Analysis

  • user interaction
    yes
  • max time kernel
    159s
  • max time network
    200s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/09/2026, 04:13

General

  • Target
    setupvcs.exe
  • Size 701.5MB
  • Sample260910-es2vgaxclb
  • SHA256 a9085154912a14093bb3fceba203411b2b6bb87c7195858d394f123bb244249e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

  • Modifies registry class 20 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setupvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\setupvcs.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:6044
    • C:\Users\Admin\AppData\Local\Temp\is-B4A2G.tmp\setupvcs.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-B4A2G.tmp\setupvcs.tmp" /SL5="$300B4,734710541,791552,C:\Users\Admin\AppData\Local\Temp\setupvcs.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4840
      • C:\Program Files (x86)\GTA Vice City Stories\Enginevcs.exe
        "C:\Program Files (x86)\GTA Vice City Stories\Enginevcs.exe" vcsgamedata.iso
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3492

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Enginevcs.exe

        • Path C:\Program Files (x86)\GTA Vice City Stories\Enginevcs.exe
        • Size 16.3MB
        • SHA256 48dc747a1f3e4a34209604027057e3844a663a06c57eaac17608434979730d00
        • MD5 SHA1 SHA512 SSDEEP TLSH

        asciifont_atlas.meta

        • Path C:\Program Files (x86)\GTA Vice City Stories\assets\asciifont_atlas.meta
        • Size 6KB
        • SHA256 92ab3d61d17e6fa2111a80bd75d89cc241f2a85461d0f3e58198f84adcf35c9c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        asciifont_atlas.zim

        • Path C:\Program Files (x86)\GTA Vice City Stories\assets\asciifont_atlas.zim
        • Size 81KB
        • SHA256 1020b3cc03eced719dceec715b547f849b5594c4b7085143eab50ed3e3d87afc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        compat.ini

        • Path C:\Program Files (x86)\GTA Vice City Stories\assets\compat.ini
        • Size 38KB
        • SHA256 81c4a8a21d2a2d77ddb0bf9c444fb515be772f5de2382bc14b4b948a8a28b7d7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        compatvr.ini

        • Path C:\Program Files (x86)\GTA Vice City Stories\assets\compatvr.ini
        • Size 23KB
        • SHA256 22e0b4a2a95151da24ab57cc601ba0db68105813b29e518d192755b7cd2b9cd0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-RRVOA.tmp

        • Path C:\Program Files (x86)\GTA Vice City Stories\assets\is-RRVOA.tmp
        • Size 109KB
        • SHA256 d014cfc19b2e6f96383c9f55683e5c8224bbcf45f819b103bfc2169bae9fda69
        • MD5 SHA1 SHA512 SSDEEP TLSH

        en_US.ini

        • Path C:\Program Files (x86)\GTA Vice City Stories\assets\lang\en_US.ini
        • Size 46KB
        • SHA256 8bf5e590c3c97d840b9a33e53b167b5b57c69cd8f348f4a3961a3a9bdeb46edb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        langregion.ini

        • Path C:\Program Files (x86)\GTA Vice City Stories\assets\langregion.ini
        • Size 1KB
        • SHA256 5a665794365419ae2ac39375ffb951a8551bce63d16f21a76e1d078cdb4eacbc
        • MD5 SHA1 SHA512 TLSH

        ppge_atlas.meta

        • Path C:\Program Files (x86)\GTA Vice City Stories\assets\ppge_atlas.meta
        • Size 49KB
        • SHA256 2eadb18c05d8f492b46c23bcbad4f4811c98cf717145536ccfe136787845f2ed
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ppge_atlas.zim

        • Path C:\Program Files (x86)\GTA Vice City Stories\assets\ppge_atlas.zim
        • Size 650KB
        • SHA256 3ab7fcf6956d0281ada94d501fc6d1cfa8fc034f139e25fed6c829f723d92a95
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sfx_achievement_unlocked.wav

