hxxps://freetp[.]org/engine/download[.]php?id=8130&area=

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25-02-2024 04:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://freetp.org/engine/download.php?id=8130&area=

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
4548	[FreeTP.Org]Ready-Or-Not-Multiplayer-Fix-Online-v8.2.exe
1516	[FreeTP.Org]Ready-Or-Not-Multiplayer-Fix-Online-v8.2.tmp

Loads dropped DLL 5 IoCs

pid	Process
1516	[FreeTP.Org]Ready-Or-Not-Multiplayer-Fix-Online-v8.2.tmp
1516	[FreeTP.Org]Ready-Or-Not-Multiplayer-Fix-Online-v8.2.tmp
1516	[FreeTP.Org]Ready-Or-Not-Multiplayer-Fix-Online-v8.2.tmp
1516	[FreeTP.Org]Ready-Or-Not-Multiplayer-Fix-Online-v8.2.tmp
1516	[FreeTP.Org]Ready-Or-Not-Multiplayer-Fix-Online-v8.2.tmp

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	[FreeTP.Org]Ready-Or-Not-Multiplayer-Fix-Online-v8.2.tmp
File opened (read-only)	\??\Q:	[FreeTP.Org]Ready-Or-Not-Multiplayer-Fix-Online-v8.2.tmp
File opened (read-only)	\??\T:	[FreeTP.Org]Ready-Or-Not-Multiplayer-Fix-Online-v8.2.tmp
File opened (read-only)	\??\U:	[FreeTP.Org]Ready-Or-Not-Multiplayer-Fix-Online-v8.2.tmp
File opened (read-only)	\??\V:	[FreeTP.Org]Ready-Or-Not-Multiplayer-Fix-Online-v8.2.tmp
File opened (read-only)	\??\W:	[FreeTP.Org]Ready-Or-Not-Multiplayer-Fix-Online-v8.2.tmp
File opened (read-only)	\??\X:	[FreeTP.Org]Ready-Or-Not-Multiplayer-Fix-Online-v8.2.tmp
File opened (read-only)	\??\Y:	[FreeTP.Org]Ready-Or-Not-Multiplayer-Fix-Online-v8.2.tmp
File opened (read-only)	\??\E:	[FreeTP.Org]Ready-Or-Not-Multiplayer-Fix-Online-v8.2.tmp
File opened (read-only)	\??\G:	[FreeTP.Org]Ready-Or-Not-Multiplayer-Fix-Online-v8.2.tmp
File opened (read-only)	\??\I:	[FreeTP.Org]Ready-Or-Not-Multiplayer-Fix-Online-v8.2.tmp
File opened (read-only)	\??\K:	[FreeTP.Org]Ready-Or-Not-Multiplayer-Fix-Online-v8.2.tmp
File opened (read-only)	\??\L:	[FreeTP.Org]Ready-Or-Not-Multiplayer-Fix-Online-v8.2.tmp
File opened (read-only)	\??\O:	[FreeTP.Org]Ready-Or-Not-Multiplayer-Fix-Online-v8.2.tmp
File opened (read-only)	\??\R:	[FreeTP.Org]Ready-Or-Not-Multiplayer-Fix-Online-v8.2.tmp
File opened (read-only)	\??\M:	[FreeTP.Org]Ready-Or-Not-Multiplayer-Fix-Online-v8.2.tmp
File opened (read-only)	\??\Z:	[FreeTP.Org]Ready-Or-Not-Multiplayer-Fix-Online-v8.2.tmp
File opened (read-only)	\??\A:	[FreeTP.Org]Ready-Or-Not-Multiplayer-Fix-Online-v8.2.tmp
File opened (read-only)	\??\B:	[FreeTP.Org]Ready-Or-Not-Multiplayer-Fix-Online-v8.2.tmp
File opened (read-only)	\??\H:	[FreeTP.Org]Ready-Or-Not-Multiplayer-Fix-Online-v8.2.tmp
File opened (read-only)	\??\N:	[FreeTP.Org]Ready-Or-Not-Multiplayer-Fix-Online-v8.2.tmp
File opened (read-only)	\??\P:	[FreeTP.Org]Ready-Or-Not-Multiplayer-Fix-Online-v8.2.tmp
File opened (read-only)	\??\S:	[FreeTP.Org]Ready-Or-Not-Multiplayer-Fix-Online-v8.2.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	[FreeTP.Org]Ready-Or-Not-Multiplayer-Fix-Online-v8.2.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	[FreeTP.Org]Ready-Or-Not-Multiplayer-Fix-Online-v8.2.tmp
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor	[FreeTP.Org]Ready-Or-Not-Multiplayer-Fix-Online-v8.2.tmp
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	[FreeTP.Org]Ready-Or-Not-Multiplayer-Fix-Online-v8.2.tmp
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	[FreeTP.Org]Ready-Or-Not-Multiplayer-Fix-Online-v8.2.tmp

