File name:

2025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber

Full analysis: https://app.any.run/tasks/cd04d75a-4e81-4bf9-bf1c-39fa3dec7bb3
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: May 30, 2025, 21:21:19
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
roblox
loader
arch-scr
arch-doc
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

F08323C75999D01776A114530DEB1FA5

SHA1:

F1E93A9FD4A83C1A8B440D33E7B6670D5D6722AF

SHA256:

84791D8D70199F43B049C9948129ED1DAE24583A51977F5879ADE17130B7FD5D

SSDEEP:

98304:qs0H4Oy/n+GffEkBwcinFTy11t/iEzZUHLy0HMPCUHV4s9Yb2m0PbNcrAy+GE5Pk:ZHL2mRsoo

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Application launched itself

      • 2025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exe (PID: 4892)
      • RobloxPlayerLauncher.exe (PID: 5548)

    • Reads security settings of Internet Explorer

      • 2025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exe (PID: 4892)
      • 2025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exe (PID: 6032)
      • RobloxPlayerLauncher.exe (PID: 5548)
      • RobloxPlayerLauncher.exe (PID: 5452)

    • Executable content was dropped or overwritten

      • 2025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exe (PID: 4892)
      • RobloxPlayerLauncher.exe (PID: 5548)

  • INFO

    • Checks supported languages

      • 2025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exe (PID: 4892)
      • 2025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exe (PID: 6032)
      • RobloxPlayerLauncher.exe (PID: 5452)
      • RobloxPlayerLauncher.exe (PID: 5548)

    • The sample compiled with english language support

      • 2025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exe (PID: 4892)
      • RobloxPlayerLauncher.exe (PID: 5548)

    • Reads the computer name

      • 2025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exe (PID: 4892)
      • 2025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exe (PID: 6032)
      • RobloxPlayerLauncher.exe (PID: 5548)
      • RobloxPlayerLauncher.exe (PID: 5452)

    • Create files in a temporary directory

      • 2025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exe (PID: 4892)
      • 2025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exe (PID: 6032)
      • RobloxPlayerLauncher.exe (PID: 5548)
      • RobloxPlayerLauncher.exe (PID: 5452)

    • Reads the software policy settings

      • 2025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exe (PID: 4892)
      • 2025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exe (PID: 6032)
      • RobloxPlayerLauncher.exe (PID: 5548)
      • RobloxPlayerLauncher.exe (PID: 5452)
      • slui.exe (PID: 7296)

    • Checks proxy server information

      • 2025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exe (PID: 4892)
      • 2025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exe (PID: 6032)
      • RobloxPlayerLauncher.exe (PID: 5548)
      • RobloxPlayerLauncher.exe (PID: 5452)
      • slui.exe (PID: 7296)

    • Creates files or folders in the user directory

      • 2025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exe (PID: 4892)
      • 2025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exe (PID: 6032)
      • RobloxPlayerLauncher.exe (PID: 5452)
      • RobloxPlayerLauncher.exe (PID: 5548)

    • ROBLOX mutex has been found

      • 2025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exe (PID: 4892)
      • RobloxPlayerLauncher.exe (PID: 5548)

    • Reads the machine GUID from the registry

      • 2025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exe (PID: 6032)
      • 2025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exe (PID: 4892)
      • RobloxPlayerLauncher.exe (PID: 5548)
      • RobloxPlayerLauncher.exe (PID: 5452)

    • Process checks computer location settings

      • 2025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exe (PID: 4892)
      • RobloxPlayerLauncher.exe (PID: 5548)

    • Manual execution by a user

      • wscript.exe (PID: 856)
      • wscript.exe (PID: 5216)
      • notepad.exe (PID: 7212)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 7212)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:09:14 12:20:50+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 14.29
CodeSize: 6079488
InitializedDataSize: 2023936
UninitializedDataSize: -
EntryPoint: 0x566ce2
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.6.0.56113
ProductVersionNumber: 1.6.0.56113
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Roblox Corporation
FileDescription: Roblox
FileVersion: 1, 6, 0, 6740785
LegalCopyright: Copyright © 2020 Roblox Corporation. All rights reserved.
OriginalFileName: Roblox.exe
ProductName: Roblox Bootstrapper
ProductVersion: 1, 6, 0, 6740785
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
129
Monitored processes
9
Malicious processes
0
Suspicious processes
2

