67aa43456e09b095e95ad369ed81e5eb5ada1007fb002bcbbdf02133617402ca

Resubmissions

04/11/2026, 19:10

261104-xvb1yaee377

04/11/2026, 19:07

261104-xsrnlstyg17

Analysis

user interaction
yes
max time kernel
69s
max time network
69s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/11/2026, 19:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
launcher-1.09_17.exe
Size 746KB
Sample261104-xsrnlstyg1
SHA256 67aa43456e09b095e95ad369ed81e5eb5ada1007fb002bcbbdf02133617402ca
MD5 0fbc764e8da59c3d86513a39a4d4c260
SHA1 41150deef0b46d0dc8c864464910b533c86bbbad
SHA512 863eb404cec3c4c9b3f0041d1d7a2609fd6df20975d95eeb9499d23bc01f90452cdaeb01784c42116d8d58dc945e8e6f2eec19fcb97e046d6174baddb511f5c7
SSDEEP 12288:fuvaO9Es/ZxNwsooperNotmRcWT43YQFXdQXXXfyMKJ+n8M1bkc:fuvaQ/DNTqoPWkYQ9EaSnvN/
TLSH
T188F40153F09628AEF53B87734051A22338BCB1FED04B60296AF5119B7D77C896F16398
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Loads dropped DLL 3 IoCs

pid	Process
4316	java.exe
4316	java.exe
4316	java.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
3368	GameBarPresenceWriter.exe

Drops file in System32 directory 16 IoCs

description	ioc	Process
File created	\??\c:\windows\system32\driverstore\filerepository\usbport.inf_amd64_585900615f764770\usbport.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtl64.inf_amd64_8e9c2368fe308df2\netrtl64.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_726cea1f0f349cf7\machine.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\input.inf_amd64_702fdf2336d2162d\input.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_5ab7d1c25144fcab\msmouse.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_cc6edbde0940344f\keyboard.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\keyboard.inf_amd64_cc6edbde0940344f\keyboard.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\netrtl64.inf_amd64_8e9c2368fe308df2\netrtl64.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\hdaudbus.inf_amd64_8207ba80cf22e40a\hdaudbus.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\machine.inf_amd64_726cea1f0f349cf7\machine.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\mshdc.inf_amd64_84ea762c0a90c362\mshdc.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_585900615f764770\usbport.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\input.inf_amd64_702fdf2336d2162d\input.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\msmouse.inf_amd64_5ab7d1c25144fcab\msmouse.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hdaudbus.inf_amd64_8207ba80cf22e40a\hdaudbus.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_84ea762c0a90c362\mshdc.PNF	dxdiag.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4828	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	launcher-1.09_17.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	dxdiag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dxdiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	dxdiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	dxdiag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dxdiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dxdiag.exe

