Analysis

  • user interaction
    yes
  • max time kernel
    121s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    22/10/2026, 22:55

General

  • Target
    MCServerManager-win-Setup.exe
  • Size 84.5MB
  • Sample261022-2wlc8abf93
  • SHA256 557d29c573332ad96ea85394b43db64e3f0285db40151c21566a393a9f09aeb8
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Modifies Windows Firewall 2 TTPs 5 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 1 TTPs 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 18 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 13 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 51 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MCServerManager-win-Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\MCServerManager-win-Setup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4992
    • C:\Users\Admin\AppData\Local\MCServerManager\current\ServerManagerForMinecraft.exe
      "C:\Users\Admin\AppData\Local\MCServerManager\current\ServerManagerForMinecraft.exe" --veloapp-install 4.1.0
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:1720
    • C:\Users\Admin\AppData\Local\MCServerManager\current\ServerManagerForMinecraft.exe
      "C:\Users\Admin\AppData\Local\MCServerManager\current\ServerManagerForMinecraft.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3080
      • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
        "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe" -version
        3⤵
          PID:3000
        • C:\Program Files\Java\jdk-1.8\bin\java.exe
          "C:\Program Files\Java\jdk-1.8\bin\java.exe" -version
          3⤵
            PID:4640
          • C:\Program Files\Java\jre-1.8\bin\java.exe
            "C:\Program Files\Java\jre-1.8\bin\java.exe" -version
            3⤵
              PID:4596
            • C:\Windows\SYSTEM32\netsh.exe
              "netsh" advfirewall firewall show rule name="MC Server Manager (Minecraft Java)"
              3⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:4648
            • C:\Windows\SYSTEM32\netsh.exe
              "netsh" advfirewall firewall show rule name="MC Server Manager (Minecraft Java)"
              3⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:4436
            • C:\Windows\SYSTEM32\netsh.exe
              "netsh" advfirewall firewall show rule name="MC Server Manager (Minecraft Bedrock)"
              3⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:2240
            • C:\Windows\System32\netsh.exe
              "C:\Windows\System32\netsh.exe" -f "C:\Users\Admin\AppData\Roaming\MCServerManager\firewall-rules.netsh"
              3⤵
              • Event Triggered Execution: Netsh Helper DLL
              PID:5092
            • C:\Windows\SYSTEM32\netsh.exe
              "netsh" advfirewall firewall show rule name="MC Server Manager (Minecraft Java)"
              3⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:1772
            • C:\Windows\SYSTEM32\netsh.exe
              "netsh" advfirewall firewall show rule name="MC Server Manager (Minecraft Bedrock)"
              3⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:3672
            • C:\Users\Admin\AppData\Roaming\MCServerManager\Java\jdk-25\bin\java.exe
              "C:\Users\Admin\AppData\Roaming\MCServerManager\Java\jdk-25\bin\java.exe" -Xms1024M -Xmx6144M -Dfile.encoding=UTF-8 -Dsun.stdout.encoding=UTF-8 -Dsun.stderr.encoding=UTF-8 --enable-native-access=ALL-UNNAMED -XX:+UseG1GC -XX:+ParallelRefProcEnabled -XX:MaxGCPauseMillis=200 -XX:+UnlockExperimentalVMOptions -XX:+DisableExplicitGC -XX:G1NewSizePercent=30 -XX:G1MaxNewSizePercent=40 -XX:G1HeapRegionSize=8M -XX:G1ReservePercent=20 -XX:G1HeapWastePercent=5 -XX:G1MixedGCCountTarget=4 -XX:InitiatingHeapOccupancyPercent=15 -XX:G1MixedGCLiveThresholdPercent=90 -XX:G1RSetUpdatingPauseTimePercent=5 -XX:SurvivorRatio=32 -XX:+PerfDisableSharedMem -XX:MaxTenuringThreshold=1 -jar "C:\Users\Admin\AppData\Roaming\MCServerManager\Servers\test\server.jar" nogui
              3⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Reads the TCP/IP host and domain name from the registry
              • Checks processor information in registry
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4964
            • C:\Users\Admin\AppData\Roaming\MCServerManager\Java\jdk-25\bin\jcmd.exe
              "C:\Users\Admin\AppData\Roaming\MCServerManager\Java\jdk-25\bin\jcmd.exe" 4964 GC.heap_info
              3⤵
              • Executes dropped EXE
              • Checks processor information in registry
              • Suspicious use of WriteProcessMemory
              PID:420
            • C:\Users\Admin\AppData\Roaming\MCServerManager\Java\jdk-25\bin\jcmd.exe
              "C:\Users\Admin\AppData\Roaming\MCServerManager\Java\jdk-25\bin\jcmd.exe" 4964 GC.heap_info
              3⤵
              • Executes dropped EXE
              • Checks processor information in registry
              • Suspicious use of WriteProcessMemory
              PID:2100
            • C:\Users\Admin\AppData\Roaming\MCServerManager\Java\jdk-25\bin\jcmd.exe
              "C:\Users\Admin\AppData\Roaming\MCServerManager\Java\jdk-25\bin\jcmd.exe" 4964 GC.heap_info
              3⤵
              • Executes dropped EXE
              PID:1680
        • C:\Windows\system32\wbem\WmiApSrv.exe
          C:\Windows\system32\wbem\WmiApSrv.exe
          1⤵
            PID:4088

