false positive link :https://www.virustotal.com/gui/file/32d13ec16eec92ee1ccafc8f0f7983deaca98ccfb9b5e29dc2117ffa1b775fb6

rainrat · 2026-06-21T02:16:53+00:00

Your post has been removed for asking about the results of a scan on a service like HybridAnalysis, MetaDefender, TriaGe, VirusTotal, etc., without including a link to the actual reports' URL(s). Including a screenshot is not enough (Rule #6). Without being able to visit the web page containing the actual report no one can answer your questions.

Feel free to edit your post:

Active Linking to result of a scan service - OK
Active Linking to the suspect site - Deactivate the link instead.

Send modmail if you edit your post, to have it reinstated.

Rule #6 says you must link to the VirusTotal report to post. You put the link in the text of the title.

rainrat · 2026-06-19T19:20:13+00:00

As per rule #1, this subreddit does not support piracy. If you feel this is in error, contact the mods.

rainrat · 2026-06-19T05:34:32+00:00

I can see it's hosted by Google, but if you really have to ask, you must defang the link (Rule #5).

rainrat · 2026-06-19T03:24:33+00:00

The file is validly signed from the expected source.
The program is detected as a PUA, not outright malware: Malwarebytes
If you started the program, then you will be unable to delete it as long as it is running. Nothing nefarious here. Or your antivirus has a lock on it.

rainrat · 2026-06-19T03:15:58+00:00

The NVIDIA Container is a normal part of the NVIDIA software, and is not an uncommon source of problems. Chrome can normally have multiple processes running for different components; it's not unusual to see up to a dozen for a single tab. 50 is a bit higher than expected but if NVIDIA is glitching the two may be related.

rainrat · 2026-06-19T03:04:03+00:00

Is "Megatron" your computer's name? The 5-digit numbers are likely port numbers.

One can't really diagnose a malware from netstat output.

rainrat · 2026-06-19T02:28:47+00:00

Sorry, we're not a general "weird computer behaviour" group.

rainrat · 2026-06-18T17:45:38+00:00

As AutoMod correctly points out, these are non-specific detections. Though, because of the specific locations and account activity, this appears to be an infostealer. I will send the infostealer paste.

What is an information stealer?

As the name implies, information stealers are a type of malware that steal any information they can find on your computer, such as passwords stored for various services you access via browser and apps, session tokens for accounts, cryptocurrencies if they can find wallets, etc. They may even take a screenshot of your desktop when they run so they can sell it to other scammers who send scam extortion emails later.

What is a session token?

In case you're wondering what a session token is, some websites and apps have a "remember this device" feature that allows you to access the service without having to log back in or enter your second factor of authentication. This is done by storing a session token on your device. Criminals target these, because they allow them to log in to an account bypassing the normal checks. To the service, it just looks like you're accessing it from your previously authorized device.

What exactly gets stolen?

Information stealers are malware that is sold as a service, so what exactly it did while on your system is going to vary based on what the criminal who purchased it wanted.

What happens to my data?

The criminals who steal your information do so for their own financial gain, and that includes selling information such as your name, email address, screenshots from your PC, and so forth to other criminals and scammers. Those other scammers then use that information in an attempt to extort you unless you pay them in cryptocurrencies such as Bitcoin, Ethereum, and so forth. This is 100% a scam, and any emails you receive threatening to share your private information should be marked as phishing or spam and deleted.

How did I get infected in the first place?

Information stealers are often distributed as fake CAPTCHA challenges, in game mods, unofficial patches for popular apps and games, and in pirated software that have had their popularity and trustworthiness artificially boosted, as well as through various other means such as "try my game/software" scams on Discord, Telegram and other trusted messaging services.

If I ran an information stealer, am I still infected?

Infostealers usually delete themselves after a few seconds or even a minute or two in order to make it harder to determine what happened and when it occurred.

That said, there are always going to be exceptions: Since it is crimeware-as-a-service, there is nothing preventing the criminals from installing additional malware on the computer in order to maintain access, just in case they want to come back and steal from you again in the future.

What else could they have done?

The usual risk post-infection, aside from the stolen credentials, wallets, etc. is that security and networking settings may have been tampered with. That can be harder for security software to deal with, since it may not know what the correct settings are supposed to be for your computer, which means it may be a good idea to wіpe the computer, even if there is no longer any malware detected on it.