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 68482.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1352	msedge.exe
1352	msedge.exe
4972	msedge.exe
4972	msedge.exe
4204	identity_helper.exe
4204	identity_helper.exe
3000	msedge.exe
3000	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4548	[FreeTP.Org]Ready-Or-Not-Multiplayer-Fix-Online-v8.2.exe
1516	[FreeTP.Org]Ready-Or-Not-Multiplayer-Fix-Online-v8.2.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 756	4972	msedge.exe	72
PID 4972 wrote to memory of 756	4972	msedge.exe	72
PID 4972 wrote to memory of 2996	4972	msedge.exe	90
PID 4972 wrote to memory of 2996	4972	msedge.exe	90
PID 4972 wrote to memory of 2996	4972	msedge.exe	90
PID 4972 wrote to memory of 2996	4972	msedge.exe	90
PID 4972 wrote to memory of 2996	4972	msedge.exe	90
PID 4972 wrote to memory of 2996	4972	msedge.exe	90
PID 4972 wrote to memory of 2996	4972	msedge.exe	90
PID 4972 wrote to memory of 2996	4972	msedge.exe	90
PID 4972 wrote to memory of 2996	4972	msedge.exe	90
PID 4972 wrote to memory of 2996	4972	msedge.exe	90
PID 4972 wrote to memory of 2996	4972	msedge.exe	90
PID 4972 wrote to memory of 2996	4972	msedge.exe	90
PID 4972 wrote to memory of 2996	4972	msedge.exe	90
PID 4972 wrote to memory of 2996	4972	msedge.exe	90
PID 4972 wrote to memory of 2996	4972	msedge.exe	90
PID 4972 wrote to memory of 2996	4972	msedge.exe	90
PID 4972 wrote to memory of 2996	4972	msedge.exe	90
PID 4972 wrote to memory of 2996	4972	msedge.exe	90
PID 4972 wrote to memory of 2996	4972	msedge.exe	90
PID 4972 wrote to memory of 2996	4972	msedge.exe	90
PID 4972 wrote to memory of 2996	4972	msedge.exe	90
PID 4972 wrote to memory of 2996	4972	msedge.exe	90
PID 4972 wrote to memory of 2996	4972	msedge.exe	90
PID 4972 wrote to memory of 2996	4972	msedge.exe	90
PID 4972 wrote to memory of 2996	4972	msedge.exe	90
PID 4972 wrote to memory of 2996	4972	msedge.exe	90
PID 4972 wrote to memory of 2996	4972	msedge.exe	90
PID 4972 wrote to memory of 2996	4972	msedge.exe	90
PID 4972 wrote to memory of 2996	4972	msedge.exe	90
PID 4972 wrote to memory of 2996	4972	msedge.exe	90
PID 4972 wrote to memory of 2996	4972	msedge.exe	90
PID 4972 wrote to memory of 2996	4972	msedge.exe	90
PID 4972 wrote to memory of 2996	4972	msedge.exe	90
PID 4972 wrote to memory of 2996	4972	msedge.exe	90
PID 4972 wrote to memory of 2996	4972	msedge.exe	90
PID 4972 wrote to memory of 2996	4972	msedge.exe	90
PID 4972 wrote to memory of 2996	4972	msedge.exe	90
PID 4972 wrote to memory of 2996	4972	msedge.exe	90
PID 4972 wrote to memory of 2996	4972	msedge.exe	90
PID 4972 wrote to memory of 2996	4972	msedge.exe	90
PID 4972 wrote to memory of 1352	4972	msedge.exe	89
PID 4972 wrote to memory of 1352	4972	msedge.exe	89
PID 4972 wrote to memory of 664	4972	msedge.exe	91
PID 4972 wrote to memory of 664	4972	msedge.exe	91
PID 4972 wrote to memory of 664	4972	msedge.exe	91
PID 4972 wrote to memory of 664	4972	msedge.exe	91
PID 4972 wrote to memory of 664	4972	msedge.exe	91
PID 4972 wrote to memory of 664	4972	msedge.exe	91
PID 4972 wrote to memory of 664	4972	msedge.exe	91
PID 4972 wrote to memory of 664	4972	msedge.exe	91
PID 4972 wrote to memory of 664	4972	msedge.exe	91
PID 4972 wrote to memory of 664	4972	msedge.exe	91
PID 4972 wrote to memory of 664	4972	msedge.exe	91
PID 4972 wrote to memory of 664	4972	msedge.exe	91
PID 4972 wrote to memory of 664	4972	msedge.exe	91
PID 4972 wrote to memory of 664	4972	msedge.exe	91
PID 4972 wrote to memory of 664	4972	msedge.exe	91
PID 4972 wrote to memory of 664	4972	msedge.exe	91
PID 4972 wrote to memory of 664	4972	msedge.exe	91
PID 4972 wrote to memory of 664	4972	msedge.exe	91
PID 4972 wrote to memory of 664	4972	msedge.exe	91
PID 4972 wrote to memory of 664	4972	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://freetp.org/engine/download.php?id=8130&area=
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffd28946f8,0x7fffd2894708,0x7fffd2894718
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1960,233659692472451813,18288773172892307879,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,233659692472451813,18288773172892307879,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1960,233659692472451813,18288773172892307879,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,233659692472451813,18288773172892307879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,233659692472451813,18288773172892307879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,233659692472451813,18288773172892307879,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,233659692472451813,18288773172892307879,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,233659692472451813,18288773172892307879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3824 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,233659692472451813,18288773172892307879,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,233659692472451813,18288773172892307879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1960,233659692472451813,18288773172892307879,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3440 /prefetch:8
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1960,233659692472451813,18288773172892307879,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,233659692472451813,18288773172892307879,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,233659692472451813,18288773172892307879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1960,233659692472451813,18288773172892307879,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3000
- C:\Users\Admin\Downloads\[FreeTP.Org]Ready-Or-Not-Multiplayer-Fix-Online-v8.2.exe
  "C:\Users\Admin\Downloads\[FreeTP.Org]Ready-Or-Not-Multiplayer-Fix-Online-v8.2.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4548
- - C:\Users\Admin\AppData\Local\Temp\is-LBIVT.tmp\[FreeTP.Org]Ready-Or-Not-Multiplayer-Fix-Online-v8.2.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-LBIVT.tmp\[FreeTP.Org]Ready-Or-Not-Multiplayer-Fix-Online-v8.2.tmp" /SL5="$E0032,5296922,152064,C:\Users\Admin\Downloads\[FreeTP.Org]Ready-Or-Not-Multiplayer-Fix-Online-v8.2.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Enumerates connected drives
    - Checks processor information in registry
    - Suspicious use of SetWindowsHookEx
    PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,233659692472451813,18288773172892307879,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1af9fbc1d4655baf2df9e8948103d616

