File scan report

Verdict Safe

Analyzed May 29, 20264 months ago

Is FTLProfileEditor.exe safe? Yes, no threats found.

Single less reliable engine flag on an unsigned 8-year-old file with medium prevalence and clean sandbox results.

Read the whole reasonShow less

Moderate evidence · No engine flags it, but no publisher signature confirms who made it.

Run it as usual if it came from the official source

Treat as safe; the single less reliable flag is a classic false positive on an established file.

Good practice2 tips

We found nothing harmful in this file.

Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.

No scanner can promise a file is 100% safe.

Why we think so

Reads the latest antivirus results for this file's hash. Nothing is uploaded.

Antivirus results

1 of 71 flagged

Flagged 1
No detection 70
No result 4

FileFTLProfileEditor.exe24.1 kBSHA-256 23411007ac7b…8e2f05

Code signing Unsigned
Test run Completed
First seen 8y ago

1 of the 71 antivirus engines that checked it flags it (Jiangmin).

Chapter 02

Why we think so

1 point against it and 3 in its favour, checked against the scan evidence.

Analyst conclusion

Only one less reliable detection (Jiangmin) with zero major antivirus engines reporting malicious. Medium prevalence since 2018, no malicious sandbox verdict, no malicious files it created or hosts.

Where this verdict could be wrong1 caveat

Two of our behaviour rules matched with T1055/T1562.001; if the sandbox environment accurately reflects real-world execution this could indicate malicious process injection, though the 3060-day age and lack of major corroboration make a stolen or mislabeled legitimate tool more probable.

These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.

6 sources checked · 5 complete · 1 partial. See every source

Chapter 03

What it did in our test

It ran in our isolated test environment; no test environment rated what it did as risky.

Test run summary

Capture complete

13sandbox rule tags
6spawned processes
1network contact
39filesystem & mutex artifacts

Runtime behaviour

What this file did when executed

This file was run in a sandbox and its runtime behaviour was observed.

Techniques observed in the sandbox

13

MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.

T1012
T1055· Process injection
T1056· Keylogging
T1059· Runs commands
T1071· Application protocol
T1082· System recon
T1083· Scans your files
T1106
T1129· Loads modules
T1202
T1518.001· Checks your AV
T1562.001· Disables security
T1574.010· Execution hijack

Observed activity

Processes started

6

Programs the file ran, with their command lines.

file.exe"C:\Users\<USER>\AppData\Local\Temp\file.exe"
java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -XX:+IgnoreUnrecognizedVMOptions --add-modules=java.xml.bind -classpath ".\FTLProfileEditor.jar;FTLProfileEditor.jar" net.blerf.ftl.FTLProfileEditor
23411007ac7b7d324bb457fe3a4a4155c6bdc0bb2cd82722cd518da8668e2f05.exe%SAMPLEPATH%\23411007ac7b7d324bb457fe3a4a4155c6bdc0bb2cd82722cd518da8668e2f05.exe
java.exeC:\Program Files\Java\jre1.8.0_121\bin\java.exe
iexplore.exeC:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe" -nohome"
java.exeC:\Program Files\Java\jre1.8.0_251\bin\java.exe -XX:+IgnoreUnrecognizedVMOptions --add-modules=java.xml.bind -classpath .\FTLProfileEditor.jar;FTLProfileEditor.jar net.blerf.ftl.FTLProfileEditor

Network contacts

1

1 host, listed as 1 address. Links show the host and path only.

IP address23.6.103.183

Files

29

Files the file created, changed or deleted.

