Guida Screenshare 2025

Una volta aperta la cartella .minecraft dovremo abilitare gli elementi nascosti:

»» Visualizza »» Elementi nascosti

»» Modifica opzioni »» Visualizzazione »» Nascondi file protetti da sistema (consigliato)

»» Applica »» Ok

Per controllare il log del Minecraft che sta utilizzando bisogna recarsi su:

»» .Minecraft »» Logs »» Latest

Se l'utente usa Lunar Client: C:\Users\%Username%\.lunarclient\offline

Se usa BadLion Client: C:\Users\%USERNAME%\AppData\Roaming\.minecraft\logs\blclient\

Tutte le mod hanno un peso, quindi confrontiamo i pesi delle sue mod con i pesi delle mod legit.

»» Apriamo Luyten

»» Trasciniamo la mod al suo interno

»» Controlliamo le Classi della mod e cerchiamo parole come "Aimbot", "Reach", ecc.

Pesi delle mod:

StatusEffect: ~ 24-26 kb
DirectionHud: ~ 23-24 kb
BspkrscoreMod: ~ 193-195 kb
ToggleSneak ~ Minore/uguale di 24 kb
TcpNoDelayMod: ~ 4-6 kb
TimeChanger: ~ 14 kb
CpsMod: ~ 7.6–10 kb
Batty’sCoordMod: ~ 17 kb
FastCraftMod ~ 179-183 kb

Pesi delle mod specifiche:

ArmorStatusHUD v1.26 >> 25-27 KB
ArmorStatusHUD v1.27 >> 25 KB
ArmorStatusHUD v1.28 >> 26-27 KB
ArmorStatusHUD [1.8.9] >> 29-30 KB
Autotip (V2.0.2) >> 57 KB
BattyCordinates >> 14 - 19 KB
BetterFPS Mod >> 18-62 KB
BetterFps-1.0.1 >> 62 KB
BetterSprint >> 70 KB
BetterSprinting >> 65 KB
BiomesOPlenty >> 5.652 KB
BspkrsCore v6.14-v6.16 >> 193-196 KB
BspkrsCore [1.8.9] >> 62 KB
CheatBreaker HUD v4 >> 35-36 KB
CheatBreaker HUD V3 >> 33 KB
CheatBreaker HUD V2 >> 27 KB
CPS Mod v1.1 >> 8-10 KB
Core >> 194 KB
CoordinatesMOD >> 31 KB
CoordsMod v2 >> 11 KB
Custom Crosshair Mod >> 32-64 KB
DirectionHUD v1.23 >> 24 KB
DirectionHUD v1.24 >> 23 KB
Fast Chat >> 4-5 KB
FastCraft Mod >> 115-183 KB
FastRecraft Mod >> 3 KB
FPS Plus >> 147 KB
FPS Spoofer >> 9 KB
In-Game Account Switcher >> 66 KB
ItemPhysic >> 31 KB
Keystrokes mod v1-2 >> 11 KB
Keystroke Mod v3 >> 13-14 KB
KeyMod 1.1 >> 59 KB
Legacy Java Fixer >> 7 KB
LunatriusCore-1.7.10 >> 57 KB
MemoryFix (0.3) >> 12 KB
MotionBlur Mod >> 7 KB
MouseDelayFix >> 5 KB
OldAnimationsMod v2.3.1 Classloader >> 72 KB
OldAnimationsMod v2.3.1 >> 2.209 KB
OldAnimationsMod v2.4 >> 1.437 KB
Optifine_1.7.10_HD_u_C1 >> 929 KB
OptiFine_1.7.10_HD_U_C1 >> 849 KB
OptiFine_1.7.10_HD_U_D3 >> 1,166 KB
Optifine_1.7.10_HD_U_D4 >> 1,167 KB
Optifine_1.7.10_HD_U_E7 >> 1,733 KB
Optifine_1.7.10_HD_U_E3 >> 1,626 KB
Optifine_1.7.10_HD_U_D8 >> 1,599 KB
Optifine_1.7.10_HD_U_D7 >> 1,579 KB
OptiFine_1.8.9_HD_U_H2 >> 1,314 KB
OptiFine_1.8.9_HD_U_H6 >> 1,686 KB
Optifine_1.8.9_HD_U_I7 >> 1,969 KB
Optifine_1.8.9_HD_U_I3 >> 1,840 KB
Optifine_1.8.9_HD_U_H8 >> 1,773 KB
Optifine_1.8.9_HD_U_H7 >> 1,747 KB
Optifine_1.8.9_HD_U_H5 >> 1,616 KB
PerspectiveMod >> 32 KB
Physical Items >> 36kb Lite - 48 KB
Ping Display Mod >> 9 KB
PlayerAPI >> 260-276 KB
PotAlerts Mod >> 29 KB
Potion Counter Mod >> 9 KB
QuickSW >> 4 KB
ReachDisplayMod 1.0 >> 9-10 KB
ReiMinimap Sem Entity / Player Radar >> 178 KB
Saturation Mod >> 39 KB
Sidebar Mod 1.01 >> 10-12 KB
Spinner CPS Mod >> 47 KB
StatusEffectHUD v1.26 >> 23 KB
StatusEffectHUD v1.27 >> 24 KB
StatusEffectHUD (Max) >> 26 KB
ShinyPots >> 5 KB
TabbyChat >> 379 KB
TCPNoDelay >> 4-6 KB
TimeChanger >> 15 KB
ToggleSneak / ToggleSprint >> 21 KB
VoxelMinimap sem Entity/Player Radar >> 466 KB
ToggleSneak >> 20-30 KB

