Joe Sandbox Cloud Basic

Want to search on specific fields?


Try our:

Advanced Search

Want to search in depth on all Cloud Basic reports?

Try: Joe Sandbox View

Register Login
sloganpng
top title background image
flash

w4XFffGDz1.exe

Status: finished
Submission Time: 2024-06-15 20:21:09 +02:00
Malicious
Trojan
Spyware
Evader
RedLine

Comments

Tags

  • exe
  • RedLineStealer

Details

  • Analysis ID:
    1457840
  • API (Web) ID:
    1457840
  • Original Filename:
    2185ecde5380054ad075b7a25ae0ea51.exe
  • Analysis Started:
    2024-06-15 20:21:09 +02:00
  • Analysis Finished:
    2024-06-15 20:30:48 +02:00
  • MD5:
    2185ecde5380054ad075b7a25ae0ea51
  • SHA1:
    caa1b832574fc3050af5f97b6deabc21398b5c47
  • SHA256:
    e1a01751d2ea4682e211983eb7d6d1f01876a1199ba8eb9f04e3b8594f2ee199
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
Full Report Management Report IOC Report
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

Open Full Report
malicious
Score: 49/73
malicious
Score: 21/24

IPs

IP Country Detection
45.137.22.67
 Netherlands

Domains

Name IP Detection
api.ip.sb
 0.0.0.0

URLs

Name Detection
https://ipinfo.io/ip%appdata%
http://45.137.22.67:55615/
https://api.ipify.orgcookies//settinString.Removeg
Click to see the 37 hidden entries
45.137.22.67:55615
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
https://www.chiark.greenend.org.uk/~sgtatham/putty/0
http://tempuri.org/Endpoint/SetEnvironment
http://tempuri.org/Endpoint/SetEnvironmentResponse
http://tempuri.org/Endpoint/GetUpdates
https://ac.ecosia.org/autocomplete?q=
http://schemas.xmlsoap.org/ws/2004/08/addressing
http://tempuri.org/Endpoint/GetUpdatesResponse
https://www.ecosia.org/newtab/
http://tempuri.org/Endpoint/EnvironmentSettingsResponse
http://tempuri.org/Endpoint/VerifyUpdate
http://tempuri.org/0
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
http://45.137.22.67:55615t-
http://schemas.xmlsoap.org/soap/actor/next
http://www.aforgenet.com/framework/
https://api.ip.sb/geoip%USERPEnvironmentROFILE%
http://45.137.22.67:55615
https://duckduckgo.com/chrome_newtab
https://duckduckgo.com/ac/?q=
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
http://tempuri.org/Endpoint/CheckConnectResponse
http://schemas.datacontract.org/2004/07/
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX
http://tempuri.org/Endpoint/EnvironmentSettings
http://tempuri.org/Endpoint/VerifyUpdateResponse
https://api.ip.sb
https://api.ip.sb/geoip
http://schemas.xmlsoap.org/soap/envelope/
http://www.w3.or
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
http://tempuri.org/
http://tempuri.org/Endpoint/CheckConnect
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Temp\RarSFX0\PO.exe
 PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\tmp61B0.tmp
 XML 1.0 document, ASCII text
 #
C:\Users\user\AppData\Roaming\AJzHYZtQIb.exe
 PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
 #
Click to see the 101 hidden entries
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AJzHYZtQIb.exe.log
 ASCII text, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO.exe.log
 ASCII text, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
 data
 #
C:\Users\user\AppData\Local\Temp\RarSFX0\PO.jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 390x552, components 3
 #
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2fxchldq.gpv.psm1
 ASCII text, with no line terminators
 #
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c5dgxrmw.020.psm1
 ASCII text, with no line terminators
 #
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jj5kt24d.bgw.psm1
 ASCII text, with no line terminators
 #
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ncpykx4c.cxo.ps1
 ASCII text, with no line terminators
 #
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ojbysllk.cf1.psm1
 ASCII text, with no line terminators
 #
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ucbzawq5.ay1.ps1
 ASCII text, with no line terminators
 #
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vvrkyg5q.p2h.ps1
 ASCII text, with no line terminators
 #
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vxmgtnbz.hkb.ps1
 ASCII text, with no line terminators
 #
C:\Users\user\AppData\Local\Temp\tmp10A5.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
 #
C:\Users\user\AppData\Local\Temp\tmp10C5.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