Modifies registry class 45 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1\ = "DxDiagProvider Class"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1\CLSID	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ = "DxDiagClassObject Class"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ProgID	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ForceRemove	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\CLSID	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\CLSID\ = "{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CLSID	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ = "C:\\Windows\\system32\\dxdiagn.dll"	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ThreadingModel = "Apartment"	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CurVer\ = "DxDiag.DxDiagClassObject.1"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\ProgID	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\InprocServer32	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\ = "DxDiagClassObject Class"	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ForceRemove\ = "Programmable"	dxdiag.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-338007942-693956180-937915117-1000\{667F8BB6-B1AE-4816-9561-0EF188D43688}	dxdiag.exe
Key created	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\discord-939918927989973052	java.exe
Key created	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\discord-939918927989973052\DefaultIcon	java.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\discord-939918927989973052\DefaultIcon\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\java.exe"	java.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\ = "DxDiagProvider Class"	dxdiag.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\discord-939918927989973052\ = "URL:Run game 939918927989973052 protocol"	java.exe
Key created	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\discord-939918927989973052\shell\open\command	java.exe
Key created	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\discord-939918927989973052\shell	java.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\discord-939918927989973052\shell\open\command\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\java.exe"	java.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CLSID\ = "{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CurVer	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ProgID\ = "DxDiag.DxDiagClassObject.1"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\VersionIndependentProgID	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\ = "DxDiagClassObject Class"	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CurVer\ = "DxDiag.DxDiagClassObject.1"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\VersionIndependentProgID	dxdiag.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-338007942-693956180-937915117-1000\{FF617680-5136-4217-98D8-D39FFFAC8B40}	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\VersionIndependentProgID\ = "DxDiag.DxDiagClassObject"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CLSID	dxdiag.exe
Key created	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\discord-939918927989973052\shell\open	java.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CurVer	dxdiag.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\discord-939918927989973052\URL Protocol	java.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2324	dxdiag.exe
2324	dxdiag.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2504	javaw.exe
2504	javaw.exe
2324	dxdiag.exe
4316	java.exe
4316	java.exe
4316	java.exe
4316	java.exe
3332	OpenWith.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 2504	4992	launcher-1.09_17.exe	81
PID 2504 wrote to memory of 4828	2504	javaw.exe	82
PID 4828 wrote to memory of 2324	4828	cmd.exe	84
PID 2504 wrote to memory of 4396	2504	javaw.exe	87
PID 2504 wrote to memory of 4316	2504	javaw.exe	89

C:\Users\Admin\AppData\Local\Temp\launcher-1.09_17.exe
"C:\Users\Admin\AppData\Local\Temp\launcher-1.09_17.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\launcher-1.09_17.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C dxdiag /t C:\Users\Admin\AppData\Roaming\.betacraft\launcher\dxdiag_report.txt
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4828
  - - C:\Windows\system32\dxdiag.exe
      dxdiag /t C:\Users\Admin\AppData\Roaming\.betacraft\launcher\dxdiag_report.txt
      4⤵
      Drops file in System32 directory
      Checks SCSI registry key(s)
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:2324
- - C:\Program Files\Java\jre-1.8\bin\java.exe
    "C:\Program Files\Java\jre-1.8\bin\java.exe" -version
    3⤵
    PID:4396
- - C:\Program Files\Java\jre-1.8\bin\java.exe
    "C:\Program Files\Java\jre-1.8\bin\java.exe" -XX:HeapDumpPath=java.exe_minecraft.exe.heapdump -Djava.util.Arrays.useLegacyMergeSort=true -Dhttp.nonProxyHosts=api.betacraft.uk|files.betacraft.uk|checkip.amazonaws.com -Xmx1G -Dhttp.proxyHost=betacraft.uk -cp C:\Users\Admin\AppData\Roaming\.betacraft\launcher\betacraft_wrapper.jar;C:\Users\Admin\AppData\Roaming\.betacraft\launcher\discord_rpc.jar org.betacraft.launcher.Launcher wrap hello - - - - "default instance"
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:4316

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:3368

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
PID:3900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 bf9c2624bfbfdb7a34a98e974102e35825d405ed8b6652029dc36f76c3ef2889
MD5 186109f9f0bd86a729ba85b7e95ad73c
SHA1 d2ec26087e5122c13a53b024f53ae3c5af67cd93
SHA512 5b761f7d4a9384a0324b63f2afb1876156c3423e8a05a3412074f3418811ce729afef716e25b221d0120a837c747a20a689881ac9b7ec8b378972bf475e6fad7
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 60350c7a0be1e08f42c72eed5f2eae75616d2ae6b0df5ca730aaf6f34b073988
MD5 c85c8702a5acc9d85f7f148345bb5920
SHA1 ec578a6b8fa26b3b483f42523decb61632766fed
SHA512 aa9f665e3f01d6cc2055026080895c27c9fa02ff51058831b2df18c8dbccc122b131d13f18bdaa5c28c5b296108a40b160c857789f0e95d6c3ee72c28f630149
MD5 SHA1 SHA512

