File name:

1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exe

Full analysis: https://app.any.run/tasks/43cc3d11-5146-4314-92e7-982f8cfdbfa5
Verdict: Malicious activity
Threats:

MetaStealer is an info-stealing malware primarily targeting sensitive data like login credentials, payment details, and browser history. It typically infects systems via phishing emails or malicious downloads and can exfiltrate data to a command and control (C2) server. MetaStealer is known for its stealthy techniques, including evasion and persistence mechanisms, which make it difficult to detect. This malware has been actively used in various cyberattacks, particularly for financial theft and credential harvesting from individuals and organizations.

Analysis date: May 16, 2025, 05:42:24
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
redline
netreactor
lefthook
metastealer
teapotstealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

35E36BC22394D7BEDD94E88EB9E1CA7C

SHA1:

B6A90D979E1C1DE5B3154E565E4404B7E2C99794

SHA256:

1814C3FDCBFA0B77749550DD1C4365BE2907EFBDB02ED8F677052C77CBA2F46F

SSDEEP:

24576:iZ9enanQtbhhhm37CpcZP29Di4adyLUJIeqCtbo3Zi1ejHmN7RN6NuTuQx1vBUJR:iZ9enanQtbhhhm37CpcZP29Di4adyLU+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • REDLINE has been detected (SURICATA)

      • 1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exe (PID: 4920)
    • Steals credentials from Web Browsers

      • 1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exe (PID: 4920)
    • Actions looks like stealing of personal data

      • 1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exe (PID: 4920)
    • Stealers network behavior

      • 1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exe (PID: 4920)
    • METASTEALER has been detected (SURICATA)

      • 1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exe (PID: 4920)
    • LEFTHOOK has been detected (SURICATA)

      • 1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exe (PID: 4920)
    • TEAPOT has been detected

      • 1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exe (PID: 4920)
  • SUSPICIOUS

    • Connects to unusual port

      • 1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exe (PID: 4920)
    • Application launched itself

      • 1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exe (PID: 5072)
    • Contacting a server suspected of hosting an CnC

      • 1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exe (PID: 4920)
  • INFO

    • .NET Reactor protector has been detected

      • 1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exe (PID: 5072)
    • Checks supported languages

      • 1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exe (PID: 5072)
      • 1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exe (PID: 4920)
    • Reads the computer name

      • 1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exe (PID: 5072)
      • 1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exe (PID: 4920)
    • Reads the machine GUID from the registry

      • 1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exe (PID: 5072)
      • 1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exe (PID: 4920)
    • Disables trace logs

      • 1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exe (PID: 4920)
    • Checks proxy server information

      • 1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exe (PID: 4920)
    • Reads the software policy settings

      • 1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exe (PID: 4920)
    • Create files in a temporary directory

      • 1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exe (PID: 4920)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2092:11:14 01:06:39+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 541696
InitializedDataSize: 7168
UninitializedDataSize: -
EntryPoint: 0x862e2
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: 先进人工智能平台,提供深度学习、自然语言处理、计算机视觉和知识推理等核心功能
CompanyName: 云梦数智
FileDescription: 灵智·星辰
FileVersion: 0.0.0.0
InternalName: scLQ.exe
LegalCopyright: 云梦数智 © 壬寅年至乙巳年 (2022-2025)
LegalTrademarks: 灵智™ · 星辰系列 · 第五代
OriginalFileName: scLQ.exe
ProductName: 灵智·星辰
ProductVersion: 0.0.0.0
AssemblyVersion: 0.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
130
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exe no specs sppextcomobj.exe no specs slui.exe no specs #REDLINE 1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exe conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
896"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exeSppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2908C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exesvchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
4920"C:\Users\admin\AppData\Local\Temp\1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exe"C:\Users\admin\AppData\Local\Temp\1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exe
1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exe
User:
admin
Company:
云梦数智
Integrity Level:
MEDIUM
Description:
灵智·星辰
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5072"C:\Users\admin\AppData\Local\Temp\1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exe" C:\Users\admin\AppData\Local\Temp\1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exeexplorer.exe
User:
admin
Company:
云梦数智
Integrity Level:
MEDIUM
Description:
灵智·星辰
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5124\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
2 482
Read events
2 468
Write events
14
Delete events
0

