Threat LensFile scan report

Is 67-CLIENT-FUCKED-BY-MITTKEE.jar safe?

55/100

Safety rating

Elevated risk

Verdict

Suspicious

Single tier-1 engine flags a common Java game utility that shows process manipulation but no confirmed malicious behaviour.

One high-trust engine labels the JAR as Java/GameTool.BL while 74 others remain silent. Sandbox shows process creation and permission changes but no malicious verdict or dropped malware. The file is prevalent yet carries a profanity-laden name, leaving mixed signals.

Do not open or run it until verified

Treat as potentially unwanted; do not execute without containment and monitoring.

Read the full analysis

Saved file evidenceAntivirus consensus

1of 75 flagged

Flagged 1No detection 74

Digital specimen67-CLIENT-FUCKED-BY-MITTKEE.jar02c80b74ab7cb9ee61…6b8c3e4c490403

Size3.4 MB

Code signingNot applicable

SandboxRuntime complete

First seen23d ago

Evidence3 priority signals

1 high-confidence signature or behavior rule matched this file.

01

Before opening or running

Do not open or run it until the source and publisher can be verified independently.

02

If you already opened or ran it

Stop using it, scan the device, and watch for unexpected behavior or security alerts. Get a fresh copy from the publisher's official site and verify its exact hash when possible.

Chapter 02

Intelligence

The saved assessment, checked against the scan evidence and recorded coverage.

Analyst conclusion

One high-trust engine labels the JAR as Java/GameTool.BL while 74 others remain silent. Sandbox shows process creation and permission changes but no malicious verdict or dropped malware. The file is prevalent yet carries a profanity-laden name, leaving mixed signals.

Where this verdict could be wrong1 caveat

Single tier-1 detection on a common_new file with no sandbox malicious verdict and no external-intel corroboration suggests possible over-flagging of a game utility.

These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.

Recommended action

Treat as potentially unwanted; do not execute without containment and monitoring.

Scan transparency

Coverage & freshness

4 of 5 complete

Complete means the check returned a usable result. It does not mean the file is safe.

Antivirus
Complete
1 of 75 engines flagged the file.
Updated Aug 9, 2026, 11:25 AM UTC
Sandbox
Complete
1 isolated runtime environment contributed observations.
Updated Aug 13, 2026, 11:25 AM UTC
Network
Not run
No contacted-host reputation check is recorded.
No timestamp recorded
YARA
Complete
1 signature or behavior rule matched.
Updated Aug 13, 2026, 11:25 AM UTC
External intel
Complete
3 of 3 independent reference sources completed.
Updated Aug 13, 2026, 11:25 AM UTC

Chapter 03

Behavior

Plain-English impact first, then the observed runtime evidence.

Runtime flight recorder

Capture complete

1isolated sandbox run
15MITRE ATT&CK techniques
15spawned processes
0network contacts
15filesystem & mutex artifacts

What this file does

Observed actions and their security significance

High concern: Injected code into another process, a technique that can conceal execution.
High concern: Created or modified a system service, which can keep code running.
High concern: Attempted to impair or bypass security controls.
Moderate concern: Runs hidden system commands (script or shell).
Moderate concern: Transferred a file over the network; malware can use this to fetch additional payloads.
Moderate concern: Checks which security software you have installed.
Note: Collects details about your system.

These are observed capabilities from an isolated analysis. A technique does not prove malicious intent on its own, and the file never ran on your device.

Recorded behavior

Attack story

Runtime observations grouped by analysis stage. Arrows organize the stages; they do not claim chronology or causality.

ObservedDerived

Input file

The submitted object

1

FileObserved
67-CLIENT-FUCKED-BY-MITTKEE.jar
02c80b74ab7cb9ee61bc8e9d8bd5717c846c5578ed325609c26b8c3e4c490403
01Uploaded file

Processes

Runtime execution

2

ProcessObserved
Observed process
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\<USER>\Desktop\download.jar"
02Isolated runtime analysis
ProcessObserved
Observed process
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
03Isolated runtime analysis
+1 more recorded observation in Analyst mode

Files

Created or changed

2

Written fileObserved
3416
C:\Users\<USER>\AppData\Local\Temp\hsperfdata_<USER>\3416
04Isolated runtime analysis
Written fileObserved
3903daac9bc4a3b7.timestamp
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
05Isolated runtime analysis
+1 more recorded observation in Analyst mode

5 recorded facts from one runtime window. Every fact remains independently traceable in Analyst mode.

