67aa43456e09b095e95ad369ed81e5eb5ada1007fb002bcbbdf02133617402ca

Resubmissions

04/11/2026, 19:10

261104-xvb1yaee377

04/11/2026, 19:07

261104-xsrnlstyg17

Analysis

user interaction
yes
max time kernel
68s
max time network
55s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/11/2026, 19:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
launcher-1.09_17.exe
Size 746KB
Sample261104-xvb1yaee37
SHA256 67aa43456e09b095e95ad369ed81e5eb5ada1007fb002bcbbdf02133617402ca
MD5 0fbc764e8da59c3d86513a39a4d4c260
SHA1 41150deef0b46d0dc8c864464910b533c86bbbad
SHA512 863eb404cec3c4c9b3f0041d1d7a2609fd6df20975d95eeb9499d23bc01f90452cdaeb01784c42116d8d58dc945e8e6f2eec19fcb97e046d6174baddb511f5c7
SSDEEP 12288:fuvaO9Es/ZxNwsooperNotmRcWT43YQFXdQXXXfyMKJ+n8M1bkc:fuvaQ/DNTqoPWkYQ9EaSnvN/
TLSH
T188F40153F09628AEF53B87734051A22338BCB1FED04B60296AF5119B7D77C896F16398
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Loads dropped DLL 3 IoCs

pid	Process
4300	java.exe
4300	java.exe
4300	java.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	checkip.amazonaws.com

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4812	GameBarPresenceWriter.exe

Drops file in System32 directory 16 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_5ab7d1c25144fcab\msmouse.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_726cea1f0f349cf7\machine.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\machine.inf_amd64_726cea1f0f349cf7\machine.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_585900615f764770\usbport.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\input.inf_amd64_702fdf2336d2162d\input.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\input.inf_amd64_702fdf2336d2162d\input.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_cc6edbde0940344f\keyboard.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hdaudbus.inf_amd64_8207ba80cf22e40a\hdaudbus.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\usbport.inf_amd64_585900615f764770\usbport.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtl64.inf_amd64_8e9c2368fe308df2\netrtl64.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\netrtl64.inf_amd64_8e9c2368fe308df2\netrtl64.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\hdaudbus.inf_amd64_8207ba80cf22e40a\hdaudbus.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_84ea762c0a90c362\mshdc.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\mshdc.inf_amd64_84ea762c0a90c362\mshdc.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\msmouse.inf_amd64_5ab7d1c25144fcab\msmouse.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\keyboard.inf_amd64_cc6edbde0940344f\keyboard.PNF	dxdiag.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3660	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	launcher-1.09_17.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	dxdiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	dxdiag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dxdiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dxdiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	dxdiag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dxdiag.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Modifies registry class 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\discord-939918927989973052\shell\open	java.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\VersionIndependentProgID	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\InprocServer32	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\ = "DxDiagClassObject Class"	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\CLSID\ = "{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}"	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ForceRemove\ = "Programmable"	dxdiag.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\discord-939918927989973052\shell	java.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\discord-939918927989973052\shell\open\command\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\java.exe"	java.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1\ = "DxDiagProvider Class"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CLSID	dxdiag.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1494457106-2582563566-1599095290-1000\{123A64A4-DB95-4C6A-98DA-97706B7CEC0F}	dxdiag.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\discord-939918927989973052\shell\open\command	java.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\VersionIndependentProgID\ = "DxDiag.DxDiagClassObject"	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ = "C:\\Windows\\system32\\dxdiagn.dll"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}	dxdiag.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\discord-939918927989973052\ = "URL:Run game 939918927989973052 protocol"	java.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\discord-939918927989973052\DefaultIcon\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\java.exe"	java.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CurVer\ = "DxDiag.DxDiagClassObject.1"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\ProgID	dxdiag.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1494457106-2582563566-1599095290-1000\{2B3C41F1-9D45-404E-ACF8-8DE1BF8DF9E6}	dxdiag.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1494457106-2582563566-1599095290-1000\{722B6E6C-5E05-4ADC-98AC-2D8E63A546FE}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ThreadingModel = "Apartment"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CurVer	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\CLSID	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\ = "DxDiagClassObject Class"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CLSID	dxdiag.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\discord-939918927989973052\DefaultIcon	java.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ = "DxDiagClassObject Class"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ProgID	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ForceRemove	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1\CLSID	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CurVer	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CurVer\ = "DxDiag.DxDiagClassObject.1"	dxdiag.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\discord-939918927989973052	java.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\discord-939918927989973052\URL Protocol	java.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ProgID\ = "DxDiag.DxDiagClassObject.1"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CLSID\ = "{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\VersionIndependentProgID	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\ = "DxDiagProvider Class"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	dxdiag.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5068	dxdiag.exe
5068	dxdiag.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4640	javaw.exe
4640	javaw.exe
5068	dxdiag.exe
4300	java.exe
4300	java.exe
4416	OpenWith.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 4640	1528	launcher-1.09_17.exe	81
PID 4640 wrote to memory of 3660	4640	javaw.exe	82
PID 3660 wrote to memory of 5068	3660	cmd.exe	84
PID 4640 wrote to memory of 2172	4640	javaw.exe	87
PID 4640 wrote to memory of 4300	4640	javaw.exe	89