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                DirectWriteForwarder.dll

                • Path C:\Users\Admin\AppData\Local\MCServerManager\current\DirectWriteForwarder.dll
                • Size 470KB
                • SHA256 cc7a5409a37eed77a7ed5185620a733255492974bdb270745e0489d55a6b7823
                • MD5 SHA1 SHA512 SSDEEP TLSH

                Mcsm.Core.dll

                • Path C:\Users\Admin\AppData\Local\MCServerManager\current\Mcsm.Core.dll
                • Size 1.8MB
                • SHA256 dc153d6b18484de4ced0b22fa2397a132a68539b088fb3e11aae2ebfdd0c483c
                • MD5 SHA1 SHA512 SSDEEP TLSH

                Microsoft.Win32.Primitives.dll

                • Path C:\Users\Admin\AppData\Local\MCServerManager\current\Microsoft.Win32.Primitives.dll
                • Size 15KB
                • SHA256 2ac29370b9734bfd2fac7ea4037d759e81b61b5863dfd416baffc2d60a8079a7
                • MD5 SHA1 SHA512 SSDEEP TLSH

                NuGet.Versioning.dll

                • Path C:\Users\Admin\AppData\Local\MCServerManager\current\NuGet.Versioning.dll
                • Size 63KB
                • SHA256 bfcba996b3fc59fbee4d67ae42cc86acae455cbe55119216cda2b84b4457256f
                • MD5 SHA1 SHA512 SSDEEP TLSH

                PresentationCore.dll

                • Path C:\Users\Admin\AppData\Local\MCServerManager\current\PresentationCore.dll
                • Size 7.9MB
                • SHA256 183905d574ad301fa8625cf971a0cf95b60fa5ab15167d9e9995a9322edef5d6
                • MD5 SHA1 SHA512 SSDEEP TLSH

                PresentationFramework.dll

                • Path C:\Users\Admin\AppData\Local\MCServerManager\current\PresentationFramework.dll
                • Size 15.1MB
                • SHA256 3af6d3f0471d1b366975fe29fa181ece7d2e65892a03b593439f733ad045c22a
                • MD5 SHA1 SHA512 SSDEEP TLSH

                ServerManagerForMinecraft.deps.json

                • Path C:\Users\Admin\AppData\Local\MCServerManager\current\ServerManagerForMinecraft.deps.json
                • Size 41KB
                • SHA256 9ef0b4dab6a57c307c0d88d9efeca5f028cbfb75fc56a36b1a9a19cc9b10e662
                • MD5 SHA1 SHA512 SSDEEP TLSH

                ServerManagerForMinecraft.dll

                • Path C:\Users\Admin\AppData\Local\MCServerManager\current\ServerManagerForMinecraft.dll
                • Size 4.2MB
                • SHA256 4af3748e5a4af9a649de439bc1992a78641fd813747a07154903a7e07e4f7a35
                • MD5 SHA1 SHA512 SSDEEP TLSH

                ServerManagerForMinecraft.exe

                • Path C:\Users\Admin\AppData\Local\MCServerManager\current\ServerManagerForMinecraft.exe
                • Size 191KB
                • SHA256 e7a6a3cf3f10bc161f4fa45f51faf998a83bb69b69d02ca46386265d820f19ea
                • MD5 SHA1 SHA512 SSDEEP TLSH