Runtime behaviour

What this file did when executed

This file was detonated in 1 sandbox and its runtime behaviour was observed.

MITRE ATT&CK

15

Adversary techniques mapped to the MITRE ATT&CK framework.

T1055· Process injectionT1059· Runs commandsT1064T1074T1082· System reconT1105· Network file transferT1106T1129· Loads modulesT1202T1518.001· Checks your AVT1543.002· Service installT1562.001· Disables securityT1564· Hides artifactsT1564.001· Hides artifactsT1564.003· Hides artifacts

Spawned processes

15

$(unnamed)

"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\<USER>\Desktop\download.jar"

$(unnamed)

C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M

$(unnamed)

C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files\Java\jre1.8.0_441\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\runtime.jar"" >> C:\cmdlinestart.log 2>&1

$(unnamed)

C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

$(unnamed)

"C:\Program Files\Java\jre1.8.0_441\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\runtime.jar"

$(unnamed)

/bin/gzip

$(unnamed)

/bin/sh sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log "

$(unnamed)

/usr/sbin/invoke-rc.d invoke-rc.d --quiet cups restart

+7 more processes captured.

Filesystem & mutexes

15

Files written13

C:\Users\<USER>\AppData\Local\Temp\hsperfdata_<USER>\3416
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
C:\ProgramData\Oracle\Java\.oracle_jre_usage\17dfc292991c8786.timestamp
C:\Users\user\AppData\Local\Temp\hsperfdata_user
C:\Users\user\AppData\Local\Temp\hsperfdata_user\4716

+8 more

Files deleted2

C:\Users\user\AppData\Local\Temp\hsperfdata_user\5236
/tmp/hsperfdata_root/3556

Dropped payload

Files this sample writes at runtime

This file drops 9 children at runtime. None are currently flagged malicious in our cache.

9 unseen

43540f4ea132f0b66345…da1206Never scanned
never seen before
06bb7ea5e7225f5ca931…16783aNever scanned
never seen before
9561cda6640f19d6fa81…a6a4b5Never scanned
never seen before
3f8096f14540c8e18e4e…ad10b8Never scanned
never seen before
d87c5f3cdfb5b7c0510e…1ade9eNever scanned
never seen before
61625fd8b084f70f242d…55abd2Never scanned
never seen before
50c82f36208ed8040447…2d7843Never scanned
never seen before
8e8711854186c68e2368…4a3c7cNever scanned
never seen before
759aafcfa2395ce1b800…2af0f7Never scanned
never seen before

Chapter 04

Detection & Forensics

Consensus, attribution, signatures, code structure, prevalence, and identity.

RecordedObserved or authoritative facts

6

DerivedEvidence-backed analyst inferences

2

1rule hit recorded
1 / 75engines flagged
234sources in submission history

Evidence provenance

Why these facts are shown

Each statement identifies whether it was directly recorded or derived from saved scan facts.

01
1 high-confidence signature or behavior rule matched this file.
Verdict inputView chapter
ProvenanceDerived
SourceSignature and behavior rules
Observed atAug 13, 2026, 11:25 AM UTC
02
1 of 75 antivirus engines flagged the file, including ESET-NOD32.
Verdict inputView chapter
ProvenanceObserved
SourceAntivirus analysis
Observed atAug 9, 2026, 11:25 AM UTC
03
The hash has been submitted 283 times from 234 sources.
View chapter
ProvenanceDerived
SourceSaved report facts
Observed atAug 13, 2026, 11:25 AM UTC
04
Scanned file: 67-CLIENT-FUCKED-BY-MITTKEE.jar — 02c80b74ab7cb9ee61bc8e9d8bd5717c846c5578ed325609c26b8c3e4c490403
View chapter
ProvenanceObserved
SourceUploaded file
Observed atAug 13, 2026, 11:25 AM UTC
05
Observed process — "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\<USER>\Desktop\download.jar"
View chapter
ProvenanceObserved
SourceIsolated runtime analysis
Observed atAug 13, 2026, 11:25 AM UTC
06
Observed process — C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
View chapter
ProvenanceObserved
SourceIsolated runtime analysis
Observed atAug 13, 2026, 11:25 AM UTC
07
File written: 3416 — C:\Users\<USER>\AppData\Local\Temp\hsperfdata_<USER>\3416
View chapter
ProvenanceObserved
SourceIsolated runtime analysis
Observed atAug 13, 2026, 11:25 AM UTC
08
File written: 3903daac9bc4a3b7.timestamp — C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
View chapter
ProvenanceObserved
SourceIsolated runtime analysis
Observed atAug 13, 2026, 11:25 AM UTC

Evidence map

Detection sources at a glance

4 completed · 0 unavailable

Antivirus

Threat match

1/75 flagged

Malware samples

No match

no match

Researcher rules

No match

no match

Reference software

No match

no match

Threat attribution

gametool

Category: pua

External intelligence

No researcher-database hits

MalwareBazaar, YARAify, and CIRCL hashlookup completed and returned no entries for this hash.

