File name:

2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber

Full analysis: https://app.any.run/tasks/a1f544dc-72fe-4ce5-8a8c-08dbb420cef2
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: May 25, 2025, 11:54:06
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
roblox
loader
m0yv
arch-scr
arch-doc
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

08A638FCB7401512970AB7D3A1F810A9

SHA1:

D80BAC32A8CD97F97AEE8CC84E401C74C2DB396B

SHA256:

5A6C13DEB25E8E56E308FFC4F15355BDEC9D61190F84EF6B7A9F01C1F5CC8603

SSDEEP:

98304:hs0H4Oy/n+GffEkBwcinFTy11t/iEzZUHLy0HMPCUHV4s9Yb2m0PbNcrAy+GE5PB:MHL2IRsot

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • M0YV has been detected (YARA)

      • 2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exe (PID: 7456)
      • 2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exe (PID: 7528)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • 2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exe (PID: 7456)
      • 2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exe (PID: 7528)

    • Application launched itself

      • 2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exe (PID: 7456)

    • Executable content was dropped or overwritten

      • 2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exe (PID: 7456)

  • INFO

    • Reads the computer name

      • 2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exe (PID: 7456)
      • 2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exe (PID: 7528)

    • The sample compiled with english language support

      • 2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exe (PID: 7456)

    • Checks supported languages

      • 2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exe (PID: 7456)
      • 2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exe (PID: 7528)

    • Create files in a temporary directory

      • 2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exe (PID: 7528)
      • 2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exe (PID: 7456)

    • Reads the machine GUID from the registry

      • 2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exe (PID: 7528)
      • 2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exe (PID: 7456)

    • Checks proxy server information

      • 2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exe (PID: 7456)
      • 2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exe (PID: 7528)

    • Reads the software policy settings

      • 2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exe (PID: 7528)
      • 2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exe (PID: 7456)

    • Creates files or folders in the user directory

      • 2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exe (PID: 7528)
      • 2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exe (PID: 7456)

    • ROBLOX mutex has been found

      • 2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exe (PID: 7456)

    • Process checks computer location settings

      • 2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exe (PID: 7456)

    • Manual execution by a user

      • wscript.exe (PID: 8092)
      • wscript.exe (PID: 8140)
      • notepad.exe (PID: 8180)
      • notepad.exe (PID: 1676)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 8180)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:09:14 12:20:50+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 14.29
CodeSize: 6079488
InitializedDataSize: 2023936
UninitializedDataSize: -
EntryPoint: 0x566ce2
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.6.0.56113
ProductVersionNumber: 1.6.0.56113
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Roblox Corporation
FileDescription: Roblox
FileVersion: 1, 6, 0, 6740785
LegalCopyright: Copyright © 2020 Roblox Corporation. All rights reserved.
OriginalFileName: Roblox.exe
ProductName: Roblox Bootstrapper
ProductVersion: 1, 6, 0, 6740785
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
131
Monitored processes
8
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #M0YV 2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exe #M0YV 2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exe wscript.exe no specs wscript.exe no specs notepad.exe no specs rundll32.exe no specs slui.exe notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1188C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
1676"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\gamecontrollerdb.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
4408C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7456"C:\Users\admin\Desktop\2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exe" C:\Users\admin\Desktop\2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exe
explorer.exe
User:
admin
Company:
Roblox Corporation
Integrity Level:
MEDIUM
Description:
Roblox
Version:
1, 6, 0, 6740785
Modules
Images
c:\users\admin\desktop\2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
7528C:\Users\admin\Desktop\2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exe --crashpad --no-rate-limit --database=C:\Users\admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\admin\AppData\Local\Temp\crashpad_roblox --url=https://uploads.backtrace.rbx.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=c2ff9cded52b36099a4fc1299e5b87018c9f1b61 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x880,0x884,0x888,0x7f0,0x890,0x1710f74,0x1710f84,0x1710f94C:\Users\admin\Desktop\2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exe
2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exe
User:
admin
Company:
Roblox Corporation
Integrity Level:
MEDIUM
Description:
Roblox
Version:
1, 6, 0, 6740785
Modules
Images
c:\users\admin\desktop\2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
8092"C:\Windows\System32\WScript.exe" C:\Users\admin\Desktop\rofiler.tools.jsC:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
8140"C:\Windows\System32\WScript.exe" C:\Users\admin\Desktop\rofiler.jsC:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
1
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
8180"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\gamecontrollerdb.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
Total events
11 476
Read events
11 463
Write events
13
Delete events
0

