0737e631cbaf6f59b1680927006d5650b6ec9c00b76fc64f7f3eca33049c348f

Analysis

user interaction
yes
max time kernel
40s
max time network
47s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 20:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Bundle.exe
Size 2.4MB
Sample260817-zhy12shm2x
SHA256 0737e631cbaf6f59b1680927006d5650b6ec9c00b76fc64f7f3eca33049c348f
MD5 677a1953770b6688dea61c91869a382d
SHA1 033e1199adfed7d4bbc2b5703c0fef46eac1497d
SHA512 5817397f63b77f716f7d9011146b6152f9e07f63be75c60e2e99e4d24498f7debea5a87202429f4b071539a4bb25af0f2d02b3d90956b264ce345fcee579e081
SSDEEP 49152:pZ80Vr0mx3ZAwhwGsfnzZHOkqIDJxnZXgOFv7OK0ebRCz+fitpo:HV4m05Rfzk2DJxnZQuSviCntp
TLSH
T11CC53389D33C41CAC838C570483E2BAF6D7978A8D7D416EA97F193648FA17C6BAD5130
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4104	FiveM.exe
4680	FiveM_DumpServer

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\BDF30E7B\FiveM.app\desktop.ini	FiveM.exe

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4396	GameBarPresenceWriter.exe
1568	GameBarPresenceWriter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Control Panel\Colors	FiveM.exe

Modifies registry class 29 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\NotificationData	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	FiveM.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{0615BE0E-2074-4603-9466-80F68F7B4B81}	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	FiveM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	FiveM.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4104	FiveM.exe
4104	FiveM.exe
4680	FiveM_DumpServer
4680	FiveM_DumpServer

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4104	FiveM.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4104	FiveM.exe
4200	OpenWith.exe
4104	FiveM.exe
4104	FiveM.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 612 wrote to memory of 4104	612	Bundle.exe	89
PID 4104 wrote to memory of 4680	4104	FiveM.exe	95

C:\Users\Admin\AppData\Local\Temp\Bundle.exe
"C:\Users\Admin\AppData\Local\Temp\Bundle.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:612
- C:\Users\Admin\AppData\Local\Temp\BDF30E7B\FiveM.exe
  "C:\Users\Admin\AppData\Local\Temp\BDF30E7B\FiveM.exe"
  2⤵
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Modifies Control Panel
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4104
- - C:\Users\Admin\AppData\Local\Temp\BDF30E7B\FiveM.app\data\cache\subprocess\FiveM_DumpServer
    "C:\Users\Admin\AppData\Local\Temp\BDF30E7B\FiveM.app\data\cache\subprocess\FiveM_DumpServer" -dumpserver:2388 -parentpid:4104
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4680

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:4396

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:3080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
PID:5520

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:1568

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.meta.tmp

Path C:\Users\Admin\AppData\Local\Temp\BDF30E7B\FiveM.app\citizen\platform-2372\data\control\settings.meta.tmp
Size 37KB
SHA256 f9ae094812ce9fbd56b58dab7739451792aba8f56c5f21eee15ef96682b413a6
MD5 3656c6636cd9dbceaf83230c3c9a2be9
SHA1 989f27c6736a943fd4690091fed26f7c17e3c17f
SHA512 52bbb8f2b2d6183f30b908d9171a2ec8c2128bbce145b7af0095d4c199b1ec431d650ec4ed0b1b6cbc7bcc8d29da3285cdcc61368faa8c4e57b45315ced4e4ad
SSDEEP 384:Gs34QmZSgC5RHTiVfNSAvRSOxRlne8lISI11zHdlz9a8QSuF5MGsXZXgCoRKRyR8:D34QMfNSEWJvz39pjE4
TLSH
T1B803DA6C3A9D5F5A198880B71CF704C971AFECBA2FEA19941B25A13307C3E602376675
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.meta.tmp

Path C:\Users\Admin\AppData\Local\Temp\BDF30E7B\FiveM.app\citizen\platform-3095\data\control\settings.meta.tmp
Size 39KB
SHA256 71ad5591441d62d02d2b62155abcf2cab587af49b86e2db5be6729a5b39df5d1
MD5 619814b8b98007c1698576b7e4efb3ec
SHA1 e60f3ceaf5ca78f74e6867f0b042951bffb91786
SHA512 55ab0bd3c1750d63ad3304e63b7c26251f01c8994f385e5643e2bbd37fc6595fd0e9f5fc0d76aa655fe8ad3bc6fdee33248d9f4a76cce11a25d84c3f5de16236
SSDEEP 384:Gs34QSSgC5RHTiVfF3AvRSOxRlne8lY7Sf11zHdlz9a8NSuFsMysXZXgCoRKRyR7:D34QOfF3E6qvz3NpcE4
TLSH
T17803CA2C3A9D5F56198880B71CF704C971AFECBA2FEA19941B25E03307C3E602376675
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

release.txt

Path C:\Users\Admin\AppData\Local\Temp\BDF30E7B\FiveM.app\citizen\release.txt
Size 7B
SHA256 100a9c30696779bb18ee76b7e9e50159c6d721518e23e14901922c8e9c5f8bd1
MD5 26f505ef194689c712161be9a13f640b
SHA1 a81fa1af6258dc0d60d6c349491e20bcb2574e1a
SHA512 60e16d99d8538092ef54e5b47af76fb1eb835c8593fcaf046c00e7a36e344cf59f7147aa029cac8c1492e6c1a27a2ecc9bfbeeb68440c0525a845e2df7c2ada7
MD5 SHA1 SHA512

