darksiderat | 61c35ecbd844ae6509484a0b71bec1abf9122a76a09c7e3c32e9632aedabe635

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/11/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-03_e6eef8e6821ff6b2cdb4e2f717f13729_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 5.0MB
Sample261104-e7bltse18z
SHA256 61c35ecbd844ae6509484a0b71bec1abf9122a76a09c7e3c32e9632aedabe635
MD5 e6eef8e6821ff6b2cdb4e2f717f13729
SHA1 a8df1217f07b27a7a680893672882eb9456df4bc
SHA512 daf12cd7822eca38183f70f9445cb656d4cae9442be4f9ca4193b7b393a50f53d2eb569ceb11e6dfce30dde706f37ed247a049f5c124b6351b586d40f8a9b9a3
SSDEEP 49152:ROjPWCYlcqTdNuNoY1fcvTFYaQzVUu8cdV0hN81Tvs0ET2lKBay1Jtyun95QamLQ:HTqf4YaQzVpEBTQtB71THSvF2k
TLSH
T16A369D56A3E500E8D1B7C178CE964127E7B2BC061371DBDF02A0666A1F37AE16E3E714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery darksiderat trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 8 IoCs

resource	yara_rule
behavioral1/memory/5060-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/5060-4-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/5060-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/5060-0-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/3288-21-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/3288-35-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/1464-1335-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/1464-1338-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Executes dropped EXE 4 IoCs

pid	Process
1832	FiveM.exe
3288	FiveM.exe
3160	FiveM_DumpServer
1464	FiveM_DumpServer

Loads dropped DLL 3 IoCs

pid	Process
1464	FiveM_DumpServer
1464	FiveM_DumpServer
1464	FiveM_DumpServer

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\FiveM\FiveM.app\desktop.ini	FiveM.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
684	GameBarPresenceWriter.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4348 set thread context of 5060	4348	2026-11-03_e6eef8e6821ff6b2cdb4e2f717f13729_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe	84
PID 1832 set thread context of 3288	1832	FiveM.exe	89
PID 3160 set thread context of 1464	3160	FiveM_DumpServer	106

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-03_e6eef8e6821ff6b2cdb4e2f717f13729_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-03_e6eef8e6821ff6b2cdb4e2f717f13729_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	FiveM.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	FiveM.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	FiveM_DumpServer
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	FiveM_DumpServer

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\Colors	FiveM.exe

Modifies registry class 21 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	FiveM.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{E943B550-4C40-4A26-88F1-E84DA757D66F}	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	FiveM.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{1506FFA5-EB7B-4FEC-9888-45B8B5DB8E2F}	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	FiveM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	FiveM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	FiveM.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4348	2026-11-03_e6eef8e6821ff6b2cdb4e2f717f13729_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4348	2026-11-03_e6eef8e6821ff6b2cdb4e2f717f13729_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1832	FiveM.exe
1832	FiveM.exe
3160	FiveM_DumpServer
3160	FiveM_DumpServer

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1832	FiveM.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1832	FiveM.exe
4808	OpenWith.exe
1832	FiveM.exe
1832	FiveM.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 5060	4348	2026-11-03_e6eef8e6821ff6b2cdb4e2f717f13729_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe	84
PID 4348 wrote to memory of 5060	4348	2026-11-03_e6eef8e6821ff6b2cdb4e2f717f13729_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe	84
PID 4348 wrote to memory of 5060	4348	2026-11-03_e6eef8e6821ff6b2cdb4e2f717f13729_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe	84
PID 4348 wrote to memory of 5060	4348	2026-11-03_e6eef8e6821ff6b2cdb4e2f717f13729_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe	84
PID 4348 wrote to memory of 5060	4348	2026-11-03_e6eef8e6821ff6b2cdb4e2f717f13729_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe	84
PID 4348 wrote to memory of 5060	4348	2026-11-03_e6eef8e6821ff6b2cdb4e2f717f13729_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe	84
PID 4348 wrote to memory of 5060	4348	2026-11-03_e6eef8e6821ff6b2cdb4e2f717f13729_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe	84
PID 4348 wrote to memory of 1832	4348	2026-11-03_e6eef8e6821ff6b2cdb4e2f717f13729_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe	88
PID 1832 wrote to memory of 3288	1832	FiveM.exe	89
PID 1832 wrote to memory of 3288	1832	FiveM.exe	89
PID 1832 wrote to memory of 3288	1832	FiveM.exe	89
PID 1832 wrote to memory of 3288	1832	FiveM.exe	89
PID 1832 wrote to memory of 3288	1832	FiveM.exe	89
PID 1832 wrote to memory of 3288	1832	FiveM.exe	89
PID 1832 wrote to memory of 3288	1832	FiveM.exe	89
PID 1832 wrote to memory of 3160	1832	FiveM.exe	105
PID 3160 wrote to memory of 1464	3160	FiveM_DumpServer	106
PID 3160 wrote to memory of 1464	3160	FiveM_DumpServer	106
PID 3160 wrote to memory of 1464	3160	FiveM_DumpServer	106
PID 3160 wrote to memory of 1464	3160	FiveM_DumpServer	106
PID 3160 wrote to memory of 1464	3160	FiveM_DumpServer	106
PID 3160 wrote to memory of 1464	3160	FiveM_DumpServer	106
PID 3160 wrote to memory of 1464	3160	FiveM_DumpServer	106

