darksiderat | 61c35ecbd844ae6509484a0b71bec1abf9122a76a09c7e3c32e9632aedabe635

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-03_e6eef8e6821ff6b2cdb4e2f717f13729_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 5.0MB
Sample261104-e7bltse18z
SHA256 61c35ecbd844ae6509484a0b71bec1abf9122a76a09c7e3c32e9632aedabe635
MD5 e6eef8e6821ff6b2cdb4e2f717f13729
SHA1 a8df1217f07b27a7a680893672882eb9456df4bc
SHA512 daf12cd7822eca38183f70f9445cb656d4cae9442be4f9ca4193b7b393a50f53d2eb569ceb11e6dfce30dde706f37ed247a049f5c124b6351b586d40f8a9b9a3
SSDEEP 49152:ROjPWCYlcqTdNuNoY1fcvTFYaQzVUu8cdV0hN81Tvs0ET2lKBay1Jtyun95QamLQ:HTqf4YaQzVpEBTQtB71THSvF2k
TLSH
T16A369D56A3E500E8D1B7C178CE964127E7B2BC061371DBDF02A0666A1F37AE16E3E714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery darksiderat trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 4 IoCs

resource	yara_rule
behavioral2/memory/3752-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/3752-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/4872-11-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/5992-1312-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Executes dropped EXE 4 IoCs

pid	Process
5644	FiveM.exe
4872	FiveM.exe
4932	FiveM_DumpServer
5992	FiveM_DumpServer

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\FiveM\FiveM.app\desktop.ini	FiveM.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4756	GameBarPresenceWriter.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3884 set thread context of 3752	3884	2026-11-03_e6eef8e6821ff6b2cdb4e2f717f13729_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe	90
PID 5644 set thread context of 4872	5644	FiveM.exe	92
PID 4932 set thread context of 5992	4932	FiveM_DumpServer	100

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-03_e6eef8e6821ff6b2cdb4e2f717f13729_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-03_e6eef8e6821ff6b2cdb4e2f717f13729_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	FiveM.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	FiveM.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	FiveM_DumpServer
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	FiveM_DumpServer

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Control Panel\Colors	FiveM.exe

Modifies registry class 30 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\NotificationData	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	FiveM.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4057491610-3392471755-192832105-1000\{9E4FB4BA-E300-422C-967D-7D92D4150D5E}	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	FiveM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	FiveM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	FiveM.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4057491610-3392471755-192832105-1000\{0D8DE2B3-6B26-46E3-96C0-873EC2552CF5}	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	FiveM.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3884	2026-11-03_e6eef8e6821ff6b2cdb4e2f717f13729_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
3884	2026-11-03_e6eef8e6821ff6b2cdb4e2f717f13729_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
5644	FiveM.exe
5644	FiveM.exe
4932	FiveM_DumpServer
4932	FiveM_DumpServer

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5644	FiveM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5644	FiveM.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5644	FiveM.exe
3788	OpenWith.exe
5644	FiveM.exe
5644	FiveM.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 3752	3884	2026-11-03_e6eef8e6821ff6b2cdb4e2f717f13729_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe	90
PID 3884 wrote to memory of 3752	3884	2026-11-03_e6eef8e6821ff6b2cdb4e2f717f13729_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe	90
PID 3884 wrote to memory of 3752	3884	2026-11-03_e6eef8e6821ff6b2cdb4e2f717f13729_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe	90
PID 3884 wrote to memory of 3752	3884	2026-11-03_e6eef8e6821ff6b2cdb4e2f717f13729_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe	90
PID 3884 wrote to memory of 3752	3884	2026-11-03_e6eef8e6821ff6b2cdb4e2f717f13729_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe	90
PID 3884 wrote to memory of 3752	3884	2026-11-03_e6eef8e6821ff6b2cdb4e2f717f13729_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe	90
PID 3884 wrote to memory of 3752	3884	2026-11-03_e6eef8e6821ff6b2cdb4e2f717f13729_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe	90
PID 3884 wrote to memory of 5644	3884	2026-11-03_e6eef8e6821ff6b2cdb4e2f717f13729_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe	91
PID 5644 wrote to memory of 4872	5644	FiveM.exe	92
PID 5644 wrote to memory of 4872	5644	FiveM.exe	92
PID 5644 wrote to memory of 4872	5644	FiveM.exe	92
PID 5644 wrote to memory of 4872	5644	FiveM.exe	92
PID 5644 wrote to memory of 4872	5644	FiveM.exe	92
PID 5644 wrote to memory of 4872	5644	FiveM.exe	92
PID 5644 wrote to memory of 4872	5644	FiveM.exe	92
PID 5644 wrote to memory of 4932	5644	FiveM.exe	99
PID 4932 wrote to memory of 5992	4932	FiveM_DumpServer	100
PID 4932 wrote to memory of 5992	4932	FiveM_DumpServer	100
PID 4932 wrote to memory of 5992	4932	FiveM_DumpServer	100
PID 4932 wrote to memory of 5992	4932	FiveM_DumpServer	100
PID 4932 wrote to memory of 5992	4932	FiveM_DumpServer	100
PID 4932 wrote to memory of 5992	4932	FiveM_DumpServer	100
PID 4932 wrote to memory of 5992	4932	FiveM_DumpServer	100