WrittenC:\Users\<USER>\AppData\Local\Temp\hsperfdata_admin\580
WrittenC:\ProgramData\Oracle\Java\.oracle_jre_usage\17dfc292991c8023.timestamp
WrittenC:\ProgramData\Oracle\Java\.oracle_jre_usage
WrittenC:\ProgramData\Oracle\Java\.oracle_jre_usage\17dfc292991c8080.timestamp
WrittenC:\Users\user\AppData\Local\Temp\hsperfdata_user
WrittenC:\Users\user\AppData\Local\Temp\hsperfdata_user\6508

Show all 29 entries

Written\Device\ConDrv
Written\Device\ConDrv\\Connect
WrittenC:\Users\user\AppData\Local\Temp\hsperfdata_user\8148
WrittenC:\Users\user\AppData\Local\Temp\hsperfdata_user\4292
WrittenC:\Users\user\AppData\Local\Temp\hsperfdata_user\8036
WrittenC:\Users\user\AppData\Local\Temp\hsperfdata_user\4520
WrittenC:\Users\user\AppData\Local\Temp\hsperfdata_user\864
WrittenC:\Users\user\AppData\Local\Temp\hsperfdata_user\6864
DeletedC:\ProgramData\Oracle\Java\.oracle_jre_usage\17dfc292991c7c05.timestamp
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER124A.tmp.WERInternalMetadata.xml
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER12E7.tmp.csv
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER1336.tmp.txt
DeletedC:\Windows\System32\spp\store\2.0\cache\cache.dat
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER296C.tmp.WERInternalMetadata.xml
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER297E.tmp.csv
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER297F.tmp.txt
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER14AC.tmp.WERInternalMetadata.xml
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER15B5.tmp.csv
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER15F5.tmp.txt
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER16A1.tmp.WERInternalMetadata.xml
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER173E.tmp.csv
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER179D.tmp.txt
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER3498.tmp.WERInternalMetadata.xml

Mutexes

10

Named locks a program uses so only one copy runs; malware families often reuse them.

CTF.LBES.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.Compart.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.Asm.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.Layouts.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.TMD.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.TimListCache.FMPDefaultS-1-5-21-1482476501-1645522239-1417001333-500MUTEX.DefaultS-1-5-21-1482476501-1645522239-1417001333-500

Show all 10 entries

ZonesCounterMutex
ZonesCacheCounterMutex
ZonesLockedCacheCounterMutex
ShimCacheMutex

Sandbox background — not the file

26

The analysis machine's own processes and connections, recorded in every run.

VM processicacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
VM processwuapihost.exeC:\Windows\System32\wuapihost.exe
VM processUI0Detect.exeC:\Windows\System32\UI0Detect.exe
VM processupdater.exeC:\Program Files\Google2996_1954813838\bin\updater.exe
VM processupdater.exeC:\Program Files\Google1960_572457706\bin\updater.exe
VM processupdater.exeC:\Program Files\Google1904_1450413190\bin\updater.exe

Show all 26 entries

VM processicacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant everyone:(OI)(CI)M
VM hosta83f:8110:0:0:1400:0:0:0
VM host23.216.147.76
VM hosta83f:8110:cce1:d301:10:0:0:0
VM host20.99.132.105
VM host23.216.147.62
VM host20.80.129.13
VM host20.99.184.37
VM host20.99.133.109
VM host20.99.186.246
VM host192.229.211.108
VM host23.216.147.64
VM hosta83f:8110:2203:0:0:0:2203:0
VM host13.107.4.50
VM host20.69.140.28
VM host192.168.0.84
VM host23.216.81.152
VM host23.198.171.50
VM hosta83f:8110:e024:6df7:100:0:2a00:0
VM host192.168.0.33

Dropped payload

Files this sample writes at runtime

This file drops 9 children at runtime. None are currently flagged malicious in our cache. 9 have no saved verdict and were not checked; that is missing coverage, not a finding.