Le Mod Unloadate sono quelle mod rimosse dal processo di Minecraft (javaw.exe).

»» Apriamo Process Hacker

»» javaw.exe »» Properties »» Handles »» Selezioniamo la mod e premiamo su "close"
			DETECT
»» Process Hacker
»» javaw.exe
»» Properties
»» Memory
»» Togliamo la spunta su "hide free regions"
»» Selezioniamo "4" al posto di "10"
»» Attiviamo la spunta su Image e Mapped
»» Filter
»» Contains (case-insensitive)
»» Incolliamo la directory delle mod (esempio: C:\Users\user\AppData\Roaming\.minecraft\mods)

Le mod offuscate hanno codici non leggibili. Se aprendo una mod con Luyten riceviamo un errore sulle .class, la mod è offuscata.

Per "Java Edit" si intende una versione di Java modificata con possibili cheat.

»» Usiamo HashMyFiles per calcolare l'hash SHA-256

»» Confrontiamo l'hash della versione con una versione legit

Ecco le SHA256 per le versioni di Minecraft (fino ad 1.16.5):

1.7.2_OptiFine >> 507fb3660e77ab1a3000424d9b08c61606ae1e5a9be41caa3728bddd9597365f
1.7.10_OptiFine >> a4fc2284657544e0f4bcc964f927c2fda3e3a205178ed1d5d58883aaf9780cce
1.8.0_Optifine >> ccccd0a92f76fbb24279691daad9b67f85d80471a37e59e0da76d7754982dfe8
1.8.1 >> 66a749ad95adcb929439155c0341309e89e437444867e108dcb36fd16493b0bd
1.8.2 >> 5cc5b24312f3d182bf06e7f1a4da3a05ce94be6c861d5c9995c86e6d8811fbe9
1.8.3 >> a4fc2284657544e0f4bcc964f927c2fda3e3a205178ed1d5d58883aaf9780cce
1.9.0_OptiFine >> fc5d229e50a4b91d2e7ae74c8d301f9c41c
1.10.0_OptiFine >> 30d5cc5c34d531121b1f26e560ac4cb2c73c7c1c69bc1bba12513b956d6cfae3
1.11.0_OptiFine >> 6ac68735b345453b01728a99db2cd812992a071f9029987e5d9e7c3d59a738a6
1.12.0_OptiFine >> b4db17c274f5603e37c7ffbb1c62da1b4b06a88f25b9d19a98e4b859d3e91b22
1.12.2_OptiFine >> a0b87d90983cd94490691fef56ec4f4c265648b6f5b8f742fe19113e8ec49e8c