C:\Users\Admin\AppData\Local\Temp\2026-11-03_e6eef8e6821ff6b2cdb4e2f717f13729_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-03_e6eef8e6821ff6b2cdb4e2f717f13729_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Users\Admin\AppData\Local\Temp\2026-11-03_e6eef8e6821ff6b2cdb4e2f717f13729_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-03_e6eef8e6821ff6b2cdb4e2f717f13729_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
  2⤵
  PID:3752
- C:\Users\Admin\AppData\Local\FiveM\FiveM.exe
  "C:\Users\Admin\AppData\Local\FiveM\FiveM.exe"
  2⤵
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Suspicious use of SetThreadContext
  - Reads the TCP/IP host and domain name from the registry
  - Modifies Control Panel
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5644
- - C:\Users\Admin\AppData\Local\FiveM\FiveM.exe
    "C:\Users\Admin\AppData\Local\FiveM\FiveM.exe"
    3⤵
    - Executes dropped EXE
    PID:4872
- - C:\Users\Admin\AppData\Local\FiveM\FiveM.app\data\cache\subprocess\FiveM_DumpServer
    "C:\Users\Admin\AppData\Local\FiveM\FiveM.app\data\cache\subprocess\FiveM_DumpServer" -dumpserver:1520 -parentpid:5644
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4932
  - - C:\Users\Admin\AppData\Local\FiveM\FiveM.app\data\cache\subprocess\FiveM_DumpServer
      "C:\Users\Admin\AppData\Local\FiveM\FiveM.app\data\cache\subprocess\FiveM_DumpServer"
      4⤵
      Executes dropped EXE
      PID:5992