SHA1
c58d5c208d0d5aab5b6979b64102b0086799b0bf

SHA256
e83daa7b2af963dbb884d82919710164e2337f0f9f5e5c56ee4b7129d160c135

SHA512
714d0ff527a8a24ec5d32a0a2b74e402ee933ea86e42d3e2fb5615c8345e6c09aa1c2ddf2dea53d71c5a666483a3b494b894326fea0cc1d8a06d3b32ec9397d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
aa6f46176fbc19ccf3e361dc1135ece0

SHA1
cb1f8c693b88331e9513b77efe47be9e43c43b12

SHA256
2f5ba493c7c4192e9310cea3a96cfec4fd14c6285af6e3659627ab177e560819

SHA512
5d26fdffebeb1eb5adde9f7da19fe7069e364d3f68670013cb0cc3e2b40bf1fbcb9bdebbfe999747caf141c88ccd53bd4acf2074283e4bde46b8c28fbae296f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
178B

MD5
5be72d97c958c606357a2c5988aa22c9

SHA1
d93c0f7ee4763c908d7877cf349cb5a4a46345ac

SHA256
e5ff9f441add4007c94325924084a73d99265431374717a8df41052ae4b07538

SHA512
1b5ca6ba4d59efd9b4744305a0537171c93af27e378708367ccf3b8a78fac91ba942bfe803c22810205263641154d12842cf4096e30e8279152eedbeec15d591

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6d3e7ff3177d9682609c8fd157ddc7e4