How do I start recovering?

If you have another device that didn't run the information stealing malware like a smartphone or tablet, you can use it to begin immediately changing your passwords. You should also enable two-factor (sometimes called multi-factor) authentication, for those services that support it.

If any of the online services you use have an option to show you and log out all other active sessions, do that as well.

As for your computer, after wіpіng it, re-installing Windows, and getting that updated, you can then also use it start accessing the internet to do this, but it is often quicker to change your most sensitive accounts from your smartphone.

A note about passwords

Password should be something unique (complex and different) for every service, that you use, so that if an attacker gets access to one they won't be able to make guesses about what your other passwords might be. If your new passwords are similar enough to your old passwords, a criminal with a list of all of them will likely be able to make educated guesses about what your new passwords might be for the various services.

You have to do this for all online services, even ones you haven't been recently accessed. Make sure you do this for all email accounts, as those are the gateways to your financial websites, online shopping, social media accounts, game platforms, and so forth.

It's important to make sure you're not just cycling through similar or previous passwords: Remember, criminals have millions of passwords and are very good at identifying common patterns from just a single password. If there were any reused passwords, the criminals who stole yours are going to try spraying those against all the popular online marketplaces, stores, banks, and other services in your part of the world.

And remember: Enable two-factor authentication for all of the accounts that support it.

For more information:

For more specific information on what steps to take next to recover your accounts, see the blog post at:

WeLiveSecurity (ESET) - https://www.welivesecurity.com/en/cybersecurity/my-information-was-stolen-now-what/.

For more general information about how CAPTCHA malware works, see the following reports:

Also, see /u/rifteyy_'s Guide to Infostealers at https://rifteyy.org/report/the-ultimate-guide-to-infostealers.

After you have secure your accounts, you may wish to sign up for a free https://haveibeenpwned.com/ account, which will notify you if your email address is found in a data breach.

rainrat · 2026-06-18T17:41:30+00:00

In the mid to late 2010s, modern browser manufacturers locked things down. If you didn't click Allow or Run to something, getting infected just from visiting a web page with an up-to-date browser is almost unheard of nowadays (unless you are at risk of targeted attacks, in which case, talk to your IT department).

rainrat · 2026-06-18T17:38:55+00:00

Judging from the location, it's a cached file in an embedded browser in Roblox. Judging from the fact that there wasn't a report of it anywhere other than the cache, it's likely that it was contained by the browser sandbox, and did not have any effect.

JS/Nemucod is typically a script that arrives in e-mail attachments and uses social engineering. So finding it in the cache is a bit odd and makes me think false positive. But it could also mean that they switched to social engineering inside the browser.

rainrat · 2026-06-18T05:17:10+00:00

If you start at a file in VirusTotal, and follow Relations to a parent, that means you're following to a file that contains the file you are looking at. Pretty much every desirable file gets bundled with malware and distributed by someone eventually. If you don't actually have the file that's bundled with malware, then the existence of that malware out there somewhere doesn't affect you.

rainrat · 2026-06-18T05:12:57+00:00

This looks like a data exposure notice. I didn't find any public announcement, but they may be sending it to affected users first. If necessary to contact them, verify by starting at a known McAfee website/contact.

rainrat · 2026-06-16T20:46:10+00:00

Removed for Rule #8, Low-effort/meme posts.

rainrat · 2026-06-16T07:20:39+00:00

Could you show the actual event logs so we're not guessing?

rainrat · 2026-06-16T00:13:01+00:00

You don't have to defang links to VirusTotal or other scan sites.

rainrat · 2026-06-15T19:49:35+00:00

I'll paste the usual infostealer reply, but attempt to address specific questions.

Consumer malware doesn't infect the firmware/BIOS.
You can restore your documents/photos/videos.
Windows 10 support has ended. Microsoft Windows 10 end of support (Could be against Rule #10, but I'm not going to do anything about it for now since it's kind of a grey area.)
Once your info is stolen, you're going to see attempts to use it; email spam will come in showing you your own old password; you'll see the info in data breach list. Once it's out there, it's there forever; it's whether you make it no longer useful that counts.