Modification events

(PID) Process:(4920) 1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(4920) 1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(4920) 1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4920) 1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(4920) 1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(4920) 1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(4920) 1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(4920) 1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(4920) 1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(4920) 1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
Executable files
0
Suspicious files
36
Text files
0
Unknown types
2

Dropped files

PID
Process
Filename
Type
49201814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exeC:\Users\admin\AppData\Local\Temp\tmp36D2.tmpbinary
MD5:F6C33AC5E1032A0873BE7BFC65169287
SHA256:D97895CEDED32E33D57BDCACCDBE144E58AA87AF4D2F8855D630286CE30A8D83
49201814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exeC:\Users\admin\AppData\Local\Temp\tmp36C1.tmpbinary
MD5:A45465CDCDC6CB30C8906F3DA4EC114C
SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209
49201814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exeC:\Users\admin\AppData\Local\Temp\tmp36AE.tmpbinary
MD5:A45465CDCDC6CB30C8906F3DA4EC114C
SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209
49201814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exeC:\Users\admin\AppData\Local\Temp\tmp36F4.tmpbinary
MD5:F6C33AC5E1032A0873BE7BFC65169287
SHA256:D97895CEDED32E33D57BDCACCDBE144E58AA87AF4D2F8855D630286CE30A8D83
49201814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exeC:\Users\admin\AppData\Local\Temp\tmp36B0.tmpbinary
MD5:A45465CDCDC6CB30C8906F3DA4EC114C
SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209
49201814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exeC:\Users\admin\AppData\Local\Temp\tmp36E3.tmpbinary
MD5:F6C33AC5E1032A0873BE7BFC65169287
SHA256:D97895CEDED32E33D57BDCACCDBE144E58AA87AF4D2F8855D630286CE30A8D83
49201814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exeC:\Users\admin\AppData\Local\Temp\tmp36F3.tmpbinary
MD5:F6C33AC5E1032A0873BE7BFC65169287
SHA256:D97895CEDED32E33D57BDCACCDBE144E58AA87AF4D2F8855D630286CE30A8D83
49201814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exeC:\Users\admin\AppData\Local\Temp\tmp369D.tmpbinary
MD5:A45465CDCDC6CB30C8906F3DA4EC114C
SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209
49201814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exeC:\Users\admin\AppData\Local\Temp\tmp36C2.tmpbinary
MD5:A45465CDCDC6CB30C8906F3DA4EC114C
SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209
49201814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exeC:\Users\admin\AppData\Local\Temp\tmp3717.tmpbinary
MD5:F6C33AC5E1032A0873BE7BFC65169287
SHA256:D97895CEDED32E33D57BDCACCDBE144E58AA87AF4D2F8855D630286CE30A8D83
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
21
DNS requests
14
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
4920
1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exe
POST
200
185.222.57.92:55615
http://185.222.57.92:55615/
unknown
unknown
6712
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
6712
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
4920
1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exe
POST
200
185.222.57.92:55615
http://185.222.57.92:55615/
unknown
unknown
4920
1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exe
POST
200
185.222.57.92:55615
http://185.222.57.92:55615/
unknown
unknown
4920
1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exe
POST
200
185.222.57.92:55615
http://185.222.57.92:55615/
unknown
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
whitelisted
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
whitelisted
2112
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 95.101.149.131
whitelisted
google.com
  • 142.250.185.206
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.159.75
  • 40.126.31.67
  • 40.126.31.128
  • 20.190.159.129
  • 40.126.31.131
  • 40.126.31.73
  • 40.126.31.2
  • 20.190.159.64
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
api.ip.sb
  • 172.67.75.172
  • 104.26.13.31
  • 104.26.12.31
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

PID
Process
Class
Message
4920
1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exe
Malware Command and Control Activity Detected
ET MALWARE RedLine Stealer - CheckConnect Response
4920
1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exe
A Network Trojan was detected
AV TROJAN RedLine Stealer Config Download
4920
1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound
4920
1814c3fdcbfa0b77749550dd1c4365be2907efbdb02ed8f677052c77cba2f46f.exe
A Network Trojan was detected
ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)
No debug info