C:\Users\Admin\AppData\Local\Temp\2026-11-03_e6eef8e6821ff6b2cdb4e2f717f13729_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-03_e6eef8e6821ff6b2cdb4e2f717f13729_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Users\Admin\AppData\Local\Temp\2026-11-03_e6eef8e6821ff6b2cdb4e2f717f13729_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-03_e6eef8e6821ff6b2cdb4e2f717f13729_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
  2⤵
  PID:5060
- C:\Users\Admin\AppData\Local\FiveM\FiveM.exe
  "C:\Users\Admin\AppData\Local\FiveM\FiveM.exe"
  2⤵
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Suspicious use of SetThreadContext
  - Reads the TCP/IP host and domain name from the registry
  - Modifies Control Panel
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\Users\Admin\AppData\Local\FiveM\FiveM.exe
    "C:\Users\Admin\AppData\Local\FiveM\FiveM.exe"
    3⤵
    - Executes dropped EXE
    PID:3288
- - C:\Users\Admin\AppData\Local\FiveM\FiveM.app\data\cache\subprocess\FiveM_DumpServer
    "C:\Users\Admin\AppData\Local\FiveM\FiveM.app\data\cache\subprocess\FiveM_DumpServer" -dumpserver:2616 -parentpid:1832
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3160
  - - C:\Users\Admin\AppData\Local\FiveM\FiveM.app\data\cache\subprocess\FiveM_DumpServer
      "C:\Users\Admin\AppData\Local\FiveM\FiveM.app\data\cache\subprocess\FiveM_DumpServer"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1464

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:684

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:3500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msvcp140.dll