Submit Download

discord-rpc.dll

Path C:\Users\Admin\AppData\Local\Temp\drpc585264512930\discord-rpc.dll
Size 390KB
SHA256 5cc2e504800cf4ed2f4781364f661ea22349658ddc391b5d54195e573109d87b
MD5 5882c37b79bae47a0d090006564edb22
SHA1 ac7bbbdb1d34eb763d8db4ef7875a50f700e9d48
SHA512 d4a6a1a36842dd1c8b2162168807b990e0d491a908e11b52ebf11174a67f818b131607c2122dbb484f5d946418a05a1a84d42e1468bef5c98ec3fcff7d225ccd
SSDEEP 6144:TnQCrLe2xJLChxTC+LxTYXrHJZ5upQtXsK+62C3wh+0U1c5xrunBLko:TnQCrLXxgvU7v8ph7+0kHB7
TLSH
T12C847D5AFB6448B5D0679135C973864BE3B27C891B70D78F23A8439A2F37BA1453E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jna2556445239789037309.dll

Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna2556445239789037309.dll
Size 240KB
SHA256 0525f9e2db0146f7abcc8cd86cf4fb01721fad0d5c9a1806b5805bb789eb8c98
MD5 1164914ca1307de98cc0d57e42285ef2
SHA1 9387f983c88c425c91e5caae2409cf4180b02096
SHA512 7fbb98c3768e22429ad39070fd2fdbf38d9585e81df592d7fb64cdc03e890d6ce57a72bafbc8815ace9076e5241cfb77d8c23ff1db66ba7564131506d487dc5e
SSDEEP 6144:ONdFEp41M0A9mAkXZdHlLm1Rq6Y+S4Dedhx3U3YfHy0o8N:2FEG1jQRA+SQOI
TLSH
T114342907F7B248E5E8B7C03A49136A12F57278194320EBEB47858B535F66BE09B3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinput.jar

Path C:\Users\Admin\AppData\Roaming\.betacraft\bin\jinput.jar
Size 226KB
SHA256 ce27de713e36a72a89e9495861c8265b0f81069366567c1c5c69e7d2ede58c89
MD5 e41a078a1f6cae716215235fbf0b5689
SHA1 a91a5631d319c8f50851b731c435cf66eb1d1e7e
SHA512 6a2e6adf035eb6d99bbe69dbda7d84cbdce5ef95ad3751731a5b564928a43306deec8799af8e5abcbb9decfd8cb50c2196098787f1373bc274ddc80852a3a2f1
SSDEEP 6144:39U+yLUxpmoMxD8nobRwNXiBkZZuUGT89bZZ:39U8xIb/m8BkvuUR3
TLSH
T1EB34CF276EAA8529F223C3320991A2D6FC2C95A45C0B926F7071C49D78B0D4617DBFDF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lwjgl.jar

Path C:\Users\Admin\AppData\Roaming\.betacraft\bin\lwjgl.jar
Size 1.0MB
SHA256 3751d0003f4c9c94075a362b03385357140c111dc5d3ffe2fd7c969bf421633e
MD5 980065fb23b1f8aab432cb5ee9da4f23
SHA1 d04e9dc91396d49f5d849277365f821ced845d94
SHA512 948262452fa5ea31016b314730c191966b8cf79c0740151fbadcff415b265f1d3a82470ff5c526ebf2058f8a3fd6dea71c207d77ec152fa0a82552b27637c66f
SSDEEP 24576:q6xwM053tw8NvDXbDkrl5QWZPBMOb6MDGDxsLJIMLQI:Litw85krlyWdBVbKxs9Is
TLSH
T17C25F123DCE7902AFD27413944932B3A741D37ECD886899017AA1BC2B5778A5FB27734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lwjgl64.dll