C:\Users\Admin\AppData\Local\Temp\launcher-1.09_17.exe
"C:\Users\Admin\AppData\Local\Temp\launcher-1.09_17.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\launcher-1.09_17.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C dxdiag /t C:\Users\Admin\AppData\Roaming\.betacraft\launcher\dxdiag_report.txt
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3660
  - - C:\Windows\system32\dxdiag.exe
      dxdiag /t C:\Users\Admin\AppData\Roaming\.betacraft\launcher\dxdiag_report.txt
      4⤵
      Drops file in System32 directory
      Checks SCSI registry key(s)
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:5068
- - C:\Program Files\Java\jre-1.8\bin\java.exe
    "C:\Program Files\Java\jre-1.8\bin\java.exe" -version
    3⤵
    PID:2172
- - C:\Program Files\Java\jre-1.8\bin\java.exe
    "C:\Program Files\Java\jre-1.8\bin\java.exe" -XX:HeapDumpPath=java.exe_minecraft.exe.heapdump -Djava.util.Arrays.useLegacyMergeSort=true -Dhttp.nonProxyHosts=api.betacraft.uk|files.betacraft.uk|checkip.amazonaws.com -Xmx1G -Dhttp.proxyHost=betacraft.uk -Dhttp.proxyPort=11705 -cp C:\Users\Admin\AppData\Roaming\.betacraft\launcher\betacraft_wrapper.jar;C:\Users\Admin\AppData\Roaming\.betacraft\launcher\discord_rpc.jar org.betacraft.launcher.Launcher wrap hello - - - - "default instance"
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:4300

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:4812

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:2076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

discord-rpc.dll

Path C:\Users\Admin\AppData\Local\Temp\drpc560892857050\discord-rpc.dll
Size 390KB
SHA256 5cc2e504800cf4ed2f4781364f661ea22349658ddc391b5d54195e573109d87b
MD5 5882c37b79bae47a0d090006564edb22
SHA1 ac7bbbdb1d34eb763d8db4ef7875a50f700e9d48
SHA512 d4a6a1a36842dd1c8b2162168807b990e0d491a908e11b52ebf11174a67f818b131607c2122dbb484f5d946418a05a1a84d42e1468bef5c98ec3fcff7d225ccd
SSDEEP 6144:TnQCrLe2xJLChxTC+LxTYXrHJZ5upQtXsK+62C3wh+0U1c5xrunBLko:TnQCrLXxgvU7v8ph7+0kHB7
TLSH
T12C847D5AFB6448B5D0679135C973864BE3B27C891B70D78F23A8439A2F37BA1453E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jna2872112671917176670.dll

Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna2872112671917176670.dll
Size 240KB
SHA256 0525f9e2db0146f7abcc8cd86cf4fb01721fad0d5c9a1806b5805bb789eb8c98
MD5 1164914ca1307de98cc0d57e42285ef2
SHA1 9387f983c88c425c91e5caae2409cf4180b02096
SHA512 7fbb98c3768e22429ad39070fd2fdbf38d9585e81df592d7fb64cdc03e890d6ce57a72bafbc8815ace9076e5241cfb77d8c23ff1db66ba7564131506d487dc5e
SSDEEP 6144:ONdFEp41M0A9mAkXZdHlLm1Rq6Y+S4Dedhx3U3YfHy0o8N:2FEG1jQRA+SQOI
TLSH
T114342907F7B248E5E8B7C03A49136A12F57278194320EBEB47858B535F66BE09B3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinput.jar

Path C:\Users\Admin\AppData\Roaming\.betacraft\bin\jinput.jar
Size 226KB
SHA256 ce27de713e36a72a89e9495861c8265b0f81069366567c1c5c69e7d2ede58c89
MD5 e41a078a1f6cae716215235fbf0b5689
SHA1 a91a5631d319c8f50851b731c435cf66eb1d1e7e
SHA512 6a2e6adf035eb6d99bbe69dbda7d84cbdce5ef95ad3751731a5b564928a43306deec8799af8e5abcbb9decfd8cb50c2196098787f1373bc274ddc80852a3a2f1
SSDEEP 6144:39U+yLUxpmoMxD8nobRwNXiBkZZuUGT89bZZ:39U8xIb/m8BkvuUR3
TLSH
T1EB34CF276EAA8529F223C3320991A2D6FC2C95A45C0B926F7071C49D78B0D4617DBFDF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lwjgl.jar

Path C:\Users\Admin\AppData\Roaming\.betacraft\bin\lwjgl.jar
Size 1.0MB
SHA256 3751d0003f4c9c94075a362b03385357140c111dc5d3ffe2fd7c969bf421633e
MD5 980065fb23b1f8aab432cb5ee9da4f23
SHA1 d04e9dc91396d49f5d849277365f821ced845d94
SHA512 948262452fa5ea31016b314730c191966b8cf79c0740151fbadcff415b265f1d3a82470ff5c526ebf2058f8a3fd6dea71c207d77ec152fa0a82552b27637c66f
SSDEEP 24576:q6xwM053tw8NvDXbDkrl5QWZPBMOb6MDGDxsLJIMLQI:Litw85krlyWdBVbKxs9Is
TLSH
T17C25F123DCE7902AFD27413944932B3A741D37ECD886899017AA1BC2B5778A5FB27734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lwjgl_util.jar

Path C:\Users\Admin\AppData\Roaming\.betacraft\bin\lwjgl_util.jar
Size 183KB
SHA256 79780bf0034ce3483881728ff98c27f5006558dcb88710a564b670cf5bf045cb
MD5 0df9866d92e0f383c4753b28a80dd7aa
SHA1 6a147878f2d2675fe103f8bd0abee580f722b8a6
SHA512 364b79a3e5d6240fe5b28c2d16c0758403e45f6e88e88ba3c5e456c5c70a97c9fa8f6abff70b6309ca852c7f794d09afe89afcca968830121afd12f144772540
SSDEEP 3072:VaxteT4eaxYCGjZRn99oNlByzPRICdDGjl+LCKhhUBg1KVQEGCN:Vaxtm4eaulfCNlcOCdDpO+hUBIadGCN
TLSH
T1D904DF41FDFBFA3DE207813901838792653AD384A9E9E0B788D48656CAD4C964F437ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lwjgl64.dll

Path C:\Users\Admin\AppData\Roaming\.betacraft\bin\natives\lwjgl64.dll
Size 310KB
SHA256 094c38a9b6b9ab76e3730838d542419811e63de5d4a4ba5a22d83f6edd803943
MD5 73cb2a967d771c65bc46c543f61a9898
SHA1 0ef71be40bac0a5213b1a5c38739b1610ab311e6
SHA512 1fa057fe5739f1ba457e0b95f01c1a378469fcb4944453bbd5b335281dbce882e730b601fa1e6053860053fdce2a6bd7f72342b6e9d8b6bf1f75a49af59662e8
SSDEEP 3072:by6nSomUPQukwpSor62AIiGYIR2LGPHc0Ul+S4KQIw6tqYKVFlCh7NZqSEgbh:bciFkwpL2DI0yPHqw6tVKYr
TLSH
T1A2642363EF27C47AEE4B323944C00875721C74A01A5563C7261CEAC6B5DE7B487A6F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

