fOjPWkBEGgHRtHhFAgI60X/i3klpPVVgqxdSA+tDNzDksQPBJTehAazOtFwaW40u:WpUJI6klpPVnSAnCabJ8JhOJp3pGWme
TLSH
T17D369D2663A401E8C5B7D178CA978627E7B2BC051371D7DF02A0666A1F37BE16E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FiveM.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FiveM.lnk
Size 2KB
SHA256 c50bfa37536b80e2ea6c6dd8a3647987c297ca383a796c845e1bf53f1451306b
MD5 6d3196a05ab4a8652e925a485838ffc4
SHA1 51549b362341680cd0a6efda11b8dba936249538
SHA512 35eeace3be551146d2efc133e75f7907cc2190147bee9c88862688612f4c1ea22b5bed4f03a5470d5f2ea9c80785eb08db6e22b03864048703bb89eba7c6ccd8
TLSH
T1E441F30399DA9F21D7EDC87094F7B31059B2BCD5A3659B4F404091880992D41DD95F1F
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2352-5-0x00007FFD68D70000-0x00007FFD68D71000-memory.dmp

Download

memory/4124-99-0x0000015C1B7F0000-0x0000015C1BE70000-memory.dmp

Download

memory/4124-68-0x0000015C1B7F0000-0x0000015C1BE70000-memory.dmp

Download