05a99a0067ddde35a8b6c92721fc8ee058ffe1cee9a9dceb2bafb1a8e2d92368

Analysis

user interaction
yes
max time kernel
50s
max time network
45s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/10/2026, 09:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FiveM.exe
Size 5.0MB
Sample261020-lb3trsys3j
SHA256 05a99a0067ddde35a8b6c92721fc8ee058ffe1cee9a9dceb2bafb1a8e2d92368
MD5 e8c3fd1b35507fa301fac9367f28757f
SHA1 fd03919c9370248a62c9d540f6cd9fbeccac09f6
SHA512 7f4f60aa0978a5f3f49cac744c11b6fe410cf32ec8dcd83fd6ad2120e9830b242b6f6a758c03ca76e8ffa800dbfec1b92f759c176f829f94492ed81e65befcdd
SSDEEP 49152:XOjPWFWnM4r0BEjYoVKs0B6N58NaUjwg1mxE9tOjhhVmaeI84dhAzBM04arJYLaw:iMKk0N5f/rQcc9YL4P1G/Lzg5ji13
TLSH
T113369D5663A401E8C5B7D1B8CD968527EBB27C161331DBDB02A0767A1F37AE16E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\FiveM\FiveM.app\desktop.ini	FiveM.exe

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
2012	GameBarPresenceWriter.exe
4056	GameBarPresenceWriter.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	CitizenFX.exe.new

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
4596	CitizenFX.exe.new

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 4 IoCs

pid	Process
4596	CitizenFX.exe.new
2640	FiveM.exe
4740	FiveM.exe
1908	FiveM_DumpServer

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	FiveM.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	FiveM.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	FiveM.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	FiveM.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	FiveM.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	FiveM_DumpServer
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	FiveM.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	FiveM_DumpServer

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\Colors	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\Colors	FiveM.exe

Modifies registry class 50 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac04000000c8000000354b179bff40d211a27e00c04fc308710300000080000000354b179bff40d211a27e00c04fc308710200000080000000	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	FiveM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	FiveM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	FiveM.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{D5CE2759-8B41-441C-B111-FA0B5080B5D2}	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	FiveM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	FiveM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	FiveM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "4294967295"	FiveM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	FiveM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	FiveM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	FiveM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "4"	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	FiveM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	FiveM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	FiveM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	FiveM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	FiveM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\NodeSlot = "2"	FiveM.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{C9D66E11-BD05-4BCB-BFDD-5A99F01E9BC3}	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	FiveM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	FiveM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	FiveM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	FiveM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	FiveM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	FiveM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	FiveM.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4596	CitizenFX.exe.new
4596	CitizenFX.exe.new
2640	FiveM.exe
2640	FiveM.exe
4740	FiveM.exe
4740	FiveM.exe
1908	FiveM_DumpServer
1908	FiveM_DumpServer

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4740	FiveM.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4596	CitizenFX.exe.new

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4620	FiveM.exe
4740	FiveM.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4620	FiveM.exe
2776	OpenWith.exe
4740	FiveM.exe
3808	OpenWith.exe
4740	FiveM.exe
4740	FiveM.exe
4052	OpenWith.exe
3712	OpenWith.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 4596	4620	FiveM.exe	88
PID 4596 wrote to memory of 2640	4596	CitizenFX.exe.new	89
PID 2640 wrote to memory of 4740	2640	FiveM.exe	90
PID 4740 wrote to memory of 1908	4740	FiveM.exe	104

C:\Users\Admin\AppData\Local\Temp\FiveM.exe
"C:\Users\Admin\AppData\Local\Temp\FiveM.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Modifies Control Panel
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Users\Admin\AppData\Local\Temp\CitizenFX.exe.new
  CitizenFX.exe.new -bootstrap "C:\Users\Admin\AppData\Local\Temp\FiveM.exe"
  2⤵
  - Checks computer location settings
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Users\Admin\AppData\Local\Temp\FiveM.exe
    "C:\Users\Admin\AppData\Local\Temp\FiveM.exe"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2640
  - - C:\Users\Admin\AppData\Local\FiveM\FiveM.exe
      "C:\Users\Admin\AppData\Local\FiveM\FiveM.exe"
      4⤵
      Drops desktop.ini file(s)
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      Modifies Control Panel
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4740
    - - C:\Users\Admin\AppData\Local\FiveM\FiveM.app\data\cache\subprocess\FiveM_DumpServer
        