Verifica dei programmi avviati da Explorer (filtri .exe) >> file:/// + .exe
---------------------------------------------------------------------------
Utilizzo del PcaClient per visualizzare i 10 file eseguibili più recenti >> Pcaclient, Salva come .txt, verifica file sospetti
---------------------------------------------------------------------------
Verifica dei file avviati tramite Telegram Desktop >> Regex ^[A-Z:.Users.+.Telegram Desktop.+\.(.*)$
---------------------------------------------------------------------------
Controllo di file avviati da archivi WinRAR o 7Zip >> Regex ^[C-H]:\\Users\\.*\\appdata\\.*\\Temp\\.*.$
---------------------------------------------------------------------------
Filtraggio di file avviati fuori dal Disco C: >> Regex ^(?!C:)[A-Z]:\\.+
---------------------------------------------------------------------------
Ricerca di autoclicker.dll nel System32 >> Regex ^\w:\.+\system32\.+.dll$
---------------------------------------------------------------------------
Ricerca di autoclicker.dll nei file di sistema >> Regex [C-G]:\\(?!windows\\system32).*dll
---------------------------------------------------------------------------
Rilevamento file rinominati o USB history >> Regex ^(?!C:)[A-Z]:\\.+
---------------------------------------------------------------------------
Rilevamento file di registrazione multimediale >> Regex ^[A-Z]:.+\.(|flv|divx|avi|asf|mp4|3gp|swf|mp3|mpeg|mpg|ogm|wmv|mov|mkv|nbr|rm|vob|sfd|webm|xvid)$
---------------------------------------------------------------------------
Ricerca di file con caratteri speciali >> Regex ^file:///[A-Z]:/.+./$
---------------------------------------------------------------------------
Rilevamento di volumi con Mountvol >> Regex ^\\\\?\\.+.Volume.+.\\.+.$
---------------------------------------------------------------------------
Rilevamento di volumi con Mountvol (alternativa) >> Regex \\\?\\Volume{.+}\\.+
---------------------------------------------------------------------------
Filtraggio di ogni file .exe >> Regex ^file:///.+\.exe$
---------------------------------------------------------------------------
Filtraggio di qualsiasi estensione >> Regex ^file:///.+$
---------------------------------------------------------------------------
Filtraggio file di tipo stream >> Regex ^[C-H]:\\.+:
---------------------------------------------------------------------------
Ricerca di file jnativehook >> Regex ^.+jnativehook-.+\.dll$
---------------------------------------------------------------------------
Ricerca di file .cfg in programmi >> Regex ^\w:\\.+{directory}.+\.(exe|cfg)$
---------------------------------------------------------------------------
Rilevamento dei file .dll non nel sistema >> Contains (case-insensitive) Stringa Visited

Clear-Host

if ((Get-AuthenticodeSignature $MyInvocation.MyCommand.Path).Status -ne "Valid")
{
    $check = [System.Windows.Forms.MessageBox]::Show($this, "WARNING:`n$(Split-path $MyInvocation.MyCommand.Path -Leaf) has been modified since it was signed.`nPress 'YES' to Continue or 'No' to Exit", "Warning", 'YESNO', 48)
    switch ($check)
    {
        "YES" { Continue }
        "NO" { Exit }
    }
}

$sw = [Diagnostics.Stopwatch]::StartNew()

if (!(Get-PSDrive -Name HKLM -PSProvider Registry)){
    Try {
        New-PSDrive -Name HKLM -PSProvider Registry -Root HKEY_LOCAL_MACHINE
    }
    Catch {
        "Error Mounting HKEY_Local_Machine"
        exit
    }
}

$bv = @("bam", "bam\State")

Try {
    $Users = foreach ($ii in $bv) {
        Get-ChildItem -Path "HKLM:\SYSTEM\CurrentControlSet\Services\$($ii)\UserSettings\" | Select-Object -ExpandProperty PSChildName
    }
}
Catch {
    "Error Parsing BAM Key. Likely unsupported Windows Version"
    exit
}

$rpath = @("HKLM:\SYSTEM\CurrentControlSet\Services\bam\", "HKLM:\SYSTEM\CurrentControlSet\Services\bam\state\")

$UserTime = (Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\TimeZoneInformation").TimeZoneKeyName
$UserBias = (Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\TimeZoneInformation").ActiveTimeBias
$UserDay = (Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\TimeZoneInformation").DaylightBias

$Bam = Foreach ($Sid in $Users) {
    $u++
            
    foreach ($rp in $rpath) {
        Write-Progress -id 1 -Activity "$($rp)"
        $BamItems = Get-Item -Path "$($rp)UserSettings\$Sid" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Property
        Write-Progress -id 2 -Activity "Collecting Security ID (sid) entries" -Status "($($Users.Count)) sid: $($objSID.value)" -ParentId 1 
        $bi = 0

Try {
            $objSID = New-Object System.Security.Principal.SecurityIdentifier($Sid)
            $User = $objSID.Translate([System.Security.Principal.NTAccount]).Value
        }
        Catch {
            $User = ""
        }

$i = 0
        ForEach ($Item in $BamItems) {
            $i++
            $Key = Get-ItemProperty -Path "$($rp)UserSettings\$Sid" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty $Item
            Write-Progress -id 3 -Activity "Collecting BAM entries for SID: $($objSID.value)" -Status "(Entry $i of $($BamItems.Count))" -ParentId 1