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:4756

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:5104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:5624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CitizenFX.Core.Client.xml.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\clr2\lib\mono\4.5\ref\CitizenFX.Core.Client.xml.tmp
Size 6.6MB
SHA256 73035e37ee074f8f1d5dd9a1f5674bb30e0bb2d24ebd676bcfc8433663d89f49
MD5 1b6812e260b9da251bacca4d1fda7fc8
SHA1 b02302803d4e9ed1bf4c9bb0f03db3a108e99dbd
SHA512 a1c5b9b7ccd48433e48ffa117e51606793b15c45753ab51fa55847757f20360229329a75baf6af26a66a23f9faac69f5492c3a4dcdb34399203b963543adbfd5
SSDEEP 49152:MaG9a/E7S78ScSwYSNMdpqy2r8kOpWhrbrxH2TIrCqJg0a9f6Uzqny6OxTi8DDWo:chbETIrCqS0Qzqny6OHDeaYaAfity2z
TLSH
T11266EF147BC59E200EB281266E28B9C8FF25492721456D26348E3F734F7ADC797EF861
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsgPack.dll.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\clr2\lib\mono\4.5\ref\MsgPack.dll.tmp
Size 384KB
SHA256 872f9a0e93f652ec96b7b2ff4dd85737af09f3c1904c4675c76d79e9917aa1e0
MD5 3b0ea1f1e586dc3c70af6a6ee3b22f42
SHA1 0cc387dea9f848c5e9f94b83e858c903ec6b9523
SHA512 b6f85b6e31831d4f70f9b8150f3a3046e2f9f5dcfafeb44ea2696d2891ca02088de6b164bae375db11241640cb24b087ad1c47da27ba35f07c752f4d0f72d84b
SSDEEP 6144:9eCTWCT4qS1ReuAW/SJqhpECMurgskeC2NsBfz1Si2DW3/tUNf4jqqrRrL:zTtT4qS+jWIvz21PWl04jqqrRrL
TLSH
T162845B4C37DC0653D6DFA77A9036568683B8C067A14EE3DA1CC5D8BD9DF2BA38902253
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsgPack.xml.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\clr2\lib\mono\4.5\ref\MsgPack.xml.tmp
Size 600KB
SHA256 3ad561cbcba9b7da8991a9132bc9a22a036d51570129e729f238393ba33b538d
MD5 b01b2defff08859297cf2cfc8d4eee17
SHA1 4f533a702164bce501590ee330be3a2ad30a3d52
SHA512 91b76194533f6a870b1b1d55bb6544f3a218e67d326f7a2379b7968aad3314850b29e449890a9c00070af26f01357da6528a785133ad4fd7146dd64b6fd3ab82
SSDEEP 1536:ROzOlcArQL7o7eRwu7ZFo7A5wAY8D69JL6KdLXhtgyzgwtr5YOlp1CoEsP+oRz/z:W/d26yLXwyzNtNYOz1bwY
TLSH
T183D4123876C98E130CB3421A5D25F485FE3E0523704AA896B08D5F677FBACD993B7909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Reflection.Metadata.dll.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\clr2\lib\mono\4.5\ref\System.Reflection.Metadata.dll.tmp
Size 454KB
SHA256 652ded0ce5e153b85154ac65d00244aafb49e0fe8a958e2afb9c5bea83a957c0
MD5 50119d5845f7e74821108ff3f5058a63
SHA1 74443707eda9ebbb98a68a1d03a29d5305b25f11
SHA512 7510645c489dc890fd8e8dd89b3c08777e2928dce49f84a9fe409b5d8b5269b82e504668f5f7a1caa9cd863d42629c626572db9b40ee5aa9d815e4c2910536e3
SSDEEP 6144:wNXb/BmfTcqQ9d8l1+h2pThycq7/K5PBNplTm+sTosDAhmomkUulC+Cd3r335wq:wNrBmfIqzl1+h2pTQj76oWXCB1
TLSH
T122A47C8263F8672BE6DFC778E0304A154771E916660BFB5F88A8E76A0C537E84C015B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.meta.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\platform-2189\data\control\settings.meta.tmp
Size 37KB
SHA256 f9ae094812ce9fbd56b58dab7739451792aba8f56c5f21eee15ef96682b413a6
MD5 3656c6636cd9dbceaf83230c3c9a2be9
SHA1 989f27c6736a943fd4690091fed26f7c17e3c17f
SHA512 52bbb8f2b2d6183f30b908d9171a2ec8c2128bbce145b7af0095d4c199b1ec431d650ec4ed0b1b6cbc7bcc8d29da3285cdcc61368faa8c4e57b45315ced4e4ad
SSDEEP 384:Gs34QmZSgC5RHTiVfNSAvRSOxRlne8lISI11zHdlz9a8QSuF5MGsXZXgCoRKRyR8:D34QMfNSEWJvz39pjE4
TLSH
T1B803DA6C3A9D5F5A198880B71CF704C971AFECBA2FEA19941B25A13307C3E602376675
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.meta.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\platform-3095\data\control\settings.meta.tmp
Size 39KB
SHA256 71ad5591441d62d02d2b62155abcf2cab587af49b86e2db5be6729a5b39df5d1
MD5 619814b8b98007c1698576b7e4efb3ec
SHA1 e60f3ceaf5ca78f74e6867f0b042951bffb91786
SHA512 55ab0bd3c1750d63ad3304e63b7c26251f01c8994f385e5643e2bbd37fc6595fd0e9f5fc0d76aa655fe8ad3bc6fdee33248d9f4a76cce11a25d84c3f5de16236
SSDEEP 384:Gs34QSSgC5RHTiVfF3AvRSOxRlne8lY7Sf11zHdlz9a8NSuFsMysXZXgCoRKRyR7:D34QOfF3E6qvz3NpcE4
TLSH
T17803CA2C3A9D5F56198880B71CF704C971AFECBA2FEA19941B25E03307C3E602376675
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.meta.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\platform-3788\data\control\settings.meta.tmp
Size 46KB
SHA256 a35da765f0332a10150daa530506289fe5683e5afda6b7b70a362d7e66f0fd9d
MD5 b12db507b6e5063a1ce25c4e22ee3efd
SHA1 c90eda2a2dd2a3562136975457e6a1dbc9070fff
SHA512 2aa09ff789000897b4e29b756260159195308f54d762ac516ca7acc85a25ceee7c1ca4aa2917c3a647843b39a13684d33ac9a5ec24749477a880a4f35640f6d4
SSDEEP 384:Ij3F4QSSgC5RHTiVfF3AvRSOxRlne8lY7SkfX7vz11zHdlz9aVzaoSuFUMysXZXs:M3F4QOfF3E6j/vz3YaspbOzE4
TLSH
T16523BA2C395D5F5A198880B71CF704C975AFECBA2FEA19A41B25E07307C3E602376679
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

