I didn't really understand the "creator program", what people will actually benefit from registering using "creator" codes?
and also about source code, it's not going toe be free unless I fully shut down all vape.chat servers (which will not happen atleast not in the coming months) and that's because I update it, and I worked long time fully remaking website, loader, cloud, etc. and also because I don't want skids to take it and make it their "own".
i tried scanning this via chatgpt and this is what i got, i scanned both the dll, and exe.
also got similar results also did what the creator of this said
d2651e7d.exe
File
can you see if this is safe.
I checked the uploaded d2651e7d.exe statically. I would not consider it safe to run yet.
A few things stand out:
That doesn't automatically mean it's malware. The wording strongly suggests this may be a DLL injector/loader, which can be legitimate for things like game modding, but the same techniques are also commonly used by malware.
- It is a Windows 64-bit executable, about 1.36 MB.
- It imports networking functions from WS2_32.dll and has WinHTTP-related strings, meaning it can communicate over the network.
- More importantly, it contains functionality/strings associated with process injection:
- OpenProcess
- VirtualAllocEx
- WriteProcessMemory
- CreateRemoteThread
- LoadLibrary
- It explicitly contains strings such as:
- Failed to inject NativeLoader.dll
- NativeLoader.dll
- Product DLL loading
- Already Injected
- Loader controller socket
- /loader/login
- It requests highestAvailable Windows privileges.
- It is not digitally signed according to the PE security directory.
- Its embedded timestamp is September 1, 2026.
I would not double-click it on your main PC yet.
If you tell me where you got this EXE / what program it's supposed to be, I can investigate the file's identity and compare its hash against known/public sources. The SHA-256 I extracted is:
05382bb9d0f2a113fad2ab4c9de271cd252ad e b75db8432c1dc91e9531f9c9a0
no other stuff that may seem like its a rat/stealer
Yeah — if you're specifically looking for RAT/stealer behavior, that's the right thing to investigate. The injection APIs alone don't prove it's a RAT.
From the static indicators I can see, I don't see an obvious smoking gun like:
However, there are network/loader components, including WinHTTP and the "Loader controller socket" / "/loader/login" strings. Combined with NativeLoader.dll injection, that's enough that I wouldn't call it clean without going deeper.
- Credential/browser password theft
- Cookies/session-token theft
- Discord token harvesting
- Crypto-wallet targeting
- Keylogging
- Screenshot/webcam capture
- Persistence mechanisms such as Run keys or scheduled tasks
- Windows Defender tampering
- Ransomware/file-encryption behavior
- Obvious C2 commands such as a hidden reverse shell
The SHA-256 is:
05382bb9d0f2a113fad2ab4c9de271cd252adeb75db8432c1dc91e9531f9c9a0
If you want, I can do a much deeper RAT/stealer-focused inspection of this exact EXE—looking specifically for browser/Discord token theft, credential access, persistence, C2 addresses/domains, obfuscation, anti-analysis, and suspicious Windows APIs.
NativeLoader.dll
File
now this
I checked NativeLoader.dll much more deeply, specifically for RAT/stealer indicators.
Verdict: I don't see evidence of a RAT/stealer
This DLL is 24.5 MB and contains a large embedded Java/Vape client. The package names and classes strongly identify it as a Vape.gg Minecraft client native component, rather than a generic Windows RAT.
I specifically looked for:
The cookie strings I found are from Netty's normal HTTP cookie library, not browser-cookie harvesting. Likewise, keystroke is associated with Vape's Keystrokes HUD, and AccountCredentials is an actual Vape class for Minecraft account authentication.
Discord token stealing — nothing found
Things that are expected but worth noting
The DLL does have:
Those sound scary in isolation, but they're consistent with what a Minecraft client/modification like Vape needs to do.
- GetAsyncKeyState
- Clipboard APIs
- Network sockets
- HTTP functionality
- Java/Minecraft authentication code
- Native code for injecting/bridging into Minecraft
In particular, I found actual Minecraft/Xbox authentication code that communicates with Microsoft's authentication endpoints. That's very different from silently stealing browser credentials.
The DLL exports only:
and identifies itself internally as Vape421Native.dll.
- JNI_OnLoad
- JNI_OnUnload
One important connection
The previous d2651e7d.exe specifically contained:
and this DLL contains the Vape native runtime.
So the two files appear to be related components of the same loader/client, rather than the EXE randomly downloading an unrelated malicious DLL.
Based on the static analysis, I don't see RAT/stealer behavior in this DLL. I would still avoid calling it 100% safe solely from static analysis, but this is substantially less suspicious than the initial EXE looked when we only saw its injection functionality.
SHA-256 of this DLL:
5a488f2f47cee1c51054829292a8db3af8daae344c7227c90ff1d58d34ef50bf
ah i mean ig source is understandable, tbh
the "creator program" js like a fun lil thing u can add on the website like affiliate codes or whatever, idk of a actual use atm maybe like they get sum for promoting the client on their yt / tt / etc pages? or like a shout out when they post? either way the idea is inspired on sum from vape