betacraft_wrapper.jar

Path C:\Users\Admin\AppData\Roaming\.betacraft\launcher\betacraft_wrapper.jar
Size 746KB
SHA256 67aa43456e09b095e95ad369ed81e5eb5ada1007fb002bcbbdf02133617402ca
MD5 0fbc764e8da59c3d86513a39a4d4c260
SHA1 41150deef0b46d0dc8c864464910b533c86bbbad
SHA512 863eb404cec3c4c9b3f0041d1d7a2609fd6df20975d95eeb9499d23bc01f90452cdaeb01784c42116d8d58dc945e8e6f2eec19fcb97e046d6174baddb511f5c7
SSDEEP 12288:fuvaO9Es/ZxNwsooperNotmRcWT43YQFXdQXXXfyMKJ+n8M1bkc:fuvaQ/DNTqoPWkYQ9EaSnvN/
TLSH
T188F40153F09628AEF53B87734051A22338BCB1FED04B60296AF5119B7D77C896F16398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

discord_rpc.jar

Path C:\Users\Admin\AppData\Roaming\.betacraft\launcher\discord_rpc.jar
Size 2.0MB
SHA256 619500b324fcadc52b9e2319585934179b69e21589f34858cc31d7d6e2442eac
MD5 d75aa9aec06d3d536cc1229d21db46a9
SHA1 93c0f6aee918cc3a41baf36a90020d537d1eb1ba
SHA512 af8b37a56c906b1850385b80e40173928e792470faec5aed5d5c18e09c9d70235863449f650cbf1c1b542fcebf9e16964ab6ba90a82bba84be7b993db525576c
SSDEEP 49152:zkwTKERBhO88JnDqCTE+tAP4nkRCeaRPC+aGo/CP:zjeEXSBVT2BAXRPC+aTCP
TLSH
T1DBA52357FC5A811DCA27D5F732CF4B86AE165669AF116CED02FC092448829C307D3BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxdiag_report.txt

Path C:\Users\Admin\AppData\Roaming\.betacraft\launcher\dxdiag_report.txt
Size 84KB
SHA256 74c66c55d8a4b6cfee120e825eb8074875e90eceec7aa9d66e1c37ed1f2c65bf
MD5 9ec174d46665d913d32a774fcfbf54b6
SHA1 310d83bec8928b210871cd1c891a352a83128114
SHA512 3512aa0eb889a8ed5d51606839330a59e99e1cfda2cac6a238e01dfd8213e238b4141e5b7a8a5d1db1e9ad5337d431e5d57b46913906b1df2c1e9787a7c964f7
SSDEEP 768:nXqO0VWIndCwzcCotHC9pBM8nKuj5nUovxlG0C14JkNEr+aL/F/JOlKwY0:ngk6ljIV14Ou0
TLSH
T1D48398F96C41C454F055C15662787625DA2D34D320EA8DAD3ABCEFC90F22DFAE238E52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default instance.txt

Path C:\Users\Admin\AppData\Roaming\.betacraft\launcher\instances\default instance.txt
Size 288B
SHA256 629dee5efed0efa8091a8a403b7e33ab5a5d1da5276bfbd769f0ffadae47d2ef
MD5 49fe992fa8f5419c26a539c000da1e3d
SHA1 1bfd76ebf7f503ff50d90da7b143ea2cca9f2986
SHA512 b9a242afe342c9e0be551aa5d0871599970ef1a3080cf3aced20e15d35d9a7b61228f8e2d22526f7624bf4bd928d354857ec42eb498b231821ec3676fd30c88b
TLSH
T133D02B20EFA3E8BEFC7406818B60395602B39FA5325A7575DEAC00CE79832092054857
MD5 SHA1 SHA512 TLSH

Submit Download

English.txt

Path C:\Users\Admin\AppData\Roaming\.betacraft\launcher\lang\English.txt
Size 36B
SHA256 2b6a86fb912cf4d4a5e31f6792d85657615db3d853fb8babffadcb69dd8f4df0
MD5 6669d7a6e0e6b3ed8df4c9e58bcbf889
SHA1 1759adc237ce6888508d964e746f57838946ae95
SHA512 9f575cfe707ebeadd592eb9f65919cea2ce870b074257c659973758d606f33a3169a0abd428b8e646b3469989e714da5d2807b74be6dd233b4e5e27b7ff1c118
MD5 SHA1 SHA512