                ServerManagerForMinecraft.runtimeconfig.json

                • Path C:\Users\Admin\AppData\Local\MCServerManager\current\ServerManagerForMinecraft.runtimeconfig.json
                • Size 594B
                • SHA256 cac2cca737b345020dcbb9df2eda4e68ecff23315f0bdcbd36bda5bd6549d811
                • MD5 SHA1 SHA512 TLSH

                System.Collections.NonGeneric.dll

                • Path C:\Users\Admin\AppData\Local\MCServerManager\current\System.Collections.NonGeneric.dll
                • Size 102KB
                • SHA256 b88f9c3ca6815b91061596e615df54ee5eb34cccef70245883a358f9f3090bf5
                • MD5 SHA1 SHA512 SSDEEP TLSH

                System.Collections.dll

                • Path C:\Users\Admin\AppData\Local\MCServerManager\current\System.Collections.dll
                • Size 290KB
                • SHA256 4dcfa26ab7a4983f2b7095d90180e6d1a669269f1ab7fdeb653553a8d778a034
                • MD5 SHA1 SHA512 SSDEEP TLSH

                System.ComponentModel.Primitives.dll

                • Path C:\Users\Admin\AppData\Local\MCServerManager\current\System.ComponentModel.Primitives.dll
                • Size 78KB
                • SHA256 74a39a79e9e3782322aad1cd82d6299bac54f0a6bf60584560e00f60452cc746
                • MD5 SHA1 SHA512 SSDEEP TLSH

                System.Diagnostics.Debug.dll

                • Path C:\Users\Admin\AppData\Local\MCServerManager\current\System.Diagnostics.Debug.dll
                • Size 15KB
                • SHA256 cddcfd9d0d18f5ec9a5359eee558b96ca7e559509ec7f5e361198b2f076e68bf
                • MD5 SHA1 SHA512 SSDEEP TLSH

                System.Diagnostics.Process.dll

                • Path C:\Users\Admin\AppData\Local\MCServerManager\current\System.Diagnostics.Process.dll
                • Size 322KB
                • SHA256 ea51de08264f67cb31a6b1aa9cf00dd23bfbc38bd3355804fbbb21b0a766aa3b
                • MD5 SHA1 SHA512 SSDEEP TLSH

                System.Linq.dll

                • Path C:\Users\Admin\AppData\Local\MCServerManager\current\System.Linq.dll
                • Size 682KB
                • SHA256 049166628925a15b7cb7ff7ba4c952e2eac09da9a29b156d6a3bc1d1a32d3e84
                • MD5 SHA1 SHA512 SSDEEP TLSH

                System.Memory.dll

                • Path C:\Users\Admin\AppData\Local\MCServerManager\current\System.Memory.dll
                • Size 158KB
                • SHA256 21a17ae4ee7e14e54347696500910bd233cdb08007447f744bb19da2e2310a2e
                • MD5 SHA1 SHA512 SSDEEP TLSH

                System.Private.CoreLib.dll

                • Path C:\Users\Admin\AppData\Local\MCServerManager\current\System.Private.CoreLib.dll
                • Size 15.3MB
                • SHA256 0ccec5e150fe6cf43d1f04f9365a5cf2c99f43f501410475340d088b32d48748
                • MD5 SHA1 SHA512 SSDEEP TLSH

                System.Private.Uri.dll

                • Path C:\Users\Admin\AppData\Local\MCServerManager\current\System.Private.Uri.dll
                • Size 250KB
                • SHA256 392097e1bcd61974db2a085a43db5f57b82f3b2e295db471a30407c4026e0c3b
                • MD5 SHA1 SHA512 SSDEEP TLSH

                System.Private.Xml.Linq.dll

                • Path C:\Users\Admin\AppData\Local\MCServerManager\current\System.Private.Xml.Linq.dll
                • Size 382KB
                • SHA256 dbe4ddf972a6918299673e6f43af9d365e9784a8e40035ba7afdc7cba5527db7
                • MD5 SHA1 SHA512 SSDEEP TLSH

