File scan report
Verdict Safe
Is Legacy
ZIP archive shows only two less reliable detections and benign Gradle/Java build behaviour.
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Proceed with normal caution; the file shows no credible malicious indicators.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website you got it from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
2 of 66 flagged
- Flagged 2
- No detection 64
- No result 9
- Code signing Not applicable
- Test run Completed
- First seen 5mo ago
Chapter 02
Why we think so
0 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Two less reliable engines flagged the archive; no major detections, no malicious files it created, and sandbox activity matches a legitimate Gradle build chain.
The two detections come from MaxSecure and Sangfor, neither major, and no family consensus exists. Sandbox traces show a standard Gradle wrapper and Java launcher, not malware. No complete contacted-host reputation result was available. Medium prevalence and absence of external-intel hits further support a benign verdict.
What We Detected
LegacyLauncher_source.zip triggered two less reliable engines (MaxSecure Trojan.Malware.300983.susgen, Sangfor Trojan.Win32.Save.a). No major antivirus engines raised an alert. Sandbox execution revealed a Gradle build process using Java 8 and the Gradle wrapper, writing typical cache and temporary files.
Threat Behavior
Three MITRE techniques were mapped (T1055, T1543.002, T1562.001), but they align with Gradle’s process-management and permission-adjustment steps rather than malicious injection. Eighteen direct-IP contacts were observed; none matched known-malicious hosts in our cache. Ten files it created were produced, none flagged malicious.
What To Do Now
The archive can be treated as safe for development use. Keep security software enabled and verify the source before building or distributing the resulting binaries.
- No major antivirus engines flagged it
- contactedHosts clean
- droppedChildren clean
- medium prevalence
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 22sandbox rule tags
- 12spawned processes
- 19network contacts
- 24filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
22MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1055· Process injection
- T1059· Runs commands
- T1064
- T1071· Application protocol
- T1074
- T1082· System recon
- T1090
- T1105· Network file transfer
- T1106
- T1129· Loads modules
- T1202
- T1497· Sandbox evasion
- T1518.001· Checks your AV
- T1543.002· Service install
- T1562· Disables security
- T1562.001· Disables security
- T1564· Hides artifacts
- T1564.001· Hides artifacts
- T1564.003· Hides artifacts
- T1568
- T1573
- T1574· Execution hijack
Observed activity
Processes started
12Programs the file ran, with their command lines.
java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -XX:MaxMetaspaceSize=384m -XX:+HeapDumpOnOutOfMemoryError -Xms256m -Xmx512m -Dfile.encoding=windows-1252 -Duser.country=US -Duser.language=en -Duser.variant -cp C:\Users\<USER>\.gradle\wrapper\dists\gradle-8.14.2-bin\2pb3mgt1p815evrl3weanttgr\gradle-8.14.2\lib\gradle-daemon-main-8.14.2.jar -javaagent:C:\Users\<USER>\.gradle\wrapper\dists\gradle-8.14.2-bin\2pb3mgt1p815evrl3weanttgr\gradle-8.14.2\lib\agents\gradle-instrumentation-agent-8.14.2.jar org.gradle.launcher.daemon.bootstrap.GradleDaemon 8.14.2cmd.exe"C:\Windows\system32\cmd.exe" /c "cd ^"C:\Users\<USER>\AppData\Local\Temp^" && start /wait ^"^" ^"C:\Users\<USER>\AppData\Local\Temp\gradlew.bat^"cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\<USER>\AppData\Local\Temp\gradlew.batjava.exejava.exe -versionmsedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "C:\Users\<USER>\AppData\Local\Temp\launcher/src/main/resources/net/legacylauncher/ui/settings/about.html"LL.exe"C:\Users\<USER>\AppData\Local\Temp\packages/portable/baseResources/LL.exe"
Show all 12 entries for processes started
java.exe"java.exe" "-Xmx64m" "-Xms64m" "-Dorg.gradle.appname=gradlew" -classpath "C:\Users\<USER>\AppData\Local\Temp\\gradle\wrapper\gradle-wrapper.jar" org.gradle.wrapper.GradleWrapperMainunarchiver.exeC:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWow64\unarchiver.exe" "C:\Users\user\Desktop\LegacyLauncher_source.zip"7za.exeC:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\jf4imqal.kye" "C:\Users\user\Desktop\LegacyLauncher_source.zip"exo-open/usr/bin/exo-open exo-open /tmp/LegacyLauncher_source.zipexo-open/usr/bin/exo-open -engrampa/usr/bin/engrampa engrampa /tmp/LegacyLauncher_source.zip
Network contacts
1919 hosts, listed as 17 addresses, 4 links. Links show the host and path only.