        "C:\Users\Admin\AppData\Local\FiveM\FiveM.app\data\cache\subprocess\FiveM_DumpServer" -dumpserver:2060 -parentpid:4740
        5⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:1908

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:4056

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:3460

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:2012

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:2720

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4052

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
PID:2440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CitizenFX.Core.Client.xml.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\clr2\lib\mono\4.5\ref\CitizenFX.Core.Client.xml.tmp
Size 6.6MB
SHA256 73035e37ee074f8f1d5dd9a1f5674bb30e0bb2d24ebd676bcfc8433663d89f49
MD5 1b6812e260b9da251bacca4d1fda7fc8
SHA1 b02302803d4e9ed1bf4c9bb0f03db3a108e99dbd
SHA512 a1c5b9b7ccd48433e48ffa117e51606793b15c45753ab51fa55847757f20360229329a75baf6af26a66a23f9faac69f5492c3a4dcdb34399203b963543adbfd5
SSDEEP 49152:MaG9a/E7S78ScSwYSNMdpqy2r8kOpWhrbrxH2TIrCqJg0a9f6Uzqny6OxTi8DDWo:chbETIrCqS0Qzqny6OHDeaYaAfity2z
TLSH
T11266EF147BC59E200EB281266E28B9C8FF25492721456D26348E3F734F7ADC797EF861
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsgPack.dll.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\clr2\lib\mono\4.5\ref\MsgPack.dll.tmp
Size 384KB
SHA256 872f9a0e93f652ec96b7b2ff4dd85737af09f3c1904c4675c76d79e9917aa1e0
MD5 3b0ea1f1e586dc3c70af6a6ee3b22f42
SHA1 0cc387dea9f848c5e9f94b83e858c903ec6b9523
SHA512 b6f85b6e31831d4f70f9b8150f3a3046e2f9f5dcfafeb44ea2696d2891ca02088de6b164bae375db11241640cb24b087ad1c47da27ba35f07c752f4d0f72d84b
SSDEEP 6144:9eCTWCT4qS1ReuAW/SJqhpECMurgskeC2NsBfz1Si2DW3/tUNf4jqqrRrL:zTtT4qS+jWIvz21PWl04jqqrRrL
TLSH
T162845B4C37DC0653D6DFA77A9036568683B8C067A14EE3DA1CC5D8BD9DF2BA38902253
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsgPack.xml.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\clr2\lib\mono\4.5\ref\MsgPack.xml.tmp
Size 600KB
SHA256 3ad561cbcba9b7da8991a9132bc9a22a036d51570129e729f238393ba33b538d
MD5 b01b2defff08859297cf2cfc8d4eee17
SHA1 4f533a702164bce501590ee330be3a2ad30a3d52
SHA512 91b76194533f6a870b1b1d55bb6544f3a218e67d326f7a2379b7968aad3314850b29e449890a9c00070af26f01357da6528a785133ad4fd7146dd64b6fd3ab82
SSDEEP 1536:ROzOlcArQL7o7eRwu7ZFo7A5wAY8D69JL6KdLXhtgyzgwtr5YOlp1CoEsP+oRz/z:W/d26yLXwyzNtNYOz1bwY
TLSH
T183D4123876C98E130CB3421A5D25F485FE3E0523704AA896B08D5F677FBACD993B7909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Reflection.Metadata.dll.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\clr2\lib\mono\4.5\ref\System.Reflection.Metadata.dll.tmp
Size 454KB
SHA256 652ded0ce5e153b85154ac65d00244aafb49e0fe8a958e2afb9c5bea83a957c0
MD5 50119d5845f7e74821108ff3f5058a63
SHA1 74443707eda9ebbb98a68a1d03a29d5305b25f11
SHA512 7510645c489dc890fd8e8dd89b3c08777e2928dce49f84a9fe409b5d8b5269b82e504668f5f7a1caa9cd863d42629c626572db9b40ee5aa9d815e4c2910536e3
SSDEEP 6144:wNXb/BmfTcqQ9d8l1+h2pThycq7/K5PBNplTm+sTosDAhmomkUulC+Cd3r335wq:wNrBmfIqzl1+h2pTQj76oWXCB1
TLSH
T122A47C8263F8672BE6DFC778E0304A154771E916660BFB5F88A8E76A0C537E84C015B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.meta.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\platform-2060\data\control\settings.meta.tmp
Size 37KB
SHA256 f9ae094812ce9fbd56b58dab7739451792aba8f56c5f21eee15ef96682b413a6
MD5 3656c6636cd9dbceaf83230c3c9a2be9
SHA1 989f27c6736a943fd4690091fed26f7c17e3c17f
SHA512 52bbb8f2b2d6183f30b908d9171a2ec8c2128bbce145b7af0095d4c199b1ec431d650ec4ed0b1b6cbc7bcc8d29da3285cdcc61368faa8c4e57b45315ced4e4ad
SSDEEP 384:Gs34QmZSgC5RHTiVfNSAvRSOxRlne8lISI11zHdlz9a8QSuF5MGsXZXgCoRKRyR8:D34QMfNSEWJvz39pjE4
TLSH
T1B803DA6C3A9D5F5A198880B71CF704C971AFECBA2FEA19941B25A13307C3E602376675
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.meta.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\platform-2944\data\control\settings.meta.tmp
Size 38KB
SHA256 7d01c11f35d87dd39327d7314c1a9563658c5a18fb5ae10abb485cbe856f5913
MD5 9a9812f429759ba7dafd3cae3ca399fb
SHA1 3f41e4f9ed953b0800cf9a1cd4ad29a0758256b8
SHA512 ef65a0d9ff8f3d8d4c786a1e760046b0eb29138669376bd73da7418ff886defd9871b026c869c605d759729f256098990e4181f38ed423d60548952b3151603f
SSDEEP 384:Gs34QSSgC5RHTiVfFSAvRSOxRlne8lY7SI11zHdlz9a8NSuF5MGsXZXgCoRKRyRU:D34QOfFSE6Jvz3gp1E4
TLSH
T15503DB6C3A9D5F5A198C80B71CF704C971AFECBA2FEA19941B25A13307C3E602376675
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.meta.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\platform-3788\data\control\settings.meta.tmp
Size 46KB
SHA256 a35da765f0332a10150daa530506289fe5683e5afda6b7b70a362d7e66f0fd9d
MD5 b12db507b6e5063a1ce25c4e22ee3efd
SHA1 c90eda2a2dd2a3562136975457e6a1dbc9070fff
SHA512 2aa09ff789000897b4e29b756260159195308f54d762ac516ca7acc85a25ceee7c1ca4aa2917c3a647843b39a13684d33ac9a5ec24749477a880a4f35640f6d4
SSDEEP 384:Ij3F4QSSgC5RHTiVfF3AvRSOxRlne8lY7SkfX7vz11zHdlz9aVzaoSuFUMysXZXs:M3F4QOfF3E6j/vz3YaspbOzE4
TLSH
T16523BA2C395D5F5A198880B71CF704C975AFECBA2FEA19A41B25E07307C3E602376679
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