Submit Download

launcher.settings

Path C:\Users\Admin\AppData\Roaming\.betacraft\launcher\launcher.settings
Size 127B
SHA256 1316aad9ccc6fadb756ebcf168a9c285d5032612b82ac5f10040071ab0fee2df
MD5 422a1ded941591e8690fee28db6adc6c
SHA1 7967510ec7aba79d96c346265788acfecb5f805e
SHA512 0fb9055c130eeb4436f7ed39516c532cf403bb33b259c6b8ed7f11a9aae3109a27651c42d18a49f1939662dafcb519a731c4eb324f83e45ef0fbe97fbaa670d5
TLSH
T138B0921A6B20E9AEAA188282215078955BF2A158E02228A05C8E070AD3EB20D829B567
MD5 SHA1 SHA512 TLSH

Submit Download

a1.2.6.jar

Path C:\Users\Admin\AppData\Roaming\.betacraft\versions\a1.2.6.jar
Size 1.1MB
SHA256 63276bf2617068ffbaf2a1992d1f06f9339c96c21991eafc9583d5f3e7074b9c
MD5 ddd5e39467f28d1ea1a03b4d9e790867
SHA1 a68c817afd6c05c253ba5462287c2c19bbb57935
SHA512 f888705df23b55bdb5298cfa74f262f5f39f4e6c3bb18791b668117fcd10ce6c8acbcc1e5483325d9e0c5888ad86bd3438954d21bb58ff271a81c2323e6aab51
SSDEEP 24576:wiPPeUOT0ARZ2ryKiGPMK7e5RpFz/oBvAJr58YqXsfh:pPeUzA+iSR8z2vsuvXsfh
TLSH
T11C35126AEE12153AED7792350141C035B85F02ECE549E12A1AF07A9A9D61FC90F83FDF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a1.2.6.info

Path C:\Users\Admin\AppData\Roaming\.betacraft\versions\jsons\a1.2.6.info
Size 300B
SHA256 8f8d52a2f2f3f07ca8533726fcbf9412b386eee1e7a8ebbec3d5a0ad166f2bc0
MD5 5ac014c0edefb32bcb000698cccb1bdd
SHA1 5baee8b0c7431cfd5acf126681fa83344cc8de59
SHA512 614d642946fb2aa6855aa4dddb15d68bf2d49c9ecc760545dabc490bf70d79eff6a8873d657a419f01c286b7fc65ad6704023b2a14009561d528a992dc6a39ca
TLSH
T1EAE0E7D0F107A074477B43097710F39FC71D5524C4B0C2527271734140074BE814CD54
MD5 SHA1 SHA512 TLSH

Submit Download

83aa4cc77f591dfc2374580bbd95f6ba_8ff48af0-c8fa-41bb-b3f4-aa47420407ca

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1494457106-2582563566-1599095290-1000\83aa4cc77f591dfc2374580bbd95f6ba_8ff48af0-c8fa-41bb-b3f4-aa47420407ca
Size 45B
SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
MD5 c8366ae350e7019aefc9d1e6e6a498c6
SHA1 5731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA512 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
MD5 SHA1 SHA512

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1528-0-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4300-629-0x000001C9BFFF0000-0x000001C9BFFF1000-memory.dmp