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\bin\msvcp140.dll
Size 566KB
SHA256 003da4807acdc912e67edba49be574daa5238bb7acff871d8666d16f8072ff89
MD5 a62a22c33ed01a2cf362d3890ffa70e1
SHA1 ea3f55d92cdcb788876d689d394ec3225b1d222c
SHA512 7da909a6c5dc26631fec8a382d5cb677d3aabf5b5c4e98b545c120685f879adcef8cc98e7bf74d37f7fc24b0f18999780d70aa28061f50adf6b28f19ce06930a
SSDEEP 12288:cbxu4DawI5n+BOJAc/FTo8cWojFjM0TvH9Dfd2AtluP+QEKZm+jWodEEVG/:c3lfl1QEKZm+jWodEEk/
TLSH
T109C40823774905A0E195A3BCA1C78306D7F17C4A8312A3C792FAD66D2F6B3D5673B290
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\bin\vcruntime140.dll
Size 106KB
SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
MD5 4585a96cc4eef6aafd5e27ea09147dc6
SHA1 489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA512 d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
SSDEEP 1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
TLSH
T1A0B37C4A72A441F7C5AAD274C2E38A06FB71B541877093CF03B19A690F63BE15E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\bin\vcruntime140_1.dll
Size 48KB
SHA256 e4b533a94e02c574780e4b333fcf0889f65ed00d39e32c0fbbda2116f185873f
MD5 7e668ab8a78bd0118b94978d154c85bc
SHA1 dbac42a02a8d50639805174afd21d45f3c56e3a0
SHA512 72bb41db17256141b06e2eaeb8fc65ad4abdb65e4b5f604c82b9e7e7f60050734137d602e0f853f1a38201515655b6982f2761ee0fa77c531aa58591c95f0032
SSDEEP 768:YEgYXUcHJcUJSDW/tfxL1qBSHGm6Ub/I2Hi09z0XQKBcRmuU9zuKl:YvGS8fZ1esJwUpz0X3B+d8zuKl
TLSH
T1F6236CD593785082D49BA9B08197DE17BE3CFA924B50928F0BA1D15C2F637D0A73D22E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CitizenFX.Core.Client.xml.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\clr2\lib\mono\4.5\ref\CitizenFX.Core.Client.xml.tmp
Size 6.6MB
SHA256 73035e37ee074f8f1d5dd9a1f5674bb30e0bb2d24ebd676bcfc8433663d89f49
MD5 1b6812e260b9da251bacca4d1fda7fc8
SHA1 b02302803d4e9ed1bf4c9bb0f03db3a108e99dbd
SHA512 a1c5b9b7ccd48433e48ffa117e51606793b15c45753ab51fa55847757f20360229329a75baf6af26a66a23f9faac69f5492c3a4dcdb34399203b963543adbfd5
SSDEEP 49152:MaG9a/E7S78ScSwYSNMdpqy2r8kOpWhrbrxH2TIrCqJg0a9f6Uzqny6OxTi8DDWo:chbETIrCqS0Qzqny6OHDeaYaAfity2z
TLSH
T11266EF147BC59E200EB281266E28B9C8FF25492721456D26348E3F734F7ADC797EF861
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsgPack.dll.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\clr2\lib\mono\4.5\ref\MsgPack.dll.tmp
Size 384KB
SHA256 872f9a0e93f652ec96b7b2ff4dd85737af09f3c1904c4675c76d79e9917aa1e0
MD5 3b0ea1f1e586dc3c70af6a6ee3b22f42
SHA1 0cc387dea9f848c5e9f94b83e858c903ec6b9523
SHA512 b6f85b6e31831d4f70f9b8150f3a3046e2f9f5dcfafeb44ea2696d2891ca02088de6b164bae375db11241640cb24b087ad1c47da27ba35f07c752f4d0f72d84b
SSDEEP 6144:9eCTWCT4qS1ReuAW/SJqhpECMurgskeC2NsBfz1Si2DW3/tUNf4jqqrRrL:zTtT4qS+jWIvz21PWl04jqqrRrL
TLSH
T162845B4C37DC0653D6DFA77A9036568683B8C067A14EE3DA1CC5D8BD9DF2BA38902253
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsgPack.xml.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\clr2\lib\mono\4.5\ref\MsgPack.xml.tmp
Size 600KB
SHA256 3ad561cbcba9b7da8991a9132bc9a22a036d51570129e729f238393ba33b538d
MD5 b01b2defff08859297cf2cfc8d4eee17
SHA1 4f533a702164bce501590ee330be3a2ad30a3d52
SHA512 91b76194533f6a870b1b1d55bb6544f3a218e67d326f7a2379b7968aad3314850b29e449890a9c00070af26f01357da6528a785133ad4fd7146dd64b6fd3ab82
SSDEEP 1536:ROzOlcArQL7o7eRwu7ZFo7A5wAY8D69JL6KdLXhtgyzgwtr5YOlp1CoEsP+oRz/z:W/d26yLXwyzNtNYOz1bwY
TLSH
T183D4123876C98E130CB3421A5D25F485FE3E0523704AA896B08D5F677FBACD993B7909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Reflection.Metadata.dll.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\clr2\lib\mono\4.5\ref\System.Reflection.Metadata.dll.tmp
Size 454KB
SHA256 652ded0ce5e153b85154ac65d00244aafb49e0fe8a958e2afb9c5bea83a957c0
MD5 50119d5845f7e74821108ff3f5058a63
SHA1 74443707eda9ebbb98a68a1d03a29d5305b25f11
SHA512 7510645c489dc890fd8e8dd89b3c08777e2928dce49f84a9fe409b5d8b5269b82e504668f5f7a1caa9cd863d42629c626572db9b40ee5aa9d815e4c2910536e3
SSDEEP 6144:wNXb/BmfTcqQ9d8l1+h2pThycq7/K5PBNplTm+sTosDAhmomkUulC+Cd3r335wq:wNrBmfIqzl1+h2pTQj76oWXCB1
TLSH
T122A47C8263F8672BE6DFC778E0304A154771E916660BFB5F88A8E76A0C537E84C015B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.meta.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\platform-2189\data\control\settings.meta.tmp
Size 37KB
SHA256 f9ae094812ce9fbd56b58dab7739451792aba8f56c5f21eee15ef96682b413a6
MD5 3656c6636cd9dbceaf83230c3c9a2be9
SHA1 989f27c6736a943fd4690091fed26f7c17e3c17f
SHA512 52bbb8f2b2d6183f30b908d9171a2ec8c2128bbce145b7af0095d4c199b1ec431d650ec4ed0b1b6cbc7bcc8d29da3285cdcc61368faa8c4e57b45315ced4e4ad
SSDEEP 384:Gs34QmZSgC5RHTiVfNSAvRSOxRlne8lISI11zHdlz9a8QSuF5MGsXZXgCoRKRyR8:D34QMfNSEWJvz39pjE4
TLSH
T1B803DA6C3A9D5F5A198880B71CF704C971AFECBA2FEA19941B25A13307C3E602376675
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.meta.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\platform-2944\data\control\settings.meta.tmp
Size 38KB
SHA256 7d01c11f35d87dd39327d7314c1a9563658c5a18fb5ae10abb485cbe856f5913
MD5 9a9812f429759ba7dafd3cae3ca399fb
SHA1 3f41e4f9ed953b0800cf9a1cd4ad29a0758256b8
SHA512 ef65a0d9ff8f3d8d4c786a1e760046b0eb29138669376bd73da7418ff886defd9871b026c869c605d759729f256098990e4181f38ed423d60548952b3151603f
SSDEEP 384:Gs34QSSgC5RHTiVfFSAvRSOxRlne8lY7SI11zHdlz9a8NSuF5MGsXZXgCoRKRyRU:D34QOfFSE6Jvz3gp1E4
TLSH
T15503DB6C3A9D5F5A198C80B71CF704C971AFECBA2FEA19941B25A13307C3E602376675
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.meta.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\platform-3788\data\control\settings.meta.tmp
Size 46KB
SHA256 a35da765f0332a10150daa530506289fe5683e5afda6b7b70a362d7e66f0fd9d
MD5 b12db507b6e5063a1ce25c4e22ee3efd
SHA1 c90eda2a2dd2a3562136975457e6a1dbc9070fff
SHA512 2aa09ff789000897b4e29b756260159195308f54d762ac516ca7acc85a25ceee7c1ca4aa2917c3a647843b39a13684d33ac9a5ec24749477a880a4f35640f6d4
SSDEEP 384:Ij3F4QSSgC5RHTiVfF3AvRSOxRlne8lY7SkfX7vz11zHdlz9aVzaoSuFUMysXZXs:M3F4QOfF3E6j/vz3YaspbOzE4
TLSH
T16523BA2C395D5F5A198880B71CF704C975AFECBA2FEA19A41B25E07307C3E602376679
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