Behavior graph

Click at the process to see the details
start 2025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exe 2025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exe robloxplayerlauncher.exe robloxplayerlauncher.exe slui.exe wscript.exe no specs wscript.exe no specs notepad.exe no specs rundll32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
856"C:\Windows\System32\WScript.exe" C:\Users\admin\Desktop\rofiler.tools.jsC:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
1
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4892"C:\Users\admin\Desktop\2025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exe" C:\Users\admin\Desktop\2025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exe
explorer.exe
User:
admin
Company:
Roblox Corporation
Integrity Level:
MEDIUM
Description:
Roblox
Exit code:
0
Version:
1, 6, 0, 6740785
Modules
Images
c:\users\admin\desktop\2025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
5216"C:\Windows\System32\WScript.exe" C:\Users\admin\Desktop\rofiler.jsC:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
1
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5452C:\Users\admin\AppData\Local\Temp\RBX-C0687106\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\admin\AppData\Local\Temp\crashpad_roblox --url=https://uploads.backtrace.rbx.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=b278822f36fd45e9eab3abeddc4c95d8f86f7bce --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x794,0x798,0x79c,0x73c,0x7a4,0x1c7d074,0x1c7d084,0x1c7d094C:\Users\admin\AppData\Local\Temp\RBX-C0687106\RobloxPlayerLauncher.exe
RobloxPlayerLauncher.exe
User:
admin
Company:
Roblox Corporation
Integrity Level:
MEDIUM
Description:
Roblox
Version:
1, 6, 0, 6750715
Modules
Images
c:\users\admin\appdata\local\temp\rbx-c0687106\robloxplayerlauncher.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
5548"C:\Users\admin\AppData\Local\Temp\RBX-C0687106\RobloxPlayerLauncher.exe" C:\Users\admin\AppData\Local\Temp\RBX-C0687106\RobloxPlayerLauncher.exe
2025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exe
User:
admin
Company:
Roblox Corporation
Integrity Level:
MEDIUM
Description:
Roblox
Version:
1, 6, 0, 6750715
Modules
Images
c:\users\admin\appdata\local\temp\rbx-c0687106\robloxplayerlauncher.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
6032C:\Users\admin\Desktop\2025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exe --crashpad --no-rate-limit --database=C:\Users\admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\admin\AppData\Local\Temp\crashpad_roblox --url=https://uploads.backtrace.rbx.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=c2ff9cded52b36099a4fc1299e5b87018c9f1b61 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x854,0x858,0x868,0x85c,0x894,0x13b0f74,0x13b0f84,0x13b0f94C:\Users\admin\Desktop\2025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exe
2025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exe
User:
admin
Company:
Roblox Corporation
Integrity Level:
MEDIUM
Description:
Roblox
Exit code:
0
Version:
1, 6, 0, 6740785
Modules
Images
c:\users\admin\desktop\2025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
6644C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
7212"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\gamecontrollerdb.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
7296C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
18 467
Read events
18 448
Write events
19
Delete events
0

Modification events

(PID) Process:(4892) 2025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4892) 2025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4892) 2025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6032) 2025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6032) 2025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6032) 2025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4892) 2025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exeKey:HKEY_CURRENT_USER\SOFTWARE\ROBLOX Corporation\Roblox
Operation:writeName:CPath
Value:
C:\Users\admin\AppData\LocalLow\rbxcsettings.rbx
(PID) Process:(5548) RobloxPlayerLauncher.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5548) RobloxPlayerLauncher.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5548) RobloxPlayerLauncher.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
5
Suspicious files
28
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
48922025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\BatchIncrement[1].jsonbinary
MD5:BEDBF7D7D69748886E9B48F45C75FBBE
SHA256:B4A55CFD050F4A62B1C4831CA0AB6FFADDE1FE1C3F583917EADE12F8C6726F61
48922025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\WindowsPlayer[1].jsonbinary
MD5:3390D24BBA35DDBE6586F74603CB81C4
SHA256:FA218440603861F17251FDF4D4440B8E2A9954ECC4E2CAA43053DE90FFDE17BF
48922025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exeC:\Users\admin\AppData\Local\Temp\crashpad_roblox\settings.datbinary
MD5:529E906FD862755E16BF1D6F755CC9E7
SHA256:A848EA1F53273BEFEB09AEBF1684AE3B6AE4EF868147BA1D33A6A047CA666F76
60322025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\BatchIncrement[1].jsonbinary
MD5:BEDBF7D7D69748886E9B48F45C75FBBE
SHA256:B4A55CFD050F4A62B1C4831CA0AB6FFADDE1FE1C3F583917EADE12F8C6726F61
48922025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\PCClientBootstrapper[1].jsonbinary
MD5:BDAF093967ED523E97B426F9DDC18800
SHA256:E10FA38477A5566AC0B44B936C5E2805CCA42AB0A289EB7A3C32DDFB27676793
48922025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\version-ad3ee47cdc5e44f6-rbxInstallerPkgManifest[1].txttext
MD5:BD8846ED7958562EB6180AAE74C56BA6
SHA256:8FD030CC6908518ED59621C408D5AAA3F4882AD71AB91EF83037845A5952CBE4
48922025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\version-ad3ee47cdc5e44f6-rbxPkgManifest[1].txttext
MD5:F3C709C22B3F1DC8C732BE0628D2B400
SHA256:D74A90C9BCB9759A4BDA4D1821962697220B6046DB5DAD17DBAFB705E41FAD4C
48922025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\RobloxPlayerLauncher[1].exeexecutable
MD5:4F2100DE124F2471A636AFB019129A39
SHA256:4D3ABB8B332952B99B33EFF3FA8AA764FDCA7ECC0B11BCA770C28B82E6C5ADC5
5548RobloxPlayerLauncher.exeC:\Users\admin\AppData\Local\Roblox\Downloads\roblox-player\f62f7d645c32934c6f4bf3cfd9de4562.part —
MD5:—
SHA256:—
48922025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\BatchAddToSequencesV2[1].jsonbinary
MD5:BEDBF7D7D69748886E9B48F45C75FBBE
SHA256:B4A55CFD050F4A62B1C4831CA0AB6FFADDE1FE1C3F583917EADE12F8C6726F61
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
32
DNS requests
25
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.41.252.19:443
https://clientsettingscdn.roblox.com/v2/settings/application/PCClientBootstrapper
unknown
binary
13.1 Kb
whitelisted
472
RUXIMICS.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
472
RUXIMICS.exe
GET
200
23.48.23.192:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.41.252.19:443
https://clientsettingscdn.roblox.com/v2/client-version/WindowsPlayer
unknown
binary
119 b
whitelisted
—
—
GET
200
23.48.23.144:443
https://setup.rbxcdn.com/version-ad3ee47cdc5e44f6-rbxPkgManifest.txt
unknown
text
1.66 Kb
whitelisted
—
—
GET
200
23.48.23.156:443
https://setup.rbxcdn.com/version-ad3ee47cdc5e44f6-rbxBootstrapperPkgManifest.txt
unknown
—
—
—
—
—
GET
200
23.48.23.144:443
https://setup.rbxcdn.com/version-ad3ee47cdc5e44f6-rbxInstallerPkgManifest.txt
unknown
—
—
—
—
—
GET
200
23.48.23.156:443
https://setup.rbxcdn.com/version-ad3ee47cdc5e44f6-RobloxPlayerLauncher.exe
unknown
executable
7.72 Mb
whitelisted
—
—
GET
200
23.41.252.19:443
https://clientsettingscdn.roblox.com/v2/client-version/WindowsStudio64
unknown
binary
119 b
whitelisted
—
—
GET
200
23.48.23.144:443
https://setup.rbxcdn.com/version-9a1e7554d93c459d-RobloxStudioLauncherBeta.exe
unknown
executable
7.63 Mb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
472
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4892
2025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exe
23.41.252.19:443
clientsettingscdn.roblox.com
AKAMAI-AS
MX
whitelisted
472
RUXIMICS.exe
23.48.23.192:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
472
RUXIMICS.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4892
2025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exe
128.116.44.3:443
ephemeralcounters.api.roblox.com
ROBLOX-PRODUCTION
US
whitelisted
6032
2025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exe
128.116.44.3:443
ephemeralcounters.api.roblox.com
ROBLOX-PRODUCTION
US
whitelisted
4892
2025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber.exe
23.48.23.156:443
setup.rbxcdn.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
google.com
  • 142.250.186.174
whitelisted
clientsettingscdn.roblox.com
  • 23.41.252.19
whitelisted
crl.microsoft.com
  • 23.48.23.192
  • 23.48.23.173
  • 23.48.23.139
  • 23.48.23.188
  • 23.48.23.174
  • 23.48.23.138
  • 23.48.23.194
  • 23.48.23.190
  • 23.48.23.183
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
ephemeralcounters.api.roblox.com
  • 128.116.44.3
whitelisted
setup.rbxcdn.qq.com
  • 0.0.0.1
whitelisted
clientsettingscdn.roblox.qq.com
  • 0.0.0.1
whitelisted
setup.rbxcdn.com
  • 23.48.23.144
  • 23.48.23.156
whitelisted
setup-ak.rbxcdn.com
  • 23.48.23.144
  • 23.48.23.156
whitelisted

Threats

PID
Process
Class
Message
—
—
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
—
—
Misc activity
ET INFO EXE - Served Inline HTTP
—
—
Potentially Bad Traffic
ET INFO Executable served from Amazon S3
—
—
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
—
—
Misc activity
ET INFO EXE - Served Inline HTTP
—
—
Potentially Bad Traffic
ET INFO Executable served from Amazon S3
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-05-30_f08323c75999d01776a114530deb1fa5_amadey_black-basta_coinminer_darkgate_elex_hijackloader_luca-stealer_magniber