Path C:\Users\Admin\AppData\Roaming\.betacraft\bin\natives\lwjgl64.dll
Size 310KB
SHA256 094c38a9b6b9ab76e3730838d542419811e63de5d4a4ba5a22d83f6edd803943
MD5 73cb2a967d771c65bc46c543f61a9898
SHA1 0ef71be40bac0a5213b1a5c38739b1610ab311e6
SHA512 1fa057fe5739f1ba457e0b95f01c1a378469fcb4944453bbd5b335281dbce882e730b601fa1e6053860053fdce2a6bd7f72342b6e9d8b6bf1f75a49af59662e8
SSDEEP 3072:by6nSomUPQukwpSor62AIiGYIR2LGPHc0Ul+S4KQIw6tqYKVFlCh7NZqSEgbh:bciFkwpL2DI0yPHqw6tVKYr
TLSH
T1A2642363EF27C47AEE4B323944C00875721C74A01A5563C7261CEAC6B5DE7B487A6F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

betacraft_wrapper.jar

Path C:\Users\Admin\AppData\Roaming\.betacraft\launcher\betacraft_wrapper.jar
Size 746KB
SHA256 67aa43456e09b095e95ad369ed81e5eb5ada1007fb002bcbbdf02133617402ca
MD5 0fbc764e8da59c3d86513a39a4d4c260
SHA1 41150deef0b46d0dc8c864464910b533c86bbbad
SHA512 863eb404cec3c4c9b3f0041d1d7a2609fd6df20975d95eeb9499d23bc01f90452cdaeb01784c42116d8d58dc945e8e6f2eec19fcb97e046d6174baddb511f5c7
SSDEEP 12288:fuvaO9Es/ZxNwsooperNotmRcWT43YQFXdQXXXfyMKJ+n8M1bkc:fuvaQ/DNTqoPWkYQ9EaSnvN/
TLSH
T188F40153F09628AEF53B87734051A22338BCB1FED04B60296AF5119B7D77C896F16398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

discord_rpc.jar

Path C:\Users\Admin\AppData\Roaming\.betacraft\launcher\discord_rpc.jar
Size 2.0MB
SHA256 619500b324fcadc52b9e2319585934179b69e21589f34858cc31d7d6e2442eac
MD5 d75aa9aec06d3d536cc1229d21db46a9
SHA1 93c0f6aee918cc3a41baf36a90020d537d1eb1ba
SHA512 af8b37a56c906b1850385b80e40173928e792470faec5aed5d5c18e09c9d70235863449f650cbf1c1b542fcebf9e16964ab6ba90a82bba84be7b993db525576c
SSDEEP 49152:zkwTKERBhO88JnDqCTE+tAP4nkRCeaRPC+aGo/CP:zjeEXSBVT2BAXRPC+aTCP
TLSH
T1DBA52357FC5A811DCA27D5F732CF4B86AE165669AF116CED02FC092448829C307D3BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxdiag_report.txt

Path C:\Users\Admin\AppData\Roaming\.betacraft\launcher\dxdiag_report.txt
Size 84KB
SHA256 84f00daee68ceec29d372f3f7db54985335c023e37325fcabf5e576916454b19
MD5 8a2cfc07d5c8988ab542bd418d8593ad
SHA1 0ac73e32432fae2fcdeb8b69b772ee2ec26dd6cf
SHA512 d5a12e7382c79a7b56d4c2bcc081c1f0f493bd96300535412f88c318855d70d3d8061753b7390cccd1cdecfa6e5c428d1d8f1696d9b0d1471c3dafd25b5d1a7b
SSDEEP 768:LXqO0VWIndCwzcCotHC9pBM8nKuj5nUovxlG0C14JkNEr+aL/F/JOlKwY0:Lgk6ljIV14Ou0
TLSH
T1A78398F96C41C454F055C15662787625DA2D34D320EA8DAD3ABCEFC90F22DFAE238E52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default instance.txt

Path C:\Users\Admin\AppData\Roaming\.betacraft\launcher\instances\default instance.txt
Size 291B
SHA256 c21097b481dc1c5660d6977db7836b15b686a65a84ca504c5eefa4c5f6b1f414
MD5 0dd6c478dfafe88f8a6738a288850233
SHA1 f0234e6595f4876ffcb8ba7d05c90ca50904fc84
SHA512 e0c93a58765b12fc6ca1ce6f983ba8dd921849939b2252121373616cc6c73b75082fe143d08a1b1bb151730ad7b478ee154fe7080f8e57b80c05aea1b4b50e2e
TLSH
T18ED02B24FFA2E86EBC741681CBB0755A02B39FA9321AB579DEAC00CE79832052090857
MD5 SHA1 SHA512 TLSH

