File name:

Cold_Turkey v4.4 Cracked By Abo Jamal.rar

Full analysis: https://app.any.run/tasks/5b16369b-44e3-4b89-aab9-8c370b0adcce
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: September 06, 2024, 18:07:28
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

C5C70E3E40BFFE5402313BF153B50112

SHA1:

42285651D8B6E0ABEA961589DAC4E1F15E3EC81D

SHA256:

C04FB71971474874C1D58FDC49932E2AF5754A02965DD5A412AFC8F2371A97E3

SSDEEP:

98304:sBtb9l/4tvTe5ixbsq03OP5AVinhc61iwiOa6hDvlQ8IipAQtOMAvnDo2PuqEziV:cgjtNaP0OsqO/cHMi/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • Cold Turkey Blocker.exe (PID: 1748)

    • Starts CMD.EXE for commands execution

      • msedge.exe (PID: 5044)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 6844)
      • Cold_Turkey_Installer.tmp (PID: 6520)
      • ServiceHub.Helper.exe (PID: 4252)
      • Cold Turkey Blocker.exe (PID: 1748)
      • identity_helper.exe (PID: 7176)
      • Cold_Turkey_Installer.tmp (PID: 6400)

    • Executable content was dropped or overwritten

      • Cold_Turkey_Installer.exe (PID: 232)
      • Cold_Turkey_Installer.exe (PID: 2132)
      • Cold_Turkey_Installer.tmp (PID: 6400)

    • Reads the Windows owner or organization settings

      • Cold_Turkey_Installer.tmp (PID: 6400)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • Cold_Turkey_Installer.tmp (PID: 6400)

    • Changes Internet Explorer settings (feature browser emulation)

      • Cold_Turkey_Installer.tmp (PID: 6400)

    • Process drops legitimate windows executable

      • Cold_Turkey_Installer.tmp (PID: 6400)

    • Executes as Windows Service

      • ServiceHub.Power.exe (PID: 1184)

    • Reads the date of Windows installation

      • ServiceHub.Helper.exe (PID: 4252)
      • Cold Turkey Blocker.exe (PID: 1748)

    • Reads Internet Explorer settings

      • Cold Turkey Blocker.exe (PID: 1748)

    • The process verifies whether the antivirus software is installed

      • Cold Turkey Blocker.exe (PID: 1748)

    • Reads Microsoft Outlook installation path

      • Cold Turkey Blocker.exe (PID: 1748)

    • Start notepad (likely ransomware note)

      • WinRAR.exe (PID: 6844)

    • The process executes via Task Scheduler

      • CTServiceInstaller.exe (PID: 7840)

  • INFO

    • The process uses the downloaded file

      • WinRAR.exe (PID: 6844)
      • ServiceHub.Helper.exe (PID: 4252)
      • Cold Turkey Blocker.exe (PID: 1748)
      • msedge.exe (PID: 8152)
      • msedge.exe (PID: 5044)
      • Cold_Turkey_Installer.tmp (PID: 6400)

    • Checks supported languages

      • Cold_Turkey_Installer.exe (PID: 232)
      • Cold_Turkey_Installer.tmp (PID: 6520)
      • Cold_Turkey_Installer.exe (PID: 2132)
      • Cold_Turkey_Installer.tmp (PID: 6400)
      • _setup64.tmp (PID: 4576)
      • CTServiceInstaller.exe (PID: 2456)
      • ServiceHub.Power.exe (PID: 1184)
      • Cold Turkey Blocker.exe (PID: 1748)
      • ServiceHub.Helper.exe (PID: 4252)
      • CTHostInstaller.exe (PID: 1292)
      • identity_helper.exe (PID: 7176)
      • CTMsgHostEdge.exe (PID: 8076)
      • CTServiceInstaller.exe (PID: 7840)
      • Cold Turkey Blocker.exe (PID: 7336)

    • Create files in a temporary directory

      • Cold_Turkey_Installer.exe (PID: 232)
      • Cold_Turkey_Installer.exe (PID: 2132)
      • Cold_Turkey_Installer.tmp (PID: 6400)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6844)