 #
C:\Users\user\AppData\Local\Temp\tmp10D6.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
 #
C:\Users\user\AppData\Local\Temp\tmp10F6.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
 #
C:\Users\user\AppData\Local\Temp\tmp1107.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
 #
C:\Users\user\AppData\Local\Temp\tmp21E5.tmp
 SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
 #
C:\Users\user\AppData\Local\Temp\tmp2BA8.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
 #
C:\Users\user\AppData\Local\Temp\tmp2BB9.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
 #
C:\Users\user\AppData\Local\Temp\tmp2BD9.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
 #
C:\Users\user\AppData\Local\Temp\tmp2BDA.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
 #
C:\Users\user\AppData\Local\Temp\tmp2BFA.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
 #
C:\Users\user\AppData\Local\Temp\tmp2F6.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
 #
C:\Users\user\AppData\Local\Temp\tmp306.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
 #
C:\Users\user\AppData\Local\Temp\tmp327.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
 #
C:\Users\user\AppData\Local\Temp\tmp337.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
 #
C:\Users\user\AppData\Local\Temp\tmp348.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
 #
C:\Users\user\AppData\Local\Temp\tmp358.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
 #
C:\Users\user\AppData\Local\Temp\tmp369.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
 #
C:\Users\user\AppData\Local\Temp\tmp3799.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
 #
C:\Users\user\AppData\Local\Temp\tmp37AA.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
 #
C:\Users\user\AppData\Local\Temp\tmp37BB.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
 #
C:\Users\user\AppData\Local\Temp\tmp37CB.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
 #
C:\Users\user\AppData\Local\Temp\tmp37DC.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
 #
C:\Users\user\AppData\Local\Temp\tmp37FC.tmp
 SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
 #
C:\Users\user\AppData\Local\Temp\tmp380D.tmp
 SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
 #
C:\Users\user\AppData\Local\Temp\tmp4825.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
 #
C:\Users\user\AppData\Local\Temp\tmp4836.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
 #
C:\Users\user\AppData\Local\Temp\tmp4856.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
 #
C:\Users\user\AppData\Local\Temp\tmp4876.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
 #
C:\Users\user\AppData\Local\Temp\tmp4887.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
 #
C:\Users\user\AppData\Local\Temp\tmp621E.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
 #
C:\Users\user\AppData\Local\Temp\tmp623F.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
 #
C:\Users\user\AppData\Local\Temp\tmp624F.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
 #
C:\Users\user\AppData\Local\Temp\tmp6270.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
 #
C:\Users\user\AppData\Local\Temp\tmp6280.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
 #
C:\Users\user\AppData\Local\Temp\tmp6291.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
 #
C:\Users\user\AppData\Local\Temp\tmp7F38.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
 #
C:\Users\user\AppData\Local\Temp\tmp7F58.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
 #
C:\Users\user\AppData\Local\Temp\tmp7F78.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
 #
C:\Users\user\AppData\Local\Temp\tmp7F89.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
 #
C:\Users\user\AppData\Local\Temp\tmp7F8A.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
 #
C:\Users\user\AppData\Local\Temp\tmp7F9B.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
 #
C:\Users\user\AppData\Local\Temp\tmp8574.tmp
 XML 1.0 document, ASCII text
 #
C:\Users\user\AppData\Local\Temp\tmp9838.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
 #
C:\Users\user\AppData\Local\Temp\tmp9858.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
 #
C:\Users\user\AppData\Local\Temp\tmp9869.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
 #
C:\Users\user\AppData\Local\Temp\tmp9889.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