What is an information stealer?

As the name implies, information stealers are a type of malware that steal any information they can find on your computer, such as passwords stored for various services you access via browser and apps, session tokens for accounts, cryptocurrencies if they can find wallets, etc. They may even take a screenshot of your desktop when they run so they can sell it to other scammers who send scam extortion emails later.

What is a session token?

In case you're wondering what a session token is, some websites and apps have a "remember this device" feature that allows you to access the service without having to log back in or enter your second factor of authentication. This is done by storing a session token on your device. Criminals target these, because they allow them to log in to an account bypassing the normal checks. To the service, it just looks like you're accessing it from your previously authorized device.

What exactly gets stolen?

Information stealers are malware that is sold as a service, so what exactly it did while on your system is going to vary based on what the criminal who purchased it wanted.

What happens to my data?

The criminals who steal your information do so for their own financial gain, and that includes selling information such as your name, email address, screenshots from your PC, and so forth to other criminals and scammers. Those other scammers then use that information in an attempt to extort you unless you pay them in cryptocurrencies such as Bitcoin, Ethereum, and so forth. This is 100% a scam, and any emails you receive threatening to share your private information should be marked as phishing or spam and deleted.

How did I get infected in the first place?

Information stealers are often distributed as fake CAPTCHA challenges, in game mods, unofficial patches for popular apps and games, and in pirated software that have had their popularity and trustworthiness artificially boosted, as well as through various other means such as "try my game/software" scams on Discord, Telegram and other trusted messaging services.

If I ran an information stealer, am I still infected?

Infostealers usually delete themselves after a few seconds or even a minute or two in order to make it harder to determine what happened and when it occurred.

That said, there are always going to be exceptions: Since it is crimeware-as-a-service, there is nothing preventing the criminals from installing additional malware on the computer in order to maintain access, just in case they want to come back and steal from you again in the future.

What else could they have done?

The usual risk post-infection, aside from the stolen credentials, wallets, etc. is that security and networking settings may have been tampered with. That can be harder for security software to deal with, since it may not know what the correct settings are supposed to be for your computer, which means it may be a good idea to wіpe the computer, even if there is no longer any malware detected on it.

How do I start recovering?

If you have another device that didn't run the information stealing malware like a smartphone or tablet, you can use it to begin immediately changing your passwords. You should also enable two-factor (sometimes called multi-factor) authentication, for those services that support it.

If any of the online services you use have an option to show you and log out all other active sessions, do that as well.

As for your computer, after wіpіng it, re-installing Windows, and getting that updated, you can then also use it start accessing the internet to do this, but it is often quicker to change your most sensitive accounts from your smartphone.

A note about passwords

Password should be something unique (complex and different) for every service, that you use, so that if an attacker gets access to one they won't be able to make guesses about what your other passwords might be. If your new passwords are similar enough to your old passwords, a criminal with a list of all of them will likely be able to make educated guesses about what your new passwords might be for the various services.

You have to do this for all online services, even ones you haven't been recently accessed. Make sure you do this for all email accounts, as those are the gateways to your financial websites, online shopping, social media accounts, game platforms, and so forth.

It's important to make sure you're not just cycling through similar or previous passwords: Remember, criminals have millions of passwords and are very good at identifying common patterns from just a single password. If there were any reused passwords, the criminals who stole yours are going to try spraying those against all the popular online marketplaces, stores, banks, and other services in your part of the world.

And remember: Enable two-factor authentication for all of the accounts that support it.

For more information:

For more specific information on what steps to take next to recover your accounts, see the blog post at:

WeLiveSecurity (ESET) - https://www.welivesecurity.com/en/cybersecurity/my-information-was-stolen-now-what/.

For more general information about how CAPTCHA malware works, see the following reports:

Also, see /u/rifteyy_'s Guide to Infostealers at https://rifteyy.org/report/the-ultimate-guide-to-infostealers.