Rule-based evidence

Signatures and behavior heuristics

A community signature or high-severity behavioral heuristic matched. Signatures identify known patterns; heuristics are strong leads but are not proof on their own.

1 heuristic

MITRE ATT&CK profile

Defense evasion× 1

Behavior heuristics

Deterministic patterns derived from scan data and observed runtime behavior

ProcessInjection
T1055
high
The saved runtime evidence maps this activity to MITRE T1055 (Process Injection). The mapping supports possible process injection, but it does not prove the exact injection method or the operator's intent.
Evidence
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\<USER>\Desktop\download.jar"

Antivirus consensus

1 of 75 engines flagged this file

1 malicious0 suspicious74 not flagged

Tier-117 engines

1flagged

Tier-241 engines

0flagged

Low-trust17 engines

0flagged

ESET-NOD32malicious

Java/GameTool.BL potentially unsafe application

View all 75 engine results

ESET-NOD32DET

AcronisOK

AhnLab-V3OK

AlibabaOK

alibabacloudOK

ALYacOK

Antiy-AVLOK

APEXtyp

ArcabitOK

AvastOK

Avast-MobileOK

AVGOK

AviraOK

BitDefenderOK

BitDefenderFalxtyp

BkavOK

CAT-QuickHealOK

ClamAVOK

CMCOK

CrowdStrikeOK

CTXOK

Cylancetyp

CynetOK

DeepInstincttyp

DrWebOK

Elastictyp

EmsisoftOK

F-SecureOK

FortinetOK

GDataOK

GoogleOK

GridinsoftOK

huorongOK

Ikarusfai

JiangminOK

K7AntiVirusOK

K7GWOK

KasperskyOK

Kingsofttim

LionicOK

MalwarebytesOK

MaxSecureOK

McAfeeDOK

MicrosoftOK

MicroWorld-eScanOK

NANO-AntivirusOK

Paloaltotyp

PandaOK

RisingOK

SangforOK

SentinelOneOK

SkyhighOK

SophosOK

SUPERAntiSpywareOK

SymantecOK

SymantecMobileInsighttyp

TACHYONOK

tehtristyp

TencentOK

Trapminetyp

TrellixENSOK

TrendMicroOK

TrendMicro-HouseCallOK

TrustlookOK

VaristOK

VBA32OK

VIPREOK

VirITOK

ViRobotOK

WebrootOK

XcitiumOK

YandexOK

Zillyafai

ZoneAlarmOK

ZonerOK

PE structure

Not applicable

PE structure analysis applies to Windows executable formats, not this file type.

Prevalence

How widely this file has been seen

Lots of people are uploading this but it's recent — typical of newly-released legitimate software. Low prior for malware.

Common & new

Unique uploaders

234

Hundreds of people have uploaded this — common.

Total submissions

283

Includes repeat uploads by the same source.

First seen

23d ago

Jul 20, 2026

Prevalence quadrant

Rare · New

Needs evidence-led scrutiny

here

Common · New

Just-released software

Rare · Old

Niche or internal tooling

Common · Old

Often established software

File identity

Fingerprint and provenance

File name: 67-CLIENT-FUCKED-BY-MITTKEE.jar
Format: JAR
Code signing: Not applicable to this file type
Size: 3.4 MB
Last analyzed: Aug 13, 2026, 11:25 AM UTC

SHA-256

02c80b74ab7cb9ee61bc8e9d8bd5717c846c5578ed325609c26b8c3e4c490403

Chapter 05

Safety & FAQ

Complete recovery guidance and answers for the next decision.

What to do now

We couldn't fully clear this file. Treat it with caution.

Recovery step 01
Don't open or run it unless you're certain it came from a source you trust.
Recovery step 02
Check where you got it — an unexpected attachment or a random download link is a red flag.
Recovery step 03
If its origin cannot be confirmed, delete this Java file and use a fresh copy from a trusted source. Get a fresh copy from the publisher's official site and verify its exact hash when possible.
Recovery step 04
If you're still unsure, scan it again in a day or two — detections often catch up on newer files.