release.txt

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\release.txt
Size 7B
SHA256 9527eac631ce25c2a76fd339ca926a2d7aef4fe193d72d202fe94b0d4253d8ac
MD5 681982b719c9d5f851470929de314469
SHA1 2d4088b0c751fb6a520510fb7b98c5b8d3dea156
SHA512 2392c6ec7855331150a3a6a6acf975b429df4a4158aced3a209898240e35e426d56c68db390dadfb199c1f11d5b23674f154af1776d0772f40ea3eea0f7de70b
MD5 SHA1 SHA512

Submit Download

natives_21E43A33.lua.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\scripting\lua\natives_21E43A33.lua.tmp
Size 2.0MB
SHA256 75ff1b676fe1c16846f3a463c3920e2f9b8297851d713f37e65a204f647060dc
MD5 dff524002313a6fd2f794696dcd8e078
SHA1 32f5187a8a8796baf36b90bc873f4668f28d18f5
SHA512 afc3d696e473a9950465b4fc8ce0daf1361ffdf1880d95e352864d7c23e54fdfc12ad2879df5ebc2860fc79b284b5c2f45f9fb99718231fe4bd64e953e0f5489
SSDEEP 49152:JNbJqV8HyrbVWFYX5oFz7hpp0ZcM+aeHBqkAxZhXMBvFZGh:Ig9FYX5cuh
TLSH
T1DE9509DA781ED3559543632A511F194BF269C0A8212D01F0F185B8DE2432FB96BFF8FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

