File scan report

Verdict Safe

Analyzed Nov 10, 202616 hours ago

Is BeamMP_Installer.exe safe? Yes, no threats found.

Only CrowdStrike flagged this widely distributed installer as grayware; major antivirus engines and the combined sandbox result found no corroborating malicious activity.

Strong evidence · Widely seen for a long time, and nothing harmful found.

Install it as usual if it came from the official source

Good practice2 tips

We found nothing harmful in this file.

Install it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.

No scanner can promise a file is 100% safe.

Why we think so

Antivirus results

1 of 70 flagged

Flagged 1
No detection 69
No result 5

FileBeamMP_Installer.exe4.9 MBSHA-256 7b216d881d95…b3e1e2

Code signing Signer not verified
Test run Completed
First seen 7mo ago

It has a long history: seen by 3,659 sources over more than six months.

Chapter 02

Why we think so

4 points against it and 5 in its favour, checked against the scan evidence.

Analyst conclusion

Only 1 of the 70 antivirus engines that checked it flagged the installer, using a generic grayware label, while all reporting major antivirus engines were silent. Its broad submission history and clean combined sandbox verdict outweigh that isolated detection, although the failed certificate verification and protected code warrant obtaining it from the official project channel.

Full reasoning

CrowdStrike was the only engine among 75 to flag the file, and its result was a generic grayware assessment rather than a named malware family. All 18 reporting major antivirus engines returned no detection, and the combined sandbox verdict was clean with no named injection target or high-risk technique recorded. The sample has an established distribution history involving 3,659 distinct submitters and 8,392 submissions. One community rule and the .NET Reactor protection create some uncertainty, but neither is corroborated by malicious evidence from the test run, hostile hosts, or a family consensus. The signature claiming BeamMP Mod Team failed verification because its chain ends in an untrusted root, so it provides no publisher assurance. Overall, the isolated detection is more likely a false positive or grayware classification than evidence of active malware.

Detailed assessment

What We Detected

Only 1 of the 70 antivirus engines that checked it flagged the installer. CrowdStrike supplied a generic grayware label, while all 18 reporting major antivirus engines returned no detection and no engine consensus identified a malware family. One community rule named upxHook, and the executable uses .NET Reactor protection, but these findings are not independently confirmed as malicious.

Threat Behavior

The combined sandbox verdict was clean. Execution showed installer and launcher processes plus expected network requests, with no named process-injection target, persistence indicator, malicious child, or known-malicious contacted host. The uncorroborated T1055 mapping does not establish that process injection occurred.

What To Do Now

The signature claiming BeamMP Mod Team failed certificate verification, so do not rely on the signature as proof of origin. Obtain the installer through the project's official release channel, verify any published checksum when available, and keep security software enabled during installation.

Where this verdict could be wrong4 caveats

The signature cannot authenticate the claimed publisher because its certificate chain ends at an untrusted root.
CrowdStrike applied a grayware label, and one community rule named upxHook.
The executable is protected with .NET Reactor, which limits visibility into its code.
Files built with the same import table have conflicting prior outcomes, including three harmful and two clean assessments, but none shares a verified publisher.

These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.

Points in its favour

Only 1 of the 70 antivirus engines that checked it flagged the file, and no major antivirus engines detected it.
The file has been submitted 8,392 times by 3,659 distinct sources since Apr 12, 2026.
The combined sandbox verdict was clean, with no named injection target or high-risk technique.
The complete host-reputation check found no known-malicious or suspicious contacted hosts.
No inspected child was identified as malicious or suspicious.

Points against

The publisher signature failed verification because its certificate chain ends at an untrusted root.
CrowdStrike labeled the executable as grayware.
The executable uses .NET Reactor protection, which obscures parts of its code.
One community detection rule matched an altered-packer pattern.

6 sources checked · all complete. See every source

Chapter 03

What it did in our test

It ran in 3 isolated tests; no test environment rated what it did as risky.

Test run summary

Capture complete

3isolated sandbox runs
16sandbox rule tags
7spawned processes
4network contacts
27filesystem & mutex artifacts

Runtime behaviour

What this file did when executed

This file was detonated in 3 sandboxes and its runtime behaviour was observed.

1 clean detonation

Sandbox verdicts

VT: CLEANclean

Techniques observed in the sandbox

MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.