release.txt

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\release.txt
Size 7B
SHA256 cd19d03697196957a6a3953bc3e9c6350105f3afc0713a1c97073ee3eb37ab04
MD5 da3dbe346d1211689883fbdcb1329cd4
SHA1 381b88207d76673d4e15e560942fdaef6cddfdae
SHA512 7308674a0042c7d7e4c17bf047f8a5e8bb1f56eb604aa2d6b506df70820f900a063a1adf3aaccc41980d5b1d93082a074fdb4aae9d0f725ced623884441da0fc
MD5 SHA1 SHA512

Submit Download

natives_21E43A33.lua.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\scripting\lua\natives_21E43A33.lua.tmp
Size 2.0MB
SHA256 75ff1b676fe1c16846f3a463c3920e2f9b8297851d713f37e65a204f647060dc
MD5 dff524002313a6fd2f794696dcd8e078
SHA1 32f5187a8a8796baf36b90bc873f4668f28d18f5
SHA512 afc3d696e473a9950465b4fc8ce0daf1361ffdf1880d95e352864d7c23e54fdfc12ad2879df5ebc2860fc79b284b5c2f45f9fb99718231fe4bd64e953e0f5489
SSDEEP 49152:JNbJqV8HyrbVWFYX5oFz7hpp0ZcM+aeHBqkAxZhXMBvFZGh:Ig9FYX5cuh
TLSH
T1DE9509DA781ED3559543632A511F194BF269C0A8212D01F0F185B8DE2432FB96BFF8FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