SHA1
3227b749594b235ff5f21aa93418abae5378e55c

SHA256
c0eb3fc41f82165136e5672906d505cae0183d9f8830aaed40372973c1c9bb67

SHA512
9fa1138da4b9ef13fd6c7b09d120f5435b5d8c1625be27646170c0ee05e07134bd84eb6551f9ec33a89a70c86b11230ddd6a394229cbd9c7027615726bf0cc53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
811d7feca66a5deda3d06a5a55f473ff

SHA1
b3c3c433f85acd11f44720ea2e25bed9df68a065

SHA256
8de0282d3946faf84cb425f157e440154c802cf0a504281dab70dd79a57a3f64

SHA512
b257117fb4323e65faecfe5560aa11af44e638807783f40b2d78599734984ddefdc94969e4f2dc5e11efea02325376a495e1f9a8757eca41a56ba7c09fc18676

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
dc89cf8a5b4dbe77405228d2527c15a4

SHA1
0522603a9b963cabab10cffdaad399987397849f

SHA256
ef1b68b024740d2eb2977587c5821918838b289e3dfb60f29cf6c1c56a68ebd7

SHA512
fe50b2618caff2e30ed056b730731ad896b33490a2f4d24a5185feee7b75a304c567282e2c19cbc84be4cfd72c7e913ddd9eabb8c03e0919c3714a4c253b9a24

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-LBIVT.tmp\[FreeTP.Org]Ready-Or-Not-Multiplayer-Fix-Online-v8.2.tmp

Filesize
1.4MB

MD5
7300211c571951be86be6c6f8cdfc09d

SHA1
5464e16689003406513c7677b3d970f673551d18

SHA256
e77c3184d90f6e7a1276bb8389aba06296be97deb2e8a3433ca9a537538696da

SHA512
9c340edcd63c87565a9de26892d2e83647798583cc942bf608b54e86b8fd36bc2ad64421241b88f0a0682e7c006a5af712e62d3231ca5a81264d8b1a1905ebb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-QM9J9.tmp\CheckBox.png

Filesize
7KB

MD5
abd301b0263b0e0cebdd71e4855ac7d3

SHA1
1e8480c3f3b47a5daa7cb1183b6a7a49998cda6e

SHA256
aff003e75bbf410ed2f7ca8728afe01ab4a517536647ad20109d00c4adf570d5

SHA512
b5abb188bd23d7fc2e3253a5639cc3eba6d21774dba55b43395cf84ddb49fe707ad54dc0a7f157e6b0804c1662d9c4cb4bef2787aafb194ea73fbebd1a63bb6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-QM9J9.tmp\WizardImage.jpg

Filesize
62KB

MD5
b91658597f15d7f689c86f5a2e7824bd

SHA1
00da609aa0b39140b767a3bc2644433d64edbd71

SHA256
b3cda6ab45ad5aa6a0a5f700d2c8987b3c1c1ebda63165d9bd5a566b24dcbd84

SHA512
00b287fb14b947edf4b16d52243e9a992595d8894e83d8590473103d1b54a4670b323db13c4f78234617c44f905baf517e68fcceaad313f3ea7cd44cf036daea

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-QM9J9.tmp\botva2.dll

Filesize
32KB

MD5
295832fa6400cb3407cfe84b06785531

SHA1
7068910c2e0ea7f4535c770517e29d9c2d2ee77b

SHA256
13e372c4d843603096f33603915c3f25d0e0d4475001c33ce5263bfcd1760784

SHA512
50516f9761efd14641f65bd773cfdd50c4ab0de977e094ba9227796dc319d9330321c7914243fc7dc04b5716752395f8dac8ccdfdb98ba7e5f5c1172408ce57b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-QM9J9.tmp\button.png

Filesize
12KB

MD5
51af4120d6d22b1126cc87a5143740ef

SHA1
1cb4e91e765537a72c9628056d29fbd6a7ce515c

SHA256
c74fed62141f7e666379a0b00d5b39c86975332cf08151cbe8cab88eff2c393c

SHA512
2595be954684ca34bc9284337524a5191c72fbea46b59555a5113ed8404a1e7ab6c2aa0f5a975f832cccdd8934ff1140c679ecd940f31cc14b4c3a362a225cbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-QM9J9.tmp\get_hw_caps.dll