        • Path C:\Program Files (x86)\GTA Vice City Stories\assets\sfx_achievement_unlocked.wav
        • Size 79KB
        • SHA256 c95f53b1279684c8db5f2b518a63675db3713b3c097c65fd2ff280baf29ffd34
        • MD5 SHA1 SHA512 SSDEEP TLSH

        defaultthemes.ini

        • Path C:\Program Files (x86)\GTA Vice City Stories\assets\themes\defaultthemes.ini
        • Size 749B
        • SHA256 b8ae8848494033ee1e59bb5e044ea4c81f36c46e9c8808d5a8f0266584125113
        • MD5 SHA1 SHA512 TLSH

        ui_atlas.meta

        • Path C:\Program Files (x86)\GTA Vice City Stories\assets\ui_atlas.meta
        • Size 1KB
        • SHA256 d48b922fde83c3a0489d60ce42595fa23b0b661e697d636eba1787ef84ea9d46
        • MD5 SHA1 SHA512 TLSH

        ui_atlas.zim

        • Path C:\Program Files (x86)\GTA Vice City Stories\assets\ui_atlas.zim
        • Size 70KB
        • SHA256 b0f2e6b88ee204b3a9a4fc3554052331bcf32558a2db0bd1e8eed44bd0f139bd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        d3dcompiler_47.dll

        • Path C:\Program Files (x86)\GTA Vice City Stories\d3dcompiler_47.dll
        • Size 4.0MB
        • SHA256 e994847e01a6f1e4cbdc5a864616ac262f67ee4f14db194984661a8d927ab7f4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ULUS10160.ini

        • Path C:\Program Files (x86)\GTA Vice City Stories\memstick\PSP\Cheats\ULUS10160.ini
        • Size 83B
        • SHA256 40fb3ed0e4c7e77e5adff338cc6cf079fd8e3fbe715d2d628b9a35ec08881a0f
        • MD5 SHA1 SHA512 TLSH

        GTAVCS.PPSSPP.WidescreenFix.ini

        • Path C:\Program Files (x86)\GTA Vice City Stories\memstick\PSP\PLUGINS\GTAVCS.PPSSPP.WidescreenFix\GTAVCS.PPSSPP.WidescreenFix.ini
        • Size 1KB
        • SHA256 308a24920097944a22eb0d0aad728337d40721b0e316cdb2411f420b09a68e13
        • MD5 SHA1 SHA512 TLSH

        GTAVCS.PPSSPP.WidescreenFix.prx

        • Path C:\Program Files (x86)\GTA Vice City Stories\memstick\PSP\PLUGINS\GTAVCS.PPSSPP.WidescreenFix\GTAVCS.PPSSPP.WidescreenFix.prx
        • Size 245KB
        • SHA256 22beb4a7045ebbff47b8942efe9df2d69f3e806ba8b906ba2fbd3736dadb71f8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        plugin.ini

        • Path C:\Program Files (x86)\GTA Vice City Stories\memstick\PSP\PLUGINS\GTAVCS.PPSSPP.WidescreenFix\plugin.ini
        • Size 197B
        • SHA256 a3c6e98af8607432209ca0b47aa1b10e0fce40dcee98cad342c6565242a325ea
        • MD5 SHA1 SHA512 TLSH

        cheatdevice_names_vcs.ini

        • Path C:\Program Files (x86)\GTA Vice City Stories\memstick\PSP\PLUGINS\cheatdevice_remastered\cheatdevice_names_vcs.ini
        • Size 106KB
        • SHA256 233d26fe1f098da6de1b374d1729fad091404b00cf2e99143477204ee2d57c1d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cheatdevice_remastered.cfg

        • Path C:\Program Files (x86)\GTA Vice City Stories\memstick\PSP\PLUGINS\cheatdevice_remastered\cheatdevice_remastered.cfg
        • Size 496B
        • SHA256 c6fecb9296e6527666e01fdca0bd7ab3ca82eaf37666dbc7f04874f8ad12404d
        • MD5 SHA1 SHA512 TLSH

        cheatdevice_remastered.prx

        • Path C:\Program Files (x86)\GTA Vice City Stories\memstick\PSP\PLUGINS\cheatdevice_remastered\cheatdevice_remastered.prx
        • Size 440KB
        • SHA256 e02d5787cf4c29c7d5344b648977ceaefd6f81b7861eafb8d78b0dab65765a14
        • MD5 SHA1 SHA512 SSDEEP TLSH