9 not checked

13f8be4dafd0a0d261d4…8b96f1Not checked
no saved verdict
63b84513f63e7911a977…58c2f6Not checked
no saved verdict
363d6bdbcec8fd9c84e1…22be11Not checked
no saved verdict
c21c6b13afec132f2bbf…e4350aNot checked
no saved verdict
d019edfbf6d2b12bf41c…e958f4Not checked
no saved verdict
445ce1f1164d368b3d44…75eab9Not checked
no saved verdict
6eccf3ce31c9423f2b62…19fab8Not checked
no saved verdict
4ff4b0d96b3817686146…bf9292Not checked
no saved verdict
b6555a95843fb699aef1…f6f555Not checked
no saved verdict

Chapter 04

Technical details

1 of the 71 antivirus engines that checked it flags it; no publisher signature.

SourceStatusResultChecked

Antivirus enginesVirusTotal · 75 enginesComplete1 of 71 engines flagged it · 4 gave no result · treated as non-decisive DetailsMay 29, 2026

Sandbox runVirusTotal sandboxesCompleteRuntime behaviour was recorded DetailsMay 29, 2026

Contacted hostsMalwareTips URL scannerPartial1 host contacted in the test run had no completed reputation check DetailsMay 29, 2026

Signature rulesYARAify community rules + MalwareTips rulesComplete1 MalwareTips behaviour rule DetailsMay 29, 2026

Malware sample databaseabuse.ch MalwareBazaarCompleteNot listedOct 18, 2026

Known-software referenceCIRCL hashlookupCompleteNo matchOct 18, 2026

Engines that flagged it 1

The saved verdict treats these detections as likely false positives.

JiangminTrojan.PSW.Stealer.bbw

File fingerprint

Last analyzed: May 29, 2026, 1:27 PM UTC

SHA-256: 23411007ac7b7d324bb457fe3a4a4155c6bdc0bb2cd82722cd518da8668e2f05
SHA-1: 8727414fef9880de0db6b33fb8dd020b7c714acf
MD5: d5dca14f14b18296aece3a85f8d44e57

About this file

FTLProfileEditor.exe is a Win32 EXE file of 24.1 kB.

Type and size: Win32 EXE · 24.1 kB
Signer: UnsignedNo code signature.
First seen: Jan 11, 2018On VirusTotal.
Submitted by: 98 distinct sources
Packer: None detected
Entropy: 5.51 of 8

First scanned May 29, 2026

Antivirus consensus

1 of 71 engines flagged this file

1 malicious0 suspicious70 not flagged4 no result

4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.

Tier-118 engines
0flagged
Tier-236 engines
0flagged
Low-trust17 engines
1flagged

These detections were treated as likely false positives in the saved verdict.

View all 75 engine results

JiangminMalicious: Trojan.PSW.Stealer.bbw
AcronisClean
AhnLab-V3Clean
AlibabaClean
alibabacloudClean
ALYacClean
Antiy-AVLClean
APEXClean
ArcabitClean
AvastClean
Avast-MobileNo result
AVGClean
AviraClean
BitDefenderClean
BitDefenderFalxNo result
BkavClean
CAT-QuickHealClean
ClamAVClean
CMCClean
CrowdStrikeClean
CTXClean
CylanceClean
CynetClean
DeepInstinctClean
DrWebClean
ElasticClean
EmsisoftClean
ESET-NOD32Clean
F-SecureClean
FortinetClean
GDataClean
GoogleClean
GridinsoftClean
huorongClean
IkarusClean
K7AntiVirusClean
K7GWClean
KasperskyClean
KingsoftClean
LionicClean
MalwarebytesClean
MaxSecureClean
McAfeeDClean
MicrosoftClean
MicroWorld-eScanClean
NANO-AntivirusClean
PaloaltoClean
PandaClean
RisingClean
SangforClean
SentinelOneClean
SkyhighClean
SophosClean
SUPERAntiSpywareClean
SymantecClean
SymantecMobileInsightNo result
TACHYONClean
tehtrisClean
TencentClean
TrapmineClean
TrellixENSClean
TrendMicroClean
TrendMicro-HouseCallClean
TrustlookNo result
VaristClean
VBA32Clean
VIPREClean
VirITClean
ViRobotClean
WebrootClean
XcitiumClean
YandexClean
ZillyaClean
ZoneAlarmClean
ZonerClean

Rule-based evidence

Signatures and behavior heuristics

Low-severity pattern matches — worth noting but not on their own cause for alarm.