Submit Download

English.txt

Path C:\Users\Admin\AppData\Roaming\.betacraft\launcher\lang\English.txt
Size 36B
SHA256 2b6a86fb912cf4d4a5e31f6792d85657615db3d853fb8babffadcb69dd8f4df0
MD5 6669d7a6e0e6b3ed8df4c9e58bcbf889
SHA1 1759adc237ce6888508d964e746f57838946ae95
SHA512 9f575cfe707ebeadd592eb9f65919cea2ce870b074257c659973758d606f33a3169a0abd428b8e646b3469989e714da5d2807b74be6dd233b4e5e27b7ff1c118
MD5 SHA1 SHA512

Submit Download

launcher.settings

Path C:\Users\Admin\AppData\Roaming\.betacraft\launcher\launcher.settings
Size 127B
SHA256 1316aad9ccc6fadb756ebcf168a9c285d5032612b82ac5f10040071ab0fee2df
MD5 422a1ded941591e8690fee28db6adc6c
SHA1 7967510ec7aba79d96c346265788acfecb5f805e
SHA512 0fb9055c130eeb4436f7ed39516c532cf403bb33b259c6b8ed7f11a9aae3109a27651c42d18a49f1939662dafcb519a731c4eb324f83e45ef0fbe97fbaa670d5
TLSH
T138B0921A6B20E9AEAA188282215078955BF2A158E02228A05C8E070AD3EB20D829B567
MD5 SHA1 SHA512 TLSH

Submit Download

pc-132011.info

Path C:\Users\Admin\AppData\Roaming\.betacraft\versions\jsons\pc-132011.info
Size 267B
SHA256 3a2accab6fea0ced43d18c8dc099f4865a51b7a895c616ac4b4418cf5c29e651
MD5 df9ac4cad2533e09d9bf3bd84f29463b
SHA1 2ca1f87021dcf5fb4c983d4d3a74f6cec9603655
SHA512 d8d9a54202c0929614a1454eb71720618addb447000364be1c4ac756376fd306f3b5df7e8d5063077f6c8fb98b2d60648455253630a5ce152d8a0c3339f64a19
TLSH
T13ED02BD9D14621518B789610A906F7AED60D792CC5D58761B1767381141A47A5308D98
MD5 SHA1 SHA512 TLSH

Submit Download

pc-132011.jar

Path C:\Users\Admin\AppData\Roaming\.betacraft\versions\pc-132011.jar
Size 26KB
SHA256 407460840eaeab01260b9e7951bd518f7c31e2e3f12a352e436502fa7050a6e7
MD5 99fdaea10c494b9c3c3254636b98b799
SHA1 393e8d4b4d708587e2accd7c5221db65365e1075
SHA512 d91170d09c4cf8b34ceafbca6e2e0325df20bdf507bd7ec79ebca7c9681e1ae66950bfc4e02e294872529cbf41a376826d8d17defcada2baf407c940bf005606
SSDEEP 384:EAYKAhxIJqK6c6e+/j4lq+JC/85ovOCrmqnEzQyXarcPAqFy4oIX:EzK1qBcVkp05QdqqnEcy4qfoY
TLSH
T16BC2C07B3D4D23B8EF52F13E6A1AC9963C5000B39121789353DA29E59963D8F0F94379
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

83aa4cc77f591dfc2374580bbd95f6ba_1a9c8d58-701b-4482-9720-484627d698d4

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-338007942-693956180-937915117-1000\83aa4cc77f591dfc2374580bbd95f6ba_1a9c8d58-701b-4482-9720-484627d698d4
Size 45B
SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
MD5 c8366ae350e7019aefc9d1e6e6a498c6
SHA1 5731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA512 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
MD5 SHA1 SHA512