        plugin.ini

        • Path C:\Program Files (x86)\GTA Vice City Stories\memstick\PSP\PLUGINS\cheatdevice_remastered\plugin.ini
        • Size 205B
        • SHA256 f221be46fcacd3bd8c64d6b5d4b7d2a948184f72902ae0e09f9762b9e9f94e53
        • MD5 SHA1 SHA512 TLSH

        cleo.log

        • Path C:\Program Files (x86)\GTA Vice City Stories\memstick\PSP\PLUGINS\cleo\cleo.log
        • Size 1KB
        • SHA256 8824c6b678278407a64cb0b92cb8fa02e1e6cedf4216dcab89b264376ecef199
        • MD5 SHA1 SHA512 TLSH

        cleo.prx

        • Path C:\Program Files (x86)\GTA Vice City Stories\memstick\PSP\PLUGINS\cleo\cleo.prx
        • Size 483KB
        • SHA256 cb48a22bec48b3dc80d9abe41b39134a711550ab523eb5de02f0b75cd9f0b264
        • MD5 SHA1 SHA512 SSDEEP TLSH

        plugin.ini

        • Path C:\Program Files (x86)\GTA Vice City Stories\memstick\PSP\PLUGINS\cleo\plugin.ini
        • Size 203B
        • SHA256 a146f21d92bd2881535bec822d0f76f620a71fb4c36a159a3e9aadfb5cea31dd
        • MD5 SHA1 SHA512 TLSH

        MOUSE.CSA

        • Path C:\Program Files (x86)\GTA Vice City Stories\memstick\PSP\PLUGINS\cleo\vcs\MOUSE.CSA
        • Size 853B
        • SHA256 b8e1a7c1f9ba37fbdeccece738cfd34fa451e48a702bb85d0cec955684a6e07c
        • MD5 SHA1 SHA512 TLSH

        MOUSECAR.CSA

        • Path C:\Program Files (x86)\GTA Vice City Stories\memstick\PSP\PLUGINS\cleo\vcs\MOUSECAR.CSA
        • Size 1KB
        • SHA256 5a0c9b32cc10a5a2c2140b0bfa8084623752acca80e9a10d6d99744f3bba7c40
        • MD5 SHA1 SHA512 TLSH

        WEAPFIX.CSA

        • Path C:\Program Files (x86)\GTA Vice City Stories\memstick\PSP\PLUGINS\cleo\vcs\WEAPFIX.CSA
        • Size 1KB
        • SHA256 6499fb5fdfe4b320772abdf51c3812d68c023669fa32df4fa86510315fd026b4
        • MD5 SHA1 SHA512 TLSH

        gtavcs.autoaim.csa

        • Path C:\Program Files (x86)\GTA Vice City Stories\memstick\PSP\PLUGINS\cleo\vcs\gtavcs.autoaim.csa
        • Size 257B
        • SHA256 5b546a2f3370db2a97d92509372eb017738b42f79985e95c918cbd9b66deffd3
        • MD5 SHA1 SHA512 TLSH

        gtavcs.bodyguards.csi

        • Path C:\Program Files (x86)\GTA Vice City Stories\memstick\PSP\PLUGINS\cleo\vcs\gtavcs.bodyguards.csi
        • Size 378B
        • SHA256 497f0850546d339ff2544fdf63a3e7b56f567aef72ce0352f436ca5f1e0e8120
        • MD5 SHA1 SHA512 TLSH

        gtavcs.bodyguards.fxt

        • Path C:\Program Files (x86)\GTA Vice City Stories\memstick\PSP\PLUGINS\cleo\vcs\gtavcs.bodyguards.fxt
        • Size 55B
        • SHA256 568a9bd129660f27affb3a3b568521cfafd072f3e81d7f808a78120b0c22e7a1
        • MD5 SHA1 SHA512 TLSH

        gtavcs.carspawner.csi

        • Path C:\Program Files (x86)\GTA Vice City Stories\memstick\PSP\PLUGINS\cleo\vcs\gtavcs.carspawner.csi
        • Size 1KB
        • SHA256 051b2e243adc24a22267e1d88cc06cf0c5ce2aa55353fa186883c15b249a0fce
        • MD5 SHA1 SHA512 TLSH