release.txt

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\release.txt
Size 7B
SHA256 cd19d03697196957a6a3953bc3e9c6350105f3afc0713a1c97073ee3eb37ab04
MD5 da3dbe346d1211689883fbdcb1329cd4
SHA1 381b88207d76673d4e15e560942fdaef6cddfdae
SHA512 7308674a0042c7d7e4c17bf047f8a5e8bb1f56eb604aa2d6b506df70820f900a063a1adf3aaccc41980d5b1d93082a074fdb4aae9d0f725ced623884441da0fc
MD5 SHA1 SHA512

Submit Download

natives_21E43A33.lua.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\scripting\lua\natives_21E43A33.lua.tmp
Size 2.0MB
SHA256 75ff1b676fe1c16846f3a463c3920e2f9b8297851d713f37e65a204f647060dc
MD5 dff524002313a6fd2f794696dcd8e078
SHA1 32f5187a8a8796baf36b90bc873f4668f28d18f5
SHA512 afc3d696e473a9950465b4fc8ce0daf1361ffdf1880d95e352864d7c23e54fdfc12ad2879df5ebc2860fc79b284b5c2f45f9fb99718231fe4bd64e953e0f5489
SSDEEP 49152:JNbJqV8HyrbVWFYX5oFz7hpp0ZcM+aeHBqkAxZhXMBvFZGh:Ig9FYX5cuh
TLSH
T1DE9509DA781ED3559543632A511F194BF269C0A8212D01F0F185B8DE2432FB96BFF8FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

natives_21E43A33.d.ts.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\scripting\v8\natives_21E43A33.d.ts.tmp
Size 2.3MB
SHA256 9e9e81bc60cbe5d2b40a0e79add23f6c0d1eaea7dce2712ae38504c4a84dc9d8
MD5 36f5cddf9cd88dbfa27edf671c7c129d
SHA1 cd43a3155a234be4dad8fd71ffcb5a270ec749a6
SHA512 80f46f1143ff06eac28a66ccaf53bcaf2b380773996019857d836ee3f9ceb41422b4bff03e775156c60ea3add307574fa790e153d8cc1a731fa531b7a60e29d4
SSDEEP 49152:kO4NUH1AeYZJkDx1H9AAH2HD7lcmu6DjBvdnrD:kO4K4JkD2AkD
TLSH
T1BEB5969AFF493233E6B29232B0BF5048E9746258A91131DF7CF464540F1B2BC26A7D9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