    • Reads the computer name

      • Cold_Turkey_Installer.tmp (PID: 6520)
      • Cold_Turkey_Installer.tmp (PID: 6400)
      • CTServiceInstaller.exe (PID: 2456)
      • ServiceHub.Power.exe (PID: 1184)
      • ServiceHub.Helper.exe (PID: 4252)
      • Cold Turkey Blocker.exe (PID: 1748)
      • CTHostInstaller.exe (PID: 1292)
      • identity_helper.exe (PID: 7176)
      • CTMsgHostEdge.exe (PID: 8076)
      • CTServiceInstaller.exe (PID: 7840)
      • Cold Turkey Blocker.exe (PID: 7336)

    • Process checks computer location settings

      • Cold_Turkey_Installer.tmp (PID: 6520)
      • Cold_Turkey_Installer.tmp (PID: 6400)
      • ServiceHub.Helper.exe (PID: 4252)
      • Cold Turkey Blocker.exe (PID: 1748)

    • Creates files in the program directory

      • Cold_Turkey_Installer.tmp (PID: 6400)
      • ServiceHub.Power.exe (PID: 1184)
      • ServiceHub.Helper.exe (PID: 4252)
      • Cold Turkey Blocker.exe (PID: 1748)
      • CTMsgHostEdge.exe (PID: 8076)

    • Creates a software uninstall entry

      • Cold_Turkey_Installer.tmp (PID: 6400)

    • Reads the machine GUID from the registry

      • CTServiceInstaller.exe (PID: 2456)
      • ServiceHub.Power.exe (PID: 1184)
      • ServiceHub.Helper.exe (PID: 4252)
      • Cold Turkey Blocker.exe (PID: 1748)
      • CTHostInstaller.exe (PID: 1292)
      • CTMsgHostEdge.exe (PID: 8076)
      • Cold Turkey Blocker.exe (PID: 7336)
      • CTServiceInstaller.exe (PID: 7840)

    • Sends debugging messages

      • ServiceHub.Power.exe (PID: 1184)
      • ServiceHub.Helper.exe (PID: 4252)
      • Cold Turkey Blocker.exe (PID: 1748)
      • CTMsgHostEdge.exe (PID: 8076)

    • Checks proxy server information

      • Cold Turkey Blocker.exe (PID: 1748)

    • Disables trace logs

      • Cold Turkey Blocker.exe (PID: 1748)

    • Reads the software policy settings

      • Cold Turkey Blocker.exe (PID: 1748)

    • Reads Environment values

      • Cold Turkey Blocker.exe (PID: 1748)
      • identity_helper.exe (PID: 7176)

    • Application launched itself

      • msedge.exe (PID: 5044)

    • Reads Microsoft Office registry keys

      • WinRAR.exe (PID: 6844)