                System.Private.Xml.dll

                • Path C:\Users\Admin\AppData\Local\MCServerManager\current\System.Private.Xml.dll
                • Size 7.4MB
                • SHA256 3c866e68c0b3eacd69851ca65e1633488dd5ed2d10233e51026d93522a9e3e56
                • MD5 SHA1 SHA512 SSDEEP TLSH

                System.Runtime.CompilerServices.VisualC.dll

                • Path C:\Users\Admin\AppData\Local\MCServerManager\current\System.Runtime.CompilerServices.VisualC.dll
                • Size 30KB
                • SHA256 0a087afdf85723e622c97bdc3f08accaea2fe6af23f1e84c75064607dd3a8dc7
                • MD5 SHA1 SHA512 SSDEEP TLSH

                System.Runtime.Extensions.dll

                • Path C:\Users\Admin\AppData\Local\MCServerManager\current\System.Runtime.Extensions.dll
                • Size 17KB
                • SHA256 fb5c3a7854ab0fa57c89f0dc16f8a6f756bfb9297a5037b04def73fca39b033f
                • MD5 SHA1 SHA512 SSDEEP TLSH

                System.Runtime.InteropServices.dll

                • Path C:\Users\Admin\AppData\Local\MCServerManager\current\System.Runtime.InteropServices.dll
                • Size 110KB
                • SHA256 62b6669d9970f333ca66c45a5a2e6084ea1e87540c49e8ec0c1f19910fda207d
                • MD5 SHA1 SHA512 SSDEEP TLSH

                System.Runtime.dll

                • Path C:\Users\Admin\AppData\Local\MCServerManager\current\System.Runtime.dll
                • Size 44KB
                • SHA256 c5839cad9c86b59c75475bd2cd13cdfa3eab3c6a74e6ad9041c5bb82a91d57b1
                • MD5 SHA1 SHA512 SSDEEP TLSH

                System.Text.Encoding.Extensions.dll

                • Path C:\Users\Admin\AppData\Local\MCServerManager\current\System.Text.Encoding.Extensions.dll
                • Size 15KB
                • SHA256 60d75d0b3467b637e8fc3cf7f56f40e64cc38022bbddebba80ef3a39fac2932f
                • MD5 SHA1 SHA512 SSDEEP TLSH

                System.Threading.Thread.dll

                • Path C:\Users\Admin\AppData\Local\MCServerManager\current\System.Threading.Thread.dll
                • Size 15KB
                • SHA256 4c98643005da343011cf2b70a168223173f0df597f11fece0acc1355d3617257
                • MD5 SHA1 SHA512 SSDEEP TLSH

                System.Threading.dll

                • Path C:\Users\Admin\AppData\Local\MCServerManager\current\System.Threading.dll
                • Size 82KB
                • SHA256 9faa4d24cf6a8782aa77215b03bda1108f5ffc60dbf825bf8988d901b5d87a41
                • MD5 SHA1 SHA512 SSDEEP TLSH

                System.Xaml.dll

                • Path C:\Users\Admin\AppData\Local\MCServerManager\current\System.Xaml.dll
                • Size 1.3MB
                • SHA256 781b3852cbf086e5389968601087a2c9cbc3184375fb8b68ecca243dd0e06f82
                • MD5 SHA1 SHA512 SSDEEP TLSH

                System.Xml.ReaderWriter.dll

                • Path C:\Users\Admin\AppData\Local\MCServerManager\current\System.Xml.ReaderWriter.dll
                • Size 21KB
                • SHA256 dbde2bf651ef0420bc5c2b26a19a141f10003d6cb3f6456a75c2fae9a827d463
                • MD5 SHA1 SHA512 SSDEEP TLSH

                System.Xml.XDocument.dll

                • Path C:\Users\Admin\AppData\Local\MCServerManager\current\System.Xml.XDocument.dll
                • Size 15KB
                • SHA256 c6c40f525b4de181cf86ef2c75c7ba3a38edb5676932556bb1fb32eb9032bd28
                • MD5 SHA1 SHA512 SSDEEP TLSH

                Velopack.dll

                • Path C:\Users\Admin\AppData\Local\MCServerManager\current\Velopack.dll
                • Size 268KB
                • SHA256 bde31bef4aa010ac2efa23d120d06ff7ea61b256a6f6eee0d295501aa7d3bd7b
                • MD5 SHA1 SHA512 SSDEEP TLSH