natives_21E43A33.d.ts.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\scripting\v8\natives_21E43A33.d.ts.tmp
Size 2.3MB
SHA256 9e9e81bc60cbe5d2b40a0e79add23f6c0d1eaea7dce2712ae38504c4a84dc9d8
MD5 36f5cddf9cd88dbfa27edf671c7c129d
SHA1 cd43a3155a234be4dad8fd71ffcb5a270ec749a6
SHA512 80f46f1143ff06eac28a66ccaf53bcaf2b380773996019857d836ee3f9ceb41422b4bff03e775156c60ea3add307574fa790e153d8cc1a731fa531b7a60e29d4
SSDEEP 49152:kO4NUH1AeYZJkDx1H9AAH2HD7lcmu6DjBvdnrD:kO4K4JkD2AkD
TLSH
T1BEB5969AFF493233E6B29232B0BF5048E9746258A91131DF7CF464540F1B2BC26A7D9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

natives_21E43A33.js.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\scripting\v8\natives_21E43A33.js.tmp
Size 2.1MB
SHA256 bd072c00cb50219bad8959d7efee5bdc8caf90bd876fe4e3142b28a9386280af
MD5 9b1dcdbfc5e33692ecbc91477f5f0853
SHA1 1e0c5a805d7fbb81c53109cfe0d333e60256851f
SHA512 07c8a2e6aca864a2d0e1194dde07ba7baa43015874d794a675bbd462f04408f2a1a549a2b4512d59744b09d6d9596bc39893641ad351cc0014f48c41f55f5056
SSDEEP 49152:eIMMNUYXFaHRKkPjJG1R9NGABKeNrEDEi8XbhNEVgs:ZlmKkPZAhs
TLSH
T19FA5E8E93881622AE523723CD12B5D09F374E431598D21E8BCDD64982D24FBD46FEDAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

im3d.fxc.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\shaderz\win32_40_lq_final\im3d.fxc.tmp
Size 9KB
SHA256 be0c4a87833b062965bc2c2af4cedc30dd76d9cad10d996c2a5809de2f7e34c0
MD5 7f32d8c9e8ec983ab316a093be55ebd0
SHA1 077e8b5225a2d7dccf6a7ecabc3aa5d46e684955
SHA512 c44b9b2ac8410c2ca2bbd936697d83376ba7b02248342c6ecd9ec60e42a306ed070184f16e64e0daa9712ef204b1599ffd4152acf2bc5440271ff7d877f7fa78
SSDEEP 96:V7GKCm7GKCoQGKCUtKIV/h4KIb0FKG1ReGKGKyFt21mQxzjfDeGKGKy3Mrbk/vp:V7V7EN/K0XReSt21Z5jfDeYMrbOx
TLSH
T12922EC1A27821EB7EA2D9373C0DB4F01B377D86226E3DF53888155194CE63C4EE256AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

outlinez.fxc.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\shaderz\win32_40_lq_final\outlinez.fxc.tmp
Size 4KB
SHA256 53aab937bc5573154a144ec115b14ab51d7a9bca485af71021ba5bb225756ee4
MD5 4785ebb287fa3aa86649dd35b7b7f561
SHA1 e82f7fb0456c7e0b13a01c91929abb0ab1754007
SHA512 4cf76f9145d75faeebcd7403bfc9e82effbca4c74dead2ed260868b6f2495d64c4a76b6fd284fc23d278835affb732f911be86baf7dc46060455e1746071855c
SSDEEP 96:+KwqdQteKwqdQtLDlI5PJKHdRVzIPJKHdUS83EvWOM:StytLDlu+eXS83EE
TLSH
T174B10E016B85AE3BE76E9732CDD703197335D8411BF387234AD522242C523C46EA639E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

outlinez_firm.fxc.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\shaderz\win32_40_lq_final\outlinez_firm.fxc.tmp
Size 4KB
SHA256 05df82e50fb5a00894a7f15c9fddc4235e8ae4aed37083297034e6e28a91a656
MD5 c31cf050db671c2f142f322d24e481ed
SHA1 11a3a81ec89bcca5d8cd6488a00e6daddf926876
SHA512 ac1d7daa4b905ae406a18dcd6ec72ce21a5df6619432ca411a45bb179b6a6f9f58e679e73634051a0e27957647697169afa80196e67c774c3007bf0f185edbcf
SSDEEP 96:+KwqdQteKwqdQtirlKHdzzZKHdvytmWlM:StytWuz8yt2
TLSH
T1BB91CB126F85EE37EB6E4B36CADB03153336D9415BF38B13459121242D533C48EA679E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