Download

memory/4300-749-0x000001C9BFFF0000-0x000001C9BFFF1000-memory.dmp

Download

memory/4300-747-0x000001C9BFFF0000-0x000001C9BFFF1000-memory.dmp

Download

memory/4300-634-0x000001C9BFFF0000-0x000001C9BFFF1000-memory.dmp

Download

memory/4300-746-0x000001C9BFFF0000-0x000001C9BFFF1000-memory.dmp

Download

memory/4300-729-0x000001C9BFFF0000-0x000001C9BFFF1000-memory.dmp

Download

memory/4300-642-0x000001C9BFFF0000-0x000001C9BFFF1000-memory.dmp

Download

memory/4300-650-0x000001C9BFFF0000-0x000001C9BFFF1000-memory.dmp

Download

memory/4300-670-0x000001C9BFFF0000-0x000001C9BFFF1000-memory.dmp

Download

memory/4300-569-0x000001C9BFFF0000-0x000001C9BFFF1000-memory.dmp

Download

memory/4300-675-0x000001C9BFFF0000-0x000001C9BFFF1000-memory.dmp

Download

memory/4640-163-0x0000013995880000-0x0000013995890000-memory.dmp

Download

memory/4640-192-0x0000013995930000-0x0000013995940000-memory.dmp

Download

memory/4640-128-0x0000013995700000-0x0000013995710000-memory.dmp

Download

memory/4640-127-0x00000139956F0000-0x0000013995700000-memory.dmp

Download

memory/4640-126-0x00000139957F0000-0x0000013995800000-memory.dmp

Download

memory/4640-125-0x00000139957E0000-0x00000139957F0000-memory.dmp

Download

memory/4640-124-0x00000139956E0000-0x00000139956F0000-memory.dmp

Download

memory/4640-122-0x00000139956D0000-0x00000139956E0000-memory.dmp

Download

memory/4640-121-0x00000139956C0000-0x00000139956D0000-memory.dmp

Download

memory/4640-120-0x00000139956B0000-0x00000139956C0000-memory.dmp

Download

memory/4640-119-0x00000139957D0000-0x00000139957E0000-memory.dmp

Download

memory/4640-118-0x00000139957C0000-0x00000139957D0000-memory.dmp

Download

memory/4640-117-0x00000139956A0000-0x00000139956B0000-memory.dmp

Download

memory/4640-113-0x0000013995790000-0x00000139957A0000-memory.dmp

Download

memory/4640-112-0x0000013995690000-0x00000139956A0000-memory.dmp

Download

memory/4640-111-0x00000139957B0000-0x00000139957C0000-memory.dmp

Download

memory/4640-107-0x0000013995770000-0x0000013995780000-memory.dmp

Download

memory/4640-106-0x0000013995760000-0x0000013995770000-memory.dmp

Download

memory/4640-105-0x0000013995750000-0x0000013995760000-memory.dmp

Download

memory/4640-104-0x0000013995740000-0x0000013995750000-memory.dmp

Download

memory/4640-102-0x0000013995680000-0x0000013995690000-memory.dmp

Download

memory/4640-96-0x0000013995730000-0x0000013995740000-memory.dmp

Download

memory/4640-95-0x0000013995670000-0x0000013995680000-memory.dmp

Download

memory/4640-93-0x0000013995660000-0x0000013995670000-memory.dmp

Download

memory/4640-92-0x0000013995720000-0x0000013995730000-memory.dmp

Download

memory/4640-91-0x0000013995710000-0x0000013995720000-memory.dmp

Download

memory/4640-90-0x0000013993BC0000-0x0000013993BC1000-memory.dmp

Download

memory/4640-132-0x0000013995800000-0x0000013995810000-memory.dmp

Download

memory/4640-131-0x0000013995720000-0x0000013995730000-memory.dmp

Download

memory/4640-135-0x0000013995810000-0x0000013995820000-memory.dmp

Download

memory/4640-134-0x0000013995710000-0x0000013995720000-memory.dmp

Download

memory/4640-138-0x0000013995820000-0x0000013995830000-memory.dmp

Download

memory/4640-143-0x0000013995830000-0x0000013995840000-memory.dmp

Download

memory/4640-142-0x0000013995780000-0x0000013995790000-memory.dmp

Download

memory/4640-141-0x0000013995740000-0x0000013995750000-memory.dmp

Download

memory/4640-140-0x0000013995730000-0x0000013995740000-memory.dmp