                WindowsBase.dll

                • Path C:\Users\Admin\AppData\Local\MCServerManager\current\WindowsBase.dll
                • Size 2.1MB
                • SHA256 5623c6fbdf1a2104a88f66c654b8a5ee836d47dfb1223f3f3c9d4ccca307c9e0
                • MD5 SHA1 SHA512 SSDEEP TLSH

                clrjit.dll

                • Path C:\Users\Admin\AppData\Local\MCServerManager\current\clrjit.dll
                • Size 2.0MB
                • SHA256 a570cf82e47b74847821da210410bf7959a4fe5d421e9d74c20f95ade54f8dca
                • MD5 SHA1 SHA512 SSDEEP TLSH

                coreclr.dll

                • Path C:\Users\Admin\AppData\Local\MCServerManager\current\coreclr.dll
                • Size 4.4MB
                • SHA256 eeca161055e8f6547c51348acaeb106c43ed661cbd24aee92510d2d36d475edd
                • MD5 SHA1 SHA512 SSDEEP TLSH

                hostfxr.dll

                • Path C:\Users\Admin\AppData\Local\MCServerManager\current\hostfxr.dll
                • Size 371KB
                • SHA256 4dd83895ffada7fd873b0cc70335d993ed821a68d954b8cbfffd4f1483f81c90
                • MD5 SHA1 SHA512 SSDEEP TLSH

                hostpolicy.dll

                • Path C:\Users\Admin\AppData\Local\MCServerManager\current\hostpolicy.dll
                • Size 370KB
                • SHA256 3e0bdef9416a0c798b304b636f1bfabf469198016af10b9d6a769ff0c9eec76f
                • MD5 SHA1 SHA512 SSDEEP TLSH

                netstandard.dll

                • Path C:\Users\Admin\AppData\Local\MCServerManager\current\netstandard.dll
                • Size 98KB
                • SHA256 4922ed9efb749c604bdb18f777627ecd104a2f02d78064120a81f5f055fd7ee3
                • MD5 SHA1 SHA512 SSDEEP TLSH

                sq.version

                • Path C:\Users\Admin\AppData\Local\MCServerManager\current\sq.version
                • Size 525B
                • SHA256 c6d0520b950affff73163f4afb2bfaf8a4c712ba2fd3634bad80669a5b1b2ef7
                • MD5 SHA1 SHA512 TLSH

                vcruntime140_cor3.dll

                • Path C:\Users\Admin\AppData\Local\MCServerManager\current\vcruntime140_cor3.dll
                • Size 121KB
                • SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
                • MD5 SHA1 SHA512 SSDEEP TLSH

                jna8115299803256717109.dll

                • Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna8115299803256717109.dll
                • Size 267KB
                • SHA256 5a7ff949f6d93d86491eb5b26b1cfc60051168a60622650224b89995ac420023
                • MD5 SHA1 SHA512 SSDEEP TLSH

                default_US_export.policy

                • Path C:\Users\Admin\AppData\Roaming\MCServerManager\Java\jdk-25.0.4.1+1\conf\security\policy\unlimited\default_US_export.policy
                • Size 146B
                • SHA256 758b930a526fc670ab7537f8c26321527050a31f5f42149a2dda623c56a0a1a9
                • MD5 SHA1 SHA512 TLSH

                ADDITIONAL_LICENSE_INFO

                • Path C:\Users\Admin\AppData\Roaming\MCServerManager\Java\jdk-25.0.4.1+1\legal\java.datatransfer\ADDITIONAL_LICENSE_INFO
                • Size 49B
                • SHA256 ebf9777bd307ed789ceabf282a9aca168c391c7f48e15a60939352efb3ea33f9
                • MD5 SHA1 SHA512

                ASSEMBLY_EXCEPTION

                • Path C:\Users\Admin\AppData\Roaming\MCServerManager\Java\jdk-25.0.4.1+1\legal\java.datatransfer\ASSEMBLY_EXCEPTION
                • Size 44B
                • SHA256 b998cda101e5a1ebcfb5ff9cddd76ed43a2f2169676592d428b7c0d780665f2a
                • MD5 SHA1 SHA512

