FakeGit luau.exe LuaJIT Loader Chain Executing ico64.txt via application.cmd

Shadows VMB@Vemorian_Mort

•updated Jul 22, 2026•4•0•16

Detects execution of Lua/LuaJIT binaries, specifically luau.exe or lua(jit).exe, with command-line arguments referencing ico64.txt, or execution via application.cmd. This behavior is often associated with malware loaders attempting to execute secondary scripts or payloads.