natives_21E43A33.d.ts.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\scripting\v8\natives_21E43A33.d.ts.tmp
Size 2.3MB
SHA256 9e9e81bc60cbe5d2b40a0e79add23f6c0d1eaea7dce2712ae38504c4a84dc9d8
MD5 36f5cddf9cd88dbfa27edf671c7c129d
SHA1 cd43a3155a234be4dad8fd71ffcb5a270ec749a6
SHA512 80f46f1143ff06eac28a66ccaf53bcaf2b380773996019857d836ee3f9ceb41422b4bff03e775156c60ea3add307574fa790e153d8cc1a731fa531b7a60e29d4
SSDEEP 49152:kO4NUH1AeYZJkDx1H9AAH2HD7lcmu6DjBvdnrD:kO4K4JkD2AkD
TLSH
T1BEB5969AFF493233E6B29232B0BF5048E9746258A91131DF7CF464540F1B2BC26A7D9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

natives_21E43A33.js.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\scripting\v8\natives_21E43A33.js.tmp
Size 2.1MB
SHA256 bd072c00cb50219bad8959d7efee5bdc8caf90bd876fe4e3142b28a9386280af
MD5 9b1dcdbfc5e33692ecbc91477f5f0853
SHA1 1e0c5a805d7fbb81c53109cfe0d333e60256851f
SHA512 07c8a2e6aca864a2d0e1194dde07ba7baa43015874d794a675bbd462f04408f2a1a549a2b4512d59744b09d6d9596bc39893641ad351cc0014f48c41f55f5056
SSDEEP 49152:eIMMNUYXFaHRKkPjJG1R9NGABKeNrEDEi8XbhNEVgs:ZlmKkPZAhs
TLSH
T19FA5E8E93881622AE523723CD12B5D09F374E431598D21E8BCDD64982D24FBD46FEDAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

im3d.fxc.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\shaderz\win32_40_lq_final\im3d.fxc.tmp
Size 9KB
SHA256 be0c4a87833b062965bc2c2af4cedc30dd76d9cad10d996c2a5809de2f7e34c0
MD5 7f32d8c9e8ec983ab316a093be55ebd0
SHA1 077e8b5225a2d7dccf6a7ecabc3aa5d46e684955
SHA512 c44b9b2ac8410c2ca2bbd936697d83376ba7b02248342c6ecd9ec60e42a306ed070184f16e64e0daa9712ef204b1599ffd4152acf2bc5440271ff7d877f7fa78
SSDEEP 96:V7GKCm7GKCoQGKCUtKIV/h4KIb0FKG1ReGKGKyFt21mQxzjfDeGKGKy3Mrbk/vp:V7V7EN/K0XReSt21Z5jfDeYMrbOx
TLSH
T12922EC1A27821EB7EA2D9373C0DB4F01B377D86226E3DF53888155194CE63C4EE256AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

outlinez.fxc.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\shaderz\win32_40_lq_final\outlinez.fxc.tmp
Size 4KB
SHA256 53aab937bc5573154a144ec115b14ab51d7a9bca485af71021ba5bb225756ee4
MD5 4785ebb287fa3aa86649dd35b7b7f561
SHA1 e82f7fb0456c7e0b13a01c91929abb0ab1754007
SHA512 4cf76f9145d75faeebcd7403bfc9e82effbca4c74dead2ed260868b6f2495d64c4a76b6fd284fc23d278835affb732f911be86baf7dc46060455e1746071855c
SSDEEP 96:+KwqdQteKwqdQtLDlI5PJKHdRVzIPJKHdUS83EvWOM:StytLDlu+eXS83EE
TLSH
T174B10E016B85AE3BE76E9732CDD703197335D8411BF387234AD522242C523C46EA639E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

outlinez_firm.fxc.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\shaderz\win32_40_lq_final\outlinez_firm.fxc.tmp
Size 4KB
SHA256 05df82e50fb5a00894a7f15c9fddc4235e8ae4aed37083297034e6e28a91a656
MD5 c31cf050db671c2f142f322d24e481ed
SHA1 11a3a81ec89bcca5d8cd6488a00e6daddf926876
SHA512 ac1d7daa4b905ae406a18dcd6ec72ce21a5df6619432ca411a45bb179b6a6f9f58e679e73634051a0e27957647697169afa80196e67c774c3007bf0f185edbcf
SSDEEP 96:+KwqdQteKwqdQtirlKHdzzZKHdvytmWlM:StytWuz8yt2
TLSH
T1BB91CB126F85EE37EB6E4B36CADB03153336D9415BF38B13459121242D533C48EA679E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