Safety FAQ

Direct answers grounded in the saved verdict and evidence in this report.

8 evidence-based answers

Is 67-CLIENT-FUCKED-BY-MITTKEE.jar safe, or is it malware?

Evidence-based answer

67-CLIENT-FUCKED-BY-MITTKEE.jar is suspicious — treat it as unsafe until you're sure. 1 of 75 antivirus engines flag it (family: gametool); that detection signal contributes to the cautious verdict. Don't open or run it unless you fully trust where it came from. Get a fresh copy from the publisher's official site and verify its exact hash when possible.

What is 67-CLIENT-FUCKED-BY-MITTKEE.jar?

Evidence-based answer

67-CLIENT-FUCKED-BY-MITTKEE.jar is a Java application or archive, about 3.4 MB. We identify a file by its cryptographic hash rather than its name, because the same filename can be reused by completely different files — the hash below is the reliable fingerprint.

How many antivirus engines detected 67-CLIENT-FUCKED-BY-MITTKEE.jar?

Evidence-based answer

1 of 75 antivirus engines flagged 67-CLIENT-FUCKED-BY-MITTKEE.jar, 1 of them as outright malicious. The raw count alone does not establish safety or danger; we also weigh which engines flagged it and corroborating behavior, identity, reputation, and rule evidence.

What should I do if I already opened or ran 67-CLIENT-FUCKED-BY-MITTKEE.jar?

Evidence-based answer

Act quickly. 1) Disconnect the device from the internet to stop the malware communicating or spreading. 2) Run a full scan with reputable anti-malware software (such as Malwarebytes) and quarantine everything it finds. 3) Change your important passwords from a DIFFERENT, clean device — many threats log keystrokes or steal saved credentials. 4) If you bank or shop on this device, watch closely for fraud and alert your bank. 5) For a confirmed infection, the most reliable fix is to back up your personal files and reinstall the operating system for a clean start.

How do I remove 67-CLIENT-FUCKED-BY-MITTKEE.jar?

Evidence-based answer

To remove 67-CLIENT-FUCKED-BY-MITTKEE.jar: 1) restart into Safe Mode (Safe Mode with Networking if you need to download a tool) so the malware doesn't auto-start. 2) Run a full scan with reputable anti-malware software and let it quarantine or delete the detections. 3) Delete this Java file from the device, then empty the Recycle Bin or Trash. 4) Check your browser extensions, startup items, and scheduled tasks for anything unfamiliar. 5) Reboot and scan again to confirm it's gone. If detections keep coming back, a clean operating-system reinstall is the most dependable cure.

What kind of malware is 67-CLIENT-FUCKED-BY-MITTKEE.jar?

Evidence-based answer

67-CLIENT-FUCKED-BY-MITTKEE.jar is classified as adware or a potentially unwanted program (PUA) — not always destructive, but it bundles ads, trackers, or unwanted changes you didn't ask for. Engines attribute it to the gametool family. Knowing the family matters because it tells you the likely impact — data theft, remote control, file encryption, or unwanted ads — and guides the cleanup.

What is the SHA-256 hash of 67-CLIENT-FUCKED-BY-MITTKEE.jar?

Evidence-based answer

The SHA-256 hash of 67-CLIENT-FUCKED-BY-MITTKEE.jar is 02c80b74ab7cb9ee61bc8e9d8bd5717c846c5578ed325609c26b8c3e4c490403, and its MD5 is 9a3202303ab49d8e33bda9572fdcae2d. This hash is the file's unique fingerprint — two files with the same SHA-256 are identical. Use it to confirm you're looking at exactly this file (not just one with the same name) when comparing against antivirus databases or a download's published checksum.

How up to date is this analysis of 67-CLIENT-FUCKED-BY-MITTKEE.jar?

Evidence-based answer

This report reflects the scan run on August 13, 2026. Because a file's hash never changes, the identity of 67-CLIENT-FUCKED-BY-MITTKEE.jar is fixed — but antivirus coverage improves over time, so a file that looks clean today can pick up detections later (and vice-versa). If you need the latest picture, MalwareTips staff can re-run the analysis from scratch.

Chapter 06

Community

Member reviews and reports for this exact file hash.

Check a different file

Check if a link is safe

The raw file is processed temporarily and is not retained after processing. Its hash and report are public and permanent, so the next person who checks the same file gets an instant answer. Unknown files may be submitted to VirusTotal for analysis. If you ran this file on your computer and are worried, scan your system with an up-to-date antivirus and change critical passwords from a different device.