Modification events

(PID) Process:(7456) 2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7456) 2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7456) 2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7528) 2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7528) 2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7528) 2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7456) 2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exeKey:HKEY_CURRENT_USER\SOFTWARE\ROBLOX Corporation\Roblox
Operation:writeName:CPath
Value:
C:\Users\admin\AppData\LocalLow\rbxcsettings.rbx
(PID) Process:(7456) 2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exeKey:HKEY_CURRENT_USER\SOFTWARE\ROBLOX Corporation\Environments
Operation:writeName:roblox-player
Value:
roblox-player
(PID) Process:(7456) 2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exeKey:HKEY_CURRENT_USER\SOFTWARE\ROBLOX Corporation\Environments\RobloxPlayer\Channel
Operation:writeName:www.roblox.com
Value:
(PID) Process:(7456) 2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exeKey:HKEY_CURRENT_USER\SOFTWARE\ROBLOX Corporation\Environments\roblox-player
Operation:writeName:curQTStudioVer
Value:
Executable files
3
Suspicious files
33
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
75282025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\BatchIncrement[1].jsonbinary
MD5:BEDBF7D7D69748886E9B48F45C75FBBE
SHA256:B4A55CFD050F4A62B1C4831CA0AB6FFADDE1FE1C3F583917EADE12F8C6726F61
74562025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\WindowsPlayer[1].jsonbinary
MD5:5DA4602569C93DAA3037788112E0CDF0
SHA256:4E97AD516FC0775072BDA2C9320BD4B44F513B46DF2E11656C71754AF134F2CD
74562025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exeC:\Users\admin\AppData\Local\Roblox\Versions\RobloxStudioLauncherBeta.exeexecutable
MD5:E8830D32E2680A1C9B28329A389908A1
SHA256:E62051E03C0664BCF36DF70C19ECCFBD6E9C0787F974566367FE5626DCCF46A4
74562025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\version-e00a4ca39fb04359-rbxPkgManifest[1].txttext
MD5:3872AC03D26E9A440AE6F2FCFA907D87
SHA256:0FF6A0844D51E4C7FAA8054709AF0AFC2B2DD3FC7AFE0EBA33CCE49AC0A5D9FA
74562025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\BatchIncrement[1].jsonbinary
MD5:BEDBF7D7D69748886E9B48F45C75FBBE
SHA256:B4A55CFD050F4A62B1C4831CA0AB6FFADDE1FE1C3F583917EADE12F8C6726F61
74562025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exeC:\Users\admin\AppData\Local\Roblox\Downloads\roblox-player\86a74f3545e704d736c3ebc3e2535c36.part —
MD5:—
SHA256:—
74562025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\BatchIncrement[1].jsonbinary
MD5:BEDBF7D7D69748886E9B48F45C75FBBE
SHA256:B4A55CFD050F4A62B1C4831CA0AB6FFADDE1FE1C3F583917EADE12F8C6726F61
74562025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\BatchIncrement[1].jsonbinary
MD5:BEDBF7D7D69748886E9B48F45C75FBBE
SHA256:B4A55CFD050F4A62B1C4831CA0AB6FFADDE1FE1C3F583917EADE12F8C6726F61
74562025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\version-e00a4ca39fb04359-rbxBootstrapperPkgManifest[1].txttext
MD5:639C87779585B6822C580A048002EC7B
SHA256:6E073B91C3F7ADA4E352F9186BE316F78018C5CC1DD3B608ACF54ED0D094CF21
74562025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exeC:\Users\admin\AppData\Local\Temp\crashpad_roblox\settings.datbinary
MD5:8A245AE2B84146534B1AD46DCCFD4001
SHA256:5F5F7245153E920EF2692606E05D19AA66A5E8933550E0C0F46D042A219DC7AE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
19
TCP/UDP connections
27
DNS requests
20
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.45.109.46:443
https://clientsettingscdn.roblox.com/v2/client-version/WindowsPlayer
unknown
binary
119 b
whitelisted
—
—
GET
200
23.45.109.46:443
https://clientsettingscdn.roblox.com/v2/settings/application/PCClientBootstrapper
unknown
binary
14.2 Kb
whitelisted
—
—
GET
200
13.32.27.4:443
https://setup.rbxcdn.com/version-e00a4ca39fb04359-rbxPkgManifest.txt
unknown
text
1.66 Kb
whitelisted
4172
RUXIMICS.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
13.32.27.39:443
https://setup.rbxcdn.com/version-e00a4ca39fb04359-rbxBootstrapperPkgManifest.txt
unknown
—
—
—
—
—
GET
200
13.32.27.39:443
https://setup.rbxcdn.com/version-e00a4ca39fb04359-rbxInstallerPkgManifest.txt
unknown
—
—
—
—
—
GET
200
23.45.109.46:443
https://clientsettingscdn.roblox.com/v2/client-version/WindowsStudio64
unknown
binary
119 b
whitelisted
4172
RUXIMICS.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
13.32.27.39:443
https://setup.rbxcdn.com/version-6dbf1fd58a49447c-RobloxStudioLauncherBeta.exe
unknown
executable
7.64 Mb
whitelisted
—
—
GET
200
13.32.27.39:443
https://setup.rbxcdn.com/version-e00a4ca39fb04359-content-configs.zip
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4172
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7456
2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exe
23.45.109.46:443
clientsettingscdn.roblox.com
AKAMAI-AS
DE
whitelisted
7456
2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exe
128.116.5.3:443
ephemeralcounters.api.roblox.com
ROBLOX-PRODUCTION
US
whitelisted
7528
2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exe
128.116.5.3:443
ephemeralcounters.api.roblox.com
ROBLOX-PRODUCTION
US
whitelisted
4172
RUXIMICS.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4172
RUXIMICS.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
7456
2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber.exe
13.32.27.4:443
setup.rbxcdn.com
AMAZON-02
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
google.com
  • 142.250.186.78
whitelisted
clientsettingscdn.roblox.com
  • 23.45.109.46
whitelisted
ephemeralcounters.api.roblox.com
  • 128.116.5.3
whitelisted
setup.rbxcdn.qq.com
  • 0.0.0.1
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
clientsettingscdn.roblox.qq.com
  • 0.0.0.1
whitelisted
setup.rbxcdn.com
  • 13.32.27.4
  • 13.32.27.35
  • 13.32.27.22
  • 13.32.27.39
whitelisted
setup-ak.rbxcdn.com
  • 23.48.23.144
  • 23.48.23.156
whitelisted
setup-ll.rbxcdn.com
  • —
whitelisted

Threats

PID
Process
Class
Message
—
—
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
—
—
Potentially Bad Traffic
ET INFO Executable served from Amazon S3
—
—
Misc activity
ET INFO EXE - Served Inline HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-05-25_08a638fcb7401512970ab7d3a1f810a9_amadey_black-basta_coinminer_darkgate_elex_luca-stealer_magniber