Download

memory/4640-148-0x0000013995770000-0x0000013995780000-memory.dmp

Download

memory/4640-151-0x0000013995840000-0x0000013995850000-memory.dmp

Download

memory/4640-150-0x0000013995790000-0x00000139957A0000-memory.dmp

Download

memory/4640-149-0x00000139957B0000-0x00000139957C0000-memory.dmp

Download

memory/4640-147-0x0000013995760000-0x0000013995770000-memory.dmp

Download

memory/4640-146-0x0000013995750000-0x0000013995760000-memory.dmp

Download

memory/4640-154-0x0000013995850000-0x0000013995860000-memory.dmp

Download

memory/4640-152-0x00000139957A0000-0x00000139957B0000-memory.dmp

Download

memory/4640-159-0x0000013995870000-0x0000013995880000-memory.dmp

Download

memory/4640-158-0x0000013995860000-0x0000013995870000-memory.dmp

Download

memory/4640-157-0x00000139957D0000-0x00000139957E0000-memory.dmp

Download

memory/4640-165-0x00000139957F0000-0x0000013995800000-memory.dmp

Download

memory/4640-164-0x0000013995890000-0x00000139958A0000-memory.dmp

Download

memory/4640-108-0x0000013995780000-0x0000013995790000-memory.dmp

Download

memory/4640-162-0x00000139957E0000-0x00000139957F0000-memory.dmp

Download

memory/4640-156-0x00000139957C0000-0x00000139957D0000-memory.dmp

Download

memory/4640-171-0x0000013995800000-0x0000013995810000-memory.dmp

Download

memory/4640-173-0x00000139958B0000-0x00000139958C0000-memory.dmp

Download

memory/4640-172-0x00000139958A0000-0x00000139958B0000-memory.dmp

Download

memory/4640-174-0x00000139958C0000-0x00000139958D0000-memory.dmp

Download

memory/4640-175-0x00000139958D0000-0x00000139958E0000-memory.dmp

Download

memory/4640-176-0x00000139958E0000-0x00000139958F0000-memory.dmp

Download

memory/4640-177-0x0000013995810000-0x0000013995820000-memory.dmp

Download

memory/4640-187-0x0000013995820000-0x0000013995830000-memory.dmp

Download

memory/4640-180-0x0000013993BC0000-0x0000013993BC1000-memory.dmp

Download

memory/4640-194-0x0000013995830000-0x0000013995840000-memory.dmp

Download

memory/4640-193-0x0000013995920000-0x0000013995930000-memory.dmp

Download

memory/4640-114-0x00000139957A0000-0x00000139957B0000-memory.dmp

Download

memory/4640-191-0x0000013995940000-0x0000013995950000-memory.dmp

Download

memory/4640-190-0x0000013995910000-0x0000013995920000-memory.dmp

Download

memory/4640-189-0x0000013995900000-0x0000013995910000-memory.dmp

Download

memory/4640-188-0x00000139958F0000-0x0000013995900000-memory.dmp

Download

memory/4640-197-0x0000013995950000-0x0000013995960000-memory.dmp

Download

memory/4640-196-0x0000013995840000-0x0000013995850000-memory.dmp

Download

memory/4640-198-0x0000013993BC0000-0x0000013993BC1000-memory.dmp

Download

memory/4640-200-0x0000013995850000-0x0000013995860000-memory.dmp

Download

memory/4640-201-0x0000013995960000-0x0000013995970000-memory.dmp

Download

memory/4640-203-0x0000013995860000-0x0000013995870000-memory.dmp

Download

memory/4640-206-0x0000013993BC0000-0x0000013993BC1000-memory.dmp

Download

memory/4640-254-0x0000013993BC0000-0x0000013993BC1000-memory.dmp

Download

memory/4640-275-0x0000013993BC0000-0x0000013993BC1000-memory.dmp

Download

memory/4640-372-0x0000013993BC0000-0x0000013993BC1000-memory.dmp

Download

memory/4640-385-0x0000013993BC0000-0x0000013993BC1000-memory.dmp

Download

memory/4640-390-0x0000013993BC0000-0x0000013993BC1000-memory.dmp

Download

memory/4640-420-0x0000013993BC0000-0x0000013993BC1000-memory.dmp

Download