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2324-512-0x000002572EA80000-0x000002572EA81000-memory.dmp

Download

memory/2324-511-0x000002572EA80000-0x000002572EA81000-memory.dmp

Download

memory/2324-510-0x000002572EA80000-0x000002572EA81000-memory.dmp

Download

memory/2324-522-0x000002572EA80000-0x000002572EA81000-memory.dmp

Download

memory/2324-516-0x000002572EA80000-0x000002572EA81000-memory.dmp

Download

memory/2324-517-0x000002572EA80000-0x000002572EA81000-memory.dmp

Download

memory/2324-518-0x000002572EA80000-0x000002572EA81000-memory.dmp

Download

memory/2324-519-0x000002572EA80000-0x000002572EA81000-memory.dmp

Download

memory/2324-520-0x000002572EA80000-0x000002572EA81000-memory.dmp

Download

memory/2324-521-0x000002572EA80000-0x000002572EA81000-memory.dmp

Download

memory/2504-172-0x00000147F8C50000-0x00000147F8C51000-memory.dmp

Download

memory/2504-153-0x00000147804C0000-0x00000147804D0000-memory.dmp

Download

memory/2504-100-0x00000147803B0000-0x00000147803C0000-memory.dmp

Download

memory/2504-99-0x00000147803A0000-0x00000147803B0000-memory.dmp

Download

memory/2504-90-0x00000147802A0000-0x00000147802B0000-memory.dmp

Download

memory/2504-89-0x0000014780290000-0x00000147802A0000-memory.dmp

Download

memory/2504-88-0x0000014780390000-0x00000147803A0000-memory.dmp

Download

memory/2504-87-0x0000014780380000-0x0000014780390000-memory.dmp

Download

memory/2504-86-0x0000014780370000-0x0000014780380000-memory.dmp

Download

memory/2504-85-0x0000014780360000-0x0000014780370000-memory.dmp

Download

memory/2504-84-0x0000014780350000-0x0000014780360000-memory.dmp

Download

memory/2504-83-0x0000014780340000-0x0000014780350000-memory.dmp

Download

memory/2504-82-0x0000014780280000-0x0000014780290000-memory.dmp

Download

memory/2504-81-0x00000147F8C50000-0x00000147F8C51000-memory.dmp

Download

memory/2504-67-0x0000014780320000-0x0000014780330000-memory.dmp

Download

memory/2504-112-0x0000014780420000-0x0000014780430000-memory.dmp

Download

memory/2504-111-0x00000147802E0000-0x00000147802F0000-memory.dmp

Download

memory/2504-110-0x00000147802D0000-0x00000147802E0000-memory.dmp

Download

memory/2504-113-0x0000014780430000-0x0000014780440000-memory.dmp

Download

memory/2504-117-0x00000147F8C50000-0x00000147F8C51000-memory.dmp

Download

memory/2504-122-0x0000014780450000-0x0000014780460000-memory.dmp

Download

memory/2504-124-0x0000014780300000-0x0000014780310000-memory.dmp

Download

memory/2504-127-0x0000014780330000-0x0000014780340000-memory.dmp

Download

memory/2504-126-0x0000014780320000-0x0000014780330000-memory.dmp

Download

memory/2504-125-0x0000014780310000-0x0000014780320000-memory.dmp

Download

memory/2504-123-0x0000014780460000-0x0000014780470000-memory.dmp

Download

memory/2504-121-0x0000014780440000-0x0000014780450000-memory.dmp

Download

memory/2504-128-0x0000014780470000-0x0000014780480000-memory.dmp

Download

memory/2504-120-0x00000147802F0000-0x0000014780300000-memory.dmp

Download

memory/2504-130-0x0000014780480000-0x0000014780490000-memory.dmp

Download

memory/2504-133-0x0000014780350000-0x0000014780360000-memory.dmp

Download

memory/2504-138-0x0000014780490000-0x00000147804A0000-memory.dmp