outlinez_mask.fxc.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\shaderz\win32_40_lq_final\outlinez_mask.fxc.tmp
Size 1KB
SHA256 925cac9047d439bcb5e6852fc58a759a64033ff27441ad02e7f8c2333da8423a
MD5 9b343ffa22056230a315fc5a5760185f
SHA1 23dad37c308d42b9e729c038757cdc2e0427edd8
SHA512 3bc7f19a979c19593476b6135a574c361e023d985196f4a20a1808f8dc810a70311714619096feb26455f5a5559a1788e09941d15362c4f018da462b5e5db3fc
TLSH
T1F641A8122B88FE0BDB2E5B35CBA207053776EA866793CB0398C021340C133C88F6275D
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\desktop.ini
Size 157B
SHA256 b1fe21f251cf7875783ea162ef86c2a5b5022a1c5157bbb7972b6b34e14ec08a
MD5 f9d948aa9426cb1a2a82e651b81a1912
SHA1 2d496caeef3b0bff6b91b99e58736cea51366348
SHA512 a962fae3853f43e4a8e2b33aa5f51a917673d76648845dffcc32037c25cb3f300e4c4fc3ea633bf78b714449dbda84416e41cc16256373c170fb82d8485e3369
TLSH
T14DC04C06818FC62DC42ED0BB1DA1A248CCBD0D2BAF6E7E04D6C0D50827D6F4FACA5685
MD5 SHA1 SHA512 TLSH

Submit Download

thumbcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
Size 28KB
SHA256 e551ba284fcb8bdae4eb2adb8b0cfdf877e115c48426c91ca01a19e06203588b
MD5 03d276d1877844e06e3a80cecc2aaa05
SHA1 8df0ed3cece51e2c064608427c502be1657f5551
SHA512 490ee7da32b922eb2f75320caffda846918b26fd4a990f921dd951cb5d816f001907ec5a9b211bf04c5435f4d4b0b67a067ee750eddec3b891af4552ac5b5dec
SSDEEP 96:oJYEVchWPtpWMmtrekKVCPMypmObV5SOH6f2ZH+V2j:CF+hsbR7kKwPMypdDH60+V2j
TLSH
T155D2E9A97E30E690C509197C9D2FDAEE6D28FEC6DD5810133BF1F7AF48B55138912248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CitizenFX.exe.new

Path C:\Users\Admin\AppData\Local\Temp\CitizenFX.exe.new
Size 5.0MB
SHA256 ff0a30e2dd73270bbf11b9e3d9c8c9e40a2587e9fe306d980c8f9ef7148b3bf1
MD5 a86fa79bfbeb8e05da719123ed2ed8ad
SHA1 d5675c361673a18d4a6cbbf525a290f2720f9d35
SHA512 fdb1cfdc7ea67efe8d606923e2315d283e78f970956b1b81afa27ba531447277916fe91a648c1a4502e81fb0aaca463db21d3f3361a6c5d034946af42523423b
SSDEEP 49152:4OjPWCYlcqTdNuNoY1fcvTFYaQzVUu8cdV0hN81Tvs0ET2lKBay1Jtyun95QamLd:sTqf4YaQzVpEBTQtB71THSvw2kP
TLSH
T124369D56A3E400E8D5B7C178CE964127E7B2BC061371DBDF02A0666A1F37AE16E3E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FiveM.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FiveM.lnk
Size 2KB
SHA256 32a569b930d8324152a7669f05e05d88bc032130659c51afeea789e29bb7c4ce
MD5 d196e55ffe52b3a01fae5cebecba48ca
SHA1 7e9008c25fe5febfcb1bfb019115ee7aa9afbfae
SHA512 cb723d103441cfa72fb8c3adcdb9b2537e8056ece35317ce0c50a7c73262ad62fa772fadb03ce21b9bb59a51671be31b1742f6d301d36e7db5e2b3e52c198ee5
TLSH
T12941D00749FA8B30E3E7DCF154BB932045737CE1A2548F5E5081428C1D61E51A9A6F4B
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download