memory/4640-423-0x0000013993BC0000-0x0000013993BC1000-memory.dmp

Download

memory/4640-456-0x0000013993BC0000-0x0000013993BC1000-memory.dmp

Download

memory/4640-481-0x0000013993BC0000-0x0000013993BC1000-memory.dmp

Download

memory/4640-477-0x0000013993BC0000-0x0000013993BC1000-memory.dmp

Download

memory/4640-483-0x0000013993BC0000-0x0000013993BC1000-memory.dmp

Download

memory/4640-536-0x0000013993BC0000-0x0000013993BC1000-memory.dmp

Download

memory/4640-534-0x0000013993BC0000-0x0000013993BC1000-memory.dmp

Download

memory/4640-532-0x0000013993BC0000-0x0000013993BC1000-memory.dmp

Download

memory/4640-531-0x0000013993BC0000-0x0000013993BC1000-memory.dmp

Download

memory/4640-3-0x0000013995390000-0x0000013995600000-memory.dmp

Download

memory/4640-16-0x0000013993BC0000-0x0000013993BC1000-memory.dmp

Download

memory/4640-31-0x0000013995600000-0x0000013995610000-memory.dmp

Download

memory/4640-33-0x0000013995610000-0x0000013995620000-memory.dmp

Download

memory/4640-36-0x0000013995620000-0x0000013995630000-memory.dmp

Download

memory/4640-84-0x0000013995630000-0x0000013995640000-memory.dmp

Download

memory/4640-85-0x0000013995640000-0x0000013995650000-memory.dmp

Download

memory/4640-86-0x0000013995650000-0x0000013995660000-memory.dmp

Download

memory/4640-81-0x0000013995620000-0x0000013995630000-memory.dmp

Download

memory/4640-82-0x00000139956F0000-0x0000013995700000-memory.dmp

Download

memory/4640-83-0x0000013995700000-0x0000013995710000-memory.dmp

Download

memory/4640-68-0x00000139956B0000-0x00000139956C0000-memory.dmp

Download

memory/4640-69-0x00000139956C0000-0x00000139956D0000-memory.dmp

Download

memory/4640-70-0x00000139956D0000-0x00000139956E0000-memory.dmp

Download

memory/4640-71-0x00000139956E0000-0x00000139956F0000-memory.dmp

Download

memory/4640-72-0x0000013995610000-0x0000013995620000-memory.dmp

Download

memory/4640-67-0x0000013995600000-0x0000013995610000-memory.dmp

Download

memory/4640-58-0x0000013995690000-0x00000139956A0000-memory.dmp

Download

memory/4640-59-0x00000139956A0000-0x00000139956B0000-memory.dmp

Download

memory/4640-57-0x0000013995390000-0x0000013995600000-memory.dmp

Download

memory/4640-54-0x0000013995680000-0x0000013995690000-memory.dmp

Download

memory/4640-53-0x0000013995670000-0x0000013995680000-memory.dmp

Download

memory/4640-50-0x0000013995660000-0x0000013995670000-memory.dmp

Download

memory/4640-45-0x0000013995630000-0x0000013995640000-memory.dmp

Download

memory/4640-47-0x0000013995640000-0x0000013995650000-memory.dmp

Download

memory/4640-48-0x0000013995650000-0x0000013995660000-memory.dmp

Download

memory/4640-39-0x0000013993BC0000-0x0000013993BC1000-memory.dmp

Download

memory/5068-498-0x0000018C13F60000-0x0000018C13F61000-memory.dmp

Download

memory/5068-497-0x0000018C13F60000-0x0000018C13F61000-memory.dmp

Download

memory/5068-487-0x0000018C13F60000-0x0000018C13F61000-memory.dmp

Download

memory/5068-488-0x0000018C13F60000-0x0000018C13F61000-memory.dmp

Download

memory/5068-486-0x0000018C13F60000-0x0000018C13F61000-memory.dmp

Download

memory/5068-496-0x0000018C13F60000-0x0000018C13F61000-memory.dmp

Download

memory/5068-495-0x0000018C13F60000-0x0000018C13F61000-memory.dmp

Download

memory/5068-494-0x0000018C13F60000-0x0000018C13F61000-memory.dmp

Download

memory/5068-493-0x0000018C13F60000-0x0000018C13F61000-memory.dmp

Download

memory/5068-492-0x0000018C13F60000-0x0000018C13F61000-memory.dmp

Download