1 heuristic

MITRE ATT&CK profile

Defense evasion× 1

Behavior heuristics

Deterministic patterns derived from scan data and observed runtime behavior

ProcessInjection
T1055
low
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
Evidence
T1055 (sandbox MITRE mapping)

PE forensics

Section entropy & packers

No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.

ent 5.51Unpacked

Section entropy6 sections

.text

6.05

.data

0.14

.rdata

5.39

.bss

0.00

.idata

4.27

.rsrc

3.58

0.0Packed threshold 7.28.0

Prevalence

How widely this file has been seen

Moderate prevalence — neither rare nor common. No strong prior applies.

Medium

Unique uploaders

98

Moderate upload volume.

Total submissions

112

Includes repeat uploads by the same source.

First seen

9y ago

Jan 11, 2018

Prevalence quadrant

Rare · New

Needs evidence-led scrutiny

Common · New

Just-released software

Rare · Old

Niche or internal tooling

Common · Old

Often established software

Chapter 05

Questions & answers

Short answers to the 6 questions people ask most about this file.

Is FTLProfileEditor.exe safe?

We found nothing harmful in FTLProfileEditor.exe. 1 of the 71 antivirus engines that checked it flags it; after weighing the other evidence we treat that alert as false alarms. Run it only if it came from the developer's own website or an official app store.

What is FTLProfileEditor.exe?

FTLProfileEditor.exe is a Windows program, about 24.1 kB. It carries no version information saying what it is or who made it. VirusTotal first saw it on Jan 11, 2018.

How many antivirus engines detected FTLProfileEditor.exe?

1 of the 71 antivirus engines that checked it flags FTLProfileEditor.exe (Jiangmin). We weigh which engines flagged it and what else the scan found, not just the count.

What is the SHA-256 hash of FTLProfileEditor.exe?

The SHA-256 fingerprint of FTLProfileEditor.exe is 23411007ac7b7d324bb457fe3a4a4155c6bdc0bb2cd82722cd518da8668e2f05, and its MD5 is d5dca14f14b18296aece3a85f8d44e57. Two files with the same SHA-256 are identical, so use it to check you have exactly this file, not just one with the same name.

Is it safe to run FTLProfileEditor.exe?

We found nothing harmful in FTLProfileEditor.exe. The main caveat is where you got it: attackers sometimes spread malware under the name of real software, so get it from the official website. If your own antivirus warns about it, check the source before you ignore the warning.

How up to date is this analysis of FTLProfileEditor.exe?

This report reflects the scan on May 29, 2026. A file's fingerprint never changes, but antivirus engines keep learning, so a rating can change later. To get a newer result, scan the file again: we refresh the antivirus results when the saved ones are out of date.

Is FTLProfileEditor.exe safe? Yes, no threats found.

Why we think so

The reasoning behind this verdict

What We Detected

Threat Behavior

What To Do Now

What it did in our test

Test run summary

What this file did when executed

Techniques observed in the sandbox

Observed activity

Processes started

Network contacts

Files

Mutexes

Sandbox background — not the file

Files this sample writes at runtime

Technical details

Every check behind this verdict

Engines that flagged it 1

File fingerprint

About this file

1 of 71 engines flagged this file

Signatures and behavior heuristics

Section entropy & packers

How widely this file has been seen

Questions & answers

Community

Is FTLProfileEditor.exe safe? Yes, no threats found.

What We Detected

Threat Behavior

What To Do Now

Test run summary

Techniques observed in the sandbox

Observed activity

Processes started

Network contacts

Files

Mutexes

Sandbox background — not the file

Engines that flagged it 1

File fingerprint

About this file

Related file reports