                LICENSE

                • Path C:\Users\Admin\AppData\Roaming\MCServerManager\Java\jdk-25.0.4.1+1\legal\java.datatransfer\LICENSE
                • Size 33B
                • SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
                • MD5 SHA1 SHA512

                jcmd.exe

                • Path C:\Users\Admin\AppData\Roaming\MCServerManager\Java\jdk-25\bin\jcmd.exe
                • Size 23KB
                • SHA256 a9e64854c83bdc17fcebfe52dd9b56ebbce768f42d08fe706b8ef4bbdada4cc2
                • MD5 SHA1 SHA512 SSDEEP TLSH

                ops.json

                • Path C:\Users\Admin\AppData\Roaming\MCServerManager\Servers\test\ops.json
                • Size 2B
                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                • MD5 SHA1 SHA512

                server.properties

                • Path C:\Users\Admin\AppData\Roaming\MCServerManager\Servers\test\server.properties
                • Size 433B
                • SHA256 3ac8be96d16ebd399fce9302b1bbbdcb3cb97bece497bb10db2a2513eb543587
                • MD5 SHA1 SHA512 TLSH

                server-26.3.jar

                • Path C:\Users\Admin\AppData\Roaming\MCServerManager\Servers\test\versions\26.3\server-26.3.jar
                • Size 25.4MB
                • SHA256 a362163eec5d1612d520772bc16e5b39c09e3b234fdc045f56bf544284ee8ae6
                • MD5 SHA1 SHA512 SSDEEP TLSH

                custom_boss_events.dat

                • Path C:\Users\Admin\AppData\Roaming\MCServerManager\Servers\test\world\data\minecraft\custom_boss_events.dat
                • Size 48B
                • SHA256 49937c8cea10110c1a760809c5537145cbdabc5405c8c456563e750c4cf592e0
                • MD5 SHA1 SHA512

                level.dat

                • Path C:\Users\Admin\AppData\Roaming\MCServerManager\Servers\test\world\level.dat
                • Size 400B
                • SHA256 7ef071a4b7d28e0964b56cf99ef35dffaa795cbac1244030cab18d0929e3b0ad
                • MD5 SHA1 SHA512 TLSH

                level.dat

                • Path C:\Users\Admin\AppData\Roaming\MCServerManager\Servers\test\world\level.dat
                • Size 386B
                • SHA256 4f3c2f2ddc7a8fdfbfe19ceedbab0bff1ba6c1ad72f28e656ab2ff34b9c29380
                • MD5 SHA1 SHA512 TLSH

                app-settings.json

                • Path C:\Users\Admin\AppData\Roaming\MCServerManager\app-settings.json
                • Size 810B
                • SHA256 860c095da94d195e25278892124f8f9ff20b0613a6160c16823bd56006ea12ad
                • MD5 SHA1 SHA512 TLSH

                app-settings.json

                • Path C:\Users\Admin\AppData\Roaming\MCServerManager\app-settings.json
                • Size 771B
                • SHA256 6b98d400b21a784ba80180f20e48470d723afe9b95d2af4fb99b0ac3e7830df5
                • MD5 SHA1 SHA512 TLSH

                app-settings.json

                • Path C:\Users\Admin\AppData\Roaming\MCServerManager\app-settings.json
                • Size 810B
                • SHA256 d9137d2fb0093e7d75347baf7ddff1c87b08a6b49b14bfa19feea2f8f150851e
                • MD5 SHA1 SHA512 TLSH

                app-2026-10-22_23-56-51.log

                • Path C:\Users\Admin\AppData\Roaming\MCServerManager\logs\app-2026-10-22_23-56-51.log
                • Size 1KB
                • SHA256 589a40a3e4c020cef6e59a1ed9102f3863799192c20bada5646a134bbc9268bf
                • MD5 SHA1 SHA512 TLSH

                app-2026-10-22_23-56-51.log

                • Path C:\Users\Admin\AppData\Roaming\MCServerManager\logs\app-2026-10-22_23-56-51.log
                • Size 1KB
                • SHA256 ff7adaf06e8f4bded72f0e5cd37c7655aeba1d4f7165e94464baee54b9edc959
                • MD5 SHA1 SHA512 TLSH