If ($key.length -eq 24) {
                $Hex = [System.BitConverter]::ToString($key[7..0]) -replace "-",""
                $TimeLocal = Get-Date ([DateTime]::FromFileTime([Convert]::ToInt64($Hex, 16))) -Format o
                $TimeUTC = Get-Date ([DateTime]::FromFileTimeUtc([Convert]::ToInt64($Hex, 16))) -Format u
                $Bias = -([convert]::ToInt32([Convert]::ToString($UserBias,2),2))
                $Day = -([convert]::ToInt32([Convert]::ToString($UserDay,2),2)) 
                $Biasd = $Bias/60
                $Dayd = $Day/60
                $TImeUser = (Get-Date ([DateTime]::FromFileTimeUtc([Convert]::ToInt64($Hex, 16))).addminutes($Bias) -Format s) 
                $d = if ((((split-path -path $item) | ConvertFrom-String -Delimiter "\\").P3) -match '\d{1}') {
                    ((split-path -path $item).Remove(23)).trimstart("\Device\HarddiskVolume")
                } else {
                    $d = ""
                }
                $f = if ((((split-path -path $item) | ConvertFrom-String -Delimiter "\\").P3) -match '\d{1}') {
                    Split-path -leaf ($item).TrimStart()
                } else {
                    $item
                }   
                $cp = if ((((split-path -path $item) | ConvertFrom-String -Delimiter "\\").P3) -match '\d{1}') {
                    ($item).Remove(1,23)
                } else {
                    $cp = ""
                }
                $path = if ((((split-path -path $item) | ConvertFrom-String -Delimiter "\\").P3) -match '\d{1}') {
                    "(Vol"+$d+") "+$cp
                } else {
                    $path = ""
                }   
                
                [PSCustomObject]@{
                    'Examiner Time' = $TimeLocal
                    'Last Execution Time (UTC)' = $TimeUTC
                    'Last Execution User Time' = $TimeUser
                    Application = $f
                    Path = $path
                    User = $User
                    Sid = $Sid
                    rpath = $rp
                }
            }
        }
    }
}

$Bam | Out-GridView -PassThru -Title "Join our Discord Community: https://discord.gg/2N8v8E2xpX - BAM key entries $($Bam.count) - User TimeZone: ($UserTime) -> ActiveBias: ( $Bias) - DayLightTime: ($Day)"

$sw.stop()
$t = $sw.Elapsed.TotalMinutes
write-host "Elapsed Time $t minutes" -f yellow

Processi Fondamentali:

SYSMAIN >> sc query sysmain
DPS >> sc query dps
APPINFO >> sc query appinfo
DIAGTRACK >> sc query diagtrack
BAM >> sc query bam
PCASVC >> sc query pcasvc

1^ METODO PER TROVARE UN CHEAT DLL:

Vai su regedit
Copia e incolla questo:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU

1^ METODO PER TROVARE UN CHEAT JAR:

Vai su winprefetchview
Trova il processo javaw o java:
Analizza le sotto classi del file e detecta quelli sospetti

Evita di venir bypassato per un eliminazione del journal o un cambio d'ora:

Vai su eventvwr
---------------------------------------------------------------------------
Sicurezza Windows, clicca su filtri e al posto di
tutti gli id evento, metti 4616 per il cambio d'ora (detect)
---------------------------------------------------------------------------
metti 3079 per eliminazione / riavvio journal (detect)

Trova le macro nei mouse

LOGITECH >> C:\Users\%username%\AppData\Local\LGHUB
---------------------------------------------------------------------------
BLOODY >> C:\Program Files (x86)\Bloody7\Bloody7\UserLog\Mouse
---------------------------------------------------------------------------
ROCCAT >> C:\Users\%username%\AppData\Roaming\ROCCAT\SWARM\macro
---------------------------------------------------------------------------
GLORIUS >> C:\Users\%username%\AppData\Local\BY-COMBO2
---------------------------------------------------------------------------
RAZER >> C:\ProgramData\Razer\Razer Central\Accounts

Il wmic è un metodo di bypass abbastanza conosciuto, passiamo al detect

1^ detect || Explorer -> Contains (Case-Insensitive) -> Wmic process call create
---------------------------------------------------------------------------
2^ detect || MsMpEng -> Contains (Case-Insensitive) -> Wmic process call create
---------------------------------------------------------------------------
3^ detect || Regedit -> Soon..

Ecco a voi i migliori "processi" da utilizzare con l'esegui.

C:\$recycle.bin
---------------------------------------------------------------------------
shell-recent
---------------------------------------------------------------------------
crashdumps
---------------------------------------------------------------------------
%temp%
---------------------------------------------------------------------------
appwiz.cpl

Visite al sito: 0

► Elementi Nascosti

► Logs

► Mods

Pesi delle mod:

Pesi delle mod specifiche:

► Mods Unloadate

► Mods Offuscate

► Java Edit

► SHA256 Versioni Minecraft

► Explorer

► Bam

► Processi

► DLL

► JAR

► EventVwr

► Macro

► WMIC

► Win + R

► More in arrivo...