natives_21E43A33.js.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\scripting\v8\natives_21E43A33.js.tmp
Size 2.1MB
SHA256 bd072c00cb50219bad8959d7efee5bdc8caf90bd876fe4e3142b28a9386280af
MD5 9b1dcdbfc5e33692ecbc91477f5f0853
SHA1 1e0c5a805d7fbb81c53109cfe0d333e60256851f
SHA512 07c8a2e6aca864a2d0e1194dde07ba7baa43015874d794a675bbd462f04408f2a1a549a2b4512d59744b09d6d9596bc39893641ad351cc0014f48c41f55f5056
SSDEEP 49152:eIMMNUYXFaHRKkPjJG1R9NGABKeNrEDEi8XbhNEVgs:ZlmKkPZAhs
TLSH
T19FA5E8E93881622AE523723CD12B5D09F374E431598D21E8BCDD64982D24FBD46FEDAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

im3d.fxc.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\shaderz\win32_40_lq_final\im3d.fxc.tmp
Size 9KB
SHA256 be0c4a87833b062965bc2c2af4cedc30dd76d9cad10d996c2a5809de2f7e34c0
MD5 7f32d8c9e8ec983ab316a093be55ebd0
SHA1 077e8b5225a2d7dccf6a7ecabc3aa5d46e684955
SHA512 c44b9b2ac8410c2ca2bbd936697d83376ba7b02248342c6ecd9ec60e42a306ed070184f16e64e0daa9712ef204b1599ffd4152acf2bc5440271ff7d877f7fa78
SSDEEP 96:V7GKCm7GKCoQGKCUtKIV/h4KIb0FKG1ReGKGKyFt21mQxzjfDeGKGKy3Mrbk/vp:V7V7EN/K0XReSt21Z5jfDeYMrbOx
TLSH
T12922EC1A27821EB7EA2D9373C0DB4F01B377D86226E3DF53888155194CE63C4EE256AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

outlinez.fxc.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\shaderz\win32_40_lq_final\outlinez.fxc.tmp
Size 4KB
SHA256 53aab937bc5573154a144ec115b14ab51d7a9bca485af71021ba5bb225756ee4
MD5 4785ebb287fa3aa86649dd35b7b7f561
SHA1 e82f7fb0456c7e0b13a01c91929abb0ab1754007
SHA512 4cf76f9145d75faeebcd7403bfc9e82effbca4c74dead2ed260868b6f2495d64c4a76b6fd284fc23d278835affb732f911be86baf7dc46060455e1746071855c
SSDEEP 96:+KwqdQteKwqdQtLDlI5PJKHdRVzIPJKHdUS83EvWOM:StytLDlu+eXS83EE
TLSH
T174B10E016B85AE3BE76E9732CDD703197335D8411BF387234AD522242C523C46EA639E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

outlinez_firm.fxc.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\shaderz\win32_40_lq_final\outlinez_firm.fxc.tmp
Size 4KB
SHA256 05df82e50fb5a00894a7f15c9fddc4235e8ae4aed37083297034e6e28a91a656
MD5 c31cf050db671c2f142f322d24e481ed
SHA1 11a3a81ec89bcca5d8cd6488a00e6daddf926876
SHA512 ac1d7daa4b905ae406a18dcd6ec72ce21a5df6619432ca411a45bb179b6a6f9f58e679e73634051a0e27957647697169afa80196e67c774c3007bf0f185edbcf
SSDEEP 96:+KwqdQteKwqdQtirlKHdzzZKHdvytmWlM:StytWuz8yt2
TLSH
T1BB91CB126F85EE37EB6E4B36CADB03153336D9415BF38B13459121242D533C48EA679E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