Download

memory/2504-137-0x0000014780390000-0x00000147803A0000-memory.dmp

Download

memory/2504-136-0x0000014780380000-0x0000014780390000-memory.dmp

Download

memory/2504-135-0x0000014780370000-0x0000014780380000-memory.dmp

Download

memory/2504-134-0x0000014780360000-0x0000014780370000-memory.dmp

Download

memory/2504-132-0x0000014780340000-0x0000014780350000-memory.dmp

Download

memory/2504-141-0x00000147804A0000-0x00000147804B0000-memory.dmp

Download

memory/2504-142-0x00000147803A0000-0x00000147803B0000-memory.dmp

Download

memory/2504-150-0x00000147804B0000-0x00000147804C0000-memory.dmp

Download

memory/2504-155-0x0000014780420000-0x0000014780430000-memory.dmp

Download

memory/2504-166-0x0000014780500000-0x0000014780510000-memory.dmp

Download

memory/2504-168-0x0000014780470000-0x0000014780480000-memory.dmp

Download

memory/2504-102-0x00000147803D0000-0x00000147803E0000-memory.dmp

Download

memory/2504-179-0x0000014780490000-0x00000147804A0000-memory.dmp

Download

memory/2504-178-0x0000014780540000-0x0000014780550000-memory.dmp

Download

memory/2504-177-0x0000014780530000-0x0000014780540000-memory.dmp

Download

memory/2504-176-0x0000014780520000-0x0000014780530000-memory.dmp

Download

memory/2504-175-0x0000014780480000-0x0000014780490000-memory.dmp

Download

memory/2504-163-0x0000014780460000-0x0000014780470000-memory.dmp

Download

memory/2504-162-0x0000014780450000-0x0000014780460000-memory.dmp

Download

memory/2504-161-0x0000014780440000-0x0000014780450000-memory.dmp

Download

memory/2504-160-0x00000147804F0000-0x0000014780500000-memory.dmp

Download

memory/2504-159-0x00000147804E0000-0x00000147804F0000-memory.dmp

Download

memory/2504-158-0x0000014780430000-0x0000014780440000-memory.dmp

Download

memory/2504-167-0x0000014780510000-0x0000014780520000-memory.dmp

Download

memory/2504-154-0x00000147804D0000-0x00000147804E0000-memory.dmp

Download

memory/2504-101-0x00000147803C0000-0x00000147803D0000-memory.dmp

Download

memory/2504-149-0x0000014780410000-0x0000014780420000-memory.dmp

Download

memory/2504-148-0x0000014780400000-0x0000014780410000-memory.dmp

Download

memory/2504-147-0x00000147803F0000-0x0000014780400000-memory.dmp

Download

memory/2504-146-0x00000147803E0000-0x00000147803F0000-memory.dmp

Download

memory/2504-144-0x00000147803C0000-0x00000147803D0000-memory.dmp

Download

memory/2504-145-0x00000147803D0000-0x00000147803E0000-memory.dmp

Download

memory/2504-143-0x00000147803B0000-0x00000147803C0000-memory.dmp

Download

memory/2504-183-0x0000014780550000-0x0000014780560000-memory.dmp

Download

memory/2504-182-0x00000147804A0000-0x00000147804B0000-memory.dmp

Download

memory/2504-186-0x00000147804B0000-0x00000147804C0000-memory.dmp

Download

memory/2504-187-0x0000014780580000-0x0000014780590000-memory.dmp

Download

memory/2504-191-0x00000147804D0000-0x00000147804E0000-memory.dmp

Download

memory/2504-190-0x00000147804C0000-0x00000147804D0000-memory.dmp

Download

memory/2504-188-0x0000014780560000-0x0000014780570000-memory.dmp

Download

memory/2504-189-0x0000014780570000-0x0000014780580000-memory.dmp

Download

memory/2504-193-0x0000014780590000-0x00000147805A0000-memory.dmp