- IP address
150.171.73.13 - IP address
173.194.206.132 - IP address
104.16.73.101 - IP address
140.82.113.4 - IP address
185.199.110.133 - IP address
150.171.74.13
Show all 21 entries for network contacts
- IP address
72.21.91.29 - IP address
172.64.149.23 - IP address
104.18.38.233 - IP address
23.61.214.171 - IP address
67.195.228.56 - IP address
17.248.193.65 - IP address
17.253.83.201 - IP address
17.57.144.26 - IP address
52.40.100.195 - IP address
17.253.83.131 - IP address
151.101.3.6 - URL
http://ocsp.usertrust.com/MFYwVKADAgEAME0wSzBJMAkGBSsOAwIaBQAEFM0w0kw0OoKrHwVwFYrXoQd2KZLpBBRTeb9aqitKz1SA4dibwJ3ysgNmywIQXfq7lXfPq2cfx93%2B0c8gWw%3D%3D - URL
http://ocsp.comodoca.com/MFcwVaADAgEAME4wTDBKMAkGBSsOAwIaBQAEFOsl2JD%2BJyD0HX1qwV7vds9iz6t4BBR1cacZSBm8nZ3qQUfflMRId5nTeQIRAJjBcnaqg2kI3NxbTvi9QXQ%3D - URL
http://ocsp.usertrust.com/MFYwVKADAgEAME0wSzBJMAkGBSsOAwIaBQAEFM0w0kw0OoKrHwVwFYrXoQd2KZLpBBRTeb9aqitKz1SA4dibwJ3ysgNmywIQXfq7lXfPq2cfx93+0c8gWw== - URL
http://ocsp.comodoca.com/MFcwVaADAgEAME4wTDBKMAkGBSsOAwIaBQAEFOsl2JD+JyD0HX1qwV7vds9iz6t4BBR1cacZSBm8nZ3qQUfflMRId5nTeQIRAJjBcnaqg2kI3NxbTvi9QXQ=
Files
24Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\hsperfdata_<USER>\3220 - Written
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp - Written
C:\Users\<USER>\AppData\Local\Temp\hsperfdata_<USER>\6248 - Written
\Device\ConDrv\Connect - Written
C:\Users\<USER>\AppData\Local\Temp\hsperfdata_<USER>\1540 - Written
C:\Users\<USER>\.gradle\wrapper\dists\gradle-8.14.2-bin\2pb3mgt1p815evrl3weanttgr\gradle-8.14.2-bin.zip.lck
Show all 24 entries for files
- Written
C:\Users\<USER>\.gradle\wrapper\dists\gradle-8.14.2-bin\2pb3mgt1p815evrl3weanttgr\gradle-8.14.2-bin.zip.part - Written
C:\Users\<USER>\.gradle\wrapper\dists\gradle-8.14.2-bin\2pb3mgt1p815evrl3weanttgr\gradle-8.14.2-bin.zip - Written
C:\Users\<USER>\.gradle\wrapper\dists\gradle-8.14.2-bin\2pb3mgt1p815evrl3weanttgr\gradle-8.14.2\LICENSE - Written
C:\Users\<USER>\.gradle\wrapper\dists\gradle-8.14.2-bin\2pb3mgt1p815evrl3weanttgr\gradle-8.14.2\NOTICE - Written
C:\Users\<USER>\.gradle\wrapper\dists\gradle-8.14.2-bin\2pb3mgt1p815evrl3weanttgr\gradle-8.14.2\README - Written
C:\Users\<USER>\.gradle\wrapper\dists\gradle-8.14.2-bin\2pb3mgt1p815evrl3weanttgr\gradle-8.14.2\init.d\readme.txt - Written
C:\Users\<USER>\.gradle\wrapper\dists\gradle-8.14.2-bin\2pb3mgt1p815evrl3weanttgr\gradle-8.14.2\bin\gradle - Written
C:\Users\<USER>\.gradle\wrapper\dists\gradle-8.14.2-bin\2pb3mgt1p815evrl3weanttgr\gradle-8.14.2\bin\gradle.bat - Written
C:\Users\<USER>\.gradle\wrapper\dists\gradle-8.14.2-bin\2pb3mgt1p815evrl3weanttgr\gradle-8.14.2\lib\gradle-runtime-api-info-8.14.2.jar - Deleted
C:\Users\<USER>\.gradle\wrapper\dists\gradle-8.14.2-bin\2pb3mgt1p815evrl3weanttgr\gradle-8.14.2-bin.zip.part - Deleted
C:\Users\<USER>\.gradle\wrapper\dists\gradle-8.14.2-bin\2pb3mgt1p815evrl3weanttgr\gradle-8.14.2-bin.zip - Deleted
/var/lib/logrotate/status.tmp - Deleted
/var/log/apport.log.1 - Deleted