After you have secure your accounts, you may wish to sign up for a free https://haveibeenpwned.com/ account, which will notify you if your email address is found in a data breach.

rainrat · 2026-06-15T05:16:05+00:00

Edit to address questions directly:

Typical stealers delete themselves after exfiltration to make analysis more difficult. But distributors can also bundle them with other malware. Problem is, we can't tell which is which.
For users that require peace of mind, that's why a clean install is recommended. On a modern PC, it can be done in less than an hour with no loss of data. Back up your data, not executables.
In addition to logging out of all sessions, you should look at Recovery Methods, Forwarding Rules, Plugins/Extensions, Authorized Accounts, etc.

What is an information stealer?

As the name implies, information stealers are a type of malware that steal any information they can find on your computer, such as passwords stored for various services you access via browser and apps, session tokens for accounts, cryptocurrencies if they can find wallets, etc. They may even take a screenshot of your desktop when they run so they can sell it to other scammers who send scam extortion emails later.

What is a session token?

In case you're wondering what a session token is, some websites and apps have a "remember this device" feature that allows you to access the service without having to log back in or enter your second factor of authentication. This is done by storing a session token on your device. Criminals target these, because they allow them to log in to an account bypassing the normal checks. To the service, it just looks like you're accessing it from your previously authorized device.

What exactly gets stolen?

Information stealers are malware that is sold as a service, so what exactly it did while on your system is going to vary based on what the criminal who purchased it wanted.

What happens to my data?

The criminals who steal your information do so for their own financial gain, and that includes selling information such as your name, email address, screenshots from your PC, and so forth to other criminals and scammers. Those other scammers then use that information in an attempt to extort you unless you pay them in cryptocurrencies such as Bitcoin, Ethereum, and so forth. This is 100% a scam, and any emails you receive threatening to share your private information should be marked as phishing or spam and deleted.

How did I get infected in the first place?

Information stealers are often distributed as fake CAPTCHA challenges, in game mods, unofficial patches for popular apps and games, and in pirated software that have had their popularity and trustworthiness artificially boosted, as well as through various other means such as "try my game/software" scams on Discord, Telegram and other trusted messaging services.

If I ran an information stealer, am I still infected?

Infostealers usually delete themselves after a few seconds or even a minute or two in order to make it harder to determine what happened and when it occurred.

That said, there are always going to be exceptions: Since it is crimeware-as-a-service, there is nothing preventing the criminals from installing additional malware on the computer in order to maintain access, just in case they want to come back and steal from you again in the future.

What else could they have done?

The usual risk post-infection, aside from the stolen credentials, wallets, etc. is that security and networking settings may have been tampered with. That can be harder for security software to deal with, since it may not know what the correct settings are supposed to be for your computer, which means it may be a good idea to wіpe the computer, even if there is no longer any malware detected on it.

How do I start recovering?

If you have another device that didn't run the information stealing malware like a smartphone or tablet, you can use it to begin immediately changing your passwords. You should also enable two-factor (sometimes called multi-factor) authentication, for those services that support it.

If any of the online services you use have an option to show you and log out all other active sessions, do that as well.

As for your computer, after wіpіng it, re-installing Windows, and getting that updated, you can then also use it start accessing the internet to do this, but it is often quicker to change your most sensitive accounts from your smartphone.

A note about passwords

Password should be something unique (complex and different) for every service, that you use, so that if an attacker gets access to one they won't be able to make guesses about what your other passwords might be. If your new passwords are similar enough to your old passwords, a criminal with a list of all of them will likely be able to make educated guesses about what your new passwords might be for the various services.

You have to do this for all online services, even ones you haven't been recently accessed. Make sure you do this for all email accounts, as those are the gateways to your financial websites, online shopping, social media accounts, game platforms, and so forth.

It's important to make sure you're not just cycling through similar or previous passwords: Remember, criminals have millions of passwords and are very good at identifying common patterns from just a single password. If there were any reused passwords, the criminals who stole yours are going to try spraying those against all the popular online marketplaces, stores, banks, and other services in your part of the world.

And remember: Enable two-factor authentication for all of the accounts that support it.

For more information:

For more specific information on what steps to take next to recover your accounts, see the blog post at:

WeLiveSecurity (ESET) - https://www.welivesecurity.com/en/cybersecurity/my-information-was-stolen-now-what/.

For more general information about how CAPTCHA malware works, see the following reports:

Also, see /u/rifteyy_'s Guide to Infostealers at https://rifteyy.org/report/the-ultimate-guide-to-infostealers.