        gtavcs.cheats.csi

        • Path C:\Program Files (x86)\GTA Vice City Stories\memstick\PSP\PLUGINS\cleo\vcs\gtavcs.cheats.csi
        • Size 1KB
        • SHA256 aee9a251cc0cdc536d7767c107823ec6e60beb5556ffb369771fcb57e00ca88d
        • MD5 SHA1 SHA512 TLSH

        gtavcs.clear_wanted.csi

        • Path C:\Program Files (x86)\GTA Vice City Stories\memstick\PSP\PLUGINS\cleo\vcs\gtavcs.clear_wanted.csi
        • Size 67B
        • SHA256 48533a7ce4f85dd4820796661d059fc673b165a5e7e4a3e91a6f815ab5afc12d
        • MD5 SHA1 SHA512 TLSH

        gtavcs.select_mission.csi

        • Path C:\Program Files (x86)\GTA Vice City Stories\memstick\PSP\PLUGINS\cleo\vcs\gtavcs.select_mission.csi
        • Size 707B
        • SHA256 3f7eab11d7ecb0254332fe3b3a89d576c067dc856254f09b5767fb19c272f471
        • MD5 SHA1 SHA512 TLSH

        gtavcs.teleport.csi

        • Path C:\Program Files (x86)\GTA Vice City Stories\memstick\PSP\PLUGINS\cleo\vcs\gtavcs.teleport.csi
        • Size 642B
        • SHA256 e75116a9d750cc3a18a6c38cee1f83657fb35e0ab434ffa0e82fa68dc0189aad
        • MD5 SHA1 SHA512 TLSH

        gtavcs.weather.csi

        • Path C:\Program Files (x86)\GTA Vice City Stories\memstick\PSP\PLUGINS\cleo\vcs\gtavcs.weather.csi
        • Size 318B
        • SHA256 c159b650b45a03d5d8c5b84adc30b83c305c4550c1b0254ccd4c9ab909f0e216
        • MD5 SHA1 SHA512 TLSH

        ULUS10160_1.03_0.ppst

        • Path C:\Program Files (x86)\GTA Vice City Stories\memstick\PSP\PPSSPP_STATE\ULUS10160_1.03_0.ppst
        • Size 2.4MB
        • SHA256 fa666bfa1745d634a0a2740ed10df4d9d0f44f36c9030942bf0b45e1f53e0194
        • MD5 SHA1 SHA512 SSDEEP TLSH

        load_undo.ppst

        • Path C:\Program Files (x86)\GTA Vice City Stories\memstick\PSP\PPSSPP_STATE\load_undo.ppst
        • Size 2.4MB
        • SHA256 6d0f5dc950ab3fa5d01fd0f390624d6c07ac2fb810c8e4e9fcbf5b3d465c54c2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DATA.BIN

        • Path C:\Program Files (x86)\GTA Vice City Stories\memstick\PSP\SAVEDATA\ULUS10160S92F7\DATA.BIN
        • Size 55KB
        • SHA256 3d406fe2c6c145dad93f75715c47502dc906fc940c27643aecdbb7d87c72c00d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PARAM.SFO

        • Path C:\Program Files (x86)\GTA Vice City Stories\memstick\PSP\SAVEDATA\ULUS10160S92F7\PARAM.SFO
        • Size 4KB
        • SHA256 93288234b87c90f4e3c7d9f4981c28ec7d1cd911329197befeef9d322ef9b23b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        icon.cache

        • Path C:\Program Files (x86)\GTA Vice City Stories\memstick\PSP\SYSTEM\CACHE\icon.cache
        • Size 12B
        • SHA256 92ccb5502136f88218fd6489558b0e7678a5f5a6c63e2e1c6e463a32d02c251c
        • MD5 SHA1 SHA512