    • Creates files or folders in the user directory

      • identity_helper.exe (PID: 7176)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 7500)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
205
Monitored processes
72
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe cold_turkey_installer.exe cold_turkey_installer.tmp no specs cold_turkey_installer.exe cold_turkey_installer.tmp netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs _setup64.tmp no specs conhost.exe no specs ctserviceinstaller.exe no specs servicehub.power.exe servicehub.helper.exe cold turkey blocker.exe cthostinstaller.exe no specs cthostinstaller.exe msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs cmd.exe no specs conhost.exe no specs ctmsghostedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs notepad.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs ctserviceinstaller.exe no specs cold turkey blocker.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
232"C:\Users\admin\AppData\Local\Temp\Rar$EXa6844.38179\Cold_Turkey_Installer.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa6844.38179\Cold_Turkey_Installer.exe
WinRAR.exe
User:
admin
Company:
Cold Turkey Software, Inc.
Integrity Level:
MEDIUM
Description:
Cold Turkey Blocker Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa6844.38179\cold_turkey_installer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
320"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --no-appcompat-clear --mojo-platform-channel-handle=5324 --field-trial-handle=2272,i,15631317547673942204,10674686585378917771,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
876\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—netsh.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
888\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—netsh.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1184"C:\Program Files\Cold Turkey\ServiceHub.Power.exe"C:\Program Files\Cold Turkey\ServiceHub.Power.exe
services.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Description:
ServiceHub.Power
Version:
1.0.0.0
Modules
Images
c:\program files\cold turkey\servicehub.power.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1292"C:\Program Files\Cold Turkey\CTHostInstaller.exe" msedge falseC:\Program Files\Cold Turkey\CTHostInstaller.exe
Cold Turkey Blocker.exe
User:
admin
Company:
Cold Turkey Software Inc.
Integrity Level:
HIGH
Description:
CTHostInstaller
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\program files\cold turkey\cthostinstaller.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1440"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5332 --field-trial-handle=2272,i,15631317547673942204,10674686585378917771,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1748"C:\Program Files\Cold Turkey\Cold Turkey Blocker.exe" -first-runC:\Program Files\Cold Turkey\Cold Turkey Blocker.exe
ServiceHub.Helper.exe
User:
admin
Company:
Cold Turkey Software Inc.
Integrity Level:
MEDIUM
Description:
Cold Turkey Blocker
Version:
4.4.0.0
Modules
Images
c:\program files\cold turkey\cold turkey blocker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2132"C:\Users\admin\AppData\Local\Temp\Rar$EXa6844.38179\Cold_Turkey_Installer.exe" /SPAWNWND=$E01F6 /NOTIFYWND=$80396 C:\Users\admin\AppData\Local\Temp\Rar$EXa6844.38179\Cold_Turkey_Installer.exe
Cold_Turkey_Installer.tmp
User:
admin
Company:
Cold Turkey Software, Inc.
Integrity Level:
HIGH
Description:
Cold Turkey Blocker Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa6844.38179\cold_turkey_installer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2384"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Cold Turkey Blocker" dir=in program="C:\Program Files\Cold Turkey\Cold Turkey Blocker.exe" action=allowC:\Windows\SysWOW64\netsh.exe—Cold_Turkey_Installer.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
13 186
Read events
13 112
Write events
73
Delete events
1

Modification events

(PID) Process:(6844) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(6844) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Cold_Turkey v4.4 Cracked By Abo Jamal.rar
(PID) Process:(6844) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6844) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6844) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6844) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6400) Cold_Turkey_Installer.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Cold Turkey\Blocker\Settings
Operation:writeName:JustInstalled
Value:
true
(PID) Process:(6400) Cold_Turkey_Installer.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Cold Turkey\Blocker\Settings
Operation:writeName:Restarted
Value:
false
(PID) Process:(6400) Cold_Turkey_Installer.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION
Operation:writeName:Cold Turkey Blocker.exe
Value:
11000
(PID) Process:(6400) Cold_Turkey_Installer.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING
Operation:writeName:Cold Turkey Blocker.exe
Value:
1
Executable files
45
Suspicious files
446
Text files
309
Unknown types
64