T1012
T1027· Obfuscated code
T1027.002· Obfuscated code
T1036
T1055· Process injection
T1057· Lists programs
T1070· Covers its tracks
T1071· Application protocol
T1082· System recon
T1129· Loads modules
T1202
T1485
T1497· Sandbox evasion
T1518· Checks your AV
T1548
T1573

Observed activity

Processes started

Programs the file ran, with their command lines.

BeamMP_Installer.exe"C:\Users\<USER>\Desktop\BeamMP_Installer.exe"
BeamMP_Installer.tmp"C:\Users\<USER>\AppData\Local\Temp\is-EKAQ040KCC.tmp\BeamMP_Installer.tmp" /SL5="$70070,3625129,1208320,C:\Users\<USER>\Desktop\BeamMP_Installer.exe"
BeamMP-Launcher.exe"C:\Users\<USER>\AppData\Roaming\BeamMP-Launcher\BeamMP-Launcher.exe"
cmd.exeC:\Windows\system32\cmd.exe /c cls
BeamMP_Installer.exeC:\Users\<USER>\AppData\Local\Temp\is-IWCBX6II5W.tmp\BeamMP_Installer.tmp /SL5=$100140,3625129,1208320,C:\Users\<USER>\Downloads\BeamMP_Installer.exe
BeamMP_Installer.exe"C:\Users\user\Desktop\BeamMP_Installer.exe"

Show all 7 entries

BeamMP_Installer.tmp"C:\Users\user\AppData\Local\Temp\is-AQOOC57DH5.tmp\BeamMP_Installer.tmp" /SL5="$10452,3625129,1208320,C:\Users\user\Desktop\BeamMP_Installer.exe"

Network contacts

4 hosts, listed as 2 domains, 2 addresses, 4 links. Links show the host and path only.

Domainbackend.beammp.com
Domaincrls.ssl.com
IP address104.21.24.118
IP address3.163.189.62
URLhttp://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
URLhttp://crls.ssl.com/SSL.com-TLS-T-ECC-R2.crl

Show all 8 entries

URLhttps://backend.beammp.com/sha/launcher
URLhttps://backend.beammp.com/version/launcher

Files

Files the file created, changed or deleted.

WrittenC:\Users\<USER>\AppData\Local\Temp\is-EKAQ040KCC.tmp\BeamMP_Installer.tmp
WrittenC:\Users\<USER>\AppData\Local\Temp\is-82HO9YQRRN.tmp\_isetup\_setup64.tmp
WrittenC:\Users\<USER>\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
WrittenC:\Users\<USER>\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db
WrittenC:\Users\<USER>\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
WrittenC:\Users\<USER>\AppData\Roaming\BeamMP-Launcher\BeamMP-Launcher.exe

Show all 26 entries

WrittenC:\Users\<USER>\AppData\Roaming\BeamMP-Launcher\unins000.dat
WrittenC:\Users\<USER>\AppData\Roaming\BeamMP-Launcher\is-KACI0FVEUF.tmp
WrittenC:\Users\<USER>\AppData\Roaming\BeamMP-Launcher\unins000.exe
WrittenC:\Users\<USER>\AppData\Roaming\BeamMP-Launcher\is-6NRWQCJPBR.tmp
WrittenC:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BeamMP-Launcher\BeamMP-Launcher.lnk
WrittenC:\Users\<USER>\Desktop\BeamMP-Launcher.lnk
WrittenC:\Users\<USER>\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db
WrittenC:\Users\<USER>\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db
WrittenC:\Users\<USER>\AppData\Roaming\BeamMP-Launcher\Launcher.log
DeletedC:\Users\<USER>\AppData\Roaming\BeamMP-Launcher\is-KACI0FVEUF.tmp
DeletedC:\Users\<USER>\AppData\Roaming\BeamMP-Launcher\is-6NRWQCJPBR.tmp
DeletedC:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BeamMP-Launcher\BeamMP-Launcher.lnk
DeletedC:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BeamMP-Launcher\BeamMP-Launcher.pif
DeletedC:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BeamMP-Launcher\BeamMP-Launcher.url
DeletedC:\Users\<USER>\Desktop\BeamMP-Launcher.lnk
DeletedC:\Users\<USER>\Desktop\BeamMP-Launcher.pif
DeletedC:\Users\<USER>\Desktop\BeamMP-Launcher.url
DeletedC:\Users\<USER>\AppData\Local\Temp\is-82HO9YQRRN.tmp\_isetup
DeletedC:\Users\<USER>\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\LocalCache\KnownGameList.bin
DeletedC:\Users\<USER>\AppData\Local\Microsoft\GameDVR\KnownGameList.update

Registry and auto-start

Settings the file changed, including ways to start again after a restart.

SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000
SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash
SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5189654e-63b2-4ef5-92c7-7b0488ef757b}}_is1\Inno Setup: Setup Version
SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5189654e-63b2-4ef5-92c7-7b0488ef757b}}_is1\Inno Setup: App Path
SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5189654e-63b2-4ef5-92c7-7b0488ef757b}}_is1\InstallLocation
SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5189654e-63b2-4ef5-92c7-7b0488ef757b}}_is1\Inno Setup: Icon Group

Show all 18 entries

SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5189654e-63b2-4ef5-92c7-7b0488ef757b}}_is1\Inno Setup: User
SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5189654e-63b2-4ef5-92c7-7b0488ef757b}}_is1\Inno Setup: Selected Tasks
SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5189654e-63b2-4ef5-92c7-7b0488ef757b}}_is1\Inno Setup: Language
SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5189654e-63b2-4ef5-92c7-7b0488ef757b}}_is1\DisplayName
SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5189654e-63b2-4ef5-92c7-7b0488ef757b}}_is1\DisplayIcon
SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5189654e-63b2-4ef5-92c7-7b0488ef757b}}_is1\UninstallString
SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5189654e-63b2-4ef5-92c7-7b0488ef757b}}_is1\QuietUninstallString
SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5189654e-63b2-4ef5-92c7-7b0488ef757b}}_is1\DisplayVersion
SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5189654e-63b2-4ef5-92c7-7b0488ef757b}}_is1\NoModify
DeletedHKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000\Sequence
DeletedHKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000\Owner
DeletedHKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash

Mutexes

Named locks a program uses so only one copy runs; malware families often reuse them.

cversions.3.m

Sandbox background — not the file

The analysis machine's own processes and connections, recorded in every run.

VM processExplorer.EXEC:\Windows\Explorer.EXE
VM processservices.exeC:\Windows\system32\services.exe
VM processsvchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p
VM processsvchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup
VM processlsass.exeC:\Windows\system32\lsass.exe
VM processsvchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc

Show all 8 entries

VM processsvchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time
VM host162.159.36.2

Dropped payload

Files this sample writes at runtime

This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.

10 not checked

b8996632026de2da49ae…15e4e8Not checked
no saved verdict
35a74b3ec25677d8ae60…88a2edNot checked
no saved verdict
5197aaa49e4f9e032119…5e9584Not checked
no saved verdict
00a2ea47540e3698251e…6d597dNot checked
no saved verdict
1c53f0cfaf81df0e3cb8…d5a768Not checked
no saved verdict
314f99e2316ca296d3db…7a3683Not checked
no saved verdict
f65e7f4431506c258138…27289dNot checked
no saved verdict
35569fc533d5d814bf5f…6c4606Not checked
no saved verdict
a0160f0c7c32954339ad…1f125eNot checked
no saved verdict
2354b257fdbed9193c43…e4be96Not checked
no saved verdict

Chapter 04

Technical details

1 of the 70 antivirus engines that checked it flags it; a signature that did not verify.

SourceStatusResultChecked

Antivirus enginesVirusTotal · 75 enginesComplete1 of 70 engines flagged it · 5 gave no result · treated as non-decisive DetailsNov 10, 2026

Sandbox runVirusTotal sandboxes · CAPE Sandbox, VirusTotal Jujubox, ZenboxComplete3 runs: 1 clean, 2 without a verdict DetailsNov 10, 2026

Contacted hostsMalwareTips URL scannerComplete4 contacted hosts checked DetailsNov 10, 2026

Signature rulesYARAify community rules + MalwareTips rulesComplete8 community YARA rules (1 malware-specific) · 2 MalwareTips behaviour rules DetailsNov 10, 2026

Malware sample databaseabuse.ch MalwareBazaarCompleteNot listedNov 10, 2026

Known-software referenceCIRCL hashlookupCompleteNo matchNov 10, 2026

Engines that flagged it 1

The Safe verdict weighed these detections and treats them as non-decisive.