                app-2026-10-22_23-56-51.log

                • Path C:\Users\Admin\AppData\Roaming\MCServerManager\logs\app-2026-10-22_23-56-51.log
                • Size 2KB
                • SHA256 b8dbca3c1ecd099a4c19788d9cad983f4ef58c5e937013fb41ce6cc48d70be4d
                • MD5 SHA1 SHA512 TLSH

                app-2026-10-22_23-56-51.log

                • Path C:\Users\Admin\AppData\Roaming\MCServerManager\logs\app-2026-10-22_23-56-51.log
                • Size 4KB
                • SHA256 772e9866f2cec0c6e45370010a6ba787ad34a98d803877351a577513cec1383c
                • MD5 SHA1 SHA512 SSDEEP TLSH

                servers.json.tmp-190ff730

                • Path C:\Users\Admin\AppData\Roaming\MCServerManager\servers.json.tmp-190ff730
                • Size 3KB
                • SHA256 c9a655cd88dd768fddec0ff77f9da9a0d2070d988313b3916999529805ce842d
                • MD5 SHA1 SHA512 TLSH

                servers.json.tmp-a82be20a

                • Path C:\Users\Admin\AppData\Roaming\MCServerManager\servers.json.tmp-a82be20a
                • Size 3KB
                • SHA256 a9fdb424db45b26c5154be1bf5ea1cb9647382af76247e29c5457cd2282e74ad
                • MD5 SHA1 SHA512 TLSH

                memory/3000-607-0x0000013F8E440000-0x0000013F8E441000-memory.dmp

                memory/4596-633-0x0000022A57E40000-0x0000022A57E41000-memory.dmp

                memory/4640-620-0x000001DE43A50000-0x000001DE43A51000-memory.dmp

                memory/4964-2188-0x0000023F8E3B0000-0x0000023F8F3B0000-memory.dmp

                memory/4964-2207-0x0000023F8E3B0000-0x0000023F8F3B0000-memory.dmp

                memory/4964-2185-0x0000023F8E3B0000-0x0000023F8F3B0000-memory.dmp

                memory/4964-2186-0x0000023F8E3B0000-0x0000023F8F3B0000-memory.dmp

                memory/4964-2194-0x0000023F8E3B0000-0x0000023F8F3B0000-memory.dmp

                memory/4964-2197-0x0000023F8E3B0000-0x0000023F8F3B0000-memory.dmp

                memory/4964-2196-0x0000023F8E3B0000-0x0000023F8F3B0000-memory.dmp

                memory/4964-2195-0x0000023F8E3B0000-0x0000023F8F3B0000-memory.dmp

                memory/4964-2191-0x0000023F8E3B0000-0x0000023F8F3B0000-memory.dmp

                memory/4964-2193-0x0000023F8E3B0000-0x0000023F8F3B0000-memory.dmp

                memory/4964-2192-0x0000023F8E3B0000-0x0000023F8F3B0000-memory.dmp

                memory/4964-1793-0x0000023FA6F40000-0x0000023FA6F41000-memory.dmp

                memory/4964-2184-0x0000023F8E3B0000-0x0000023F8F3B0000-memory.dmp

                memory/4964-2189-0x0000023F8E3B0000-0x0000023F8F3B0000-memory.dmp

                memory/4964-2187-0x0000023F8E3B0000-0x0000023F8F3B0000-memory.dmp

                memory/4964-2183-0x0000023F8E3B0000-0x0000023F8F3B0000-memory.dmp

                memory/4964-2199-0x0000023F8E3B0000-0x0000023F8F3B0000-memory.dmp

                memory/4964-2202-0x0000023F8E3B0000-0x0000023F8F3B0000-memory.dmp

                memory/4964-2200-0x0000023F8E3B0000-0x0000023F8F3B0000-memory.dmp

                memory/4964-2204-0x0000023F8E3B0000-0x0000023F8F3B0000-memory.dmp

                memory/4964-2203-0x0000023F8E3B0000-0x0000023F8F3B0000-memory.dmp

                memory/4964-2190-0x0000023F8E3B0000-0x0000023F8F3B0000-memory.dmp

                memory/4964-2209-0x0000023F8E3B0000-0x0000023F8F3B0000-memory.dmp

                memory/4964-2206-0x0000023F8E3B0000-0x0000023F8F3B0000-memory.dmp

                memory/4964-2201-0x0000023F8E3B0000-0x0000023F8F3B0000-memory.dmp