Dropped files

PID
Process
Filename
Type
6844WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa6844.38179\readme.txttext
MD5:57E0E8E536F3D4CC3246D638173143DA
SHA256:AF75D26CF78FA6D818831FAB8B157D565F322C6F98113CF3890FF9007D52E318
6400Cold_Turkey_Installer.tmpC:\Program Files\Cold Turkey\unins000.exeexecutable
MD5:E57D9126EBA98EF808173F04B71994CF
SHA256:2C9D704D0718FABB7B80970623974193ABCDFB5DAA2E93B1F5747BA0424651B5
6400Cold_Turkey_Installer.tmpC:\Program Files\Cold Turkey\CTHostInstaller.exeexecutable
MD5:C2E639633D46B0F92518ACD99B2CCA4B
SHA256:5E8FF71AEDF36A995151309A6626FFFADC51194E39EE1B9633810B752E7E59F2
6400Cold_Turkey_Installer.tmpC:\Users\admin\AppData\Local\Temp\is-PKV85.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
6400Cold_Turkey_Installer.tmpC:\Program Files\Cold Turkey\is-9UHKF.tmpbinary
MD5:0A8AF25D1F9D0A3D27C8DCE58C8E4B86
SHA256:6949974F9F8BC30A1EBA5747B854C2F8C9B9CA0D315251830DF3EB2044D9C53D
6400Cold_Turkey_Installer.tmpC:\Program Files\Cold Turkey\is-CPL9E.tmpexecutable
MD5:E57D9126EBA98EF808173F04B71994CF
SHA256:2C9D704D0718FABB7B80970623974193ABCDFB5DAA2E93B1F5747BA0424651B5
6400Cold_Turkey_Installer.tmpC:\Program Files\Cold Turkey\CTMsgHostChrome.jsonbinary
MD5:9F9FEF0EF707D3B2DCAB79428390B9BE
SHA256:C304EF695BB3A6220ED56E6FD3B0539CED6EE20A90AD9D1237876B46F71D1A16
6400Cold_Turkey_Installer.tmpC:\Program Files\Cold Turkey\is-PSQJP.tmpbinary
MD5:9F9FEF0EF707D3B2DCAB79428390B9BE
SHA256:C304EF695BB3A6220ED56E6FD3B0539CED6EE20A90AD9D1237876B46F71D1A16
6400Cold_Turkey_Installer.tmpC:\Program Files\Cold Turkey\Cold Turkey Blocker.exeexecutable
MD5:63749ED774E00D7C42697BBFF53782DA
SHA256:0E609F514B197A41F4AB88DD537F47018108E0336104F8C91168F4FDA5148420
6400Cold_Turkey_Installer.tmpC:\Program Files\Cold Turkey\CTMsgHostChrome.exeexecutable
MD5:51DF1E551B43B86A09473FC5762CEBEE
SHA256:E249DF689FE9949F5DEE35C753787946F3E4C0327C1CE8E6E7DDD8B05C90FC4B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
97
DNS requests
105
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6516
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2112
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2112
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1492
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6936
svchost.exe
HEAD
200
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/d22c7ab6-bcb4-4503-abeb-559fd82e64a8?P1=1726213476&P2=404&P3=2&P4=c0YLdXfq7yRgydbxYEuUu1t3PWAdqZHHUzHwsR%2bJEfBg3GYdcqvdhrnNWEbHhafNOBw3VEvGyPrADDVVYYpz%2bA%3d%3d
unknown
—
—
whitelisted
6936
svchost.exe
GET
206
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/d22c7ab6-bcb4-4503-abeb-559fd82e64a8?P1=1726213476&P2=404&P3=2&P4=c0YLdXfq7yRgydbxYEuUu1t3PWAdqZHHUzHwsR%2bJEfBg3GYdcqvdhrnNWEbHhafNOBw3VEvGyPrADDVVYYpz%2bA%3d%3d
unknown
—
—
whitelisted
6936
svchost.exe
GET
206
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/d22c7ab6-bcb4-4503-abeb-559fd82e64a8?P1=1726213476&P2=404&P3=2&P4=c0YLdXfq7yRgydbxYEuUu1t3PWAdqZHHUzHwsR%2bJEfBg3GYdcqvdhrnNWEbHhafNOBw3VEvGyPrADDVVYYpz%2bA%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
6516
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1356
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6516
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6516
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3260
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1492
svchost.exe
40.126.32.140:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.238
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
login.live.com
  • 40.126.32.140
  • 40.126.32.76
  • 40.126.32.72
  • 20.190.160.20
  • 40.126.32.134
  • 20.190.160.22
  • 40.126.32.136
  • 40.126.32.138
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
getcoldturkey.com
  • 188.114.97.3
  • 188.114.96.3
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted

Threats

No threats detected
Process
Message
ServiceHub.Power.exe
Native library pre-loader is trying to load native SQLite library "C:\Program Files\Cold Turkey\x64\SQLite.Interop.dll"...
ServiceHub.Helper.exe
Native library pre-loader is trying to load native SQLite library "C:\Program Files\Cold Turkey\x64\SQLite.Interop.dll"...
Cold Turkey Blocker.exe
Native library pre-loader is trying to load native SQLite library "C:\Program Files\Cold Turkey\x64\SQLite.Interop.dll"...
CTMsgHostEdge.exe
Native library pre-loader is trying to load native SQLite library "C:\Program Files\Cold Turkey\x86\SQLite.Interop.dll"...
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Cold_Turkey v4.4 Cracked By Abo Jamal.rar