Submit Download

natives_universal.lua.tmp

Path C:\Users\Admin\AppData\Local\Temp\BDF30E7B\FiveM.app\citizen\scripting\lua\natives_universal.lua.tmp
Size 2.0MB
SHA256 de11a2b8c358f670870849ec20602938f32216c7c68b98dd9a10a0f381b2ddd9
MD5 0b086870cb47cd0d818099da7607a872
SHA1 7f0ff7cf7f462c45d72f7494dcf8b72ce47997cb
SHA512 a74693b672f8dfe9110fd6c1eb6c35c9105e4eee56398d59c33432944adc8e0987d2ff1873a392fc1585938c0ff18ff275821cbcca2715bf7c61e734f5706424
SSDEEP 49152:JNbJqV8HyrbVWFY45oFz7hpp0ZcM+aeHBqkAxZhXMBvFZGh:Ig9FY45cuh
TLSH
T1509509DA781ED3559543632A511F194BF269C0A8212D01F0F185B8DE2432FB96BFF8FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

natives_universal.d.ts.tmp

Path C:\Users\Admin\AppData\Local\Temp\BDF30E7B\FiveM.app\citizen\scripting\v8\natives_universal.d.ts.tmp
Size 2.3MB
SHA256 52499390f5fc1a91165b4b8980b0c7c3fb3798d1db71499892e9eaa1319f56c3
MD5 b6c23a02770b32f213c2595ef5c0ae1c
SHA1 1b34f25141e2ac2aa326a7ab77ba04e100de4ff8
SHA512 d2ed9c3aed79d6be37887a19d94d815c4a004c1a54d2c0bdc66732cd9f67b39d2cc754891f328d7b0f974fb9886da2cc76d582a74a2e47b738cc0c1ab913995f
SSDEEP 49152:kO4NUH1AeYZJkIx1H9AAH2HD7lcmu6DjBvdnrD:kO4K4JkI2AkD
TLSH
T10CB5969AFF493233E6B29232B0BF5048E9746258A91131DF7CF464540F1B2BC26A7D9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

natives_universal.js.tmp

Path C:\Users\Admin\AppData\Local\Temp\BDF30E7B\FiveM.app\citizen\scripting\v8\natives_universal.js.tmp
Size 2.1MB
SHA256 02e08cc92e39910f68356f73946acdfa462f270fa3bf541dedbd4b64713dbf5d
MD5 9949bda20f33c3e4598e8ef24c735bb6
SHA1 3982a1cdf3a16be944fcae8c349e0835b23b1757
SHA512 e53400c828f00eac8dda8d2ebe393f813405a735d4406a60987ebbcf13959518977c52f3fb6790c756b3826bde2281344c12adac163b94f8698bd49353af034a
SSDEEP 49152:eIMMNUYXFaHRKk0jJG1R9NGABKeNrEDEi8XbhNEVgs:ZlmKk0ZAhs
TLSH
T193A5E8E93881622AE523723CD12B5D09F374E431598D21E8BCDD64982D24FBD46FEDAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\AppData\Local\Temp\BDF30E7B\FiveM.app\desktop.ini
Size 173B
SHA256 17ae87576a962bcabf6855ca556935d6dcd8d6eadb309282069380b5c9453bc7
MD5 9d7c86da717ecc4e85cc164ada64afda
SHA1 54f8b87cbb44b337d409df406085e9b4fd22ab16
SHA512 2fd7b235d320d69678ba473fa979f84cc09a8d4cb3b3b25c73dbd6d7fb1a017ffab9f2e658faa9c771bd3df1166848be79c54b0a96bf426e5e3275d8daed4fe2
TLSH
T10BC0120290CF822C841AC0AB48B5A188C4A80C2FEE2E7B058A90D60812C2E0EBD80781
MD5 SHA1 SHA512 TLSH

Submit Download

FiveM.exe

Path C:\Users\Admin\AppData\Local\Temp\BDF30E7B\FiveM.exe
Size 5.0MB
SHA256 c31baa5af6919a2be8be2b19275d161fcc113ca936a905855bdeecf2cacc1ecb
MD5 9bc89d3b1400d2ec8db893bdc4db81c1
SHA1 f5e266a08a31ffb7e0b7be6d536d06d4ebc894b0
SHA512 fbe870cf6e1cc9040663cae11b7a82cac9e71c6ede0d1ea4cbdeb34f692dcd618d556801732b53d9010299fbf46ad04fb238051747d598825eb7f61c6b19c0c7
SSDEEP 49152:TOjPWIYgLg9GI35nZemOvAVDAIqNVB+VSavnAERUtnzrNKY3rNgMVBE5IouLTdaO:vGIVqvB+VvYxUCBaKcw0xCoBkdH92kr
TLSH
T11136AD5673A400E8D5B7D178CA968527E7B2BC061371CBDF02A0666A1F37BE16E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4104-4-0x00007FFCE8A70000-0x00007FFCE8A71000-memory.dmp

Download