outlinez_mask.fxc.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\shaderz\win32_40_lq_final\outlinez_mask.fxc.tmp
Size 1KB
SHA256 925cac9047d439bcb5e6852fc58a759a64033ff27441ad02e7f8c2333da8423a
MD5 9b343ffa22056230a315fc5a5760185f
SHA1 23dad37c308d42b9e729c038757cdc2e0427edd8
SHA512 3bc7f19a979c19593476b6135a574c361e023d985196f4a20a1808f8dc810a70311714619096feb26455f5a5559a1788e09941d15362c4f018da462b5e5db3fc
TLSH
T1F641A8122B88FE0BDB2E5B35CBA207053776EA866793CB0398C021340C133C88F6275D
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\desktop.ini
Size 157B
SHA256 b1fe21f251cf7875783ea162ef86c2a5b5022a1c5157bbb7972b6b34e14ec08a
MD5 f9d948aa9426cb1a2a82e651b81a1912
SHA1 2d496caeef3b0bff6b91b99e58736cea51366348
SHA512 a962fae3853f43e4a8e2b33aa5f51a917673d76648845dffcc32037c25cb3f300e4c4fc3ea633bf78b714449dbda84416e41cc16256373c170fb82d8485e3369
TLSH
T14DC04C06818FC62DC42ED0BB1DA1A248CCBD0D2BAF6E7E04D6C0D50827D6F4FACA5685
MD5 SHA1 SHA512 TLSH

Submit Download

FiveM.exe

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.exe
Size 5.0MB
SHA256 61c35ecbd844ae6509484a0b71bec1abf9122a76a09c7e3c32e9632aedabe635
MD5 e6eef8e6821ff6b2cdb4e2f717f13729
SHA1 a8df1217f07b27a7a680893672882eb9456df4bc
SHA512 daf12cd7822eca38183f70f9445cb656d4cae9442be4f9ca4193b7b393a50f53d2eb569ceb11e6dfce30dde706f37ed247a049f5c124b6351b586d40f8a9b9a3
SSDEEP 49152:ROjPWCYlcqTdNuNoY1fcvTFYaQzVUu8cdV0hN81Tvs0ET2lKBay1Jtyun95QamLQ:HTqf4YaQzVpEBTQtB71THSvF2k
TLSH
T16A369D56A3E500E8D1B7C178CE964127E7B2BC061371DBDF02A0666A1F37AE16E3E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FiveM.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FiveM.lnk
Size 2KB
SHA256 d87447ef2be5ad09ba93640d0b7afe76d09041320db7da54b57892adab79d94a
MD5 60b1154f5b5a70f178e942e359337fd9
SHA1 9bc8e9798ef3c2a1c89e82c831eb65b35c1a4344
SHA512 f4c187115b42e8af57ae60a0ea36c7fe5ff12c86b23a967739292228845559e2ed2dc554f652cac3590978eefae1821b674ad398be0b74f4dda1e7085a7d143a
TLSH
T14841120785DA9F20E3EADCB555B7931119737CA6E3558F8E408042881DA1E119CE9F4B
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1464-1338-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/1464-1335-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/1832-407-0x0000000140000000-0x000000014052C000-memory.dmp

Download

memory/1832-18-0x0000000140000000-0x000000014052C000-memory.dmp

Download

memory/1832-441-0x0000000140000000-0x000000014052C000-memory.dmp

Download

memory/1832-15-0x0000000140000000-0x000000014052C000-memory.dmp

Download

memory/3160-1323-0x0000000140000000-0x000000014052C000-memory.dmp

Download

memory/3160-1339-0x0000000140000000-0x000000014052C000-memory.dmp

Download

memory/3288-21-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/3288-35-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4348-5-0x0000000140000000-0x000000014052C000-memory.dmp

Download

memory/4348-14-0x0000000140000000-0x000000014052C000-memory.dmp

Download

memory/4348-3-0x0000000140000000-0x000000014052C000-memory.dmp

Download

memory/5060-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/5060-0-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/5060-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/5060-4-0x0000000140000000-0x0000000140015000-memory.dmp

Download