 #
C:\Users\user\AppData\Local\Temp\tmp989A.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
 #
C:\Users\user\AppData\Local\Temp\tmp98BA.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
 #
C:\Users\user\AppData\Local\Temp\tmp9F36.tmp
 ASCII text, with very long lines (1024), with CRLF line terminators
 #
C:\Users\user\AppData\Local\Temp\tmp9F46.tmp
 ASCII text, with very long lines (1024), with CRLF line terminators
 #
C:\Users\user\AppData\Local\Temp\tmp9F47.tmp
 ASCII text, with very long lines (1024), with CRLF line terminators
 #
C:\Users\user\AppData\Local\Temp\tmp9F58.tmp
 ASCII text, with very long lines (1024), with CRLF line terminators
 #
C:\Users\user\AppData\Local\Temp\tmp9F59.tmp
 ASCII text, with very long lines (1024), with CRLF line terminators
 #
C:\Users\user\AppData\Local\Temp\tmp9F5A.tmp
 ASCII text, with very long lines (1024), with CRLF line terminators
 #
C:\Users\user\AppData\Local\Temp\tmpA0AE.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
 #
C:\Users\user\AppData\Local\Temp\tmpA0BE.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
 #
C:\Users\user\AppData\Local\Temp\tmpB5DE.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
 #
C:\Users\user\AppData\Local\Temp\tmpB5EF.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
 #
C:\Users\user\AppData\Local\Temp\tmpB600.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
 #
C:\Users\user\AppData\Local\Temp\tmpB610.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
 #
C:\Users\user\AppData\Local\Temp\tmpB621.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
 #
C:\Users\user\AppData\Local\Temp\tmpB631.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
 #
C:\Users\user\AppData\Local\Temp\tmpB642.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
 #
C:\Users\user\AppData\Local\Temp\tmpBA4F.tmp
 ASCII text, with very long lines (1024), with CRLF line terminators
 #
C:\Users\user\AppData\Local\Temp\tmpBA60.tmp
 ASCII text, with very long lines (1024), with CRLF line terminators
 #
C:\Users\user\AppData\Local\Temp\tmpBA61.tmp
 ASCII text, with very long lines (1024), with CRLF line terminators
 #
C:\Users\user\AppData\Local\Temp\tmpBA71.tmp
 ASCII text, with very long lines (1024), with CRLF line terminators
 #
C:\Users\user\AppData\Local\Temp\tmpBA72.tmp
 ASCII text, with very long lines (1024), with CRLF line terminators
 #
C:\Users\user\AppData\Local\Temp\tmpBA73.tmp
 ASCII text, with very long lines (1024), with CRLF line terminators
 #
C:\Users\user\AppData\Local\Temp\tmpCDE5.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
 #
C:\Users\user\AppData\Local\Temp\tmpCDF5.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
 #
C:\Users\user\AppData\Local\Temp\tmpCE06.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
 #
C:\Users\user\AppData\Local\Temp\tmpCE16.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
 #
C:\Users\user\AppData\Local\Temp\tmpCE27.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
 #
C:\Users\user\AppData\Local\Temp\tmpCE38.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
 #
C:\Users\user\AppData\Local\Temp\tmpCE48.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
 #
C:\Users\user\AppData\Local\Temp\tmpD8D7.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
 #
C:\Users\user\AppData\Local\Temp\tmpD8D8.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
 #
C:\Users\user\AppData\Local\Temp\tmpD8F8.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
 #
C:\Users\user\AppData\Local\Temp\tmpD909.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
 #
C:\Users\user\AppData\Local\Temp\tmpD919.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
 #
C:\Users\user\AppData\Local\Temp\tmpEC18.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
 #
C:\Users\user\AppData\Local\Temp\tmpEC29.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
 #
C:\Users\user\AppData\Local\Temp\tmpEC3A.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
 #
C:\Users\user\AppData\Local\Temp\tmpEC4A.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
 #
C:\Users\user\AppData\Local\Temp\tmpEC5B.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
 #
C:\Users\user\AppData\Local\Temp\tmpEC6B.tmp
 SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
 #
C:\Users\user\AppData\Local\Temp\tmpEC7C.tmp
 SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
 #