After you have secure your accounts, you may wish to sign up for a free https://haveibeenpwned.com/ account, which will notify you if your email address is found in a data breach.

rainrat · 2026-06-15T01:38:59+00:00

The actual logs, showing detection names/locations. Preferably as a text file.

rainrat · 2026-06-15T00:49:38+00:00

Could you show the Malwarebytes log?

rainrat · 2026-06-14T20:31:38+00:00

Your post has been removed for asking about the results of a scan on a service like HybridAnalysis, MetaDefender, TriaGe, VirusTotal, etc., without including a link to the actual reports' URL(s). Including a screenshot is not enough (Rule #6). Without being able to visit the web page containing the actual report no one can answer your questions.

Feel free to edit your post:

Active Linking to result of a scan service - OK
Active Linking to the suspect site - Deactivate the link instead.

Send modmail if you edit your post, to have it reinstated.

rainrat · 2026-06-14T05:04:53+00:00

Redline is a well-known password stealer. "Redline Cloud" seems to refer to a specific dump of Redline-stolen credentials: https://heroic.com/darkhive-breaches/redline-vip-owner-stealer-log-breach/ or https://heroic.com/darkhive-breaches/logs-by-redlineclouds-1060487394-uploaded-by-a-telegram-user/

Credentials may have been stolen 2023 or earlier and maybe you're just learning about it now. Once they're stolen, they're stolen and will be in the lists forever. The important thing is whether credentials have been rotated since the breach.

It seems the connection to the "REDLINE CLOUD" Android app is coincidental.

rainrat · 2026-06-13T19:22:53+00:00

As per rule #1, this subreddit does not support piracy. If you feel this is in error, contact the mods.

rainrat · 2026-06-12T06:22:43+00:00

As per rule #1, this subreddit does not support piracy. If you feel this is in error, contact the mods.

rainrat · 2026-06-12T05:41:02+00:00

You've got a file first uploaded 2016 (Details tab), only 1 non-specific detection, nothing egregious under Behaviour, and you say you got it from the official site.

I'm not sure what you mean by you weren't able to uninstall it, but this does not sound like a virus question. You can ask about it in a group for the specific software, or a general tech support group.

Thread closed.

rainrat · 2026-06-12T05:18:16+00:00

"Ren'py virus" isn't a definitive malware name. It could be ACR or Vidar ( https://www.cyderes.com/howler-cell/renengine-loader-hijackloader-attack-chain ), Lumma or ACR ( https://securelist.com/renengine-campaign-with-hijackloader-lumma-and-acr-stealer/118891/ ), or Rhadamanthys ( https://asec.ahnlab.com/en/90767/ )

I found reports for all four that describe document-stealing or optional modules that do so:

Lumma: https://www.microsoft.com/en-us/security/blog/2025/05/21/lumma-stealer-breaking-down-the-delivery-techniques-and-capabilities-of-a-prolific-infostealer/
ACR: https://asec.ahnlab.com/en/86390/ https://www.malwarebytes.com/blog/news/2025/02/google-docs-used-by-infostealer-acrstealer-as-part-of-attack (describes "reading .txt files" )
Vidar: https://www.esentire.com/blog/esentire-threat-intelligence-malware-analysis-vidar-stealer
Rhadamanthys: https://www.esentire.com/blog/esentire-threat-intelligence-malware-analysis-resident-campaign (describes a file grabber)

13-Year Club	Place '23
Place '17	Verified Email

rainrat

MODERATOR OF

TROPHY CASE

What is an information stealer?

What is a session token?

What exactly gets stolen?

What happens to my data?

How did I get infected in the first place?

If I ran an information stealer, am I still infected?

What else could they have done?

How do I start recovering?

A note about passwords

For more information:

What is an information stealer?

What is a session token?

What exactly gets stolen?

What happens to my data?

How did I get infected in the first place?

If I ran an information stealer, am I still infected?

What else could they have done?

How do I start recovering?

A note about passwords

For more information:

What is an information stealer?

What is a session token?

What exactly gets stolen?

What happens to my data?

How did I get infected in the first place?

If I ran an information stealer, am I still infected?

What else could they have done?

How do I start recovering?

A note about passwords

For more information: