Overview

overview

8

Static

static

3

2025-01-19...er.exe

windows7-x64

7

2025-01-19...er.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/01/2025, 13:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2025-01-19_07de39f432abc01d7f0ace453c8f5f32_hijackloader_jeefo_luca-stealer_magniber.exe
  • Size 6.8MB
  • Sample250119-ql79fsypgw
  • SHA256 8761fbd5c112d08fbc5286705e01bd5734e50701072a65a2a71b9120f3c7912b
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
discoveryevasionpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
    persistence
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 17 IoCs
  • Loads dropped DLL 15 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Checks system information in the registry 2 TTPs 8 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-01-19_07de39f432abc01d7f0ace453c8f5f32_hijackloader_jeefo_luca-stealer_magniber.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-01-19_07de39f432abc01d7f0ace453c8f5f32_hijackloader_jeefo_luca-stealer_magniber.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2304
    • C:\Windows\svchost.exe
      "C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\2025-01-19_07de39f432abc01d7f0ace453c8f5f32_hijackloader_jeefo_luca-stealer_magniber.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:876
      • C:\Users\Admin\AppData\Local\Temp\2025-01-19_07de39f432abc01d7f0ace453c8f5f32_hijackloader_jeefo_luca-stealer_magniber.exe
        "C:\Users\Admin\AppData\Local\Temp\2025-01-19_07de39f432abc01d7f0ace453c8f5f32_hijackloader_jeefo_luca-stealer_magniber.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • System Location Discovery: System Language Discovery
        • Enumerates system info in registry
        • Modifies Internet Explorer settings
        • Suspicious use of WriteProcessMemory
        PID:5088
        • C:\Users\Admin\AppData\Local\Temp\2025-01-19_07de39f432abc01d7f0ace453c8f5f32_hijackloader_jeefo_luca-stealer_magniber.exe
          C:\Users\Admin\AppData\Local\Temp\2025-01-19_07de39f432abc01d7f0ace453c8f5f32_hijackloader_jeefo_luca-stealer_magniber.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://uploads.backtrace.rbx.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=58bb11c7e73f98e8de5937d727b602eec8fc3a40 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=0 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x688,0x68c,0x694,0x67c,0x640,0x149438c,0x149439c,0x14943ac
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3608
        • C:\Users\Admin\AppData\Local\Temp\RBX-A55ADFC0\RobloxStudioLauncherBeta.exe
          "C:\Users\Admin\AppData\Local\Temp\RBX-A55ADFC0\RobloxStudioLauncherBeta.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Enumerates system info in registry
          • Modifies Internet Explorer settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4616
          • C:\Users\Admin\AppData\Local\Temp\RBX-A55ADFC0\RobloxStudioLauncherBeta.exe
            C:\Users\Admin\AppData\Local\Temp\RBX-A55ADFC0\RobloxStudioLauncherBeta.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://uploads.backtrace.rbx.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=1085fc665896c333f03037fe12580dd217f6e1ee --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=0 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x5e0,0x5e4,0x5e8,0x58c,0x5ec,0x1b4b5f8,0x1b4b608,0x1b4b618
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1488
          • C:\Program Files (x86)\Roblox\Versions\version-343512800f264d5b\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
            MicrosoftEdgeWebview2Setup.exe /silent /install
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2684
            • C:\Program Files (x86)\Microsoft\Temp\EU2726.tmp\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\Temp\EU2726.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
              6⤵
              • Event Triggered Execution: Image File Execution Options Injection
              • Checks computer location settings
              • Executes dropped EXE
              • Loads dropped DLL
              • Checks system information in the registry
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:3672
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                PID:3304
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:4792
                • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Modifies registry class
                  PID:1940
                • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Modifies registry class
                  PID:1900
                • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Modifies registry class
                  PID:4636
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NzQxQkRGQTctNzA3Qi00NEQxLUI4M0MtQjYzOThDQkQ5NUFFfSIgdXNlcmlkPSJ7NzVEODlGNjgtN0Y0MS00MkFGLTkwNzktQ0NBQTUzOTlGQjJBfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins3REJDMkZCQi05NDY3LTQ5MEEtOTI0NC00MTFGNzlDNUY3RDZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iIi8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNDcuMzciIG5leHR2ZXJzaW9uPSIxLjMuMTcxLjM5IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1Nzk5NzU4MTE3IiBpbnN0YWxsX3RpbWVfbXM9IjY0NyIvPjwvYXBwPjwvcmVxdWVzdD4
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Checks system information in the registry
                • System Location Discovery: System Language Discovery
                • System Network Configuration Discovery: Internet Connection Discovery
                PID:3756
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{741BDFA7-707B-44D1-B83C-B6398CBD95AE}" /silent
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:2288
  • C:\Windows\svchost.exe
    C:\Windows\svchost.exe
    1⤵
    • Executes dropped EXE
    PID:2952
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks system information in the registry
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:652
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NzQxQkRGQTctNzA3Qi00NEQxLUI4M0MtQjYzOThDQkQ5NUFFfSIgdXNlcmlkPSJ7NzVEODlGNjgtN0Y0MS00MkFGLTkwNzktQ0NBQTUzOTlGQjJBfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntDNDgxMDE2Ri00MjNFLTRFNEQtOUYzQS05RTM4MzQ0QjhENDV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iIi8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSI1IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1ODA0NzI4MDY4Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks system information in the registry
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:1636

Network

        MITRE ATT&CK Enterprise v15

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Persistence

        Event Triggered Execution

        2
        T1546

        Component Object Model Hijacking

        1
        T1546.015

        Image File Execution Options Injection

        1
        T1546.012

        Privilege Escalation

        Event Triggered Execution

        2
        T1546

        Component Object Model Hijacking

        1
        T1546.015

        Image File Execution Options Injection

        1
        T1546.012

        Defense Evasion

        Modify Registry

        1
        T1112

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Query Registry

        3
        T1012

        System Information Discovery

        5
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        System Network Configuration Discovery

        1
        T1016

        Internet Connection Discovery

        1
        T1016.001

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        EdgeUpdate.dat
        • Path C:\Program Files (x86)\Microsoft\Temp\EU2726.tmp\EdgeUpdate.dat
        • Size 12KB
        • SHA256 3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MicrosoftEdgeComRegisterShellARM64.exe
        • Path C:\Program Files (x86)\Microsoft\Temp\EU2726.tmp\MicrosoftEdgeComRegisterShellARM64.exe
        • Size 179KB
        • SHA256 35a14bd84e74dd6d8e2683470243fb1bb9071178d9283b12ebbfb405c8cd4aa9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MicrosoftEdgeUpdate.exe
        • Path C:\Program Files (x86)\Microsoft\Temp\EU2726.tmp\MicrosoftEdgeUpdate.exe
        • Size 201KB
        • SHA256 87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MicrosoftEdgeUpdateComRegisterShell64.exe
        • Path C:\Program Files (x86)\Microsoft\Temp\EU2726.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
        • Size 212KB
        • SHA256 4d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MicrosoftEdgeUpdateCore.exe
        • Path C:\Program Files (x86)\Microsoft\Temp\EU2726.tmp\MicrosoftEdgeUpdateCore.exe
        • Size 257KB
        • SHA256 9f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        NOTICE.TXT
        • Path C:\Program Files (x86)\Microsoft\Temp\EU2726.tmp\NOTICE.TXT
        • Size 4KB
        • SHA256 91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdate.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU2726.tmp\msedgeupdate.dll
        • Size 2.0MB
        • SHA256 d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_af.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU2726.tmp\msedgeupdateres_af.dll
        • Size 28KB
        • SHA256 a881788359b2a7d90ac70a76c45938fb337c2064487dcb8be00b9c311d10c24c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_am.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU2726.tmp\msedgeupdateres_am.dll
        • Size 24KB
        • SHA256 986b0654a8b5f7b23478463ff051bffe1e9bbdeb48744e4aa1bd3d89a7520717
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_ar.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU2726.tmp\msedgeupdateres_ar.dll
        • Size 26KB
        • SHA256 e2cc8017bc24e73048c7ee68d3787ed63c3898eec61299a9ca1bab8aeaa8da01
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_as.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU2726.tmp\msedgeupdateres_as.dll
        • Size 28KB
        • SHA256 3b82de846ad028544013383e3c9fb570d2a09abf2c854e8a4d641bd7fc3b3766
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_az.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU2726.tmp\msedgeupdateres_az.dll
        • Size 29KB
        • SHA256 5ab96e4e6e065dbce3b643c6be2c668f5570984ead1a8b3578bbd2056fbad4e9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_bg.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU2726.tmp\msedgeupdateres_bg.dll
        • Size 29KB
        • SHA256 a12df15afac4eb2695626d7a8a2888bdf54c8db671043b0677180f746d8ad105
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_bn-IN.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU2726.tmp\msedgeupdateres_bn-IN.dll
        • Size 29KB
        • SHA256 5b01fe11016610d5606f815281c970c86025732fc597b99c031a018626cd9f3c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_bn.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU2726.tmp\msedgeupdateres_bn.dll
        • Size 29KB
        • SHA256 e32f77ed3067d7735d10f80e5a0aa0c50c993b59b82dc834f2583c314e28fa98
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_bs.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU2726.tmp\msedgeupdateres_bs.dll
        • Size 28KB
        • SHA256 99b1b7e25fbc2c64489c0607cef0ae5ff720ab529e11093ed9860d953adeba04
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_ca-Es-VALENCIA.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU2726.tmp\msedgeupdateres_ca-Es-VALENCIA.dll
        • Size 29KB
        • SHA256 2726c48a468f8f6debc2d9a6a0706b640b2852c885e603e6b2dec638756160df
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_ca.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU2726.tmp\msedgeupdateres_ca.dll
        • Size 30KB
        • SHA256 8dbd55ed532073874f4fe006ef456e31642317145bd18ddc30f681ce9e0c8e07
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_cs.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU2726.tmp\msedgeupdateres_cs.dll
        • Size 28KB
        • SHA256 e0f0026ddcbeafc6c991da6ba7c52927d050f928dba4a7153552efcea893a35b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_cy.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU2726.tmp\msedgeupdateres_cy.dll
        • Size 28KB
        • SHA256 252b6f9bf5a9cb59ad1c072e289cc9695c0040b363d4bfbcc9618a12df77d18e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_da.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU2726.tmp\msedgeupdateres_da.dll
        • Size 28KB
        • SHA256 fd98159338d1f3b03814af31440d37d15ab183c1a230e6261fbb90e402f85d5f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_de.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU2726.tmp\msedgeupdateres_de.dll
        • Size 30KB
        • SHA256 061a7cdaff9867ddb0bd3de2c0760d6919d8d2ca7c7f889ec2d32265d7e7a75c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_el.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU2726.tmp\msedgeupdateres_el.dll
        • Size 30KB
        • SHA256 223d2db0bc2cc82bda04a0a2cd2b7f6cb589e2fa5c0471a2d5eb04d2ffcfcfa0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_en-GB.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU2726.tmp\msedgeupdateres_en-GB.dll
        • Size 27KB
        • SHA256 fd90699e7f29b6028a2e8e6f3ae82d26cdc6942bd39c4f07b221d87c5dbbfe1e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_en.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU2726.tmp\msedgeupdateres_en.dll
        • Size 27KB
        • SHA256 9afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_es-419.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU2726.tmp\msedgeupdateres_es-419.dll
        • Size 29KB
        • SHA256 55a69ce2d6fc4109d16172ba6d9edb59dbadbc8af6746cc71dc4045aa549022d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_es.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU2726.tmp\msedgeupdateres_es.dll
        • Size 28KB
        • SHA256 e652159a75cbab76217ecbb4340020f277175838b316b32cf71e18d83da4a819
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_et.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU2726.tmp\msedgeupdateres_et.dll
        • Size 28KB
        • SHA256 f0a4cfd96c85f2d98a3c9ecfadd41c0c139fdb20470c8004f4c112dd3d69e085
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_eu.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU2726.tmp\msedgeupdateres_eu.dll
        • Size 28KB
        • SHA256 e5615c838a71b533b26d308509954907bcc0eb4032cdbaa3db621eede5e6bfa4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_fa.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU2726.tmp\msedgeupdateres_fa.dll
        • Size 27KB
        • SHA256 c66c4024847d353e9985eb9b2f060b2d84f12cc77fb6479df5ffc55dbda97e59
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_fi.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU2726.tmp\msedgeupdateres_fi.dll
        • Size 28KB
        • SHA256 acf42b90190110ccf30bcfb2626dd999a14e42a72a3983928cba98d44f0a72e2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_fil.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU2726.tmp\msedgeupdateres_fil.dll
        • Size 29KB
        • SHA256 e622823096fc656f63d5a7bbdf3744745ef389c92ec1b804d3b874578e18c89d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        RobloxStudioInstaller.exe
        • Path C:\Program Files (x86)\Roblox\Versions\version-343512800f264d5b\RobloxStudioInstaller.exe
        • Size 7.2MB
        • SHA256 56952f66488eb973dd8dd593068ae19699bd018ed67dbeffe7a33efef4b0d1aa
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MicrosoftEdgeWebview2Setup.exe
        • Path C:\Program Files (x86)\Roblox\Versions\version-343512800f264d5b\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
        • Size 1.5MB
        • SHA256 921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MicrosoftEdgeUpdate.log
        • Path C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
        • Size 89KB
        • SHA256 63a6efa542039cc3039b70e126e9fed29969eddf5e85f3796b93dd33acf34ec7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
        • Size 2KB
        • SHA256 aa10ebb8902b290f0ab697dd5d29d17648ef28ac59a81adc2d827fd0cceef547
        • MD5 SHA1 SHA512
        Submit Download

        75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656
        • Size 1KB
        • SHA256 1b230c79b60ff022f25e03e2b80abe4ccaab717c072a3d42eb1d302a57f7e837
        • MD5 SHA1 SHA512
        Submit Download

        B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
        • Size 1KB
        • SHA256 f7362c6f79ee31ea8d4872a940bd606399b97914307aeaf8a6215743178d4568
        • MD5 SHA1 SHA512
        Submit Download

        BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
        • Size 1KB
        • SHA256 df5aba58777aaf9c9693625a94c487d3ef739d50c7b3f5a651486fcf0ee165c3
        • MD5 SHA1 SHA512
        Submit Download

        07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
        • Size 488B
        • SHA256 095a18108e7b0c262f20170b6b0ae2d6a52962b4fc058713e52ea675acb447f3
        • MD5 SHA1 SHA512
        Submit Download

        75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656
        • Size 434B
        • SHA256 40101978540ea354fbc2e93435ee5e6256b675c964630b5b5a9d595b6a3bf92d
        • MD5 SHA1 SHA512
        Submit Download

        B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
        • Size 482B
        • SHA256 776eab47097e8c17a1c892d567c08941d62c9f8523bf896b84e5fc14a961f8ba
        • MD5 SHA1 SHA512
        Submit Download

        B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
        • Size 482B
        • SHA256 a019c4cc45fbe928662d4f4cfea5fb98967ae630eb12e26749b745bc282dd51d
        • MD5 SHA1 SHA512
        Submit Download

        BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
        • Size 432B
        • SHA256 77df846d77ecfc9f51a825a8132605fc423cc21c1115fe2976488f8aa78ba574
        • MD5 SHA1 SHA512
        Submit Download