outlinez_mask.fxc.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\shaderz\win32_40_lq_final\outlinez_mask.fxc.tmp
Size 1KB
SHA256 925cac9047d439bcb5e6852fc58a759a64033ff27441ad02e7f8c2333da8423a
MD5 9b343ffa22056230a315fc5a5760185f
SHA1 23dad37c308d42b9e729c038757cdc2e0427edd8
SHA512 3bc7f19a979c19593476b6135a574c361e023d985196f4a20a1808f8dc810a70311714619096feb26455f5a5559a1788e09941d15362c4f018da462b5e5db3fc
TLSH
T1F641A8122B88FE0BDB2E5B35CBA207053776EA866793CB0398C021340C133C88F6275D
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\desktop.ini
Size 157B
SHA256 b1fe21f251cf7875783ea162ef86c2a5b5022a1c5157bbb7972b6b34e14ec08a
MD5 f9d948aa9426cb1a2a82e651b81a1912
SHA1 2d496caeef3b0bff6b91b99e58736cea51366348
SHA512 a962fae3853f43e4a8e2b33aa5f51a917673d76648845dffcc32037c25cb3f300e4c4fc3ea633bf78b714449dbda84416e41cc16256373c170fb82d8485e3369
TLSH
T14DC04C06818FC62DC42ED0BB1DA1A248CCBD0D2BAF6E7E04D6C0D50827D6F4FACA5685
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\desktop.ini
Size 83B
SHA256 8dbad4b058e6e6e2d8b119f55e84b8eabfc074c80995e1c1b6b1a5731fd1f3c8
MD5 eeb7d52c2a25022ea8e6fdd84b490968
SHA1 ac615808df874379439510643f1b68958951dcfa
SHA512 1ccd684842f249bb3acae4cf1057cbea27852a34c39123cc7a3b6d64604984cee6a0edea164b6284e843c52e39e1da3129102fc4ba1104658cddf3999af6d197
TLSH
T12DA01201408F812CC42FC06704509104C8A40C0A9E1E6D008280C0041681E0D5C94285
MD5 SHA1 SHA512 TLSH

Submit Download

FiveM.exe

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.exe
Size 5.0MB
SHA256 61c35ecbd844ae6509484a0b71bec1abf9122a76a09c7e3c32e9632aedabe635
MD5 e6eef8e6821ff6b2cdb4e2f717f13729
SHA1 a8df1217f07b27a7a680893672882eb9456df4bc
SHA512 daf12cd7822eca38183f70f9445cb656d4cae9442be4f9ca4193b7b393a50f53d2eb569ceb11e6dfce30dde706f37ed247a049f5c124b6351b586d40f8a9b9a3
SSDEEP 49152:ROjPWCYlcqTdNuNoY1fcvTFYaQzVUu8cdV0hN81Tvs0ET2lKBay1Jtyun95QamLQ:HTqf4YaQzVpEBTQtB71THSvF2k
TLSH
T16A369D56A3E500E8D1B7C178CE964127E7B2BC061371DBDF02A0666A1F37AE16E3E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FiveM.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FiveM.lnk
Size 2KB
SHA256 5fe130c49fc884d32b480df5e7867acebff4a562b0fe6786d7ce588a190c0469
MD5 7eef7865c0205b2afbb9c6ed4a9e49a2
SHA1 f1734e9288bb280eed6b61354f05e2c7b3cd4e77
SHA512 3e25441455520c01b648e4842407f310751bc05f7f4dc0ca894e522d58146f3ea1fc8f4fd9f2b8b74675d233632b8652d8dd0ba6ca6156eadeca452a8564500e
TLSH
T17F41F0039DE65F20D2FAC47959B7631585B23CE6FB16CF0F008082882D55F129C85F1E
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3752-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/3752-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/3884-3-0x00007FFD89A50000-0x00007FFD89A51000-memory.dmp

Download

memory/3884-0-0x0000000140000000-0x000000014052C000-memory.dmp

Download

memory/3884-7-0x0000000140000000-0x000000014052C000-memory.dmp

Download

memory/4872-11-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4932-1309-0x0000000140000000-0x000000014052C000-memory.dmp

Download

memory/4932-1316-0x0000000140000000-0x000000014052C000-memory.dmp

Download

memory/5644-449-0x0000000140000000-0x000000014052C000-memory.dmp

Download

memory/5644-8-0x0000000140000000-0x000000014052C000-memory.dmp

Download

memory/5992-1312-0x0000000140000000-0x0000000140015000-memory.dmp

Download