EchoTrail

OpenWebStart 1.14.0 1.14.0

by Karakun AGinstaller signed by Karakun AGValid

Sources: observed in the EchoTrail lab on Windows 11 on October 28, 2026.

The install

Installer
openwebstart_windows-x64_1_14_0.exe
Installed through
the screenshot-and-model clicker
Install directory
C:\Program Files\OpenWebStart
Launched
itw-settings.exe
Windows
Windows 11
Date
October 28, 2026
Executables dropped
111

installer sha256 1088d635e685cd4161f2d900f1e20d564da33138934b338060ddb8d826eb3c99

The lab used OpenWebStart 1.14.0 for 1 minute, changed a setting, ran its update check, then rebooted and watched what came back.

On screen

Frames from the lab session, cropped to OpenWebStart 1.14.0's own windows.

OpenWebStart 1.14.0 1.14.0: First window
First window. OpenWebStart 1.14.0 settings window is open on the About page with a left navigation list.
OpenWebStart 1.14.0 1.14.0: Main window
Main window. OpenWebStart settings window is showing the JVM Manager page with an empty list and buttons.
OpenWebStart 1.14.0 1.14.0: Settings
Settings. OpenWebStart settings window shows the Cache page with a Limit cache size checkbox unchecked.
OpenWebStart 1.14.0 1.14.0: Worth a look
Worth a look. A 'No update available' dialog is shown over the OpenWebStart settings window after checking for updates.

What it dropped

Executables

  • jvm.dll
    C:\Program Files\OpenWebStart\jre\bin\server\jvm.dll
  • jvm.dll
    C:\Program Files\OpenWebStart\jre\bin\client\jvm.dll
  • javaws.exesigned by CN=Karakun AG, O=Karakun AG, L=Basel, S=Basel-Stadt, C=CHValidran during the lab session
    C:\Program Files\OpenWebStart\javaws.exe
    sha256 0c08e86708fd5381d57cb08ab244a0848e02ef9786380d8d63f94e514c4d940e
  • itw-settings.exesigned by CN=Karakun AG, O=Karakun AG, L=Basel, S=Basel-Stadt, C=CHValidran during the lab session
    C:\Program Files\OpenWebStart\itw-settings.exe
    sha256 7ce051a7dd9d7528ccc4088557dc8f038dcc21fa8558bbf9fb7fc2f8a7f5615a
  • awt.dll
    C:\Program Files\OpenWebStart\jre\bin\awt.dll
  • ucrtbase.dll
    C:\Program Files\OpenWebStart\jre\bin\ucrtbase.dll
  • fontmanager.dll
    C:\Program Files\OpenWebStart\jre\bin\fontmanager.dll
  • uninstall.exe
    C:\Program Files\OpenWebStart\uninstall.exe
  • openwebstart update.exe
    C:\Program Files\OpenWebStart\.install4j\OpenWebStart Update.exe
  • msvcp140.dll
    C:\Program Files\OpenWebStart\jre\bin\msvcp140.dll
  • freetype.dll
    C:\Program Files\OpenWebStart\jre\bin\freetype.dll
  • mlib_image.dll
    C:\Program Files\OpenWebStart\jre\bin\mlib_image.dll
  • i4jinst.dll
    C:\Program Files\OpenWebStart\.install4j\i4jinst.dll
  • lcms.dll
    C:\Program Files\OpenWebStart\jre\bin\lcms.dll
  • jdwp.dll
    C:\Program Files\OpenWebStart\jre\bin\jdwp.dll
  • splashscreen.dll
    C:\Program Files\OpenWebStart\jre\bin\splashscreen.dll
  • windowsaccessbridge-64.dll
    C:\Program Files\OpenWebStart\jre\bin\windowsaccessbridge-64.dll
  • javajpeg.dll
    C:\Program Files\OpenWebStart\jre\bin\javajpeg.dll
  • java.dll
    C:\Program Files\OpenWebStart\jre\bin\java.dll
  • javaaccessbridge.dll
    C:\Program Files\OpenWebStart\jre\bin\javaaccessbridge.dll
  • sunec.dll
    C:\Program Files\OpenWebStart\jre\bin\sunec.dll
  • unpack200.exe
    C:\Program Files\OpenWebStart\jre\bin\unpack200.exe
  • vcruntime140.dll
    C:\Program Files\OpenWebStart\jre\bin\vcruntime140.dll
  • jaccessinspector.exe
    C:\Program Files\OpenWebStart\jre\bin\jaccessinspector.exe
  • i4jdel.exesigned by E=info@ej-technologies.com, CN=ej-technologies GmbH, O=ej-technologies GmbH, STREET=Claude-Lorrain-Str. 7, L=M�nchen, S=Bayern, C=DE, OID.1.3.6.1.4.1.311.60.2.1.1=Muenchen, OID.1.3.6.1.4.1.311.60.2.1.2=Bayern, OID.1.3.6.1.4.1.311.60.2.1.3=DE, SERIALNUMBER=HRB 141246, OID.2.5.4.15=Private OrganizationValidran during the lab session
    C:\Program Files\OpenWebStart\.install4j\i4jdel.exe
    sha256 e48ef14933f4eb6071497a5311ca0ac6e115f7a0d57a60e519296f8fd42ad4fe
  • net.dll
    C:\Program Files\OpenWebStart\jre\bin\net.dll
  • jli.dll
    C:\Program Files\OpenWebStart\jre\bin\jli.dll
  • unpack.dll
    C:\Program Files\OpenWebStart\jre\bin\unpack.dll
  • zip.dll
    C:\Program Files\OpenWebStart\jre\bin\zip.dll
  • j2pkcs11.dll
    C:\Program Files\OpenWebStart\jre\bin\j2pkcs11.dll
  • api-ms-win-crt-private-l1-1-0.dll
    C:\Program Files\OpenWebStart\jre\bin\api-ms-win-crt-private-l1-1-0.dll
  • jaccesswalker.exe
    C:\Program Files\OpenWebStart\jre\bin\jaccesswalker.exe
  • nio.dll
    C:\Program Files\OpenWebStart\jre\bin\nio.dll
  • jsound.dll
    C:\Program Files\OpenWebStart\jre\bin\jsound.dll
  • verify.dll
    C:\Program Files\OpenWebStart\jre\bin\verify.dll
  • instrument.dll
    C:\Program Files\OpenWebStart\jre\bin\instrument.dll
  • j2gss.dll
    C:\Program Files\OpenWebStart\jre\bin\j2gss.dll
  • java.exe
    C:\Program Files\OpenWebStart\jre\bin\java.exe
  • javaw.exe
    C:\Program Files\OpenWebStart\jre\bin\javaw.exe
  • vcruntime140_1.dll
    C:\Program Files\OpenWebStart\jre\bin\vcruntime140_1.dll

Run keys

  • Uninstall 26.158.0816.0003C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\lab\AppData\Local\Microsoft\OneDrive\26.158.0816.0003"

After the reboot

Autostart entries

  • service: MicrosoftCopilotElevationService"C:\Program Files (x86)\Microsoft\Copilot\Application\156.0.4314.50\elevation_service.exe"

What it talked to

Destinations

  • 81.169.145.105:443asked by itw-settings.exe2 connections
  • 104.18.38.233:80asked by itw-settings.exe
  • 172.64.149.23:80asked by itw-settings.exe

DNS

  • Casked by javaws.exe
  • download-openwebstart.comasked by itw-settings.exe
  • ocsp.sectigo.comasked by itw-settings.exe
  • ocsp.usertrust.comasked by itw-settings.exe