Download

memory/2504-196-0x00000147804E0000-0x00000147804F0000-memory.dmp

Download

memory/2504-197-0x00000147804F0000-0x0000014780500000-memory.dmp

Download

memory/2504-198-0x00000147805A0000-0x00000147805B0000-memory.dmp

Download

memory/2504-201-0x00000147805B0000-0x00000147805C0000-memory.dmp

Download

memory/2504-242-0x00000147F8C50000-0x00000147F8C51000-memory.dmp

Download

memory/2504-290-0x00000147F8C50000-0x00000147F8C51000-memory.dmp

Download

memory/2504-402-0x00000147F8C50000-0x00000147F8C51000-memory.dmp

Download

memory/2504-429-0x00000147F8C50000-0x00000147F8C51000-memory.dmp

Download

memory/2504-441-0x00000147F8C50000-0x00000147F8C51000-memory.dmp

Download

memory/2504-103-0x00000147803E0000-0x00000147803F0000-memory.dmp

Download

memory/2504-104-0x00000147803F0000-0x0000014780400000-memory.dmp

Download

memory/2504-105-0x0000014780400000-0x0000014780410000-memory.dmp

Download

memory/2504-106-0x0000014780410000-0x0000014780420000-memory.dmp

Download

memory/2504-107-0x00000147802C0000-0x00000147802D0000-memory.dmp

Download

memory/2504-91-0x00000147802B0000-0x00000147802C0000-memory.dmp

Download

memory/2504-68-0x0000014780330000-0x0000014780340000-memory.dmp

Download

memory/2504-70-0x0000014780270000-0x0000014780280000-memory.dmp

Download

memory/2504-65-0x0000014780310000-0x0000014780320000-memory.dmp

Download

memory/2504-58-0x0000014780300000-0x0000014780310000-memory.dmp

Download

memory/2504-57-0x0000014780000000-0x0000014780270000-memory.dmp

Download

memory/2504-55-0x00000147802F0000-0x0000014780300000-memory.dmp

Download

memory/2504-51-0x00000147802D0000-0x00000147802E0000-memory.dmp

Download

memory/2504-52-0x00000147802E0000-0x00000147802F0000-memory.dmp

Download

memory/2504-452-0x00000147F8C50000-0x00000147F8C51000-memory.dmp

Download

memory/2504-461-0x00000147F8C50000-0x00000147F8C51000-memory.dmp

Download

memory/2504-463-0x00000147F8C50000-0x00000147F8C51000-memory.dmp

Download

memory/2504-508-0x00000147F8C50000-0x00000147F8C51000-memory.dmp

Download

memory/2504-683-0x00000147F8C50000-0x00000147F8C51000-memory.dmp

Download

memory/2504-48-0x00000147802C0000-0x00000147802D0000-memory.dmp

Download

memory/2504-43-0x0000014780290000-0x00000147802A0000-memory.dmp

Download

memory/2504-45-0x00000147802A0000-0x00000147802B0000-memory.dmp

Download

memory/2504-46-0x00000147802B0000-0x00000147802C0000-memory.dmp

Download

memory/2504-37-0x00000147F8C50000-0x00000147F8C51000-memory.dmp

Download

memory/2504-34-0x0000014780280000-0x0000014780290000-memory.dmp

Download

memory/2504-31-0x0000014780270000-0x0000014780280000-memory.dmp

Download

memory/2504-16-0x00000147F8C50000-0x00000147F8C51000-memory.dmp

Download

memory/2504-3-0x0000014780000000-0x0000014780270000-memory.dmp

Download

memory/4316-642-0x000001CD30490000-0x000001CD30491000-memory.dmp

Download

memory/4316-667-0x000001CD30490000-0x000001CD30491000-memory.dmp

Download

memory/4316-677-0x000001CD30490000-0x000001CD30491000-memory.dmp

Download

memory/4316-584-0x000001CD30490000-0x000001CD30491000-memory.dmp

Download

memory/4992-0-0x0000000000400000-0x0000000000428000-memory.dmp

Download