/var/log/apport.log.8.gz - Deleted
/var/log/cups/access_log.1 - Deleted
/var/log/cups/access_log.8.gz - Deleted
/var/log/syslog.1 - Deleted
/var/log/syslog.8.gz
Sandbox background — not the file
6The analysis machine's own processes and connections, recorded in every run.
- VM process
icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M - VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - VM process
dbus-launch/usr/bin/dbus-launch dbus-launch --autolaunch=a39eb3ed78b7401fb6809ed0c562a5b1 --binary-syntax --close-stderr - VM host
8.8.8.8 - VM host
255.255.255.255 - VM host
162.159.36.2
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 566b4c1eafed66f7ddde…f23a40Not checkedno saved verdict
- addeff297615da3f07a9…ed3492Not checkedno saved verdict
- bc42fd94a3487447701a…c77d20Not checkedno saved verdict
- ea0c3629e45c27ee53ed…0af36aNot checkedno saved verdict
- 048bd19ef904f9fbc93f…e9c069Not checkedno saved verdict
- bdc5a6bb4379f4ad73bc…d40a3aNot checkedno saved verdict
- d7b3357af7a64f083ea3…9b1a56Not checkedno saved verdict
- ed1fe67ea208a56dedaf…82d7dbNot checkedno saved verdict
- adf10e77f36ef9992bab…bd41afNot checkedno saved verdict
- 04b12f6ed7bf2798c904…399a68Not checkedno saved verdict
Chapter 04
Technical details
2 of the 66 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 2
The saved verdict treats these detections as likely false positives.
- MaxSecureTrojan.Malware.300983.susgen
- SangforTrojan.Win32.Save.a
File fingerprint
- Last analyzed
- Aug 24, 2026, 4:57 AM UTC
- SHA-256
d51efbebc841588453d2b46a06058c44b1b7925eee052e2789cdb840dae6da17- SHA-1
e276ba6a90a1125e56d10bf44c6b877eea703676- MD5
e311b4084bb62799668bcec336ca12d4
About this file
LegacyLauncher_source.zip is a ZIP file of 26.3 MB.
- Type and size
- ZIP · 26.3 MB
- Signer
- Not applicable
- First seen
- May 14, 2026On VirusTotal.
- Submitted by
- 419 distinct sources
First scanned
Antivirus consensus
2 of 66 engines flagged this file
9 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-117 engines0flagged
- Tier-236 engines1flagged
- Low-trust13 engines1flagged
View all 75 engine results
- MaxSecureMalicious: Trojan.Malware.300983.susgen
- SangforMalicious: Trojan.Win32.Save.a
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVNo result
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusNo result
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookClean
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
How widely this file has been seen
Widely uploaded, but first seen within the last six months. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is LegacyLauncher_source.zip safe?
What is LegacyLauncher_source.zip?
How many antivirus engines detected LegacyLauncher_source.zip?
What is the SHA-256 hash of LegacyLauncher_source.zip?
Is it safe to open or extract LegacyLauncher_source.zip?
How up to date is this analysis of LegacyLauncher_source.zip?
Community
Member reviews and reports for this exact file hash.