        ULUS10160_ppsspp.ini

        • Path C:\Program Files (x86)\GTA Vice City Stories\memstick\PSP\SYSTEM\ULUS10160_ppsspp.ini
        • Size 12KB
        • SHA256 5e240a48fa9f49024c22b44a79bfa10b64263366803a4cb558aa617d81ea3a87
        • MD5 SHA1 SHA512 SSDEEP TLSH

        background.png

        • Path C:\Program Files (x86)\GTA Vice City Stories\memstick\PSP\SYSTEM\background.png
        • Size 1.3MB
        • SHA256 6ec785031f77e139eaab03a04f0a6469bfe63bd2f03f520888859cff08ddb173
        • MD5 SHA1 SHA512 SSDEEP TLSH

        controls.ini

        • Path C:\Program Files (x86)\GTA Vice City Stories\memstick\PSP\SYSTEM\controls.ini
        • Size 662B
        • SHA256 96a0821d364bb7c18117a8ba10400eb34e23be251a78e52cb8f336a447856f75
        • MD5 SHA1 SHA512 TLSH

        ppsspp.ini

        • Path C:\Program Files (x86)\GTA Vice City Stories\memstick\PSP\SYSTEM\ppsspp.ini
        • Size 17KB
        • SHA256 4ed5afb65dd52f8dcc071801d32b24abe273ceea4e18e73146e9c5a5ecfcbe3a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ppsspp.ini

        • Path C:\Program Files (x86)\GTA Vice City Stories\memstick\PSP\SYSTEM\ppsspp.ini
        • Size 17KB
        • SHA256 d9c8a715a5754dc528648846ee75b4b9802970004ef2375aab190569b209c69e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-7765S.tmp

        • Path C:\Program Files (x86)\GTA Vice City Stories\memstick\PSP\TEXTURES\ULUS10160\Buttons\is-7765S.tmp
        • Size 137B
        • SHA256 89984988bf13bffed7e616a3ddb9b0aa854a82a34756206ad979bbe2d523da35
        • MD5 SHA1 SHA512 TLSH

        Loading_Screen_2.png

        • Path C:\Program Files (x86)\GTA Vice City Stories\memstick\PSP\TEXTURES\ULUS10160\Misc\Loading_Screen_2.png
        • Size 1.2MB
        • SHA256 4262241053b4cd4eedba5558b796a8b331bbe0132e720b271198337435afd944
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gametext.png

        • Path C:\Program Files (x86)\GTA Vice City Stories\memstick\PSP\TEXTURES\ULUS10160\Text\gametext.png
        • Size 178KB
        • SHA256 29f2e12afb8dd917f00522b5c757df1c674f9d10c3679ea322077c8449f51e34
        • MD5 SHA1 SHA512 SSDEEP TLSH

        shad_car.png

        • Path C:\Program Files (x86)\GTA Vice City Stories\memstick\PSP\TEXTURES\ULUS10160\graphics\shad_car.png
        • Size 1KB
        • SHA256 3eeaacb4b707e07bdaae61235e92c0acdc7529a48ff0a47b8bd30a2fc8dc5983
        • MD5 SHA1 SHA512 TLSH

        textures.ini

        • Path C:\Program Files (x86)\GTA Vice City Stories\memstick\PSP\TEXTURES\ULUS10160\textures.ini
        • Size 13KB
        • SHA256 c23ff90fb0fa049348c2e07b189b0103214c6b64b0bbfb1b994f1dc76777e8d6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        setupvcs.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\is-B4A2G.tmp\setupvcs.tmp
        • Size 3.0MB
        • SHA256 14cae6019a0d968ea3e6ead815cd1cdd5a55616f63043f42af4d61cc50507813
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/4840-687-0x0000000000400000-0x0000000000709000-memory.dmp

        memory/4840-676-0x0000000000400000-0x0000000000709000-memory.dmp

        memory/4840-32-0x0000000000400000-0x0000000000709000-memory.dmp

        memory/4840-30-0x0000000000400000-0x0000000000709000-memory.dmp

        memory/4840-28-0x0000000000400000-0x0000000000709000-memory.dmp

        memory/4840-26-0x0000000000400000-0x0000000000709000-memory.dmp

        memory/4840-24-0x0000000000400000-0x0000000000709000-memory.dmp

        memory/4840-10-0x0000000002630000-0x0000000002631000-memory.dmp

        memory/4840-9-0x0000000000400000-0x0000000000709000-memory.dmp

        memory/4840-6-0x0000000002630000-0x0000000002631000-memory.dmp

        memory/6044-8-0x0000000000400000-0x00000000004CE000-memory.dmp

        memory/6044-0-0x0000000000400000-0x00000000004CE000-memory.dmp

        memory/6044-688-0x0000000000400000-0x00000000004CE000-memory.dmp