        PCStudioBootstrapper[1].json
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DQ67RYHS\PCStudioBootstrapper[1].json
        • Size 10KB
        • SHA256 0157e928d742a4948d01ae0fe1660999caccd83618da4aef7274fa21d7267a25
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        version-343512800f264d5b-rbxInstallerPkgManifest[1].txt
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DQ67RYHS\version-343512800f264d5b-rbxInstallerPkgManifest[1].txt
        • Size 83B
        • SHA256 198056d2862dd40e2fbf114202948fceb7f1cda10ad210f7ca2843b2d0fdf244
        • MD5 SHA1 SHA512
        Submit Download

        version-343512800f264d5b-rbxBootstrapperPkgManifest[1].txt
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EFY08QA2\version-343512800f264d5b-rbxBootstrapperPkgManifest[1].txt
        • Size 86B
        • SHA256 a7f1c06c3a212a55045bf4b7063081511e92c18848ba95f666bc35de9ef68926
        • MD5 SHA1 SHA512
        Submit Download

        WindowsStudio64[1].json
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G94T3PNL\WindowsStudio64[1].json
        • Size 119B
        • SHA256 8ba142cd9a4b005a88ab410021d84f6cb6da6ab98d4cfb437d71306c007e4e46
        • MD5 SHA1 SHA512
        Submit Download

        BatchIncrement[1].json
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PTWQX4L2\BatchIncrement[1].json
        • Size 163B
        • SHA256 b4a55cfd050f4a62b1c4831ca0ab6ffadde1fe1c3f583917eade12f8c6726f61
        • MD5 SHA1 SHA512
        Submit Download

        version-343512800f264d5b-rbxPkgManifest[1].txt
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PTWQX4L2\version-343512800f264d5b-rbxPkgManifest[1].txt
        • Size 2KB
        • SHA256 8dfc03112e93866cd3e30cb396e5dff4a0b8554772c08cf31fe0104db957bde9
        • MD5 SHA1 SHA512
        Submit Download

        2025-01-19_07de39f432abc01d7f0ace453c8f5f32_hijackloader_jeefo_luca-stealer_magniber.exe
        • Path C:\Users\Admin\AppData\Local\Temp\2025-01-19_07de39f432abc01d7f0ace453c8f5f32_hijackloader_jeefo_luca-stealer_magniber.exe
        • Size 6.8MB
        • SHA256 1dc862c638a782ca47013bbde68d72dd4edd02128af21b80661335daa6406a1f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        RobloxStudioLauncherBeta.exe
        • Path C:\Users\Admin\AppData\Local\Temp\RBX-A55ADFC0\RobloxStudioLauncherBeta.exe
        • Size 7.4MB
        • SHA256 b557ae92ddfa8580388ba4d1228609fe1b4f8651b103ae08b7fca4c130ec56a3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        settings.dat
        • Path C:\Users\Admin\AppData\Local\Temp\crashpad_roblox\settings.dat
        • Size 40B
        • SHA256 f8805ece0a0f3dce843ff63c7ce3c9fd66d7a7c212d28b1e25dc08b0f2f53d06
        • MD5 SHA1 SHA512
        Submit Download

        svchost.exe
        • Path C:\Windows\svchost.exe
        • Size 35KB
        • SHA256 20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/876-10-0x0000000000400000-0x000000000040D000-memory.dmp
        Download

        memory/2304-4-0x0000000000400000-0x0000000000429000-memory.dmp
        Download

        memory/2952-211-0x0000000000400000-0x000000000040D000-memory.dmp
        Download

        memory/2952-144-0x0000000000400000-0x000000000040D000-memory.dmp
        Download

        memory/2952-286-0x0000000000400000-0x000000000040D000-memory.dmp
        Download

        memory/2952-486-0x0000000000400000-0x000000000040D000-memory.dmp
        Download

        memory/3672-480-0x00000000000A0000-0x00000000000D5000-memory.dmp
        Download

        memory/3672-481-0x0000000073080000-0x0000000073290000-memory.dmp
        Download

        memory/3672-492-0x0000000073080000-0x0000000073290000-memory.dmp
        Download