CrowdStrikewin/grayware_confidence_60% (D)

File fingerprint

Last analyzed: Nov 10, 2026, 12:53 PM UTC

SHA-256: 7b216d881d9541cb2c563393963cccedf4c55d3282aa30abb39585af7bb3e1e2
SHA-1: 3e9ca457715c5ab585a286dd2233b0d21a199b79
MD5: 8b6ef9a77a5bc84734c3995ec4ebf6b3

About this file

BeamMP_Installer.exe says it is BeamMP Launcher Setup (BeamMP Launcher), 4.9 MB.

Claims to be: BeamMP Launcher Setup (BeamMP Launcher)From the file's own version information, written by whoever built it.
Type and size: Win32 EXE · 4.9 MB
Signer: BeamMP Mod Team (unverified signature)Worth noting: Malware sometimes copies or steals a company's signature, so this does not mean that company made it.
First seen: Apr 12, 2026On VirusTotal.
Submitted by: 3,659 distinct sources
Packer: .NET Reactor 2.X-3.X (DetectItEasy protector)Packing hides code; legitimate installers use it too.
Entropy: 4.81 of 8

First scanned Nov 10, 2026

Antivirus consensus

1 of 70 engines flagged this file

1 malicious0 suspicious69 not flagged5 no result

5 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.

Tier-118 engines
0flagged
Tier-235 engines
1flagged
Low-trust17 engines
0flagged

View all 75 engine results

CrowdStrikeMalicious: win/grayware_confidence_60% (D)
AcronisClean
AhnLab-V3Clean
AlibabaClean
alibabacloudClean
ALYacClean
Antiy-AVLClean
APEXClean
ArcabitClean
AvastClean
Avast-MobileNo result
AVGClean
AviraClean
BitDefenderClean
BitDefenderFalxNo result
BkavClean
CAT-QuickHealClean
ClamAVClean
CMCClean
CTXClean
CylanceClean
CynetClean
DeepInstinctClean
DrWebClean
ElasticClean
EmsisoftClean
ESET-NOD32Clean
F-SecureClean
FortinetClean
GDataClean
GoogleClean
GridinsoftClean
huorongClean
IkarusClean
JiangminClean
K7AntiVirusClean
K7GWClean
KasperskyClean
KingsoftClean
LionicClean
MalwarebytesClean
MaxSecureClean
McAfeeDClean
MicrosoftClean
MicroWorld-eScanClean
NANO-AntivirusClean
PaloaltoClean
PandaClean
RisingClean
SangforClean
SentinelOneClean
SkyhighNo result
SophosClean
SUPERAntiSpywareClean
SymantecClean
SymantecMobileInsightNo result
TACHYONClean
tehtrisClean
TencentClean
TrapmineClean
TrellixENSClean
TrendMicroClean
TrendMicro-HouseCallClean
TrustlookNo result
VaristClean
VBA32Clean
VIPREClean
VirITClean
ViRobotClean
WebrootClean
XcitiumClean
YandexClean
ZillyaClean
ZoneAlarmClean
ZonerClean

Rule-based evidence

Signatures and behavior heuristics

A community signature or high-severity behavioral heuristic matched. Signatures identify known patterns; heuristics are strong leads but are not proof on their own.

8 YARA2 heuristics

MITRE ATT&CK profile

Execution× 1Defense evasion× 1

Community YARA rules

Researcher-authored signatures reported by YARAify

upxHook
Borlandgeneric
CP_Script_Inject_Detectorgeneric
HUNTING_SUSP_TLS_SECTIONgeneric
pe_detect_tls_callbacksgeneric
PE_Digital_Certificategeneric
SHA512_Constantsgeneric
TH_AntiVM_MassHunt_Win_Malware_2026_CYFAREgeneric

Behavior heuristics

Deterministic patterns derived from scan data and observed runtime behavior

ProcessInjection
T1055
low
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
Evidence
T1055 (sandbox MITRE mapping)
DropperNetworkProfile
T1105 T1027
high
Unsigned, packed PE with sandbox-observed network activity. The packing step hides the payload until execution; the network call fetches / reports for the next stage. Classic dropper / stager behaviour.
Evidence
backend.beammp.com