Filesize
76KB

MD5
2e35d2894df3b691dbd8e0d4f4c84efc

SHA1
d0fc14963e397d185e9f2d7dea1d07bc6308d5b9

SHA256
869079ba362cbc560d673db290248ec2aa075a74f22a82d90621f1118f8e1c4d

SHA512
29ba662ab2e77aef0547ff76213a1b6ef52be27a446923790a27cf8b69377621048387dbb9f22001b6d15837dddada84c7350614ec9622258319658822705f90

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-QM9J9.tmp\innocallback.dll

Filesize
63KB

MD5
1c55ae5ef9980e3b1028447da6105c75

SHA1
f85218e10e6aa23b2f5a3ed512895b437e41b45c

SHA256
6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f

SHA512
1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 68482.crdownload

Filesize
5.5MB

MD5
0bdef967dc15323a782f6b52d0835f42

SHA1
c0d2345d216f1cf074463e283f5d5a93b1f8e4a4

SHA256
30562cb253480242ad564d1f549ac5027f8ae1a5b67a4f5e102820ea1e4b46b9

SHA512
93330610edecd07ef327d58fac950e0addddf15706f4b5a1224c30a751b5926908fb8dce112d6bde1c8301ea4fa8492c10ea20b7d2bddd155398323b73e40550

Download Submit
C:\Users\Admin\Downloads\[FreeTP.Org]Ready-Or-Not-Multiplayer-Fix-Online-v8.2.exe

Filesize
889KB

MD5
6cc8fe23a67b142ffc1c740f2de9fdc7

SHA1
5e1a2d0397e817d926b826a7afbe9d0a6cad5025

SHA256
a6725699e3add4a02374462d12879edc1e8bd430988f966363a778c52fa39e06

SHA512
b2340708f06a6e93e261037f8c1279a5d090f292351b83fc3129eb4591b1002918e7539bd58dc6fd17885600a0dd2fb0731c5c5e72efe1513f8926e57d342696

Download Submit
C:\Users\Admin\Downloads\[FreeTP.Org]Ready-Or-Not-Multiplayer-Fix-Online-v8.2.exe

Filesize
3.4MB

MD5
85e2d37bd08a23f731b47557a605981d

SHA1
df9f02e622ce23746b89d8fb634695869bb1ed84

SHA256
b75aa108c429c0efa0abecc1952e6cf23893ec81b8f921adfb0ffc9f6ec55a5d

SHA512
13b3d774ea317ff77cac572fe284fad62e3ef112950218f072e34cae1b9f0803b12a2a16d0cac490c6535f443b74cd0b60c504560cf3398af23e19bacb0820b1

Download Submit
memory/1516-209-0x00000000008A0000-0x00000000008A1000-memory.dmp

Filesize
4KB

Download
memory/1516-153-0x0000000005E70000-0x0000000005E85000-memory.dmp

Filesize
84KB

Download
memory/1516-192-0x0000000005840000-0x000000000584D000-memory.dmp

Filesize
52KB

Download
memory/1516-206-0x0000000000400000-0x000000000057B000-memory.dmp

Filesize
1.5MB

Download
memory/1516-187-0x0000000005FF0000-0x00000000060F0000-memory.dmp

Filesize
1024KB

Download
memory/1516-189-0x0000000005FF0000-0x00000000060F0000-memory.dmp

Filesize
1024KB

Download
memory/1516-193-0x0000000005E70000-0x0000000005E85000-memory.dmp

Filesize
84KB

Download
memory/1516-191-0x0000000000400000-0x000000000057B000-memory.dmp

Filesize
1.5MB

Download
memory/1516-81-0x00000000008A0000-0x00000000008A1000-memory.dmp

Filesize
4KB

Download
memory/1516-215-0x0000000005FF0000-0x00000000060F0000-memory.dmp

Filesize
1024KB

Download
memory/1516-214-0x0000000005FF0000-0x00000000060F0000-memory.dmp

Filesize
1024KB

Download
memory/1516-110-0x0000000005840000-0x000000000584D000-memory.dmp

Filesize
52KB

Download
memory/1516-211-0x0000000000400000-0x000000000057B000-memory.dmp

Filesize
1.5MB

Download
memory/1516-213-0x0000000005E70000-0x0000000005E85000-memory.dmp

Filesize
84KB

Download
memory/1516-212-0x0000000005840000-0x000000000584D000-memory.dmp

Filesize
52KB

Download
memory/4548-76-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4548-74-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4548-190-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download