PE forensics

Section entropy & packers

A known packer signature (UPX / Themida / VMProtect / etc.) matched this file. Packers aren't malicious on their own, but most malware uses them.

ent 4.81Likely packed

Section entropy11 sections

.text

6.38

.itext

6.04

.data

5.18

.bss

0.00

.idata

4.82

.didata

2.76

.edata

1.34

.tls

0.00

.rdata

1.38

.reloc

6.70

.rsrc

1.50

0.0Packed threshold 7.28.0

Detected packers

.NET Reactor 2.X-3.X (DetectItEasy protector)

Packers compress or encrypt the executable and only unpack it at runtime. Legitimate commercial software uses them too — but if the file is also unsigned and rare, it's a strong malware signal.

Prevalence

How widely this file has been seen

Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.

Common & old

Unique uploaders

3,659

Hundreds of people have uploaded this — common.

Total submissions

8,392

Includes repeat uploads by the same source.

First seen

7mo ago

Apr 12, 2026

Prevalence quadrant

Rare · New

Needs evidence-led scrutiny

Common · New

Just-released software

Rare · Old

Niche or internal tooling

here

Common · Old

Often established software

Chapter 05

Questions & answers

Short answers to the 7 questions people ask most about this file.

Is BeamMP_Installer.exe safe?

We found nothing harmful in BeamMP_Installer.exe. 1 of the 70 antivirus engines that checked it flags it; after weighing the other evidence we treat that alert as false alarms. Install it only if it came from the developer's own website or an official app store.

What is BeamMP_Installer.exe?

BeamMP_Installer.exe is a software installer, about 4.9 MB. Its version information says it is “BeamMP Launcher Setup” (BeamMP Launcher). Version information is written by whoever built the file, so it is a claim, not proof of who made it. VirusTotal first saw it on Apr 12, 2026.

How many antivirus engines detected BeamMP_Installer.exe?

1 of the 70 antivirus engines that checked it flags BeamMP_Installer.exe (CrowdStrike). We weigh which engines flagged it and what else the scan found, not just the count.

Is BeamMP_Installer.exe digitally signed?

It carries a signature in the name of BeamMP Mod Team that could not be verified. Malware sometimes copies or steals a company's signature, so this does not mean that company made it.

What is the SHA-256 hash of BeamMP_Installer.exe?

The SHA-256 fingerprint of BeamMP_Installer.exe is 7b216d881d9541cb2c563393963cccedf4c55d3282aa30abb39585af7bb3e1e2, and its MD5 is 8b6ef9a77a5bc84734c3995ec4ebf6b3. Two files with the same SHA-256 are identical, so use it to check you have exactly this file, not just one with the same name.

Is it safe to install BeamMP_Installer.exe?

We found nothing harmful in BeamMP_Installer.exe. The main caveat is where you got it: attackers sometimes spread malware under the name of real software, so get it from the official website. If your own antivirus warns about it, check the source before you ignore the warning.

How up to date is this analysis of BeamMP_Installer.exe?

This report reflects the scan on Nov 10, 2026. A file's fingerprint never changes, but antivirus engines keep learning, so a rating can change later. To get a newer result, scan the file again: we refresh the antivirus results when the saved ones are out of date.

Chapter 06

Community

Member reviews and reports for this exact file hash.

Is BeamMP_Installer.exe safe? Yes, no threats found.

Why we think so

The reasoning behind this verdict

What We Detected

Threat Behavior

What To Do Now

What it did in our test

Test run summary

What this file did when executed

Sandbox verdicts

Techniques observed in the sandbox

Observed activity

Processes started

Network contacts

Files

Registry and auto-start

Mutexes

Sandbox background — not the file

Files this sample writes at runtime

Technical details

Every check behind this verdict

Engines that flagged it 1

File fingerprint

About this file

1 of 70 engines flagged this file

Signatures and behavior heuristics

Section entropy & packers

How widely this file has been seen

Questions & answers

Community

Is BeamMP_Installer.exe safe? Yes, no threats found.

What We Detected

Threat Behavior

What To Do Now

Test run summary

Sandbox verdicts

Techniques observed in the sandbox

Observed activity

Processes started

Network contacts

Files

Registry and auto-start

Mutexes

Sandbox background — not the file

Engines that flagged it 1

File fingerprint

About this file

Related file reports